Bleepingcomputer

Ongoing BadCandy Infections Target Unpatched Cisco Devices in Australia

First seen 2 Nov 2025, 16:14 UTC • Thecyberexpress

•85% similarity •18.1

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Australian government has issued a warning about ongoing cyberattacks exploiting CVE-2023-20198, a critical vulnerability in Cisco IOS XE devices. As of late October 2025, over 150 devices in Australia remain compromised with the BadCandy webshell, despite patches being available since October 2023. The flaw allows remote unauthenticated attackers to create local admin users via the web interface, enabling full control of the devices.

ThreatCluster AI

Attack Flow

11 entities, 17 inferred relationships (STIX 2.1).

Threat Actor (1)

Salt Typhoon

Technique (3)

DDoS
Malware
Man-in-the-Middle

Campaign (1)

BadCandy campaign

Vulnerability (2)

CVE-2023-20198
CVE-2023-20273

Malware (2)

Badcandy
VPNFilter

Affected Platform (1)

Cisco IOS XE

Tool (1)

Nginx

Relationships

Salt Typhoon uses Badcandy
Salt Typhoon uses VPNFilter
Salt Typhoon uses Nginx
Salt Typhoon uses DDoS
Salt Typhoon uses Malware
Salt Typhoon uses Man-in-the-Middle
Badcandy exploits CVE-2023-20198
Badcandy exploits CVE-2023-20273
VPNFilter exploits CVE-2023-20198
VPNFilter exploits CVE-2023-20273
Nginx exploits CVE-2023-20198
Nginx exploits CVE-2023-20273
BadCandy campaign attributed to Salt Typhoon
BadCandy campaign uses Badcandy
BadCandy campaign uses VPNFilter
CVE-2023-20198 targets Cisco IOS XE
CVE-2023-20273 targets Cisco IOS XE

Community

Browse all →

Ongoing BadCandy Infections Target Unpatched Cisco Devices in Australia

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading