Loading story…
Amazon's threat intelligence team uncovered an advanced persistent threat (APT) actor actively exploiting two previously unknown zero-day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix NetScaler ADC. The vulnerabilities, tracked as CVE-2025-5777 (Citrix Bleed 2) and CVE-2025-20337, allowed attackers to bypass authentication on Citrix NetScaler and achieve unauthenticated remote code execution on Cisco ISE, respectively. Amazon's MadPot honeypot network detected exploitation attempts before public disclosure, and further investigation revealed the deployment of a custom web shell disguised as a legitimate Cisco ISE component, enabling persistent access for the attackers. Both vulnerabilities were exploited in the wild before patches were available, highlighting the attackers' sophistication and their focus on critical identity and network access infrastructure.
The campaign demonstrated the threat actors' ability to quickly weaponize vulnerabilities and exploit patch gaps, with Amazon sharing technical details and indicators of compromise with Cisco to aid in remediation. The custom malware used in these attacks was specifically tailored for Cisco ISE environments, and the exploitation activity underscores the increasing targeting of systems that enforce enterprise security policies and manage authentication. Both Cisco and Citrix have since released patches to address the vulnerabilities, but the incident serves as a warning about the risks posed by zero-day exploitation of core network and identity management platforms.
See which actors are running it and whether you're in range.
6 events from the most recent confirmed update back to the earliest known activity.
On November 12, 2025, Amazon published research describing the advanced campaign exploiting Cisco ISE and Citrix NetScaler zero-days, including technical details on the custom malware and the actor's tradecraft. The disclosure framed the activity as evidence of growing adversary focus on identity and access infrastructure.
Citrix released patches for CVE-2025-5777 on June 17, 2025, after Amazon had already observed exploitation in the wild. The flaw, later dubbed 'CitrixBleed 2,' was severe enough that U.S. federal agencies were reportedly given a one-day deadline to patch.
After identifying the campaign, Amazon shared its findings with Cisco, including details of the previously undisclosed Cisco ISE exploitation. At that stage, Cisco had not yet assigned a CVE and comprehensive patches were not yet available across affected branches.
During the campaign, the threat actor used a bespoke in-memory web shell and backdoor on Cisco ISE, disguised as a legitimate component and designed with advanced evasion features such as minimal forensic traces, custom encryption, and header-based access controls. The malware reflected deep knowledge of Java, Tomcat, and Cisco ISE internals.
Amazon's MadPot honeypot infrastructure detected the initial exploitation attempts tied to the campaign, helping uncover the actor's use of the Citrix and Cisco zero-days in the wild. This detection led Amazon Threat Intelligence to investigate the activity further.
In May 2025, Amazon observed an advanced threat actor exploiting CVE-2025-5777 in Citrix NetScaler and CVE-2025-20337 in Cisco ISE before public disclosure and before patches were broadly available. The activity targeted critical identity and network access infrastructure using a patch-gap exploitation approach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
13 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcesecurityaffairs.com
Open sourcecsoonline.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hackers exploited a zero-day vulnerability in Cisco's Identity Services Engine (ISE), tracked as CVE-2025-20337, which allowed for pre-authentication remote code execution and administrator-level access to affected systems. Amazon Web Services researchers detected the campaign using their MadPot honeypot, observing that attackers deployed custom web shells disguised as legitimate Cisco ISE components, specifically `IdentityAuditAction`, and used Java APIs to inject themselves into running threads and monitor HTTP requests on Tomcat servers. The vulnerability, rated with a maximum CVSS score of 10, was actively exploited in the wild before Cisco had assigned a CVE or released comprehensive patches for all affected ISE branches. Cisco released a patch for the flaw in July after confirming in-the-wild exploitation, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) subsequently added CVE-2025-20337 to its Known Exploited Vulnerabilities catalog. AWS CISO CJ Moses highlighted that the attackers' use of "patch-gap exploitation"—targeting systems before official disclosure and patch availability—demonstrates the sophistication of threat actors who rapidly weaponize newly discovered vulnerabilities. Organizations using Cisco ISE are urged to ensure patches are applied and to monitor for signs of compromise, particularly the presence of suspicious web shells or unauthorized HTTP listeners.
Jun 29, 2026
Threat actors have increasingly targeted remote access technologies in 2025 by exploiting a series of critical vulnerabilities, many of which were zero-days at the time of discovery. Security researchers have identified several high-impact vulnerabilities affecting widely deployed enterprise products, including Citrix NetScaler, Cisco IOS and IOS XE, Cisco ASA and FTD, Fortra GoAnywhere MFT, and Oracle E-Business Suite. These vulnerabilities have enabled remote code execution, authentication bypass, and other forms of unauthorized access, posing significant risks to organizations relying on these technologies for perimeter defense. Notably, some of these flaws, such as CVE-2025-7775 in Citrix NetScaler and CVE-2025-20352 in Cisco IOS/IOS XE, were exploited before public disclosure, highlighting the persistent threat of zero-day attacks. The threat actor group UAT4356, also known as ArcaneDoor, has been linked to the exploitation of certain Cisco vulnerabilities, demonstrating the involvement of sophisticated adversaries. In addition to newly discovered zero-days, attackers continue to leverage older, unpatched vulnerabilities, underscoring the ongoing challenge of maintaining effective patch management. Initial access brokers and both opportunistic and targeted threat actors have been observed using these exploits to gain footholds in enterprise environments, often as a precursor to further malicious activity such as extortion or data theft. Security bulletins from vendors like Ivanti and Fortinet have been referenced to provide guidance and mitigation steps for affected organizations. The prevalence of public proof-of-concept exploits for some vulnerabilities has accelerated their weaponization in the wild. The impact of these attacks is amplified by the critical role remote access technologies play in modern enterprise infrastructure, making timely detection and remediation essential. Security teams are urged to prioritize patching, monitor for signs of exploitation, and implement robust access controls to mitigate risk. The ongoing exploitation of both new and old vulnerabilities highlights the need for continuous vigilance and proactive security measures. Researchers emphasize the importance of machine-readable, well-vetted vulnerability intelligence to support rapid response. The trend of targeting remote access solutions is expected to persist, given their attractiveness as initial access vectors. Organizations are advised to review vendor advisories and apply recommended patches without delay. The evolving threat landscape requires a coordinated effort between vendors, security researchers, and enterprise defenders to reduce exposure and limit the impact of these attacks.
Jun 29, 2026
Cisco disclosed multiple vulnerabilities in **Identity Services Engine (ISE)** and **ISE-PIC** that could let attackers compromise deployments through **authentication bypass**, **unauthenticated remote code execution**, and **path traversal**. One of the issues, tracked as **`CVE-2025-20281`**, was described in public research as allowing unauthenticated attackers to achieve **remote code execution as root** because of insufficient input validation in a specific API, significantly raising the risk to exposed management infrastructure. Separate Cisco advisories also detailed additional **authentication bypass** weaknesses and a combination of **remote code execution and path traversal** flaws affecting the same product line, indicating broad attack surface concerns in enterprise identity and access control environments. The publication of a public GitHub checker for `CVE-2025-20281` increases the likelihood of rapid defender validation and potential attacker reconnaissance, making prompt patching, exposure review, and monitoring of Cisco ISE systems a priority for security teams.
Jun 29, 2026