Kevin Beaumont
Cisco have found an in the wild zero day in Cisco Secure Email Gateway And Cisco Secure Email and Web Manager being used to backdoor appliances for later access.
Now CVE-2025-20393.
No patch available.
They recommend nuking boxes and reinstalling from scratch if you opened spam quarantine port (6025) to internet, and closing port.
It is unclear how long boxes have been backdoored for.
Port isn't scanned by @shodan yet so scope isn't known.
Kevin Beaumont
Your admins may know the product as Ironport, that was the branding years ago.
@greynoise might want to have a look at ports 6025, 7025, 82 and 83 for anomalies.
Kevin Beaumont
I think Cisco likely need to pivot on being far more open about this one ASAP, e.g. they need to openly provide:
- IOCs
- Oldest known time of backdoor installation
- Ports used during exploitation
At the minute they've got the bare minimal in there and I don't really want to write a blog and use MSPaint.exe
𝙲𝚘𝚕𝚒𝚗 𝙶𝚛𝚊𝚍𝚢
tehfishman
@GossiTheDog "don't make me open mspaint" is a threat I plan on using in catastrophically dumb meetings.
Kevin Beaumont
If anybody interested, this group jump to residential proxies to Tor exit nodes to Linode, Vultr and Kaopu boxes via VPN tunnels (boxes usually in the same geography as the target, down to the city, to avoid triggering impossible travel rules).
They also had a CitrixBleed 2 exploit before it was public knowledge or a patch was available, also one for CVE-2025-7775 (CitrixDeelb), the iSCSI one. They're pretty good at what they do.
Kevin Beaumont
IOCs (which should probably be linked on the Cisco support page)
https://blog.talosintelligence.com/uat-9686/
172.233.67.176 (linode)
172.237.29.147 (linode)
38.54.56.95 (Kaopu Cloud HK Limited)
I suspect probably China, has overlaps with a group doing Cisco ASA backdooring with #CyberWillyWave a few months ago
Kevin Beaumont
Additional IOC for this
trendmicro-update.com
reverse shell from ironport boxes, same threat actor
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.