Cybersecurity researchers have uncovered an ongoing campaign in which a China-linked hacking group is exploiting misconfigured Cisco security products to gain unauthorized access to targeted networks.
According to Cisco, the attackers are taking advantage of insecure settings within its AsyncOS software, which powers several of the company’s email and web security appliances. While the vulnerable configuration is not enabled by default, organizations that manually activate certain features may unknowingly expose their systems to intrusion.
The group behind the activity, tracked by Cisco as UAT-9686, has been targeting systems where the Spam Quarantine feature is accessible from the internet. When improperly configured, this setting allows attackers to exploit the system and gain high-level access.
Cisco confirmed that the attackers are able to execute commands with full administrative privileges once inside the affected devices. This level of access gives them the ability to manipulate system files, deploy malware, and maintain long-term persistence within the network.
After gaining access, the attackers install a custom Python-based backdoor known as AquaShell, which enables remote command execution. Cisco also observed the use of additional tools designed to help the attackers remain hidden, including tunneling utilities that maintain persistent connections and a log-wiping tool called AquaPurge, which erases evidence of malicious activity.
According to Cisco, the campaign has been active since at least late November and was officially detected on December 10. The company attributes the operation to UAT-9686 based on tool overlaps and techniques previously associated with other China-linked advanced persistent threat groups.
Security researchers note that the use of custom-built malware like AquaShell reflects a growing trend among state-aligned hacking groups, which increasingly rely on tailored tools rather than publicly available malware to avoid detection.
Cisco is urging organizations using its security products to review their configurations, limit public exposure of administrative features, and apply recommended security updates immediately. The incident serves as another reminder that even security tools themselves can become attack vectors if not properly managed.