Nearly 4-year-old Cisco vuln linked to recent Akira ransomware attacks

Security vendor TrueSec observed multiple incident response engagements where the Akira ransomware group appears to have used Cisco AnyConnect/ASA/FTD memory-disclosure vulnerability CVE-2020-3259 as an entry point. Analysis of restored RADIUS logs showed attacker behavior consistent with exploiting the vulnerability (genuine-appearing logins across distinct accounts, no phishing or password-guessing evidence). The report urges organizations to confirm devices were patched, backtrack upgrade timelines, assume long-lived AnyConnect credentials and in-device secrets may be compromised, perform broad password resets, and enable MFA.