Cisco email security products actively targeted in zero-day campaign
Two Chinese-nexus groups have been exploiting a newly discovered flaw
· TechRadarNews By Sead Fadilpašić published 19 December 2025
(Image credit: Shutterstock / Ken Wolter) Share Share by:
Share this article 0 Join the conversation Follow us Add us as a preferred source on Google
- Cisco confirms zero‑day (CVE‑2025‑20393) in Secure Email appliances exploited by China‑linked actors
- Attackers deployed Aquashell backdoor, tunneling tools, and log‑clearing utilities for persistence
- CISA added flaw to KEV; agencies must remediate/stop use by December 24
A China-affiliated threat actor has been abusing a zero-day vulnerability in multiple Cisco email appliances to gain access to the underlying system and establish persistence.
Cisco confirmed the news in a blog post and a security advisory, urging users to apply provided recommendations and harden their networks.
In its announcement, Cisco said it first spotted the activity on December 10, and determined that it started at least in late November 2025. In the campaign, the threat actor tracked as UAT-9686 abused a bug in Cisco AsyncOS Software for Cisco Secure Email Gateway, and Cisco Secure Email and Web Manager, to execute system-level commands and deploy a persistent Python-based backdoor called Aquashell.
Two groups
The vulnerability is now tracked as CVE-2025-20393 and was given a severity score of 10/10 (critical).
The group was also seen deploying AquaTunnel (a reverse SSH tunnel) chisel (another tunneling tool), and AquaPurge (log-clearing utility).
Given the tools and infrastructure used, Cisco believes the attacks are being conducted by at least two groups - tracked as APT41, and UNC5174. Both are very active and quite dangerous - abusing legitimate cloud services, breaching VPNs, firewalls, and other tools, while engaging primarily in cyber-espionage.
At the same time, the US Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities (KEV) catalog, confirming abuse in the wild. Federal Civilian Executive Branch agencies have until December 24 to apply the provided fixes or stop using the vulnerable products entirely.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Contact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsors