Security Intelligence for Real-World Decisions
← Back to Archive

China-Linked APT Exploits Critical Cisco Zero-Day; React2Shell Ransomware Attacks Surge as CISA Adds ASUS Flaw to KEV

Critical Infrastructure Intelligence Briefing

Date: Thursday, December 18, 2025

Reporting Period: December 11–18, 2025

1. Executive Summary

Major Developments

  • Critical Cisco Zero-Day Under Active Exploitation: A China-nexus APT group (UAT-9686) is actively exploiting a maximum-severity zero-day vulnerability (CVE-2025-20393) in Cisco AsyncOS affecting Secure Email Gateway and Secure Email and Web Manager appliances. No patch is currently available. (SecurityWeek)
  • React2Shell Vulnerability Reaches Record Exploitation: CVE-2025-55182 has achieved the highest verified public exploit count of any CVE ever recorded, with ransomware groups achieving initial access to deployment in under one minute. (CyberScoop)
  • CISA Adds ASUS Live Update Flaw to KEV: CISA has added a critical ASUS Live Update vulnerability to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. (The Hacker News)
  • SonicWall Patches Actively Exploited Zero-Day: SonicWall has released patches for CVE-2025-40602 affecting SMA 100 series appliances, which was being chained with a critical bug for remote code execution. (SecurityWeek)
  • Chinese APT "Ink Dragon" Expands European Government Targeting: The threat actor has pivoted to targeting European government networks using ShadowPad and FINALDRAFT malware, compromising IIS servers to build stealthy global infrastructure. (CSO Online)

Cross-Sector Concerns

  • Multiple nation-state actors demonstrating increased focus on network edge devices and email security infrastructure
  • Ransomware operators achieving unprecedented speed from initial access to encryption
  • Supply chain vulnerabilities in widely-deployed enterprise software continue to present systemic risk
  • Transportation sector faces surge in cyber-enabled cargo theft with increasing sophistication

2. Threat Landscape

Nation-State Threat Actor Activities

China-Nexus Operations

  • UAT-9686 (Cisco Zero-Day Campaign): This advanced persistent threat group is actively exploiting CVE-2025-20393, a maximum-severity vulnerability in Cisco AsyncOS software. The unpatched flaw affects Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances—critical components in enterprise email security infrastructure. Organizations should implement network segmentation and enhanced monitoring for these devices pending patch availability. (The Hacker News)
  • Ink Dragon (Jewelbug): This group has significantly expanded operations targeting European government entities since July 2025 while maintaining campaigns against Southeast Asian and South American targets. The group is deploying ShadowPad and FINALDRAFT malware, specifically targeting IIS servers to establish persistent, stealthy network presence. European government networks are being used to mask espionage activities. (The Hacker News)

Russia-Nexus Operations

  • APT28 (BlueDelta): Insikt Group has documented a sustained credential-harvesting campaign targeting UKR.NET webmail users in Ukraine. The campaign employs multi-stage phishing techniques with evolving tradecraft, indicating long-term intelligence collection objectives against Ukrainian communications. (Recorded Future)
  • Russian APT Network Edge Targeting: A Russian APT group has pivoted tactics to exploit network edge device misconfigurations, targeting Western critical infrastructure operators. This represents a shift from traditional vulnerability exploitation to configuration-based attack vectors. (CSO Online)

North Korea-Nexus Operations

  • Kimsuky (DocSwap Campaign): The threat actor is distributing a new Android malware variant called DocSwap through QR code phishing campaigns. Phishing sites mimic legitimate delivery applications targeting users in Seoul. This represents continued mobile-focused espionage operations. (The Hacker News)

Other Nation-State Activity

  • Operation ForumTroll: Kaspersky has attributed new phishing attacks to the ForumTroll threat actor, targeting Russian scholars using fake eLibrary emails. This campaign demonstrates continued cyber espionage targeting academic and research communities. (The Hacker News)
  • Nation-State AI Platform Targeting: Recorded Future analysis revealed a $0 card test transaction that signaled a Chinese state-linked cyberattack targeting Anthropic's AI platform, demonstrating how card-testing fraud intelligence can identify nation-state operations early. (Recorded Future)

Ransomware and Cybercriminal Developments

  • React2Shell Ransomware Exploitation: Ransomware operators are actively exploiting CVE-2025-55182 with unprecedented efficiency, achieving deployment in under one minute from initial access. The vulnerability has attracted the highest number of publicly available exploits ever recorded for a single CVE, significantly lowering the barrier to entry for threat actors. (Bleeping Computer)
  • Cryptocurrency Laundering Platform Takedown: The DOJ announced the takedown of an alleged laundering platform used by cybercriminal groups, with a Russian national indicted for operating the service. This disrupts a key financial infrastructure component for ransomware operations. (CyberScoop)
  • AWS Cryptomining Campaign: Amazon's AWS GuardDuty team warns of an ongoing cryptomining campaign targeting Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) using compromised credentials. Organizations should audit IAM permissions and implement credential rotation. (Bleeping Computer)

Emerging Attack Vectors

  • Kimwolf Botnet: A massive new DDoS botnet has compromised 1.8 million Android-based devices including smart TVs, set-top boxes, and tablets. The botnet is launching large-scale DDoS attacks, representing significant amplification capability. (The Hacker News)
  • GhostPoster Browser Extension Malware: 17 Firefox add-ons with over 50,000 downloads were found embedding malicious JavaScript in logo files. The malware hijacks affiliate links, injects tracking code, removes security headers, and bypasses CAPTCHA protections. (The Hacker News)
  • Cellik RAT: A new Android remote access trojan available for $150 provides full device control and real-time surveillance capabilities comparable to advanced commercial spyware. The malware can trojanize legitimate Google Play applications. (SecurityWeek)
  • WhatsApp GhostPairing Attacks: Threat actors are abusing WhatsApp's legitimate device-linking feature to hijack accounts via pairing codes, enabling account takeover without traditional credential theft. (Bleeping Computer)
  • "Lies-in-the-Loop" AI Attack: A novel attack technique manipulates human approval prompts in agentic AI systems, undermining safety dialogs designed to prevent malicious AI actions. This has implications for organizations deploying AI-assisted security tools. (Infosecurity Magazine)

3. Sector-Specific Analysis

Energy Sector

Assessment: ELEVATED CONCERN

  • Russian APT groups continue targeting Western critical infrastructure operators through network edge device misconfigurations
  • The Cisco AsyncOS zero-day affects email security infrastructure commonly deployed in energy sector environments
  • Organizations should prioritize network segmentation and enhanced monitoring for edge devices

Recommended Actions:

  • Audit network edge device configurations against vendor security baselines
  • Implement additional monitoring for Cisco SEG/SEWM appliances pending patch release
  • Review and restrict administrative access to critical network infrastructure

Water & Wastewater Systems

Assessment: MODERATE CONCERN

  • WaterISAC has released its Quarterly Water Sector Incident Summary for July–September 2025, providing sector-specific threat intelligence
  • The React2Shell vulnerability's widespread exploitation poses risk to water utilities using affected software
  • Small and medium utilities remain particularly vulnerable to rapid ransomware deployment

Recommended Actions:

  • Review WaterISAC's quarterly summary for sector-specific threat indicators
  • Prioritize patching for React2Shell vulnerability (CVE-2025-55182)
  • Ensure offline backups of operational technology configurations

Resource: WaterISAC Quarterly Summary (TLP:CLEAR)

Communications & Information Technology

Assessment: HIGH CONCERN

  • Cisco AsyncOS Zero-Day (CVE-2025-20393): Maximum-severity, actively exploited, no patch available. Affects critical email security infrastructure.
  • SonicWall SMA 100 (CVE-2025-40602): Actively exploited in chained attacks for RCE. Patch now available—immediate application recommended.
  • FortiGate Credential Theft: Attackers are stealing firewall credentials following recent vulnerability disclosures. Organizations should rotate credentials and audit access logs.
  • JumpCloud Agent Vulnerability: A flaw turns the uninstall process into a system shortcut, potentially enabling privilege escalation.

