Redhotcyber

Cisco Email Security Products Targeted in Zero-Day Campaign by China-Linked Actors

First seen 20 Dec 2025, 20:00 UTC • Forbes

•86% similarity •67.2

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Cisco has confirmed a zero-day vulnerability (CVE-2025-20393) in its Secure Email appliances that is being exploited by actors linked to China. The attackers have deployed the Aquashell backdoor to establish persistence within affected systems.

ThreatCluster AI

Attack Flow

9 entities, 14 inferred relationships (STIX 2.1).

Technique (3)

Malware
Ransomware
Zero-day Exploit

Organization (1)

Cisco

Vulnerability (1)

CVE-2025-20393

Malware (1)

AquaShell

Affected Platform (3)

Cisco Secure Email
Cisco Secure Email And Web Manager
Cisco Secure Email Gateway

Relationships

AquaShell exploits CVE-2025-20393
CVE-2025-20393 targets Cisco Secure Email
CVE-2025-20393 targets Cisco Secure Email And Web Manager
CVE-2025-20393 targets Cisco Secure Email Gateway
AquaShell targets Cisco
Malware targets Cisco Secure Email
Malware targets Cisco Secure Email And Web Manager
Malware targets Cisco Secure Email Gateway
Ransomware targets Cisco Secure Email
Ransomware targets Cisco Secure Email And Web Manager
Ransomware targets Cisco Secure Email Gateway
Zero-day Exploit targets Cisco Secure Email
Zero-day Exploit targets Cisco Secure Email And Web Manager
Zero-day Exploit targets Cisco Secure Email Gateway

Community

Browse all →

Tracked Entities in This Story

AquaShell Cisco Cisco Secure Email Cisco Secure Email And Web Manager Cisco Secure Email Gateway Malware Ransomware Zero-day Exploit

Cisco Email Security Products Targeted in Zero-Day Campaign by China-Linked Actors

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story