Russian Targeting of Edge Devices. Cisco AsyncOS Zero Day, and React2Shell Won't Go Away

probably a 5 month period, you would find dozens of exploitable vulnerabilities in edge devices. You know, whether they're security appliances or just, you know, other edge devices, routers, things like that, switches, tons of them and not just like enterprise edge devices, consumer edge devices, all kinds of stuff. So I always feel like these are big targets, but it's always notable when SIS or someone else comes out with a warning like this because it doesn't come in a vacuum. They're telling you that for a reason, you know? Yeah, definitely.

And this was interesting too, because it was focused specifically on the research that I was looking at from Amazon was focused specifically on critical infrastructure. And essentially they tracked this campaign that happened from I think it was from 2021 through 2025. And what they found was from 2021 through 2024, this this threat group that they had linked to Sandworm or I guess they it had infrastructure overlaps with Sandworm that they primarily targeted CV ES during that time frame.

So like, you know, flaws and confluence and watch guard products, all these other kind of big vulnerabilities over the years. And then specifically over the last year, they they saw this threat group have more of a sustained targeting of, as you're saying, these, these edge devices. So they were able to really like, it's interesting. First of all, they were able to track this evolution for, you know, however many years.

But then also seeing that this trend emerge in parallel with kind of the maybe shying away from CBE exploitation, which makes sense because, you know, CBE exploitation, it requires a lot more resources. It leaves the threat actor a little bit more like it has a higher exposure for the threat actor. It's a little more noisy. So, you know, I think it it does make sense and but it's still a interesting trend to see there. I wonder if this was in I I'm sorry, it was Amazon, not not sis.

As I said, you were right. I wonder if there was like a operational reason why Sandworm or you know, the this this group that overlaps with them is moving more towards that, as you said, like, yeah, exploiting known bugs can be noisy and it can be an easy way for researcher and researchers and threat and tell teams to track those groups. Whereas if you're just taking advantage of like a default configuration that's easy to exploit, that's not, you know, that's a little quieter and it's a little more difficult for researchers to track. Or I wonder if it's just more of, you know, targets of opportunity where they're, it's just kind of a trend where they're like people are leaving these devices misconfigured and we're going to take advantage of that, you know, like the extremely lame unlocked door analogy that we hear all the time.

Yeah, I think it's really, it's interesting if you look at the two attack vectors from a defender's perspective, like if you look at a a misconfigured edge device, like a lot of when it comes to visibility, it's hard to even understand what like assets are in your environment. And especially if it's misconfigured, like how do you detect that activity and understand that it stems from a misconfiguration versus like something a little more solid like CVE, like a specific CVE if it's already known.

So I think that's a good point is that you know that maybe like just the the two different ways that operationally meet, you know, the implications for threat actors and kind of how that plays out, I think could be part of it as well. Yeah, in the AWS report, they say that in the things that they observe, the actor compromise customer network edge devices that were hosted on AWS then attempted authentication using credentials that were associated with that victim organization.

So this sounds more like they got a bunch of credentials from a dump or from some other operation where they stole them or something like that. Could be a combination of both and then did some research, found these edge devices on AWS and went from there, which makes all the sense in the world. Yeah, yeah, I think you know that. That definitely makes it a little more stealthy I guess. Yeah, and also, like, credentials are just out there, like, you know, they're, they're everywhere.

I was having a conversation with my dad the other day about, you know, some specific spam messages that he was getting and he was like, I don't know how you know why I'm getting these. And I was like, dad, you know, this like everyone's e-mail addresses and all this information is just dumped, you know, dozens and dozens of times over. There's, you know, there's nothing you can do about that part of it. You know, it's, that's the lowest, you know, hanging fruit on the annoyance tree.

Yeah, I know. I it is funny. You just kind of have to assume it's out there and then implement the right protections in place. I know. To deal with that, everything is intact on after, you know. Literally. Yes, Exactly. Yeah. So the other big story that came out this week that you also wrote about was this zero day that Cisco warned was being exploited in the wild, in the wild in their async OS software, which honestly, even though we both worked at Cisco for a while, I don't know. That software did not ring a bell for me. Like I don't know for you when you saw it, I was like, I'm not positive what that is.

