Daily Cybersecurity News - December 20, 2025

A China-linked APT, UAT-9686, is actively exploiting a zero-day vulnerability (CVE-2025-20393) in Cisco AsyncOS software, targeting Cisco Secure Email Gateway and Web Manager. This allows attackers to execute arbitrary commands with root privileges.

The APT group UAT-9686, believed to be linked to China, is using the vulnerability to drop malware, including Chisel and the Aqua family, on vulnerable appliances. This campaign has been active since at least late November 2025, with evidence of persistence mechanisms being planted.

• Target Profile: Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running AsyncOS software with the Spam Quarantine feature exposed to the internet.
• Infrastructure: Utilizes tunneling tools like Chisel and AquaTunnel, along with the AquaShell backdoor.

PRO TIP: This exploit proves that even enterprise-grade gateways are single points of failure. If your organization's email filter gets hacked, everything inside is exposed. Don't rely solely on the "corporate umbrella" for safety. Segregate your personal digital life from your work identity to protect your inbox from infrastructure-level attacks.

LongNosedGoblin, a China-aligned APT, is targeting governmental entities in Southeast Asia and Japan for cyberespionage. The group leverages Group Policy to deploy malware and move laterally across compromised networks.

LongNosedGoblin utilizes a unique toolset and Group Policy abuse, distinguishing it from other China-aligned actors. The group focuses on long-term access and sustained intelligence collection within sensitive networks.

Malicious actors are using AI-powered voice cloning tools to impersonate U.S. government officials in an effort to extract sensitive information or conduct scams. The campaign, which dates back to 2023, targets individuals, including officials' family members and personal acquaintances.

The use of AI-generated deepfakes is becoming increasingly sophisticated, making detection more challenging. This campaign highlights the potential for significant financial and reputational harm through social engineering.

The U.S. Department of Justice indicted 54 individuals connected to the Tren de Aragua (TdA) for deploying Ploutus malware in a nationwide ATM jackpotting scheme. The scheme targeted ATMs across the U.S. to steal millions of dollars.

The ATM jackpotting scheme highlights the evolving threat landscape and the use of cybercrime to fund terrorist activities.

The DOJ announced that Artem Stryzhak pleaded guilty to conspiracy to commit computer fraud for his role in deploying the Nefilim ransomware against victim computer networks in the United States and other countries. Authorities are offering an $11 million reward for information on his alleged co-conspirator, Volodymyr Tymoshchuk.

This guilty plea highlights the continued efforts to pursue and prosecute cybercriminals involved in ransomware attacks, regardless of their location.