Active Exploitation of Cisco and Citrix 0-Day Vulnerabilities Allows Webshell Deployment

Amazon’s threat intelligence team has uncovered a sophisticated cyber campaign exploiting previously undisclosed zero-day vulnerabilities in critical enterprise infrastructure.Advanced threat actors are actively targeting Cisco Identity Service Engine (ISE) and Citrix systems, deploying custom webshells to gain unauthorized administrative access to compromised networks.CVE IDAffected ProductSeverityStatusCVE-2025-20337Cisco Identity Service Engine (ISE)CriticalZero-day (Active Exploitation)CVE-2025-5777Citrix SystemsCriticalZero-day (Active Exploitation)Initial DiscoveryThe threat was first identified through Amazon’s MadPot honeypot service, which detected exploitation attempts against the Citrix Bleed Two vulnerability (CVE-2025-5777) before public disclosure.This early detection revealed that sophisticated threat actors had already weaponized the vulnerability as a zero-day in the wild.During the investigation, Amazon Threat Intelligence discovered a companion zero-day affecting Cisco ISE.The attackers exploited a deserialization vulnerability on an undocumented endpoint to achieve pre-authentication remote code execution.CVE-2025-20337: This vulnerability grants attackers administrator-level access without credentials.The critical concern is that exploitation was occurring before Cisco released comprehensive patches, a technique commonly employed by sophisticated threat actors who monitor security updates and rapidly develop exploits.Custom Webshell Deployment StrategyFollowing successful exploitation, the threat actor deployed a sophisticated custom webshell masquerading as a legitimate Cisco ISE component called IdentityAuditAction.This custom-built backdoor was engineered explicitly for Cisco ISE environments and demonstrates advanced evasion capabilities.The webshell operated entirely in memory, leaving minimal forensic evidence. It leveraged Java reflection to inject itself into running application threads. It registered as an HTTP request listener on the Tomcat server.The attacker implemented non-standard DES encryption with custom Base64 encoding to bypass traditional detection mechanisms.To access the webshell, attackers needed knowledge of specific HTTP headers and an additional authentication layer demonstrating professional-grade development practices.Amazon’s investigation confirmed that threat actors were exploiting both vulnerabilities as zero-days while indiscriminately targeting internet-exposed systems.This pattern indicates a highly resourced adversary with advanced vulnerability research capabilities or access to non-public vulnerability information.The attacker’s custom tooling reveals deep expertise in enterprise Java applications, Tomcat internals, and Cisco ISE architecture.The ability to exploit multiple undisclosed zero-day vulnerabilities underscores the campaign’s technical sophistication.Security teams should recognize that identity management systems and remote access infrastructure remain prime targets for advanced threat actors.Despite meticulous configuration and maintenance, these critical systems remain vulnerable to pre-authentication exploits.Organizations are strongly advised to implement defense-in-depth strategies with robust anomaly detection capabilities to detect unusual behavior.Amazon recommends implementing firewall-based access restrictions to privileged security appliance endpoints and management portals to limit exposure.Follow us on Google News, LinkedIn, and X to Get Instant Updates and set GBH as a Preferred Source in Google.

Based on reporting by GBHackers.