Yeah, I think it's like a rebrand of Cisco E-mail Secure E-mail Gateway I. Think it was. Which is was a little more familiar to me but it is funny because small side tangent but like this happens so much with tech companies. Is that they'll. Name and rebrand. And then when I'm trying to write about a vulnerability in a product, I'm like, this is formally this product that you probably know about, so. Anyway, it's crazy. Yeah. There's so many like AKA or formerly known as, like this, this and this. And now it's four products rolled up into one that, you know, brought all their vulnerabilities together in one convenient package.

Yeah, I know. I'm trying to. There was one other vendor that was like particularly had that issue, but yeah. Yeah. Any of the big companies that you know grow through acquisitions and things like that, you're that's just how it is. Yeah, exactly. But yeah, this one was I mean, it it this one was interesting. Like so they, it sounds like they had discovered the vulnerability specifically in this feature, the spam quarantine feature of async OS and what you know, so that feature is not on by default. So I feel like we should, you know, start by kind of emphasizing that.

But then on the on the other hand, you know this vulnerability is being currently exploited and there's not a patch available, so. It's right that or a workaround right? Or. A workaround? Yeah. So there's really nothing like that you can do at this point except, you know, the recommendations that Cisco gave was essentially to make, you know, first of all, to find, you know, if you're using this async OS in your environment. And then also if it has this spam quarantine feature.

And if it, if you do have that, to make sure that you know first of all, whether you've been impacted. And then second of all, restoring the appliance to a more like secure version of the configuration. So yeah, but it's, yeah, it's pretty serious in that regard for sure. Definitely is. And they, the advisory came out this week and I think they, the Cisco Talos researchers said that they first discovered this or became aware of it on December 10th.

But then when they went back and did some investigation, it looked like the, the campaign dated back to November sometime. So it's been ongoing for a little while. And as you said, Linds, there's no patch, there's no work around. Obviously they're, they're working on these things, but they wanted to get the information out there to make customers aware. And they attributed this with moderate confidence to a Chinese APT group. And Cisco uses its own nomenclature for these groups, of course, as everyone does.

And there's, you know, it doesn't really align with others. They, they track it as it's UAT 9686, which doesn't, you can't really like 1 to 1, you know, identify that as like some kind of panda or you know, her store or whatever other nomenclature you're using. But they do. This group was deploying a bunch of custom tools after exploitation too. So it seems like a serious group. It's not just some, you know, random opportunistic exploitation. Yeah, they found a couple of different of those tools, like I think they said there was a, you know, some telling tools a, a back door.

So there is a, a, you know, significant level of persistence that came along with this type of attack as well, Which is something else that, you know, if you're on a, on a, on a team that's kind of looking at this to, to be aware of is that, you know, the these threat actors are, are trying to stay in after they're already in. So. Of course, yeah. Yeah. So something to keep in mind as well there. And I know that was when looking at those tools, I think that was kind of how the Talos team found kind of these made that moderate assessment in terms of that the threat actor was linked to a China Nexus actor was because they saw a couple overlaps there so. Right.

And all these tools had names that start with Aqua, Aqua Shell, Aqua Tunnel, Aqua Purge. I was waiting for like Aquanet or Aqua Long or something like that. You know, it's like, come on guys, you got some opportunities here. Let's let's make some funds. Let's let's do it. Yeah. Yeah, exactly. I feel like we should, we could do like a start a consulting service that just helps these companies name threat groups and tools and like, you know, make it a little easier for everybody and also a little funnier.

I mean these some some of them are funny but not all. I know I, I actually was thinking I had an idea like at Christmas when I'm with my family to just go like with that little hot mic on video and just like go up to random family members who have no idea about cybersecurity and just be like, what is salt Typhoon? Have them figure out, you know from their thoughts, you know what that could be. I love that it's salt. Typhoon sounds like a precursor to like, you know, heart disease or something like that.

It's just like, well, Uncle Frank ate way too much ham and. Yeah, exactly. Some sort of like, yeah, very like meaty type of snack or something. You should absolutely do that. I could do that at we had we're going to my wife's like extended family thing. The weekend after Christmas. She has this giant, giant extended family. So we would have people from like their early 80s down to like some, you know, great grandkids that are like 8 or 6 or even younger.

Could be highly entertaining. And yeah, could be very, very fun. I might have to do that. I'm going to be real bored at that thing. So yeah, I might, I might have to entertain myself with like I'll have my daughter follow me around with the the camera could be fun. Yeah, you can start some new Gen. alpha slang, like, you know, using APT names. Or something. They need some new stuff cuz like what's out there now is terrible. It's real. I, I hate it. I hate every part of it. Yeah, yeah.

