Fast Facts
-
Cyber attacks targeting unpatched Cisco IOS XE devices in Australia are exploiting the critical vulnerability CVE-2023-20198, allowing attackers to gain elevated privileges remotely.
-
The malware, known as BADCANDY, has been linked to China-based threat actors and has compromised approximately 400 devices since July 2025, with 150 infections occurring in October alone.
-
BADCANDY’s low persistence means it can be removed but can easily be reintroduced if the devices remain unpatched and exposed to the internet, with attackers capable of detecting its removal.
- The Australian Signals Directorate recommends urgent patching, limiting internet exposure, and reviewing configurations and accounts to mitigate further risks and secure systems against exploitation.
ASD Alerts on BADCANDY Attacks
The Australian Signals Directorate (ASD) recently issued a warning about ongoing cyber attacks targeting unpatched Cisco IOS XE devices. These attacks exploit a critical vulnerability known as CVE-2023-20198. This flaw allows remote, unauthenticated attackers to create accounts with elevated privileges. Consequently, they can seize control of affected systems.
Furthermore, this vulnerability has faced active exploitation since 2023. Notably, China-linked threat actors, specifically Salt Typhoon, have weaponized it to breach telecommunications providers. Since October 2023, variations of malware known as BADCANDY have emerged. In 2025 alone, attackers compromised around 400 devices in Australia, with 150 infections occurring in October.
Mitigation Strategies for System Operators
ASD describes BADCANDY as a low-equity Lua-based web shell. Cyber actors often implement temporary patches to hide vulnerabilities post-compromise. However, these non-persistent fixes cannot survive system reboots. If devices remain unpatched and exposed online, threat actors can easily reintroduce the malware.
ASD stresses the urgency for system operators to apply necessary patches and limit public exposure of the web user interface. Additionally, they recommend several actions. Operators should review running configurations for any unauthorized accounts. They should also inspect for accounts with random strings or suspicious names. Moreover, unexpected tunnel interfaces and logging for configuration changes demand scrutiny.
Ultimately, thorough protective measures can significantly reduce vulnerabilities. Cybersecurity remains a shared responsibility requiring constant vigilance to safeguard critical infrastructure against evolving threats.
Continue Your Tech Journey
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Discover archived knowledge and digital history on the Internet Archive.
DataProtection-V1
