⚡ Weekly Recap: Cisco 0-Day, Record DDoS, LockBit 5.0, BMC Bugs, ShadowV2 Botnet & More

The weekly recap highlights Cisco 0-day exploits affecting ASA firewalls, with two CVEs—CVE-2025-20362 and CVE-2025-20333—being actively abused to bypass authentication and run malicious code, in a campaign linked to the ArcaneDoor cluster and a China-linked group known as UAT4356 (Storm-1849). It also notes ShadowV2, a Go-based botnet campaign that builds containers on a victim’s machine to mount DDoS and deploy a RAT, reportedly to misconfigured Docker instances on AWS.

In other big moves, Cloudflare said it blocked a record-breaking DDoS attack peaking at 22.2 Tbps and 10.6 Bpps that lasted 40 seconds, believed to be powered by the AISURU botnet and aimed at a European network infrastructure company. The week also covers two new Supermicro BMC bugs that could allow remote, persistent firmware implants, requiring administrative access to the BMC interface for exploitation.

Finally, LockBit 5.0 was analysed as an evolution with enhanced obfuscation and cross-platform capabilities, including Linux and ESXi targets, according to Trend Micro.