Loading story…
RSA disclosed that attackers breached systems tied to its SecurID two-factor authentication platform and stole sensitive information that could weaken the security of deployed tokens. Subsequent reporting said the intrusion began with a spearphishing email carrying an Excel file, 2011 Recruitment plan.xls, that exploited Adobe Flash zero-day CVE-2011-0609 to install the Poison Ivy backdoor; the attackers then escalated privileges, moved laterally, staged data internally, and exfiltrated encrypted files over FTP through an external compromised host. The central unanswered question was whether the attackers obtained token seed values, serial-number mappings, or related databases that underpin SecurID authentication.
The breach quickly raised operational risk for major customers, and Lockheed Martin later confirmed that hackers used information stolen from RSA in an attempted network intrusion, though the company said it detected and stopped the attack before significant damage occurred. In response, Lockheed replaced 45,000 SecurID tokens, forced password resets, and added another authentication layer, while EMC later said the RSA incident cost at least $66.3 million for investigation, system hardening, customer monitoring, and token replacement. Reporting at the time said the attackers were likely seeking access related to government and military accounts, and the incident became a defining example of how a compromise at a security vendor can cascade into downstream threats for thousands of enterprise and public-sector customers.
See attribution, scope, and your downstream exposure.
6 events from the most recent confirmed update back to the earliest known activity.
EMC disclosed that the RSA incident had cost at least $66.3 million, covering investigation, IT hardening, customer monitoring, and replacement of some SecurID tokens. The company said its investigation suggested the attackers were likely seeking information related to government and military accounts rather than financial data.
Lockheed Martin confirmed that hackers attempted to breach its systems using information stolen in RSA's March compromise, validating fears of follow-on attacks against SecurID customers. Lockheed said it detected and stopped the intrusion before significant data loss, then replaced 45,000 SecurID tokens, forced password changes, and added another authentication step.
RSA executive Uri Rivner disclosed that the intrusion began with spearphishing emails carrying an Excel file named "2011 Recruitment plan.xls" that exploited Adobe Flash zero-day CVE-2011-0609 and installed a Poison Ivy backdoor. He said the attackers then escalated privileges, moved laterally, staged data internally, and exfiltrated encrypted archives via FTP through an external compromised host.
As RSA continued to withhold specifics, public reporting emphasized that customers should assume critical SecurID components may have been exposed and strengthen defenses such as PINs and monitoring. The lack of transparency drew criticism and raised concerns that some customers might abandon the product.
Following RSA's disclosure, analysts and industry observers warned that if attackers obtained SecurID seed records, serial-number mappings, or details of seed generation, the security of affected tokens could be materially reduced. They also cautioned that high-value targets could face elevated risk and that phishing exploiting fear around the breach was likely.
RSA revealed that it had suffered a cyber intrusion in March 2011 and said attackers stole confidential information related to its SecurID two-factor authentication product. The company did not publicly specify whether token seed values or seed-to-serial mapping data were taken, leaving customers uncertain about the practical impact.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
wired.com
Open sourcenytimes.com
Open sourcetheregister.co.uk
Open sourcetheregister.co.uk
Open sourceweb.archive.org
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
RSA disclosed that attackers carried out an **advanced persistent threat** intrusion against its internal systems and stole information related to its **SecurID** two-factor authentication products. EMC said the compromise did not appear to expose customer or employee personally identifiable information, other RSA products, or other EMC products, but warned that the stolen data could reduce the effectiveness of existing SecurID deployments if used as part of a broader attack. The company said it notified customers, worked with authorities, hardened affected systems, and issued guidance through SecurCare Online to help organizations strengthen their SecurID implementations. RSA later described the intrusion as a targeted spear-phishing campaign in which employees received emails with the subject **"2011 Recruitment Plan"** and an attached Excel file that exploited the Adobe Flash zero-day **`CVE-2011-0609`** to install a backdoor and a customized **Poison Ivy** remote access trojan. The attackers harvested credentials, escalated privileges, moved laterally, staged data internally, and exfiltrated it via FTP in password-protected RAR archives to an external compromised host. EMC said the breach ultimately cost at least **$66.3 million** for investigation, infrastructure hardening, customer monitoring, and replacement of some SecurID tokens, and later reporting linked the stolen information to follow-on targeting, including an attempted attack on Lockheed Martin.
Jun 29, 2026
Attackers breached market intelligence vendor **Klue** and used a compromised legacy credential tied to an old integration service to implant malicious code, harvest customer OAuth tokens, and access connected **Salesforce** environments through the `Klue Battlecards` app. Incident responders and affected companies said the attackers then used legitimate Salesforce REST API access to enumerate objects and exfiltrate CRM data over many hours, including business contacts, account records, quotes, sales communications, support case metadata, and related commercial information. **Salesforce** disabled the Klue app connection during the investigation and stressed the incident did not result from a vulnerability in the Salesforce platform itself, while Klue revoked credentials and tokens, disabled multiple integrations, engaged CrowdStrike, and notified law enforcement. The campaign has been widely attributed to the **Icarus** extortion group, which allegedly sent ransom demands and threatened to leak stolen data, though some reporting noted tradecraft overlaps with **ShinyHunters**-style Salesforce OAuth abuse. Publicly disclosed victims grew from early reports involving **Huntress**, **Recorded Future**, **Jamf**, **Tanium**, **Sprout Social**, **Gong**, **HackerOne**, **Snyk**, **OneTrust**, and **Insurity** to later confirmations from **LastPass**, **BeyondTrust**, and others, with some reports putting the total affected customer count far higher. Most impacted organizations said the exposure was largely confined to CRM and business data in Salesforce or connected apps, with no evidence that core products, internal infrastructure, password vaults, payment data, or engineering systems were compromised.
Aug 11, 2026
Research into two prominent intrusion cases found that severe compromises may have stemmed from comparatively simple security weaknesses rather than uniquely advanced tradecraft. In one case, analysis of leaked **OilRig** tooling said the group's Poison Frog/Glimpse command-and-control server trusted agent-supplied input in its Node.js upload handling, creating a directory traversal flaw that could allow arbitrary file writes. The writeup said an attacker could append code to `srvr.js`, crash the process, and rely on automatic restart behavior to gain remote code execution on the C2 server, potentially helping explain reports that **Turla** had previously hijacked OilRig infrastructure. A separate assessment of the **SolarWinds Orion** breach argued that exposed credentials and accessible development information likely gave attackers a practical path into the company's update environment. The account said SolarWinds had accidentally exposed update server credentials on GitHub, after which attackers could have studied public repositories, moved laterally into developer systems, modified Orion code, and distribute trojanized, digitally signed updates from the official server between March and May 2020. Those malicious updates reportedly reached victims including **DHS**, **FireEye**, and the **U.S. Treasury**, while the malware used HTTP-based command-and-control, system profiling, file transfer and execution, service disruption, reboots, and **Cobalt Strike** deployment.
Jun 29, 2026