Amazon alerts: advanced threat actor exploits Cisco ISE & Citrix NetScaler zero-days

Amazon’s threat intelligence researchers reported that an advanced threat actor exploited two previously undisclosed zero-day flaws in Cisco Identity Service Engine (ISE) and Citrix NetScaler ADC to deliver custom malware. The campaign also leveraged multiple undisclosed vulnerabilities, with exploitation observed in the wild before Cisco had assigned CVEs or issued comprehensive patches across all affected ISE branches.

According to the advisory published by Amazon, the actor targeted pre-authentication remote code execution, using a bespoke web shell masquerading as IdentityAuditAction on one compromised Cisco ISE, running fully in-memory and injected via Java reflection to register an HTTP listener on Tomcat. The web shell used DES with nonstandard Base64 and left minimal artifacts, with a deserialization routine decoding a payload and executing a proxy class, indicating expert knowledge of Java, Tomcat and Cisco ISE internals.

The findings underscore that critical infrastructure such as identity systems and remote access gateways remain prime targets, necessitating defence-in-depth, robust detection and restricted access to privileged endpoints.