Recommended Actions:

  • Apply SonicWall patches immediately for SMA 100 series appliances
  • Implement compensating controls for Cisco AsyncOS pending patch release
  • Rotate FortiGate administrative credentials and enable MFA
  • Review JumpCloud agent deployments and apply vendor guidance

Transportation Systems

Assessment: ELEVATED CONCERN

  • Cyber-Enabled Cargo Theft Surge: The National Motor Freight Traffic Association (NMFTA) has released its 2026 Transportation Industry Cybersecurity Trends Report, warning of significant increases in both volume and sophistication of cyber-enabled cargo theft targeting the trucking industry. (SecurityWeek)
  • Advanced Air Mobility Strategy: The Department of Transportation has released the first National Strategy for Advanced Air Mobility, establishing security frameworks for emerging aviation technologies including drones and air taxis. (Homeland Security Today)
  • Airport Security Enhancement: Security Magazine highlights the need for future-proofing airport employee screening following analysis of potential threat vectors. (Security Magazine)

Recommended Actions:

  • Review NMFTA's 2026 Cybersecurity Trends Report for sector-specific guidance
  • Implement enhanced authentication for logistics and freight management systems
  • Assess exposure to supply chain fraud and cargo diversion schemes

Healthcare & Public Health

Assessment: MODERATE CONCERN

  • Smart Speaker Security Guidelines: NIST has released new guidelines for securing smart speakers used in home health care settings, addressing cybersecurity and privacy risks that could threaten patient confidentiality. (NIST)
  • Healthcare organizations remain high-value targets for ransomware operators exploiting React2Shell
  • Mobile device security concerns elevated with Cellik RAT and DocSwap malware campaigns

Recommended Actions:

  • Review NIST smart speaker guidelines for telehealth and home care deployments
  • Implement mobile device management controls to detect malicious applications
  • Ensure rapid patching capability for React2Shell vulnerability

Financial Services

Assessment: MODERATE CONCERN

  • Cryptocurrency Platform Enforcement: FTC settlement with Illusory Systems over 2022 cryptocurrency hack addresses material misrepresentation of cybersecurity capabilities. (CyberScoop)
  • Call Center Fraud Ring Disrupted: Eurojust reveals operation dismantling a $12 million Ukraine-based call center fraud gang targeting European victims. (Infosecurity Magazine)
  • UK Tax Scam Surge: HMRC reports over 135,000 scam reports in the past 10 months, including 4,800 related to self-assessment filings. (Infosecurity Magazine)

Recommended Actions:

  • Enhance fraud detection for card-testing patterns that may indicate nation-state reconnaissance
  • Review cryptocurrency platform security controls against FTC enforcement precedents
  • Implement customer awareness campaigns for tax-related fraud schemes

Government Facilities

Assessment: HIGH CONCERN

  • Ink Dragon European Campaign: Chinese APT group actively targeting European government networks, using compromised infrastructure to mask espionage operations
  • France Interior Ministry Attack: French authorities arrested a 22-year-old suspect for a cyberattack targeting France's Ministry of the Interior earlier this month. (Bleeping Computer)
  • CBP Officer Bribery: A U.S. Customs and Border Protection officer has been charged with bribery offenses, highlighting insider threat concerns. (Homeland Security Today)

Recommended Actions:

  • Implement enhanced monitoring for IIS servers and web infrastructure
  • Review network traffic for ShadowPad and FINALDRAFT malware indicators
  • Strengthen insider threat detection and access control programs

Commercial Facilities

Assessment: MODERATE CONCERN

  • Auto Parts Giant Breach: LKQ Corporation confirmed that personal information of over 9,000 individuals was compromised in an Oracle EBS breach. (SecurityWeek)
  • WordPress Theme Vulnerability: A critical flaw in the Motors WordPress theme affects more than 20,000 installations, allowing low-privileged users to gain full website control. (Infosecurity Magazine)

4. Vulnerability & Mitigation Updates

Critical Vulnerabilities Requiring Immediate Attention

CVE Product Severity Status Exploitation
CVE-2025-20393 Cisco AsyncOS (SEG/SEWM) CRITICAL (Max) UNPATCHED Active - China APT
CVE-2025-55182 React2Shell CRITICAL Patch Available Active - Ransomware
CVE-2025-40602 SonicWall SMA 100 MEDIUM (Chained) Patch Available Active - Zero-Day
ASUS Live Update ASUS Live Update CRITICAL Added to KEV Active

CISA Advisories

  • KEV Addition: CISA added the critical ASUS Live Update vulnerability to the Known Exploited Vulnerabilities catalog on December 17, 2025, citing evidence of active exploitation. Federal agencies must remediate per BOD 22-01 timelines. (The Hacker News)

Vendor Patches Released

  • SonicWall: Patches released for SMA 100 series appliances addressing CVE-2025-40602. The vulnerability was being chained with a critical bug for remote code execution. Immediate patching recommended. (The Hacker News)

