Loading story…
Chinese state-linked hacking groups have been actively targeting Cisco network devices, including Adaptive Security Appliance (ASA) firewalls and IOS XE enterprise devices, in a global campaign aimed at government, defense, and corporate networks. Security researchers from Palo Alto Networks’ Unit 42 identified Storm-1849 (also tracked as UAT4356) as responsible for scanning and exploiting Cisco ASA firewalls across the US, Europe, Asia, and other regions, with a particular focus on high-value targets such as federal agencies, financial institutions, and defense contractors. The campaign, observed throughout October, included a notable pause during China’s Golden Week holiday, and targeted public network addresses in countries including India, Nigeria, Japan, France, the UK, and Australia.
In Australia, the national cyber defense agency reported that at least 150 Cisco IOS XE devices were compromised with the "BadCandy" web shell implant, which is deployed by exploiting zero-day vulnerabilities CVE-2023-20198 and CVE-2023-20273. These vulnerabilities, which do not require authentication to exploit, allow attackers to create local administrator accounts and maintain access even after device reboots. The BadCandy implant, attributed to Chinese nation-state actors such as Salt Typhoon, is part of a broader trend of targeting network edge devices to establish persistent access within sensitive networks. The Five Eyes intelligence alliance has highlighted these vulnerabilities as among the most exploited by nation-state actors in 2023.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
By late October 2025, at least 150 Cisco IOS XE devices in Australia were found carrying the BadCandy web shell implant. The activity was attributed to the Chinese state-linked group Salt Typhoon, which used the previously patched CVE-2023-20198 and CVE-2023-20273 flaws to establish access to enterprise and government networks.
In October 2025, Palo Alto Networks Unit 42 observed Storm-1849, also tracked as UAT4356, targeting Cisco ASA firewalls used by governments and large organizations across the United States, Europe, Asia, Africa, and the Middle East. The campaign chained CVE-2025-30333 and CVE-2025-20362 to gain deep, persistent access that could survive reboots and upgrades.
CISA issued an emergency directive requiring U.S. federal civilian agencies to patch Cisco ASA vulnerabilities CVE-2025-30333 and CVE-2025-20362. The directive reflected concern that the flaws were being actively exploited against high-value targets.
The Australian Cyber Security Centre and Five Eyes partners identified the Cisco IOS XE vulnerabilities CVE-2023-20198 and CVE-2023-20273 as among the most exploited flaws in 2023. Their guidance emphasized patching and reducing internet exposure of Cisco web interfaces.
Cisco released patches for the IOS XE vulnerabilities CVE-2023-20198 and CVE-2023-20273, which can let unauthenticated attackers create local administrator accounts on exposed devices. These flaws were later cited by defenders as among the most exploited vulnerabilities of 2023.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Australian government has issued warnings about persistent cyberattacks targeting unpatched Cisco IOS XE devices, specifically exploiting the CVE-2023-20198 vulnerability to deploy the BadCandy webshell. Despite Cisco releasing a patch in October 2023, many devices remain unpatched, allowing attackers to gain root access and reintroduce the webshell even after removal. The Australian Signals Directorate has identified over 400 compromised devices since July 2025, with more than 150 still affected as of late October 2025, and continues to notify victims and provide remediation guidance. Separately, China-based threat group Storm-1849 (UAT4356) has been actively scanning and exploiting Cisco Adaptive Security Appliances (ASA) used by governments and critical sectors worldwide, including the U.S., Europe, and Asia. Unit 42 researchers observed ongoing targeting of government, defense, and financial institutions throughout October 2025, with federal and local government IP addresses in multiple countries being attacked. These incidents highlight the continued risk posed by unpatched Cisco network devices and the global scale of exploitation by sophisticated threat actors.
Jun 29, 2026
Cisco confirmed that attackers have been actively exploiting two zero-day vulnerabilities, CVE-2025-20333 and CVE-2025-20362, in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. These vulnerabilities allow attackers to execute arbitrary code as root and access restricted URLs without authentication, leading to device reloads and denial-of-service (DoS) conditions. The U.K. National Cyber Security Centre (NCSC) and Cisco have linked these exploits to malware campaigns involving RayInitiator and LINE VIPER, and have urged immediate patching. Security advisories highlight that unpatched devices are at risk of persistent compromise, and recommend comprehensive remediation steps including patching, forensic analysis, and resetting credentials. Threat intelligence reports attribute the exploitation campaign to the China-linked group Storm-1849 (ArcaneDoor), which targeted U.S. financial institutions, defense contractors, and military organizations throughout October. Despite public disclosure and patch directives from CISA, attacks continued, demonstrating the attackers' operational sophistication and persistence. Experts warn that organizations running unpatched ASA devices should assume compromise and prioritize forensic hunting for ROM-level malware, as well as implement robust monitoring and maintenance practices to mitigate ongoing risks.
Jun 29, 2026
A coordinated cyberattack campaign has been identified targeting major networking devices from Cisco, Palo Alto Networks, and Fortinet, with evidence suggesting a single threat actor is orchestrating the activity. Security researchers at GreyNoise observed simultaneous scanning of Cisco ASA devices, increased login attempts against Palo Alto Networks portals, and brute-force attacks on Fortinet SSL VPNs, all originating from shared subnets and exhibiting recurring TCP fingerprints. This temporal and infrastructural correlation points to a sophisticated, cross-vendor campaign rather than opportunistic attacks. Experts note that adversaries are leveraging generative AI to automate these attacks, adopting tactics typically associated with nation-state actors. The campaign is notable for its focus on high-value targets such as networking devices and VPNs, which serve as critical gateways into enterprise networks and often possess privileged access that can bypass internal security controls. Industries such as manufacturing, industrials, and utilities are particularly at risk due to the potential for operational disruption and rapid financial gain for attackers. Concurrently, Cisco disclosed two zero-day vulnerabilities in its ASA and Secure Firewall Threat Defense software, identified as CVE-2025-20333 and CVE-2025-20362, which are being actively exploited in the wild. CVE-2025-20333 allows authenticated remote code execution due to improper input validation in the VPN web server, potentially granting attackers root-level access. CVE-2025-20362 is an authentication bypass flaw that enables remote attackers to access restricted endpoints without credentials. The combination of these vulnerabilities poses a severe risk, as attackers can gain full control of affected devices. Cisco’s Product Security Incident Response Team (PSIRT) has confirmed ongoing exploitation and is collaborating with government agencies to coordinate a response. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive, urging all federal agencies to immediately mitigate exposure and assess for compromise. Over 90,000 Cisco FTD devices are reportedly exposed, highlighting the scale of the threat. Attackers are conducting large-scale scanning campaigns to identify vulnerable ASA login portals and entry points. Security experts emphasize the urgent need for organizations to inventory their Cisco ASA and FTD devices, apply available patches, and implement recommended mitigations. The campaign’s use of shared infrastructure and advanced automation underscores a shift in attacker methodology toward more efficient and targeted operations. The strategic targeting of network infrastructure devices reflects their critical role in enterprise security and the high impact of successful compromise. Organizations are advised to monitor for signs of compromise, follow vendor and government guidance, and prioritize remediation of affected systems. The ongoing nature of the attacks and the active exploitation of zero-day vulnerabilities make this a critical threat to enterprise and government networks worldwide.
Jun 29, 2026