eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Operation Zero Disco: Exploitation of Cisco SNMP Vulnerability
Bottom Line: Threat actors are actively exploiting the Cisco SNMP vulnerability CVE-2025-20352 to deploy Linux rootkits on legacy and current Cisco switches, enabling remote code execution and persistent access. The operation, dubbed "Zero Disco," targets devices lacking EDR, using spoofed credentials and modified Telnet exploits to bypass firewalls and evade detection.
On October 15th, 2025, Trend Micro published a report providing details on an observed campaign, targeting a vulnerability found within Cisco Simple Network Management Protocol (SNMP), with successful exploitation being used to deploy rootkits. The campaign, which Trend Micro dubbed Operation Zero Disco, involves the exploitation of CVE-2025-20352 (CVSS: 7.7), which is a vulnerability impacting the SNMP subsystem of Cisco IOS and IOS XE software, which can enable an authenticated attacker to cause a Denial of Service (DoS) or Remote Code Execution (RCE). Trend Micro indicated that Operation Zero Disco targeted “victims running older Linux systems” that did not have Endpoint Detection and Response (EDR) solutions installed.
Successful exploitation of the vulnerability resulted in threat actors deploying a rootkit, which was able to set a universal password through the installation of several hooks onto the Cisco IOS daemon (IOSd), which included low-level authentication functions. As a result, the universal password that is set by the malware works across “most authentication methods”, but due to the change being volatile, it disappears after reboot. The attacker was then able to use this universal password, which Trend Micro states included the word “disco”, to log into the device and install a fileless backdoor. Trend Micro also notes that the attackers “attempted to exploit a Telnet vulnerability” (CVE-2017-3881), which impacts the Cisco Cluster Management Protocol (CMP) processing code within Cisco IOS and IOS XE leading to RCE, but was modified to enable memory read/ write.
Within their analysis of the rootkit, Trend Micro found that a UDP controller was used by the attackers to control the rootkit. The UDP controller provided several management functions for the threat actors, including toggling log history on or off, bypassing AAA authentication and Virtual Terminal (VTY) Access Control Lists (ACLs), concealing portions of the running configuration, and resetting timestamps of running configuration writes to hide changes. The attackers were also able to use Address Resolution Protocol (ARP) spoofing and IP impersonation to laterally move across the network.
eSentire Threat Intelligence Analysis:
CVE-2025-20352 is a zero-day vulnerability, that was initially disclosed by Cisco on September 24th, 2025. Within their disclosure, Cisco stated that the Cisco Product Security Incident Response Team (PSIRT) was aware of “successful exploitation of this vulnerability in the wild” prior to its patch release. However, the advisory suggests that exploitation was observed after the local Administrator credentials were compromised. Trend Micro indicates within their report that “Cisco also contributed to this research by providing forensics for their products and impact data”, but there is no confirmation if Operation Zero Disco were the attacks that Cisco referenced in their advisory, or if these attacks were part of a separate campaign. Neither Cisco nor Trend Micro provide any details on the objectives or threat actors behind the reported attacks.
Vulnerabilities impacting Cisco products, specifically IOS and IOS XE, have a history of being targeted by threat actors as a means for initial access. The vulnerability CVE-2023-20198 (CVSS: 10) was observed being targeted in attacks following its disclosure in October 2023. Edge devices continue to be prime targets for threat actors within attacks due to their accessibility from the Internet, and the access that may be granted to an attacker upon successful exploitation. Both state-sponsored threat actors and ransomware groups have been known to target edge devices for initial access. The recent observations found within Operation Zero Disco, along with historic targeting of edge devices, underscores the criticality of organizations ensuring that edge devices are secure.
Organizations utilizing Cisco IOS and IOS XE software within their environment should ensure that they are up to date on security patches, and that best practices are followed for securing Cisco SNMP and edge devices. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices that are vulnerable to CVE-2017-3881 and CVE-2025-20352. eSentire's Threat Intelligence team is continuing to track this topic for additional information and detection opportunities.
Microsoft Patch Tuesday
Bottom Line: Microsoft’s October Patch Tuesday release addressed a total of 172 vulnerabilities. Three of the vulnerabilities were confirmed to have been exploited in the wild prior to the release, with Proof-of-Concept (PoC) exploit code publicly available for one of the three vulnerabilities.
October 14th, 2025, marks Windows 10’s end of free support (unless enrolled in Microsoft’s Extended Security Updates (ESU) subscription program) along with Microsoft’s October Patch Tuesday release, which addressed a total of 172 vulnerabilities, an increase compared to the previous month’s release. Of these are three vulnerabilities that were publicly disclosed prior to the release, and another three vulnerabilities that were exploited in the wild.