Before we go, we should also mention that there's still like a bunch of the React 2 shell, React 4 shell, whatever you want to term it, exploitation going on. Gray noise has a bunch of good information on this. If if you go and look at their blogs, they're continuously updating their their stuff. Census does as well. Shadow server, a lot of the threat and tell teams that publish, you know, detailed public information and not the stuff, but that's behind a paywall have been doing great work on this on these attacks. There's still Microsoft published something this week, which I thought was interesting for one reason, because they said in their telemetry at least that a lot of what they were saying and they didn't put like percentages or numbers on it, but a lot of the exploitation activity that they saw was from red teams.

So it at least the successful exploit attempt. So I'm sure there was a bunch of like, failed random crap from script kitties or whatever, but a lot of the successful exploits they saw were from red teams, which does make a ton of sense. And also I think brings the temperature of like, holy shit, this is a disaster down a little bit, you know? Yeah. Yeah, I'd love to see that. I feel like that's that's good. Rather see that type of exploitation then. Yeah, the good guys are are doing some work. We like to see it, yeah.

Exactly. Yeah, I'm, I'm curious, you know, how, what kind of how long this, this will kind of go on and where companies are at right now in terms of, you know, mitigating against this because it's been, you know what, 2-3 weeks now since. 2 1/2 probably, yeah. Yeah. So I mean, my guess is it'll go on for a while, but oh definitely. Yeah, yeah, yeah. Because I mean, you mentioned log 4 J earlier. I'm positive if we went and looked at some Gray noise or census data right now, you'd still see log 4 J successful exploitation going on right now.

And that's several years ago. You know, those are the kind of things that just hang around and hang around and hang around, especially the ones that have a bunch of like dependencies and downstream, you know, effects that you're always worried about. So yeah, you're probably right. This When we come back in January, there'll probably be plenty of stuff going on. Yeah, definitely. Or when I come back in January. Yes, yes, I that, that leads me to an announcement which is that I am taking maternity leave in January, so. Yes, yes, congratulations.

Thank you. Yeah, instead of covering AP, TS and react to shell be dealing with, yeah, newborn sleep schedule and all that fun stuff. You will be dying to write about AP TS in about four weeks. You don't just feel like, Oh yeah, you know what? Yeah, I need to go. I need to go back on the Internet. I my brain is fried. That's exactly what happened with my my other two I this is my third kids. So my, my last two maternity leaves were ended it pretty much with me ready to get back in the things and jump back in the news cycle. So.

This is what I remember from the last, the previous two times was towards the end of your leave, you texting me and being like I'm ready. Like we got any, we got any stories, we got any podcasts like I'm ready right now. Even when you had like 3 or 4 weeks left. I know. Yeah, that's that's my fault, I feel like. But yes. Very relatable for anyone who's ever had young kids. It's very relatable. Yeah. Yeah. I mean, 3 is 3 is an adventure we never got there, but you're gonna.

We're we're excited slightly like terrified of being outnumbered. I don't think that has hit me and I don't think it will hit me until we until I see it. I see all three of them in front of me be like, Oh no. What have we done? Yeah, yeah. So yeah, if anyone out there has any advice for taking on three kids, let me know. But. Yeah, I don't envy you that part, but I'm very happy for you guys. It's going to be great, yeah. Thank you. Yeah, it's been quite a whirlwind of a year. I feel like, just in terms of like, like even, you know, past personal stuff like with, you know, Decipher and everything that we've, you know, been doing with, with the website and everything.

So it's been great, great year to close out on. Yeah, this is a, this is a great end to the year. It's a a nice way to wrap it up, Lynn. So great job, good work. All right. Well, thanks everybody for listening. And we, we do have, there's, we're going to put out another hacker movie podcast between now and the end of the year, which we're going to record probably in about 5 minutes on Home Alone. As as I threatened last week, we also put out Die Hard this week, which was me and Pete Baker and Zoe Lindsay, which is very fun. Good times.

So you and I are going to do home loan pretty soon and we'll get that out next week for everybody. I've I've seen that movie about 6 or 8 times in the last like 2 weeks probably like almost all the way through every time. So I'm, I'm pumped. I'm ready. Yeah, it's always on TBS or always Disney Plus or wherever. So, yeah, all right, well, I will talk to you soon and enjoy your leave all. Right. Thanks, Dennis. See ya. Bye.