InfoSecBulletin Cybersecurity for mankind
Cisco warned customers maximum-severity Cisco AsyncOS zero-day actively exploited in attacks targeting Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances. This yet-to-be-patched zero-day (CVE-2025-20393) affects only Cisco SEG and Cisco SEWM appliances with non-standard configurations, when the Spam Quarantine feature is enabled and exposed on the Internet.
Cisco Talos researcher believe that Chinese threat group UAT-9686 targeting the the flaw to run arbitrary commands as root and install persistent backdoors like AquaShell, along with AquaTunnel and Chisel reverse SSH malware, and a log-clearing tool called AquaPurge. Indicators of compromise can be found in a GitHub repository.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
AquaTunnel and other malicious tools used in these attacks have been previously associated with Chinese state-backed hacking groups like UNC5174 and APT41.
“We assess with moderate confidence that the adversary, who we are tracking as UAT-9686, is a Chinese-nexus advanced persistent threat (APT) actor whose tool use and infrastructure are consistent with other Chinese threat groups,” Cisco Talos said in a Wednesday advisory.
“As part of this activity, UAT-9686 deploys a custom persistence mechanism we track as AquaShell accompanied by additional tooling meant for reverse tunneling and purging logs.”
The company urged admins to protect vulnerable devices by limiting internet access, allowing connections only from trusted hosts, and placing them behind firewalls.
Admins should separate mail handling from management, monitor web logs for unusual activity, and keep logs for investigations.
Disable unnecessary services, update to the latest Cisco AsyncOS software, use strong authentication like SAML or LDAP, change default passwords, and secure management traffic with SSL or TLS certificates.
SonicWall SMA1000 zero-day exploited:Â
SonicWall alerted customers to update the SonicWall SMA1000 Appliance Management Console due to a vulnerability linked to zero-day attacks that could escalate privileges.
SonicWall reported a medium-severity local privilege escalation flaw (CVE-2025-40602) identified by Clément Lecigne and Zander Work from the Google Threat Intelligence Group. This issue does not impact SSL-VPN on SonicWall firewalls.
“SonicWall PSIRT strongly advises users of the SMA1000 product to upgrade to the latest hotfix release version to address the vulnerability,” the company said in a Wednesday advisory.
