Loading story…
Threat actors exploited two critical zero-day vulnerabilities in Cisco firewalls, specifically CVE-2025-20362 and CVE-2025-20333, to bypass authentication and execute malicious code on affected appliances. The attacks resulted in the deployment of previously undocumented malware families, RayInitiator and LINE VIPER, which represent a significant evolution in both sophistication and evasion capabilities compared to earlier campaigns. The campaign has been attributed to a threat cluster known as ArcaneDoor, which is linked to the suspected China-based group UAT4356 (also tracked as Storm-1849). Security agencies, including the UK NCSC and U.S. CISA, issued warnings about the active exploitation of these vulnerabilities, emphasizing the urgency for organizations to patch affected Cisco Secure Firewall ASA and Secure FTD devices. The malware deployed in these attacks is capable of evading detection and maintaining persistence, posing a substantial risk to network security. Detection engineering teams responded by rapidly developing and updating detection rules across multiple platforms, including Elastic, YARA, Sigma, and KQL, to identify post-exploitation activity and suspicious child processes associated with the malware. The campaign also involved the use of advanced techniques to bypass security controls and escalate privileges within targeted environments. Cisco released security advisories and patches to address the vulnerabilities, and the flaws were added to the U.S. CISA Known Exploited Vulnerabilities catalog. The attacks targeted a range of organizations, with a focus on critical infrastructure and sectors with high-value assets. The rapid response from the security community included the sharing of indicators of compromise and technical analyses of the RayInitiator and LINE VIPER malware. The incident highlights the ongoing threat posed by sophisticated nation-state actors leveraging zero-day vulnerabilities in widely deployed network appliances. Organizations were urged to review their firewall configurations, apply available patches, and monitor for signs of compromise. The campaign underscores the importance of timely vulnerability management and the need for robust detection capabilities to counter evolving threats. Security researchers continue to analyze the malware families involved to better understand their capabilities and develop effective countermeasures. The incident serves as a reminder of the critical role that coordinated threat intelligence and rapid response play in defending against advanced persistent threats. The exploitation of these Cisco firewall vulnerabilities demonstrates the increasing complexity and impact of targeted attacks on enterprise infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
19 events from the most recent confirmed update back to the earliest known activity.
Authorities arrested two Dutch teenagers in connection with alleged Russian espionage activity. The case was cited as a notable law-enforcement development in the cyber and intelligence space.
A significant vulnerability affecting Supermicro BMC firmware was highlighted as a notable security issue. The flaw raised concerns over risks to server management infrastructure.
Akira ransomware operators were reported to have bypassed multi-factor authentication protections on SonicWall VPN appliances. The tactic enabled intrusions despite MFA being enabled.
Reports highlighted ransomware groups using stolen AWS access keys to compromise cloud environments. The activity showed a growing focus on cloud infrastructure as a ransomware intrusion vector.
A new LockBit 5.0 ransomware variant was reported, featuring improved evasion capabilities. The development signaled continued evolution of the LockBit ransomware ecosystem.
Researchers identified Olymp Loader as a new malware-as-a-service threat. Its emergence marked a new criminal service available for malware delivery operations.
Iran-aligned threat actor Nimbus Manticore was reported to have broadened its espionage operations into Western Europe. The campaign targeted critical infrastructure and used new malware variants.
Operation HAECHI VI resulted in the seizure of $439 million tied to global cybercrime groups. The action represented a major international law-enforcement disruption effort.
ENISA reported that recent airport disruptions were connected to ransomware activity. The assessment framed the incidents as part of the growing operational impact of cybercrime on transportation infrastructure.
Volvo North America was reported impacted by a breach connected to a ransomware attack on IT provider Miljödata. The incident illustrated downstream effects of third-party compromises.
A ransomware incident involving Union County, Ohio was reported to have affected 45,000 individuals. The event was listed among the week's significant breach and extortion cases.
Security reporting highlighted ongoing Brickstorm backdoor activity. The mention indicated continued use of the malware in intrusion operations.
Researchers reported a new variant of the XCSSET malware affecting macOS systems. The updated strain indicated ongoing development of the malware family.
A vulnerability in Libraesva Email Gateway was reported and attributed to exploitation by nation-state actors. The case highlighted continued targeting of email security infrastructure by advanced threat groups.
Separate from the firewall issues, Cisco IOS and IOS XE zero-day vulnerabilities were noted as being actively exploited. The reports underscored sustained attacker focus on Cisco network infrastructure.
The weekly reporting highlighted exploitation activity involving Fortra GoAnywhere MFT vulnerability CVE-2025-10035. The issue was presented as part of a broader pattern of attackers targeting enterprise software flaws.
CISA added multiple Cisco vulnerabilities and a Google Chromium issue to its Known Exploited Vulnerabilities catalog. The action reflected official recognition of active exploitation risk and the need for remediation.
Two Cisco firewall zero-day vulnerabilities, CVE-2025-20362 and CVE-2025-20333, were reported as actively exploited in the wild. The activity was attributed to the China-linked group UAT4356, also tracked as Storm-1849 and ArcaneDoor, which deployed RayInitiator and LINE VIPER malware.
