Ransomware Group
Yanluowang
Status: inactive • First seen 2021-10 • 50+ known victims
Yanluowang hackers broke into companies manually rather than using automated tools. They gained attention when they claimed to have breached Cisco, one of the largest networking companies.
Overview
Yanluowang was a manually deployed ransomware that targeted financial institutions and technology companies. The group was linked to the Lapsus$ breach of Cisco.
Target Industries
Finance, Manufacturing, Technology, Professional Services
How They Attack
- • Manual deployment
- • Financial sector focus
- • Process termination
- • Living-off-the-land
Notable Victims
Cisco (2022), Financial institutions
Is your business exposed?
How to Protect Against Yanluowang
- 1.
Monitor for lateral movement techniques
- 2.
Implement privileged access management
- 3.
Deploy deception technology
MITRE ATT&CK Techniques
Related Groups
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required