Loading story…
Multiple network security products, including those from Fortinet, SonicWall, Cisco, and WatchGuard, have been actively targeted by threat actors exploiting recently disclosed vulnerabilities. Cisco reported that CVE-2025-20393, a critical flaw in AsyncOS, has been abused by a China-nexus APT group (UAT-9686) to deliver malware such as ReverseSSH, Chisel, AquaPurge, and AquaShell, with the vulnerability remaining unpatched. SonicWall confirmed exploitation of CVE-2025-40602, a local privilege escalation flaw in SMA 100 series appliances, which, when chained with CVE-2025-23006, enables unauthenticated remote code execution with root privileges. These attacks highlight a growing trend of adversaries focusing on firewalls and edge appliances to gain deep visibility into network traffic, VPN connections, and downstream systems.
Security researchers and vendors have issued warnings and patches in response to these incidents. Fortinet's FortiGate firewalls are also being exploited via CVE-2025-59718, allowing attackers to bypass authentication and export system configuration files. The rapid exploitation of these vulnerabilities underscores the critical need for organizations to promptly apply security updates and monitor for signs of compromise in their network infrastructure. The incidents reflect a broader shift in attacker tactics, with a focus on exploiting trusted network devices to achieve persistent access and facilitate further malicious activity within targeted environments.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Authorities dismantled the E-Note cryptocurrency exchange, which had been used to launder proceeds from cybercrime. The takedown represented a notable law enforcement action against criminal financial infrastructure.
The FBI issued a warning about advanced impersonation campaigns, highlighting the threat of attackers abusing trusted identities and social engineering techniques.
Researchers reported on a global phishing operation dubbed Scripted Sparrow that targeted finance teams with sophisticated business email compromise tactics.
ESET disclosed a new China-aligned APT tracked as LongNosedGoblin. The group was observed abusing Windows Group Policy to target government entities in Southeast Asia and Japan.
SoundCloud confirmed that it had suffered a security breach and was also dealing with continuing denial-of-service attacks. The company publicly acknowledged both incidents during the week.
A local privilege escalation zero-day, CVE-2025-40602, in SonicWall SMA 1000 appliances was reported as actively exploited. The disclosure led to urgent warnings for affected organizations.
Attackers were reported exploiting CVE-2025-59718, an authentication bypass vulnerability affecting Fortinet FortiGate firewalls. The activity prompted urgent security advisories urging defenders to patch quickly.
Apple released security updates to fix two WebKit vulnerabilities, CVE-2025-14174 and CVE-2025-43529, that were being actively exploited in the wild.
Cisco email security appliances were found compromised and backdoored in an intrusion attributed to a suspected Chinese-nexus threat actor. The flaw used in the attacks remained unpatched at the time of reporting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A coordinated cyberattack campaign has been identified targeting major networking devices from Cisco, Palo Alto Networks, and Fortinet, with evidence suggesting a single threat actor is orchestrating the activity. Security researchers at GreyNoise observed simultaneous scanning of Cisco ASA devices, increased login attempts against Palo Alto Networks portals, and brute-force attacks on Fortinet SSL VPNs, all originating from shared subnets and exhibiting recurring TCP fingerprints. This temporal and infrastructural correlation points to a sophisticated, cross-vendor campaign rather than opportunistic attacks. Experts note that adversaries are leveraging generative AI to automate these attacks, adopting tactics typically associated with nation-state actors. The campaign is notable for its focus on high-value targets such as networking devices and VPNs, which serve as critical gateways into enterprise networks and often possess privileged access that can bypass internal security controls. Industries such as manufacturing, industrials, and utilities are particularly at risk due to the potential for operational disruption and rapid financial gain for attackers. Concurrently, Cisco disclosed two zero-day vulnerabilities in its ASA and Secure Firewall Threat Defense software, identified as CVE-2025-20333 and CVE-2025-20362, which are being actively exploited in the wild. CVE-2025-20333 allows authenticated remote code execution due to improper input validation in the VPN web server, potentially granting attackers root-level access. CVE-2025-20362 is an authentication bypass flaw that enables remote attackers to access restricted endpoints without credentials. The combination of these vulnerabilities poses a severe risk, as attackers can gain full control of affected devices. Cisco’s Product Security Incident Response Team (PSIRT) has confirmed ongoing exploitation and is collaborating with government agencies to coordinate a response. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency directive, urging all federal agencies to immediately mitigate exposure and assess for compromise. Over 90,000 Cisco FTD devices are reportedly exposed, highlighting the scale of the threat. Attackers are conducting large-scale scanning campaigns to identify vulnerable ASA login portals and entry points. Security experts emphasize the urgent need for organizations to inventory their Cisco ASA and FTD devices, apply available patches, and implement recommended mitigations. The campaign’s use of shared infrastructure and advanced automation underscores a shift in attacker methodology toward more efficient and targeted operations. The strategic targeting of network infrastructure devices reflects their critical role in enterprise security and the high impact of successful compromise. Organizations are advised to monitor for signs of compromise, follow vendor and government guidance, and prioritize remediation of affected systems. The ongoing nature of the attacks and the active exploitation of zero-day vulnerabilities make this a critical threat to enterprise and government networks worldwide.
Jun 29, 2026
Fortinet has disclosed multiple vulnerabilities in its FortiWeb web application firewall, including a critical OS command injection flaw tracked as CVE-2025-64446 and another actively exploited vulnerability, CVE-2025-58034. These vulnerabilities allow authenticated attackers to execute unauthorized code or commands on affected FortiWeb systems via crafted HTTP requests or CLI commands. Fortinet has observed exploitation of these flaws in the wild and has released security updates to address the issues, urging customers to upgrade to the latest versions to mitigate risk. The vulnerabilities impact several FortiWeb versions, and Fortinet has credited researchers from Trend Micro for responsible disclosure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has responded by mandating that all federal civilian agencies patch CVE-2025-64446 within seven days, highlighting the severity and active exploitation of the bug. Security researchers have noted that attackers are using HTTP POST requests to create new admin-level accounts on exposed devices, and CISA has recommended disabling HTTP/HTTPS on internet-facing interfaces if immediate patching is not possible. Fortinet has communicated directly with affected customers and emphasized the importance of prompt remediation to prevent further compromise of FortiWeb deployments.
Jul 23, 2026
Multiple maximum-severity vulnerabilities in enterprise infrastructure management products are being **actively exploited**, enabling unauthenticated remote code execution as `root` and creating high-impact initial access paths into data center and security operations environments. Reported exploitation includes mass, automated scanning and rapid weaponization following public disclosure and PoC availability, increasing the likelihood of opportunistic compromise, follow-on payload delivery, and lateral movement in affected networks. Fortinet *FortiSIEM* is reported as under active attack via **CVE-2024-23108**, an unauthenticated command-injection issue in the `phMonitor` component (noted as listening on TCP `8014`) that can yield full system compromise. Separately, Cisco *Secure Email Gateway* / *Secure Email and Web Manager* is reported as exploited via **CVE-2024-20353** (CVSS 10.0), with activity attributed to China-linked **UAT-9686** leveraging the Spam Quarantine interface to gain root execution and deploy custom malware for persistence and evasion. In parallel, Check Point-linked reporting describes **RondoDox** botnet-driven exploitation of HPE *OneView* **CVE-2025-37164** at scale (tens of thousands of attempts observed), consistent with an “exploit-shotgun” approach used to build botnets for DDoS, cryptomining, and secondary payload delivery; the surge coincided with the flaw’s addition to CISA’s known-exploited list.
Jun 29, 2026