Skip to main content

ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE Vulnerability

By

 The Australian Signals Directorate (ASD) has issued a bulletin warning of active cyber attacks against unpatched Cisco IOS XE devices in Australia that deploy a previously undocumented implant named BADCANDY (The Hacker News). The agency links the campaign to exploitation of CVE-2023-20198, a critical flaw rated CVSS 10.0 that permits a remote, unauthenticated attacker to create an account with elevated privileges and take control of affected systems (The Hacker News.)

Scope and timeline of activity

ASD reports that variations of BADCANDY first appeared in October 2023 and that attacks have continued through 2024 and into 2025 (The Hacker News). The agency estimates roughly 400 devices in Australia were compromised since July 2025, with about 150 infections recorded in October 2025 alone (The Hacker News).




Technical characteristics of BADCANDY

  • Type: Lua-based web shell.
  • Persistence: Non-persistent; the implant does not survive a reboot, but attackers commonly reintroduce it if the device remains unpatched and internet-exposed.
  • Post-compromise behavior: Operators have observed actors applying non-persistent configuration changes to obscure the device’s vulnerable status and to detect when the implant has been removed, leading to repeated re-exploitation (The Hacker News).

All of the above indicates that while a reboot may remove the running implant, it does not undo other malicious changes the attackers may have made (The Hacker News).

Threat actor context

ASD notes that China-linked groups, including Salt Typhoon, have exploited CVE-2023-20198 in recent months to target telecommunications providers, consistent with wider in-the-wild exploitation observed since late 2023 (The Hacker News).

Recommended mitigations and detection steps

ASD emphasizes immediate remediation actions: apply Cisco’s patches for CVE-2023-20198, restrict public exposure of the device web UI, and follow Cisco hardening guidance (The Hacker News). Additional checks recommended by the agency include:

  • Review running configuration for accounts with privilege 15 and remove unexpected or unapproved accounts (The Hacker News).
  • Look for accounts with random strings or names such as cisco_tac_admin, cisco_support, cisco_sys_manager, or cisco and delete them if they are not legitimate (The Hacker News).
  • Inspect running configuration for unknown tunnel interfaces (The Hacker News).
  • Review TACACS+ AAA command accounting logs (if enabled) for configuration changes (The Hacker News).

Practical note for responders

Because actors can detect removal of the implant and re-infect vulnerable devices, operators must both patch and harden devices, and validate and remediate any unauthorized configuration changes or accounts introduced by the attackers (The Hacker News).

Sources: The Hacker News

Labels:

Comments

Post a Comment

Popular posts from this blog

DVWA CHEAT SHEET

By
“If you’re waiting for permission to break the system, you’re already too late.” What You’re Actually Dealing With DVWA isn’t random vulnerable code. It’s a deliberately broken system designed to teach how real applications fail — SQL injection, XSS, command execution, file inclusion, all of it ( edgenexus.io ) Multiple difficulty levels exist for one reason: To show you how weak defenses evolve into real ones. 0. Core Principle You don’t memorize payloads. You understand flow. Input → Application Logic → Output If you control input, you control logic. If you control logic, the rest is just execution. 1. SQL Injection “You don’t bypass authentication. You redefine it.” Break the query ' Error means the application is exposing its internal structure. Take control ' OR '1'='1 # You’re not logging in. You’re forcing the query to return true. Map columns ' ORDER BY 1-- ' ORDER BY 2-- You’re learning how the database thinks. Extract data ' UNION SELECT datab...
Post a Comment
Read more

Greed - Kinnaird CTF

By
Greed Challenge — RSA Low-Exponent Write-Up Overview This challenge revolves around a classic RSA weakness: using a small public exponent (e = 3) without proper padding . Under the right conditions, this allows direct recovery of the plaintext by taking an integer cube root of the ciphertext. The task is to identify the real encrypted flag among several decoys and exploit this mathematical flaw. Key Observations RSA Parameters Public exponent: e = 3 (Narratively hinted as the warden’s “three kingdoms”) Modulus size: ~254 bits Candidate ciphertext: 0x1aadb93ce9a5704a83345e00 Critical Hint “Sometimes the treasure is so light that it never touches the vault walls.” This implies the plaintext m is small enough that: m³ < N When this happens, RSA encryption becomes: c = m³ instead of: c = m³ mod N No modular reduction occurs — which is exactly what enables the attack. Cryptographic Background RSA encryption is defined as: c = m^e mod N If m^e < N , then: c = m^e For e = 3 , recove...
Post a Comment
Read more

Pride - Kinnaird CTF

By
Writeup: Pride Challenge (Reverse Engineering) Challenge Overview Pride is a multi-layered Windows reverse engineering challenge. It requires the researcher to navigate through a protective "shell" ( UPX ), bypass environmental checks ( Anti-Debugging/Anti-VM ), and eventually reverse-engineer a custom Virtual Machine (VM) architecture to extract the hidden flag fragment. 1. Initial Analysis & Unpacking The binary initially presents a decoy flag. Analysis with PEiD or Detect It Easy (DIE) reveals the executable is compressed with UPX . Manual Unpacking While a standard upx -d pride.exe is the first step, this challenge utilizes a modified UPX header . To unpack manually: Load the binary in x64dbg . Look for the POPAD instruction followed by a large JMP —this is the jump to the Original Entry Point (OEP) . Use Scylla to dump the process and fix the IAT ( Import Address Table ). 2. Anti-Analysis Bypassing Once unpacked, the binary performs several checks to ensure it...
Post a Comment
Read more