Amazon Exposes Advanced APT Exploiting Cisco ISE (RCE) and Citrix Bleed Two as Simultaneous Zero-Days

According to Amazon Threat Intelligence, a highly sophisticated threat campaign was uncovered that exploits multiple zero‑day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix systems, signalling a major escalation in targeting of identity and network access control infrastructure.

The campaign began with the discovery of exploitation attempts hitting internet-facing Citrix infrastructure, with Amazon MadPot honeypot logging activity prior to public disclosure of Citrix Bleed Two (CVE-2025-5777) and confirming zero‑day exploitation in the wild before a CVE was assigned. A second zero‑day affecting Cisco ISE was later identified, with Cisco designating this vulnerability CVE-2025-20337 and noting pre‑authentication remote code execution on ISE systems.

The attackers deployed a custom in‑memory web shell named IdentityAuditAction, not standard malware, capable of running fully in memory, hijacking Tomcat threads via Java reflection, inspecting traffic as an HTTP listener, and encrypting payloads with DES and non‑standard Base64 encoding, activated by special HTTP headers.

The analysis also states that the threat actor possessed multiple unpublished zero‑day exploits exploited simultaneously and conducted mass internet scanning for vulnerable Citrix and Cisco systems on a large scale. 14 November 2025