APT Exploits Zero-Day Vulnerabilities in Cisco and Citrix Systems

An advanced persistent threat (APT) group exploited zero-day vulnerabilities in Cisco Identity Services Engine (ISE) and Citrix systems, specifically CVE-2025-5777 and CVE-2025-20337. The attacks were detected by Amazon's MadPot honeypot service before the vulnerabilities were publicly disclosed, allowing the attackers to deploy custom malware and gain unauthorized access to critical infrastructure.