eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Exploitation of Cisco Zero-Day Vulnerability by Chinese APT
Bottom Line: Cisco reported active exploitation of a critical-severity vulnerability, CVE-2025-20393, affecting its Secure Email products. The flaw is believed to be abused by Chinese threat actors to deliver malicious payloads for persistent remote access.
Cisco has disclosed a critical zero-day vulnerability, tracked as CVE-2025-20393, which affects Cisco AsyncOS software used in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances. This vulnerability has a CVSS score of 10.0 and allows Remote Code Execution (RCE) when the Spam Quarantine feature is enabled and exposed to the Internet. Cisco confirmed that exploitation of the vulnerability was first detected on December 10th, 2025, but goes back as early as November 2025. During their investigation, Cisco PSIRT and Cisco Talos observed that threat actors established a covert persistence mechanism on compromised appliances. Remote access continued even after initial exploitation. Cisco Talos has documented this campaign under the threat actor group UAT‑9686.
The threat actors are exploiting this flaw to execute arbitrary code remotely. Once compromised, threat actors deployed a Python-based backdoor called AquaShell to persistently reside on compromised Cisco systems. It passively listens for specially crafted HTTP POST requests. Upon receiving encoded payloads, AquaShell decodes and executes system commands on the appliance, providing ongoing remote access and stealthy control.
In addition to AquaShell, the attackers leverage AquaTunnel, a custom reverse-tunnel tool written in GoLang, based on the open-source ReverseSSH. AquaTunnel creates a covert communication channel, allowing attackers to access the target system remotely and move laterally within the compromised network. The adversaries also used Chisel, an open-source tunneling utility. In this campaign, attackers used Chisel for internal pivoting, enabling them to reach systems and services behind network segmentation without raising suspicion. Finally, to cover their tracks, the attackers deployed AquaPurge, a log-clearing tool that uses pattern matching (e.g., via egrep) to scrub any entries related to their activities. This helps erase forensic evidence, making it harder for defenders to trace the attacker's actions and increasing the chances of remaining undetected.
eSentire Threat Intelligence Analysis:
The compromise of email security infrastructure is critical because these appliances often handle sensitive communications and may integrate with identity systems. Root-level access means attackers can manipulate traffic, exfiltrate data, and potentially use the appliance as a launchpad for further attacks across the network. On December 17th, CISA added CVE-2025-20393 to its Known Exploited Vulnerabilities (KEV) catalog, setting a deadline of December 24th, 2025, for federal agencies to implement the mitigation measures outlined by Cisco.
According to Cisco, this vulnerability specifically affects Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances with the Spam Quarantine feature enabled and exposed to the internet, a feature that is not activated by default. While there are no patches available, Cisco has provided a multi-step guidance to help organizations secure affected devices, noting that the only effective solution to eliminate persistence mechanisms is to rebuild the impacted appliances. If rebuilding is not feasible, Cisco recommends contacting their support team to verify if the appliance has been compromised.
The eSentire Threat Intelligence team has published a security advisory addressing CVE-2025-20393 on December 18th, 2025. In response, the Threat Response Unit (TRU) conducted threat hunts across customer environments to identify known Indicators of Compromise (IOCs). The eSentire Managed Vulnerability Service (MVS) will incorporate relevant plugins for CVE-2025-20393 as they become available. Additionally, eSentire MDR for Network has detections to identify traffic associated with Chisel and webshells, while eSentire MDR for Endpoint focuses on detecting webshell activity on affected devices. The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities.
FortiGate Device Exploitation
Bottom Line: A recently disclosed critical vulnerability, CVE-2025-59718, affecting multiple Fortinet appliances has been confirmed as actively exploited in the wild. Organizations are strongly advised to apply the remediation measures outlined by Fortinet to mitigate the risk.
On December 16th, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE‑2025‑59718 (CVSS: 9.8) to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. CVE‑2025‑59718 is an authentication bypass vulnerability disclosed by Fortinet on December 9th, 2025, alongside a related issue, CVE‑2025‑59719.