Cloudflare reported blocking the largest distributed denial-of-service attack on record, which peaked at 22.2 Tbps. The attack was assessed as likely powered by the AISURU botnet.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourcesecurityaffairs.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco confirmed that attackers have been actively exploiting two zero-day vulnerabilities, CVE-2025-20333 and CVE-2025-20362, in Cisco Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. These vulnerabilities allow attackers to execute arbitrary code as root and access restricted URLs without authentication, leading to device reloads and denial-of-service (DoS) conditions. The U.K. National Cyber Security Centre (NCSC) and Cisco have linked these exploits to malware campaigns involving RayInitiator and LINE VIPER, and have urged immediate patching. Security advisories highlight that unpatched devices are at risk of persistent compromise, and recommend comprehensive remediation steps including patching, forensic analysis, and resetting credentials. Threat intelligence reports attribute the exploitation campaign to the China-linked group Storm-1849 (ArcaneDoor), which targeted U.S. financial institutions, defense contractors, and military organizations throughout October. Despite public disclosure and patch directives from CISA, attacks continued, demonstrating the attackers' operational sophistication and persistence. Experts warn that organizations running unpatched ASA devices should assume compromise and prioritize forensic hunting for ROM-level malware, as well as implement robust monitoring and maintenance practices to mitigate ongoing risks.
Jun 29, 2026
A state-sponsored espionage campaign dubbed **ArcaneDoor** targeted internet-facing Cisco **ASA** and **FTD** appliances, with activity observed from 2023 and victim compromises identified in early 2024. Cisco, allied cyber agencies, and researchers said the attackers focused on perimeter devices including ASA55xx systems, exploiting flaws in WebVPN and related exposed services to gain remote access and deploy two malware components: **Line Runner**, a persistent Lua-based webshell, and **Line Dancer**, a memory-resident shellcode loader. The operation enabled reconnaissance, configuration changes, traffic capture, data exfiltration, and potential lateral movement from trusted network edge infrastructure. Authorities linked the activity to an advanced threat actor tracked as **UAT4356** by Cisco and **STORM-1849** by Microsoft, and warned that affected devices included systems running vulnerable firmware such as 9.12 and 9.14. Public guidance highlighted patched vulnerabilities including `CVE-2024-20359` and `CVE-2024-20353`, while the UK NCSC detailed how Line Dancer hijacks WebVPN XML parsing through the `<host-scan-reply>` field and executes attacker-supplied shellcode entirely in memory. Defenders were urged to patch exposed devices, inspect for indicators of compromise before rebooting because Line Dancer is non-persistent, and use released detection content including behavioral checks, SNORT coverage, and YARA rules.
Sep 3, 2026
Cisco confirmed that multiple government agencies engaged its incident response teams in May 2025 to investigate targeted attacks against Cisco Adaptive Security Appliance (ASA) 5500-X Series devices running Cisco Secure Firewall ASA Software with VPN web services enabled. Attackers exploited multiple zero-day vulnerabilities to implant malware, execute commands, and potentially exfiltrate data from compromised devices. The threat actor demonstrated advanced evasion techniques, including disabling logging, intercepting CLI commands, and intentionally crashing devices to hinder forensic analysis. Cisco’s investigation, which involved providing instrumented images and analyzing packet captures and firmware, led to the identification of a critical memory corruption bug in the ASA software. The company assessed with high confidence that the activity was linked to the same threat actor behind the ArcaneDoor campaign previously reported in 2024. While the vulnerable software is present on other hardware platforms and in Cisco Secure Firewall Threat Defense (FTD) Software, there is no evidence of successful compromise beyond the ASA 5500-X Series. Cisco published detailed detection guidance, highlighting that the threat actor continues to scan for vulnerable devices using frequently changing IP addresses, and that scanning activity alone does not indicate compromise. Only specific ASA 5500-X models running certain software releases with VPN web services enabled have been confirmed as compromised. The threat actor suppressed specific syslog messages in memory as a forensic countermeasure, and a downward shift in these logs may indicate malicious activity. On September 25, 2025, Cisco released security advisories addressing critical vulnerabilities, including CVE-2025-20333, CVE-2025-20362, and CVE-2025-20363, affecting a range of ASA and FTD software versions. The Canadian Centre for Cyber Security issued alerts urging organizations to review Cisco’s advisories, apply mitigations, and update affected devices. The vulnerabilities allow for remote code execution and unauthorized access via VPN web services and HTTP servers on affected firewall products. Cisco’s advisories provided a comprehensive list of affected software versions and recommended immediate action to mitigate risk. The incident underscores the sophistication of the threat actor, the importance of timely patching, and the need for enhanced monitoring of VPN-enabled firewall devices. Cisco’s response included collaboration with affected customers, deployment of enhanced detection capabilities, and ongoing monitoring for further malicious activity. Organizations are advised to follow Cisco’s guidance, monitor for suppressed syslog IDs, and engage Cisco Technical Assistance Center if compromise is suspected. The campaign highlights the persistent targeting of network edge devices by advanced threat actors and the criticality of maintaining up-to-date security controls.
Aug 31, 2026