THREATNOIR
Subscribe
Back to advisories

‼️🇺🇸 Threat actor claims to be selling Cisco source code and database containing 3.15 million S...

Threat actor UNC6040/ShinyHunters claims to possess stolen Cisco source code (IOS, ASA, NX-OS) and 3.15M Salesforce records, seeking $500K for sale. This exposes core network infrastructure code and customer data, enabling attackers to identify zero-days and conduct targeted exploitation against Cisco-dependent environments.

CRITICALAdvisoryApr 10, 2026
Action required
Immediately inventory all Cisco IOS, ASA, and NX-OS devices in your environment. Prioritize patching and monitor for suspicious firmware modifications, unauthorized access attempts, and exploitation patterns matching leaked code functionality.
Affected products
CiscoSalesforceCisco IOSCisco ASACisco NX-OS
Linked articles
Source links