CVE‑2025‑59718 impacts multiple Fortinet products, including FortiOS, FortiProxy, and FortiSwitchManager, and stems from a flaw in the FortiCloud Single Sign‑On (SSO) feature. Successful exploitation allows an unauthenticated attacker to bypass FortiCloud SSO authentication by submitting a specially crafted SAML message. Fortinet noted that FortiCloud SSO is disabled by default and is only enabled when a device is registered to FortiCare, unless the “Allow administrative login using FortiCloud SSO” option is manually disabled during registration.
Prior to the inclusion of CVE‑2025‑59718 in the KEV catalog, security researchers reported malicious SSO login activity targeting Fortinet appliances, resulting in the theft of configuration data. These findings suggest potential exploitation of CVE‑2025‑59718 and CVE‑2025‑59719 in the observed attacks. eSentire has observed and remediated activity consistent with the reported behavior; however, no confirmed link has been established between CISA’s KEV addition and the reported incidents. Additionally, on December 17th, 2025, Rapid7 observed exploitation attempts against honeypots within its network and reported the availability of a Proof‑of‑Concept (PoC) exploit code on GitHub.
eSentire Threat Intelligence Analysis:
Authentication bypass vulnerabilities, such as CVE-2025-59718, provide attackers with easy access to affected systems, potentially enabling full network compromise and the deployment of malware, including ransomware. Such activity can disrupt normal operations and place sensitive data at significant risk. In the past, Fortinet authentication bypass vulnerabilities, including CVE-2024-55591 and CVE-2025-24472, have been leveraged by threat actors to deploy the SuperBlack ransomware. While Fortinet disclosed two authentication bypass flaws, CVE-2025-59718 has been confirmed by CISA to be actively exploited in the wild. US federal agencies have been ordered to mitigate it by December 23rd, 2025, allowing just one week for remediation, underscoring the critical severity of the vulnerability. Given the KEV addition and public availability of PoC exploit code, it is critical that organizations mitigate CVE-2025-59718 by immediately applying the recommended patches.
Fortinet vulnerabilities have historically been attractive targets for threat actors. Among the more recent flaws exploited in the wild are CVE-2025-58034 and CVE-2025-64446 affecting Fortinet FortiWeb, both of which were addressed in advisories published by the eSentire Threat Intelligence team in November 2025. Vulnerabilities in Fortinet devices are frequently targeted due to the widespread deployment of these products and relative ease with which attackers can gain network access following successful exploitation. As edge devices, Fortinet products often provide a direct entry point into organizations’ networks. Organizations should thus ensure that the Internet-facing devices are always patched and up to date. The End-of-Life (EoL) devices should be decommissioned and replaced with secured instances.
Where immediate upgrading is not feasible, Fortinet recommends disabling the FortiCloud SSO login functionality until patches can be applied. Organizations should also maintain effective vulnerability and patch management programs to promptly identify and remediate high-risk vulnerabilities across their environments. Deploying a robust Endpoint Detection and Response (EDR) solution can help detect and contain post-exploitation activity, including the deployment of malicious payloads.
The eSentire Threat Intelligence team published a security advisory on CVE-2025-59178 on December 17th, 2025, and is tracking the exploitation activity for additional detection opportunities. eSentire MDR for Log includes detections designed to identify behaviors associated with the exploitation of Fortinet devices. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-59178.
Long-Term Russian APT Campaign Pivot to Misconfigured Device Targeting
Bottom Line: Analysis into a years-long cyber espionage campaign conducted by Russian APT groups has identified a trend where threat actors have pivoted from vulnerability exploitation to targeting misconfigured edge devices for initial access against critical infrastructure organizations.
