Amazon Uncovers Attacks Exploited Cisco ISE and Citrix NetScaler as Zero-Day Flaws

Amazon’s threat intelligence team disclosed that an advanced threat actor was exploiting two zero-day flaws in Cisco Identity Service Engine (ISE) and Citrix NetScaler ADC as part of campaigns designed to deliver custom malware. The attacks targeted CVE-2025-5777 (Citrix Bleed 2) and CVE-2025-20337, with the Citrix flaw allowing authentication bypass and the Cisco flaw enabling unauthenticated remote code execution; CVSS scores are cited as 9.3 and 10.0 respectively.

The activity was detected by Amazon’s MadPot honeypot network, and investigators found a custom web shell disguised as a legitimate Cisco ISE component named IdentityAuditAction, capable of in-memory operation and Java reflection-based thread injection. CJ Moses, CISO of Amazon Integrated Security, said the pre-authentication nature of the exploits shows even well-configured systems can be compromised, underscoring the need for defence-in-depth and robust detection.

The report notes the campaign was described as indiscriminate and that the threat actor was “highly resourced,” leveraging multiple zero-days and bespoke tools to probe enterprise Java applications and Tomcat internals. according to The Hacker News.