Ongoing Exploitation of Cisco IOS XE Vulnerability with BadCandy Implant

Cybersecuritydive

Ongoing Exploitation of Cisco IOS XE Vulnerability with BadCandy Implant

First seen 2 Dec 2025, 18:33 UTC • •28.9

Article Content

1 / 9

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Cyberattacks exploiting a critical vulnerability in Cisco IOS XE (CVE-2023-20198) continue, with over 150 devices in Australia still infected with the BadCandy webshell as of late October 2025. Despite patches being available for over two years, many devices remain unpatched and vulnerable to re-infection. The Australian Signals Directorate warns that attackers can detect and reinstall the BadCandy implant if removed.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 192d ago How this analysis works

More articles in this cluster (8)

Threat Graph

14 entities, 22 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (1)

Salt Typhoon

Technique (5)

DDoS
Malware
Zero-day Exploit
Man-in-the-Middle
Web Shell

Campaign (1)

BadCandy campaign

Vulnerability (2)

CVE-2023-20198
CVE-2023-20273

Malware (2)

Badcandy
VPNFilter

Affected Platform (1)

Cisco IOS XE

Tool (2)

Lua-based web shell
Nginx

Relationships

Salt Typhoon uses Badcandy
Salt Typhoon uses VPNFilter
Salt Typhoon uses Lua-based web shell
Salt Typhoon uses Nginx
Salt Typhoon uses DDoS
Salt Typhoon uses Malware
Salt Typhoon uses Zero-day Exploit
Salt Typhoon uses Man-in-the-Middle
Salt Typhoon uses Web Shell
Badcandy exploits CVE-2023-20198
Badcandy exploits CVE-2023-20273
VPNFilter exploits CVE-2023-20198
VPNFilter exploits CVE-2023-20273
Lua-based web shell exploits CVE-2023-20198
Lua-based web shell exploits CVE-2023-20273
Nginx exploits CVE-2023-20198
Nginx exploits CVE-2023-20273
BadCandy campaign attributed to Salt Typhoon
BadCandy campaign uses Badcandy
BadCandy campaign uses VPNFilter
CVE-2023-20198 targets Cisco IOS XE
CVE-2023-20273 targets Cisco IOS XE

Following this threat?

Track Salt Typhoon, Badcandy and CVE-2023-20198 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

China-Linked QTFY Group Targets Critical Infrastructure with Advanced Exploits The Joint Cybersecurity Advisory JCSA-20260826-01, released on August 26, 2026, details ongoing activities by the China-linked hacking group QTFY, attributed to Nanjing Xinjiuwei Network Technology Co. Active since 2018, QTFY employs platforms like QScan and QTRouter to exploit vulnerabilities in critical…

Fire Ant Threat Actor Targets Trusted Infrastructure in 2026 The China-nexus threat actor known as Fire Ant has evolved its tactics in 2026, transitioning from targeting VMware hypervisors to compromising trusted infrastructure, including Cisco routers, TACACS authentication servers, and Linux management hosts. This shift allows Fire Ant to collect credentials, traffic, and…