AMAZON DISCOVERS APT EXPLOITING CISCO AND CITRIX ZERO-DAYS

Summary from the TLDR InfoSec newsletter

Amazon's threat intelligence team discovered an APT exploiting zero-day vulnerabilities CVE-2025-20337 in Cisco Identity Service Engine (pre-authentication RCE via deserialization) and CVE-2025-5777 in Citrix systems. The attacks were detected via MadPot honeypots before public disclosure. The threat actor deployed a custom Java web shell named IdentityAuditAction, which features in-memory operation, Java reflection for thread injection, DES encryption with non-standard Base64 encoding, and HTTP header-based authentication requiring specific knowledge to access. Organizations should immediately patch affected Cisco ISE and Citrix NetScaler systems, implement firewall restrictions on management portal access, deploy defense-in-depth strategies for identity infrastructure, and monitor for anomalous behavior patterns in authentication systems even when properly configured.