Loading story…
RSA disclosed that attackers carried out an advanced persistent threat intrusion against its internal systems and stole information related to its SecurID two-factor authentication products. EMC said the compromise did not appear to expose customer or employee personally identifiable information, other RSA products, or other EMC products, but warned that the stolen data could reduce the effectiveness of existing SecurID deployments if used as part of a broader attack. The company said it notified customers, worked with authorities, hardened affected systems, and issued guidance through SecurCare Online to help organizations strengthen their SecurID implementations.
RSA later described the intrusion as a targeted spear-phishing campaign in which employees received emails with the subject "2011 Recruitment Plan" and an attached Excel file that exploited the Adobe Flash zero-day CVE-2011-0609 to install a backdoor and a customized Poison Ivy remote access trojan. The attackers harvested credentials, escalated privileges, moved laterally, staged data internally, and exfiltrated it via FTP in password-protected RAR archives to an external compromised host. EMC said the breach ultimately cost at least $66.3 million for investigation, infrastructure hardening, customer monitoring, and replacement of some SecurID tokens, and later reporting linked the stolen information to follow-on targeting, including an attempted attack on Lockheed Martin.
See attribution, scope, and your downstream exposure.
5 events from the most recent confirmed update back to the earliest known activity.
EMC disclosed that the RSA breach had cost at least $66.3 million, covering investigation, IT hardening, customer transaction monitoring, and replacement of some SecurID tokens. EMC said its investigation suggested the attackers were likely seeking information tied to government and military accounts rather than financial data.
RSA released a detailed account of the attack chain, describing the spear-phishing lure, exploitation of CVE-2011-0609, deployment of a customized Poison Ivy remote access trojan, privilege escalation, lateral movement, and FTP exfiltration of password-protected RAR archives. The post also noted RSA detected the intrusion while it was still in progress.
Following the disclosure, RSA said it was actively notifying customers and providing immediate steps through a SecurCare Online note to strengthen SecurID deployments. The company also said it had taken aggressive defensive measures, hardened its infrastructure, launched an extensive investigation, and worked with appropriate authorities.
RSA publicly disclosed that it had been targeted in an extremely sophisticated cyberattack and that attackers extracted information specifically related to its SecurID two-factor authentication products. The company said it had no evidence other RSA products, other EMC products, or customer and employee personally identifiable information were compromised.
A targeted APT campaign against RSA began with spear-phishing emails titled "2011 Recruitment Plan" sent to small groups of employees. After an employee opened a malicious Excel attachment exploiting Adobe Flash vulnerability CVE-2011-0609, the attackers installed malware, stole credentials, moved laterally, and exfiltrated data from RSA systems.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
5 references tracked. Mallory keeps watching after this page renders.
govinfosecurity.com
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourceweb.archive.org
Open sourcesec.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
RSA disclosed that attackers breached systems tied to its **SecurID** two-factor authentication platform and stole sensitive information that could weaken the security of deployed tokens. Subsequent reporting said the intrusion began with a spearphishing email carrying an Excel file, `2011 Recruitment plan.xls`, that exploited Adobe Flash zero-day `CVE-2011-0609` to install the **Poison Ivy** backdoor; the attackers then escalated privileges, moved laterally, staged data internally, and exfiltrated encrypted files over FTP through an external compromised host. The central unanswered question was whether the attackers obtained token seed values, serial-number mappings, or related databases that underpin SecurID authentication. The breach quickly raised operational risk for major customers, and **Lockheed Martin** later confirmed that hackers used information stolen from RSA in an attempted network intrusion, though the company said it detected and stopped the attack before significant damage occurred. In response, Lockheed replaced **45,000** SecurID tokens, forced password resets, and added another authentication layer, while EMC later said the RSA incident cost at least **$66.3 million** for investigation, system hardening, customer monitoring, and token replacement. Reporting at the time said the attackers were likely seeking access related to government and military accounts, and the incident became a defining example of how a compromise at a security vendor can cascade into downstream threats for thousands of enterprise and public-sector customers.
Jun 29, 2026
Red Hat experienced a significant security incident involving the unauthorized access and exfiltration of data from its private GitHub repositories. The extortion group known as the Crimson Collective claimed responsibility for the breach, stating they stole approximately 570GB of compressed data, which included over 28,000 internal projects and hundreds of Customer Engagement Reports (CERs). These CERs are consultancy documents that often contain highly sensitive information such as architecture diagrams, configuration details, authentication tokens, database connection strings, and network maps, effectively providing blueprints of customer IT environments. The attackers published file listings and shared samples of the stolen data, which were verified by journalists to contain configuration snippets and references to customer systems. The group asserted that the compromised data spanned from 2020 to 2025 and involved major organizations across banking, telecom, government, airlines, and public-sector sectors, with specific mentions of companies like Citi, Verizon, Siemens, Bosch, JPMC, HSBC, and even the U.S. Senate. The Crimson Collective also claimed to have found authentication tokens and other credentials within the repositories and CERs, which they allegedly used to access downstream customer infrastructure. They stated that they attempted to warn affected customers but were ignored. Red Hat confirmed the security incident related to its consulting business but did not verify the full extent of the attackers' claims or the specific details of the breach. The company emphasized that, at the time, there was no evidence the incident impacted other Red Hat services or products, and they expressed confidence in the integrity of their software supply chain. The breach was first disclosed by the attackers on Telegram, where they posted a full file tree, CER list, and screenshots as proof. The incident has raised concerns about the exposure of sensitive customer data and the potential for further attacks leveraging the stolen credentials and infrastructure details. Red Hat has not publicly disclosed how the attackers gained access or whether they received any extortion demands, though the Crimson Collective claimed to have contacted the company and received only a generic response. The breach highlights the risks associated with storing sensitive customer information and credentials in internal repositories and the potential downstream impact on customers when such data is compromised. Security researchers have warned that the exposed information could be used to target Red Hat's clients with tailored attacks, given the detailed nature of the stolen CERs. The incident underscores the importance of robust access controls, credential management, and rapid incident response in protecting both corporate and customer assets.
Jun 29, 2026
ShinyHunters has claimed responsibility for breaching Cisco and stealing more than **3 million Salesforce records** along with internal corporate data, **GitHub repositories**, and contents from **AWS S3 buckets**, then posted a **"FINAL WARNING"** on its leak site threatening to publish the data after April 3. Reports said the alleged haul may include information tied to Cisco customers, employees, and personnel from U.S. and foreign government agencies, while screenshots shared by the group purportedly showed access to Cisco-linked AWS infrastructure and multiple connected cloud accounts. The intrusion was linked in reporting to three alleged access paths involving **Salesforce CRM**, **Salesforce Aura/Experience Cloud**, and AWS environments, and to activity tracked as **`UNC6040`** and **`UNC6395`**. Threat intelligence cited in the coverage said the attackers have used **vishing** to trick employees into approving malicious Salesforce OAuth applications, then abused stolen tokens to bypass MFA and move deeper into cloud environments; recommended defenses included auditing connected OAuth apps, revoking suspicious tokens, tightening API access controls, and monitoring for unauthorized Salesforce Data Loader activity. Cisco had not publicly addressed the March 2026 extortion claim at the time of reporting.
Jun 29, 2026