Threat Insights: Active Exploitation of Cisco ASA Zero Days
Summary: Cisco reported that a sophisticated state-sponsored threat actor, identified as the same actor behind the earlier ArcaneDoor campaign, is actively exploiting zero-day vulnerabilities in Cisco ASA and FTD software, primarily targeting government networks worldwide for data exfiltration while using evasion techniques to prevent logging. Cisco published advisories for three critical vulnerabilities, with CVE-2025-20333 and CVE-2025-20362 under active exploitation and CVE-2025-20363 at high risk of imminent exploitation, and released software updates addressing all three as of Sep. 25, 2025.
Key Takeaway: CISA issued Emergency Directive 25-03 mandating immediate mitigation for federal agencies, and the UK's NCSC documented the RayInitiator GRUB bootkit and LINE VIPER shellcode loader used in these attacks - malware that persists across reboots and firmware upgrades, meaning a patched device may still be compromised.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2025-20333CVE-2025-20362CVE-2025-20363
- Related
- Arcane Door - New espionage-focused campaign found targeting perimeter network devices Cyber Risks ·UAT-4356's Targeting of Cisco Firepower Devices Cyber Risks ·