Operation Zero Disco: Threat actors targets Cisco SNMP flaw to drop Linux rootkits

Trend Micro researchers disclosed details of a campaign, tracked as Operation Zero Disco, that exploits Cisco IOS and IOS XE SNMP vulnerabilities to drop Linux rootkits on older devices. The flaw, CVE-2025-20352 (CVSS 7.7), allows remote authenticated attackers to trigger a DoS or achieve root code execution by sending crafted SNMP packets over IPv4 or IPv6. The operation mainly targeted Cisco 9400, 9300, and legacy 3750G switches, and also attempted to exploit a modified Telnet flaw for memory access.

According to Trend Micro, once a rootkit is implanted, the malware installs a universal password containing the word disco and hooks IOSd to hide activity, with fileless components that can disappear after reboot. Attackers use a UDP controller and ARP spoofing to run implants, delete logs, bypass access controls, and maintain persistence across VLANs.

They move laterally by creating a backdoor path between two VLANs, disable switch logging during intrusions, and re‑enable logs to conceal changes, while the campaign continues to seek vulnerable, unprotected systems.