Vendor Advisories

  • Cisco: Advisory issued for CVE-2025-20393 with no patch currently available. Cisco recommends implementing compensating controls and monitoring for indicators of compromise. (Bleeping Computer)
  • Microsoft: Warning issued that MSMQ may fail after recent updates, potentially breaking enterprise applications and IIS sites. Microsoft is asking affected administrators to reach out for mitigation guidance. (Bleeping Computer)

Recommended Defensive Measures

  • For Cisco AsyncOS (Unpatched Zero-Day):
    • Implement network segmentation to isolate SEG/SEWM appliances
    • Enable enhanced logging and forward to SIEM
    • Monitor for unusual outbound connections from email security infrastructure
    • Consider temporary deployment of additional email security layers
  • For React2Shell:
    • Apply patches immediately—ransomware deployment observed in under 60 seconds
    • Ensure offline backups are current and tested
    • Implement application allowlisting where possible
  • For FortiGate Credential Theft:
    • Rotate all administrative credentials immediately
    • Enable multi-factor authentication for all management access
    • Audit configuration changes and access logs

5. Resilience & Continuity Planning

Lessons Learned

  • React2Shell Incident Response: The sub-60-second ransomware deployment timeline observed in React2Shell exploitation underscores the critical importance of:
    • Automated patch deployment for critical vulnerabilities
    • Pre-positioned incident response capabilities
    • Network segmentation to limit lateral movement
    • Immutable backup architectures that cannot be encrypted by ransomware
  • Zero-Day Response Planning: The Cisco AsyncOS situation demonstrates the need for compensating control playbooks when patches are unavailable

Physical Security Considerations

  • Raspberry Pi Physical Security Wake-Up Call: CSO Online analysis highlights how enterprises must rethink physical security given the availability of low-cost devices capable of network intrusion. Organizations should audit physical access controls to network infrastructure. (CSO Online)
  • Real-Time Crime Center Model: New Orleans' Real Time Crime Center provides a model for fusing video, CAD, license plate recognition, and governance frameworks for critical infrastructure protection. (Security Magazine)

Supply Chain Security

  • The LKQ Oracle EBS breach highlights third-party software risks in supply chain operations
  • Browser extension supply chain attacks (GhostPoster) demonstrate the need for enterprise browser security policies
  • NMFTA's cyber-enabled cargo theft warnings emphasize digital-physical supply chain convergence risks

Cross-Sector Dependencies

  • Email Security Infrastructure: The Cisco AsyncOS zero-day affects email security appliances deployed across all critical infrastructure sectors. Compromise of these systems could enable:
    • Business email compromise attacks
    • Malware delivery bypassing security controls
    • Credential harvesting through intercepted communications
  • Cloud Infrastructure: AWS cryptomining campaign demonstrates how compromised credentials can cascade across cloud-dependent operations

Deliberate Internet Shutdowns

Bruce Schneier's analysis of Afghanistan's two-day internet shutdown in September highlights the growing use of deliberate connectivity disruptions as a tool of state control. Critical infrastructure operators should consider resilience planning for scenarios involving intentional connectivity loss. (Schneier on Security)

6. Regulatory & Policy Developments

Federal Developments

  • FY26 Defense Policy Bill: The Senate has passed the FY26 Defense Policy Bill, which includes provisions affecting cybersecurity requirements for defense contractors and critical infrastructure protection. (Homeland Security Today)
  • CMMC Credentialing Authority: ISACA has been appointed by the U.S. Department of Defense as the global credentialing authority for the Cybersecurity Maturity Model Certification (CMMC) program. This establishes the framework for defense contractor cybersecurity assessments. (Infosecurity Magazine)
  • Advanced Air Mobility Strategy: DOT's first National Strategy for Advanced Air Mobility establishes security and safety frameworks for emerging aviation technologies. (Homeland Security Today)

Regulatory Enforcement

  • FTC Cryptocurrency Security Enforcement: The FTC settlement with Illusory Systems establishes precedent for enforcement against companies that materially misrepresent cybersecurity capabilities. Executives were found to have failed to implement reasonable security measures. (CyberScoop)

Proposed Regulations

  • SEC AI Disclosure Rule: CSO Online analysis examines the proposed SEC AI disclosure rule, noting that implementation details will significantly impact compliance requirements for publicly traded companies. Organizations should monitor rulemaking progress. (CSO Online)

D&O Liability Trends