On December 15th, 2025, Amazon Threat Intelligence published a report on attack trends observed throughout a years-long cyber espionage campaign, which has been linked to Russia's Main Intelligence Directorate (GRU). The analyzed campaign spanned from 2021 to 2025, where Amazon notes a “tactical pivot” where initial access to victim environments was achieved through targeting misconfigured edge devices rather than vulnerability exploitation. This shift is notable as it reduces the threat actors “exposure and resource expenditure” while enabling the same operational outcomes.
The campaign identified by Amazon has been ongoing since 2021, where both vulnerability exploitation and misconfigured edge device targeting were techniques that were both used. Between 2021 and 2022, the campaign involved the exploitation of CVE-2022-26318, an unauthenticated Remote Code Execution (RCE) vulnerability within WatchGuard Firebox and XTM appliances. In 2023, attacks linked to the campaign utilized vulnerabilities within Confluence, specifically CVE-2021-26084 and CVE-2023-22518, while in 2024, attackers targeted vulnerabilities within Veeam, such as CVE-2023-27532. Amazon indicates that by 2025, there was a decline in the targeting of n-day and zero-day vulnerabilities within attacks, while there was sustained “misconfigured customer network edge device targeting”. The primary focus of the observed campaign was critical infrastructure organizations within North America and Europe, with a focus on the energy sector and organizations with cloud-hosted network infrastructure.
The shift to targeting misconfigured devices still enables the attackers to achieve the “same strategic objectives”, which include persistent access to critical infrastructure networks and credential harvesting for enabling further access. Amazon highlights that the pivot to a heavier focus on misconfigured edge devices demonstrates a potential investment reduction in zero-day and n-day exploitation, along with “significantly reducing the risk of exposing their operations through more detectable vulnerability exploitation activity”. Amazon attributed the activity to Russia's GRU through infrastructure overlaps and targeting patterns with other Russian APTs linked to the GRU, such as Sandworm (aka APT44, Seashell Blizzard). Overlap with other Russian APT groups was also identified, including Curly COMrades, which they suggest “aligns with GRU operational patterns of specialized subclusters supporting broader campaign objectives”.
eSentire Threat Intelligence Analysis:
The GRU is the foreign intelligence arm of the Russian Ministry of Defense and has been active since at least 2009. The GRU has a focus on strategic disruption and espionage, with the goal of advancing Russia's interests and geopolitical objectives. APT groups that have been linked to the GRU include Sandworm and Fancy Bear (aka APT28), with recent cyberattacks linked to the GRU having targeted Ukraine amid the ongoing Russia-Ukraine war. Amazon's observations of Russian APT groups linked to the GRU shifting towards targeting misconfigured devices instead of vulnerability exploitation is notable, as these types of attacks are often referred to as “low-hanging fruit”. APT groups are known to invest in zero-day vulnerabilities for exploitation. The shift away from these types of attacks to misconfigured edge devices, while still being able to achieve their objectives, underscores the prevalence of exposed misconfigured devices, along with the criticality of these devices and the inherent risks that misconfigurations have.
Amazon's report follows a joint advisory published by CISA on December 9th, 2025, warning of Russian hacktivist groups conducting opportunistic attacks globally, which also involve the targeting of misconfigured edge devices for initial access. The advisory highlights that these hacktivist groups have received direct support from Russia's GRU, specifically Sandworm, highlighting this potential tactic shift across many Russia-aligned threat actors. In their report, Amazon noted infrastructure overlap in the campaign with the Russian APT Curly COMrades, suggesting that various APT groups are used to support broader campaign objectives. CISA's advisory also underscores this notion, with Russian APT groups supporting Russia-aligned hacktivist campaigns as well.
To protect against these threats, organizations should perform audits and review device configurations on exposed Internet facing devices. Organizations should also ensure that default credentials are not used on any externally facing assets and implement Multi-Factor Authentication (MFA) on all accounts where possible. eSentire's Threat Intelligence team covered CISA's report in the Weekly Threat Briefing - December 8 - December 12. eSentire's Threat Intelligence team continues to track this topic for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
