AquaShell Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
9
occurrences
First Seen
December 17, 2025
Last Seen
January 18, 2026

Related Threat Clusters

  • Cisco Fixes Critical AsyncOS Vulnerability Under Attack

    Cisco has addressed a maximum-severity vulnerability in AsyncOS, tracked as CVE-2025-20393, which has been actively exploited for at least a month. The flaw affects Secure Email Gateway (SEG) and Secure Email and Web…

    11 articles · Updated January 15, 2026
  • Cisco Email Security Products Targeted in Zero-Day Campaign by China-Linked Actors

    Cisco has confirmed a zero-day vulnerability (CVE-2025-20393) in its Secure Email appliances that is being exploited by actors linked to China. The attackers have deployed the Aquashell backdoor to establish persistence…

    6 articles · Updated December 20, 2025
  • Cisco ASA Zero-Day Exploited in State-Espionage Campaign

    Cisco disclosed a state-espionage campaign targeting its Adaptive Security Appliances (ASA), which are used for firewall and VPN functions. Attackers exploited two zero-day vulnerabilities to infiltrate government…

    27 articles · Updated December 18, 2025
  • Cisco Confirms Exploitation of AsyncOS Zero-Day by Chinese Hackers

    Cisco has reported an unpatched zero-day vulnerability (CVE-2025-20393) in its AsyncOS software, affecting Secure Email Gateway and Secure Email and Web Manager appliances. The vulnerability is being actively exploited…

    5 articles · Updated December 17, 2025
  • Cisco Patches Critical RCE Flaw Exploited by Hackers

    Cisco has released a patch for a critical remote code execution vulnerability (CVE-2025-20393) affecting its Secure Email appliances. This flaw was actively exploited by Chinese state-sponsored groups for several weeks…

    2 articles · Updated January 18, 2026

Recent Intelligence Reports

  • Cisco has finally patched maximum-level security issue targeted by hackers — Msn · January 18, 2026
  • Cisco finally fixes AsyncOS zero — Bleepingcomputer · January 16, 2026
  • Cisco email security products actively targeted in zero-day campaign — Techradar · December 19, 2025
  • Cisco says China — Cybersecuritydive · December 18, 2025
  • Cisco Vulnerability Exploit: Chinese Hackers Target Email Gateways — Technadu · December 18, 2025
  • Attacks pummeling Cisco AsyncOS 0-day since late November — Theregister · December 17, 2025
  • Attacks pummeling Cisco AsyncOS 0 — Theregister · December 17, 2025
  • Cisco warns of unpatched AsyncOS zero — Bleepingcomputer · December 17, 2025

CVSS v3.1 Breakdown