China-linked APT UAT-9686 is targeting Cisco Secure Email Gateway and Secure Email and Web Manager

Cisco disclosed a critical zero-day, tracked as CVE-2025-20393, in Secure Email Gateway and Secure Email and Web Manager, actively exploited by a China-linked group, with Cisco Talos linking the activity to the APT UAT-9686 based on tooling and infrastructure overlaps. The advisory notes that on 10 December 2025, attackers targeted a limited subset of appliances with exposed ports running Cisco AsyncOS Software, enabling root-level command execution and persistence.

Cisco Talos researchers described a campaign ongoing since at least late November 2025, targeting devices with certain ports open to the internet, and observed the attackers deploying a persistence mechanism known as AquaShell alongside tools for reverse tunnelling and log deletion. According to Cisco Talos, AquaShell is a lightweight Python backdoor embedded in a Cisco AsyncOS web server file, with AquaTunnel, Chisel, and AquaPurge supporting covert access and traffic tunnelling. The U.S.

CISA added the zero-day Cisco vulnerability to its Known Exploited Vulnerabilities catalog this week. Analysis indicates misconfigurations in non-standard appliance setups may have facilitated exposure, with AquaPurge used to erase traces from logs.