Hackers Deploy Linux Rootkits via Cisco SNMP Flaw in "Zero Disco' Attacks

Cybersecurity researchers have detailed a campaign, codenamed Operation Zero Disco by Trend Micro, that exploited a recently disclosed Cisco IOS/IOS XE flaw to install Linux rootkits on older, unprotected systems. The flaw, CVE-2025-20352, is a stack overflow in the SNMP subsystem that could allow an authenticated, remote attacker to execute arbitrary code (CVSS 7.7).

The intrusion primarily targeted Cisco 9400, 9300, and legacy 3750G series devices, with attempts to use a modified Telnet vulnerability (CVE-2017-3881) to enable memory access. According to Trend Micro, the rootkits achieved remote code execution and granted persistent unauthorised access by setting universal passwords and hooking into the IOSd memory space, with IOSd running as a software process within the Linux kernel.

The attackers reportedly focused on victims running older Linux systems lacking endpoint detection and response solutions, using spoofed IPs and Mac email addresses to fly under the radar. Although the activity was patched by Cisco late last month, the campaigns illustrate how the Zero Disco intrusions could still succeed on unprotected devices.