Cybersecuritydive Ongoing Exploitation of Cisco IOS XE Vulnerability with BadCandy Implant
Article Content
Browse articles 
Cyberattacks exploiting a critical vulnerability in Cisco IOS XE (CVE-2023-20198) continue, with over 150 devices in Australia still infected with the BadCandy webshell as of late October 2025. Despite patches being available for over two years, many devices remain unpatched and vulnerable to re-infection. The Australian Signals Directorate warns that attackers can detect and reinstall the BadCandy implant if removed.
Ask AI about this cluster
Answers cite the sources they use
Updated 242d ago How this analysis works
More articles in this cluster (8)
Following this threat?
Track Salt Typhoon, Badcandy and CVE-2023-20198 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
CISA's CI Fortify Initiative Enhances Resilience for Critical Infrastructure The CI Fortify initiative, launched by CISA and international partners, aims to ensure critical infrastructure can maintain essential services during cyber attacks. This initiative comes in response to recent attacks on U.S. water systems attributed to Iranian hackers, which highlighted vulnerabilities in operational… 
Growing Cyber Risks from IT-OT Convergence Threaten Critical Infrastructure As the convergence of IT and operational technology (OT) accelerates, cybersecurity experts warn of increasing cyber risks to critical infrastructure. During the Cyber Leaders Exchange 2026, experts highlighted how attackers are now capable of operational sabotage, including modifying programmable logic controller…