Cisco Talos Analyzes Recent Cyberattack on Cisco

Once the attacker had obtained initial access, they enrolled a series of new devices for MFA and authenticated successfully to the Cisco VPN.
The attacker then escalated to administrative privileges, allowing them to login to multiple systems, which alerted Cisco Security Incident Response Team (CSIRT), who subsequently responded to the incident.
The actor in question dropped a variety of tools, including remote access tools like LogMeIn and TeamViewer, offensive security tools such as Cobalt Strike, PowerSploit, Mimikatz, and Impacket, and added their own backdoor accounts and persistence mechanisms.