Amazon Uncovers Attacks Exploited Cisco ISE and Citrix Net Scaler as Zero-Day Flaws
Summary: Amazon's threat intelligence team reported that its MadPot honeypot network flagged exploitation of CVE-2025-5777 in Citrix NetScaler ADC as a zero-day in May 2025, and follow-on investigation found an anomalous payload targeting Cisco ISE appliances via CVE-2025-20337. The campaign ended in a custom web shell disguised as a legitimate Cisco ISE component named IdentityAuditAction, which runs entirely in memory, uses Java reflection to inject into running threads, monitors all HTTP requests on the Tomcat server, and applies DES encryption with non-standard Base64 encoding to evade detection.
What you should know: Amazon describes the actor as highly resourced, able to wield multiple zero-days at once and build a backdoor tailored to Cisco ISE, Tomcat internals and enterprise Java - and the exploits are pre-authentication, so well-maintained systems are still exposed.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-20337CVE-2025-5777
- Related
- ⚡ Weekly Recap: Share Point 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More Cyber Risks ·CVE-2025-20337: Cisco Identity Services Engine Injection Vulnerability Known Exploited Vulnerabilities · Jul 28, 2025