UAT-9686Threat actor
UAT-9686 is a Chinese state-sponsored APT known for targeting networking infrastructure and edge appliances through a sophisticated espionage campaign. They exploit a critical flaw in the Cisco AsyncOS Spam Quarantine interface to gain root access and deploy custom malware, including AquaShell, along with Python scripts that execute natively.From MISP Galaxy
Last reported 10 days ago, by The Hacker News1 report
ATT&CK techniques
1 technique · each with the sentence it comes from- T1552.004Private Keys
“A compromised member's private keys could give the attacker a way into the others, so Cisco recommends restoring every member of a cluster that contains at least one compromised appliance.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Cisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability“…-level flaw in these appliances that Cisco has confirmed exploited since December, when a China-linked group that Cisco Talos tracks as UAT-9686 used a zero-day in the spam quarantine feature, CVE-2025-20393, that Cisco patched in January.”
Thanks — we review every report.