Chinese Hackers Targeting Cisco Email Gateways

Likely Chinese nation-state hackers are exploiting an unpatched flaw in Cisco email appliances as part of an ongoing campaign to gain persistent access.

See Also: Corelight’s Brian Dye on NDR’s Role in Defeating Ransomware

Cisco Talos, the manufacturer’s threat intel arm, said Wednesday that hackers have been exploiting since mid-November a zero-day in the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager. It attributes the attacks with medium confidence to a Chinese threat actor it tracks as UAT-9686, in part because of overlap in tooling and infrastructure with other Chinese nation-state hacking groups.

The campaign exploits an improper input validation flaw tracked as CVE-2025-20393. Cisco said it became aware of the flaw on Dec. 10 and that there currently exist no workarounds to counter the attacks. If a vulnerable device’s web management console has been exposed to the internet – or if the devices were configured with a spam quarantine feature that opened up the corresponding software port – then Cisco says customers’ best bet is to yank the device off the internet.

If it’s too late – if hackers have already gotten in – then “rebuilding the appliances is, currently, the only viable option to eradicate the threat actors persistence mechanism from the appliance,” the company said.

Talos’s assessment is that only appliances “with non-standard configurations” are being hacked.

Network infrastructure made by the California-based multinational has played a central role in ongoing waves of Chinese hacking against telecoms and other sectors of critical infrastructure. The company in November pledged to improve the security of its products. In doing so, it joined a string of companies whose products took starring roles in hacking campaigns, a list that includes tech giant Microsoft and corporate VPN maker Ivanti (see: Cisco Pledges More Security in Network Equipment).

The U.S. Cybersecurity and Infrastructure Security Agency on Wednesday added the flaw to its Known Exploited Vulnerabilities catalog.

The flaw, which has a maximum CVSS ranking of 10, permits the attackers to gain root privileges on the underlying operating system. Once compromised, the hackers deploy multiple custom tools including AquaShell, a custom Python backdoor and AquaTunnel, a reverse SSH tunnel. They also deploy AquaPurge, a log clearing utility and chisel, another tunneling tool.

The attack is the latest instance of Chinese hackers’ pivot towards edge devices. Because edge devices can run for months without being rebooted or patched, hackers can remain inside victim networks without detection for long periods of time (see: State Hackers’ New Frontier: Network Edge Devices).