- CVE-2025-24990 (CVSS: 7.8) is an Elevation of Privilege vulnerability related to the third party Agere Modem driver that is present on all supported Windows operating systems
- Successful exploitation could allow an attacker to gain administrator privileges on the impacted host
- CVE-2025-59230 (CVSS: 7.8) is an Elevation of Privilege vulnerability related to Windows Remote Access Connection Manager
- Successful exploitation could allow an attacker to gain SYSTEM level privileges
- CVE-2025-47827 (CVSS: 4.6) is a Security Feature Bypass vulnerability in IGEL OS before 11
- Successful exploitation of this vulnerability could bypass Secure Boot and allow for the mounting of a crafted root file system
Other vulnerabilities of note addressed in this month’s release include CVE-2025-49708 (CVSS: 9.9), an Elevation of Privilege vulnerability related to Microsoft Graphics Component and CVE-2025-59287 (CVSS: 9.8), a Remote Code Execution vulnerability related to Windows Server Update Service (WSUS).
eSentire Threat Intelligence Analysis:
Details on the incidents involving exploitation of CVE-2025-24990, CVE-2025-59230 and CVE-2025-47827 are not available at this time, however it can be inferred that these were utilized once a threat actor had gained access to victim environments.
While PoC code is not available as of the time of writing, CVE-2025-24990 is of interest due to the vulnerable driver’s presence on all supported versions of the Windows operating system, regardless of whether the related hardware is in use. In a hypothetical scenario, a threat actor that gains access to a low-privileged account on a system with this vulnerable driver could exploit it to gain administrator privileges. Microsoft’s course of action to mitigate this is to remove the driver entirely as of the October cumulative update, rather than providing a patch given this is a legacy driver for hardware likely not in use anymore.
Several Microsoft products have reached end of support as of October 14th, 2025. This includes Windows 10, unless the device is enrolled in Microsoft’s Extended Security Updates (ESU) subscription program. Enrolled consumer users can receive updates through October 13th, 2026, and commercial or educational organizations can receive updates for a maximum of three years after the end of support for Windows 10.
Organizations are strongly encouraged to apply the security patches provided in Microsoft’s October release. Devices that are Internet-facing or are listed as “Exploitation More Likely” by Microsoft should be prioritized for testing and patch deployment.
F5 Security Incident
Bottom Line: F5 recently disclosed a security breach that took place in August 2025, perpetrated by an unknown state-sponsored threat actor. The compromise resulted in the theft of data relating to BIG-IP source code and information on undisclosed vulnerabilities that were being worked on internally.
On October 15th, 2025, F5 disclosed that it had been breached by a state-sponsored threat actor, marking a significant compromise of its internal product development and engineering knowledge environments. According to F5’s official advisory (K000154696), the company detected unauthorized access on August 9th, 2025, and subsequently obtained permission from the U.S. Department of Justice to delay public disclosure until mid-October due to national security considerations. The breach involved the exfiltration of portions of F5’s BIG-IP source code, internal vulnerability data, and customer configuration and implementation information for a small subset of clients.
F5 has stated that it has no evidence indicating that the software supply chain, including build pipelines and release artifacts, was modified or tampered with, nor that the source code or build systems were maliciously altered. Additionally, there is no evidence that the attacker accessed its CRM, financial, support case, iHealth systems, or that they accessed or modified the NGINX source code, F5’s Distributed Cloud Services, or Silverline systems. However, several cybersecurity firms and news articles have suggested that the attacker’s access may have been long-term and persistent, potentially extending beyond the August detection window.
In response, F5 has taken extensive steps to contain the incident and safeguard its systems. These measures include engaging with leading cybersecurity firms like CrowdStrike and Mandiant, cooperating with law enforcement and government partners, and deploying updates across its product lines—BIG-IP, F5OS, BIG-IP Next for Kubernetes, BIG-IQ, and APM clients—to mitigate potential vulnerabilities. Additionally, they have introduced a quarterly security notification outlining recent vulnerabilities and the essential patches addressing these threats. The security notification includes 27 high-severity CVEs, 16 medium-severity CVEs, 1 low-severity CVE, and 1 security exposure.
eSentire Threat Intelligence Analysis:
This is a developing topic. It remains unclear how threat actors gained initial access to F5 infrastructure and when the initial compromise occurred. This breach is significant because it targets the development environment of F5, which can yield sensitive knowledge about how the products are built, configured, or what internal architecture is used. That kind of knowledge could aid adversaries in crafting exploits. Although F5 claims customer systems weren’t directly impacted, the exfiltration of configuration and implementation data for some customers means that threat actors could use that to plan future attacks.
In response to the F5 breach, CISA has mandated several immediate actions for U.S. federal agencies. First, agencies must conduct an inventory of all F5 BIG-IP hardware and software systems to ensure that networked management interfaces are not publicly accessible. If any public-facing interfaces are exposed, agencies should follow CISA's Binding Operational Directive 23-02 to mitigate the associated risks. Moreover, by specified dates in October 2025, federal agencies must apply the latest updates from F5 for all identified products, ensuring that these updates are validated against F5's MD5 checksums. For agencies unable to immediately disconnect devices that have reached their end of support, they must report their reasoning and future plans to CISA. Additionally, federal agencies are required to report their compliance and inventory details to CISA. Initial summaries are due by October 29th, 2025, while comprehensive inventories must be submitted by December 3rd, 2025.
In response to the F5 breach, eSentire’s Threat Response Unit (TRU) is performing threat hunts to identify any indicators of compromise or malicious activity associated with the incident. eSentire Managed Vulnerability Service (MVS) has plugins to detect the vulnerabilities listed in the F5 security notification. Additionally, eSentire has issued an advisory on October 16th, 2025 providing additional information, recommendations, and mitigation steps for organizations that may have been impacted by this attack.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
