Cisco Routers Hacked for Rootkit Deployment

Threat actors are exploiting CVE-2025-20352, a Cisco zero-day, to deploy a rootkit on older networking devices, in a campaign described by Trend Micro as Operation ZeroDisco. According to Trend Micro, the operation targets older Cisco devices such as the 9400, 9300, and legacy 3750G series, with the rootkit able to hide activity, bypass logs and change running configurations to install a universal password containing the word disco.

The defect, a stack overflow in the SNMP component of IOS and IOS XE devices, allows DoS with low privileges and remote code execution for higher-privileged attackers; attackers also utilised a modified exploit for CVE-2017-3881 (a Telnet flaw) to gain memory read/write access. Among the methods observed, 32-bit systems used malicious SNMP packets and Telnet, while 64-bit systems combined SNMP with a universal password and a fileless backdoor, enabling lateral movement across VLANs. Trend Micro notes there is no universal automated tool to reliably determine compromise and urges contacting Cisco TAC for a low-level investigation.