Loading story…
The Australian government has issued warnings about persistent cyberattacks targeting unpatched Cisco IOS XE devices, specifically exploiting the CVE-2023-20198 vulnerability to deploy the BadCandy webshell. Despite Cisco releasing a patch in October 2023, many devices remain unpatched, allowing attackers to gain root access and reintroduce the webshell even after removal. The Australian Signals Directorate has identified over 400 compromised devices since July 2025, with more than 150 still affected as of late October 2025, and continues to notify victims and provide remediation guidance.
Separately, China-based threat group Storm-1849 (UAT4356) has been actively scanning and exploiting Cisco Adaptive Security Appliances (ASA) used by governments and critical sectors worldwide, including the U.S., Europe, and Asia. Unit 42 researchers observed ongoing targeting of government, defense, and financial institutions throughout October 2025, with federal and local government IP addresses in multiple countries being attacked. These incidents highlight the continued risk posed by unpatched Cisco network devices and the global scale of exploitation by sophisticated threat actors.
See which actors are running it and whether you're in range.
7 events from the most recent confirmed update back to the earliest known activity.
Subsequent reporting said more than 400 devices in Australia had been compromised with the BadCandy web shell via CVE-2023-20198. ASD recommended patching, restricting web UI exposure, removing unauthorized privileged accounts, and monitoring for suspicious configuration changes.
As exploitation of Cisco ASA vulnerabilities continued, CISA issued an emergency directive requiring immediate patching of affected devices. The action followed reports of persistent compromise of government and large-organization firewalls by Storm-1849.
Australia's Signals Directorate warned that attackers were actively exploiting unpatched Cisco IOS XE devices to deploy the Lua-based BadCandy web shell. The agency said operators could detect implant removal and quickly re-exploit unpatched devices, urging immediate patching and hardening.
By late October 2025, at least 150 Cisco IOS XE devices in Australia were reported to be carrying the BadCandy implant after attackers exploited unpatched systems. Reporting described the activity as targeting enterprise and government networks and linked it to Chinese state-backed operations.
Throughout October 2025, Palo Alto Networks Unit 42 observed Storm-1849/UAT4356 scanning for and exploiting Cisco ASA firewalls used by governments, defense contractors, military organizations, and financial institutions in multiple countries. The attackers chained CVE-2025-30333 and CVE-2025-20362 to gain and retain access, including across reboots and upgrades.
In 2024, the ArcaneDoor campaign targeted Cisco ASA devices and was later referenced by researchers as an earlier operation tied to the same nation-state cluster behind the 2025 ASA exploitation activity. This established historical context for later attribution to Storm-1849/UAT4356.
Cisco released fixes for CVE-2023-20198 and CVE-2023-20273, vulnerabilities later cited as the access path used to deploy the BadCandy implant on exposed IOS XE devices. These flaws were subsequently highlighted by defenders as heavily exploited edge-device vulnerabilities.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
6 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcegovinfosecurity.com
Open sourcego.theregister.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chinese state-linked hacking groups have been actively targeting Cisco network devices, including Adaptive Security Appliance (ASA) firewalls and IOS XE enterprise devices, in a global campaign aimed at government, defense, and corporate networks. Security researchers from Palo Alto Networks’ Unit 42 identified Storm-1849 (also tracked as UAT4356) as responsible for scanning and exploiting Cisco ASA firewalls across the US, Europe, Asia, and other regions, with a particular focus on high-value targets such as federal agencies, financial institutions, and defense contractors. The campaign, observed throughout October, included a notable pause during China’s Golden Week holiday, and targeted public network addresses in countries including India, Nigeria, Japan, France, the UK, and Australia. In Australia, the national cyber defense agency reported that at least 150 Cisco IOS XE devices were compromised with the "BadCandy" web shell implant, which is deployed by exploiting zero-day vulnerabilities CVE-2023-20198 and CVE-2023-20273. These vulnerabilities, which do not require authentication to exploit, allow attackers to create local administrator accounts and maintain access even after device reboots. The BadCandy implant, attributed to Chinese nation-state actors such as Salt Typhoon, is part of a broader trend of targeting network edge devices to establish persistent access within sensitive networks. The Five Eyes intelligence alliance has highlighted these vulnerabilities as among the most exploited by nation-state actors in 2023.
