Cisco VPNs, Email Services Hit in Separate Threat Campaigns

Cisco VPNs and email security appliances are the focus of two distinct campaigns within days of each other. A newly identified China-linked APT, UAT-9686, was exploiting a zero-day in Cisco AsyncOS on email security appliances, tracked as CVE-2025-20393, which has been rated critical at CVSS 10.0 and remains unpatched as Cisco works on a permanent fix, according to the advisory and subsequent analysis.

In parallel, a separate actor launched a loud tidal wave of brute-force attacks against Cisco SSL VPNs and Palo Alto GlobalProtect VPNs, with GreyNoise reporting more than 1.7 million authentication sessions across a 16-hour window and over 10,000 unique IPs observed targeting, mainly in the United States, Mexico and Pakistan.

The Cisco campaign employs AquaShell, AquaPurge and AquaTunnel payloads following exploitation of CVE-2025-20393, with AquaShell described as a lightweight Python backdoor delivered as an encoded blob. Cisco notes that no patch exists for the vulnerability itself, and it advises disabling Spam Quarantine offline while continuing to investigate. According to GreyNoise, the aim of such rapid, high-volume campaigns is often to inventory exposed systems and identify targets before defenders respond.