Cisco Discloses China-Linked Email Appliance Hack

Cisco security researchers have disclosed that China-linked hackers have been exploiting a previously unknown vulnerability in the company's email security appliances since at least late November 2025, allowing unauthorized access to systems that process corporate email traffic.

The attacks target Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running AsyncOS software, specifically those with the Spam Quarantine feature enabled and ports exposed to the internet. Cisco became aware of the activity on December 10, 2025, during a technical support case, and subsequent investigations confirmed exploitation of a zero-day flaw tracked as CVE-2025-20393. This vulnerability, stemming from improper input validation, enables attackers to execute arbitrary commands with root privileges without authentication, granting them control over the underlying operating systems.

According to Cisco's advisory, the threat actors, tracked as UAT-9686, deployed a persistent Python-based backdoor known as Aquashell, which embeds itself in a web server file to receive and execute encoded commands via HTTP requests. Additional tools included AquaTunnel, a reverse SSH tunneling...