Jun 29, 2026
Cisco confirmed that multiple government agencies engaged its incident response teams in May 2025 to investigate targeted attacks against Cisco Adaptive Security Appliance (ASA) 5500-X Series devices running Cisco Secure Firewall ASA Software with VPN web services enabled. Attackers exploited multiple zero-day vulnerabilities to implant malware, execute commands, and potentially exfiltrate data from compromised devices. The threat actor demonstrated advanced evasion techniques, including disabling logging, intercepting CLI commands, and intentionally crashing devices to hinder forensic analysis. Cisco’s investigation, which involved providing instrumented images and analyzing packet captures and firmware, led to the identification of a critical memory corruption bug in the ASA software. The company assessed with high confidence that the activity was linked to the same threat actor behind the ArcaneDoor campaign previously reported in 2024. While the vulnerable software is present on other hardware platforms and in Cisco Secure Firewall Threat Defense (FTD) Software, there is no evidence of successful compromise beyond the ASA 5500-X Series. Cisco published detailed detection guidance, highlighting that the threat actor continues to scan for vulnerable devices using frequently changing IP addresses, and that scanning activity alone does not indicate compromise. Only specific ASA 5500-X models running certain software releases with VPN web services enabled have been confirmed as compromised. The threat actor suppressed specific syslog messages in memory as a forensic countermeasure, and a downward shift in these logs may indicate malicious activity. On September 25, 2025, Cisco released security advisories addressing critical vulnerabilities, including CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363, affecting a range of ASA and FTD software versions. The Canadian Centre for Cyber Security issued alerts urging organizations to review Cisco’s advisories, apply mitigations, and update affected devices. The vulnerabilities allow for remote code execution and unauthorized access via VPN web services and HTTP servers on affected firewall products. Cisco’s advisories provided a comprehensive list of affected software versions and recommended immediate action to mitigate risk. The incident underscores the sophistication of the threat actor, the importance of timely patching, and the need for enhanced monitoring of VPN-enabled firewall devices. Cisco’s response included collaboration with affected customers, deployment of enhanced detection capabilities, and ongoing monitoring for further malicious activity. Organizations are advised to follow Cisco’s guidance, monitor for suppressed syslog IDs, and engage Cisco Technical Assistance Center if compromise is suspected. The campaign highlights the persistent targeting of network edge devices by advanced threat actors and the criticality of maintaining up-to-date security controls.
Aug 31, 2026
Cisco confirmed that attackers have been actively exploiting two zero-day vulnerabilities, CVE-2025-20333 and CVE-2025-20362, in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. These vulnerabilities allow attackers to execute arbitrary code as root and access restricted URLs without authentication, leading to device reloads and denial-of-service (DoS) conditions. The U.K. National Cyber Security Centre (NCSC) and Cisco have linked these exploits to malware campaigns involving RayInitiator and LINE VIPER, and have urged immediate patching. Security advisories highlight that unpatched devices are at risk of persistent compromise, and recommend comprehensive remediation steps including patching, forensic analysis, and resetting credentials. Threat intelligence reports attribute the exploitation campaign to the China-linked group Storm-1849 (ArcaneDoor), which targeted U.S. financial institutions, defense contractors, and military organizations throughout October. Despite public disclosure and patch directives from CISA, attacks continued, demonstrating the attackers' operational sophistication and persistence. Experts warn that organizations running unpatched ASA devices should assume compromise and prioritize forensic hunting for ROM-level malware, as well as implement robust monitoring and maintenance practices to mitigate ongoing risks.
Jun 29, 2026