7 mincritical
Ongoing exploitation of Cisco Catalyst SD-WAN vulnerabilities
Cisco Talos is tracking active exploitation of multiple vulnerabilities in Cisco Catalyst SD-WAN Controller and Manager. Threat actor UAT-8616 is exploiting CVE-2026-20182 for authentication bypass, while other clusters are chaining CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 to deploy JSP webshells and post-exploitation frameworks like Sliver and AdaptixC2.
Sens:■ ImmediateConf:highAnalyzed:2026-05-14Google
Showing defanged values
- cve
- cve
- cve
- cve
- cve
- domaina820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]devAttacker-controlled subdomain hosting the Nim-based backdoor payload
- filename20251117022131.jspGodzilla webshell variant deployed post-exploitation
- filenamesysv.jspXenShell webshell variant deployed post-exploitation
- ip104[.]233[.]156[.]1Attributed IP (Cluster 4)
- ip13[.]62[.]52[.]206C2 server for Nim-based backdoor (agent1)
- ip176[.]65[.]139[.]31IP related to Nim-based backdoor and KScan activity
- ip194[.]163[.]175[.]135AdaptixC2 and Mythic C2 server IP address
- ip194[.]233[.]100[.]40Attributed IP (Cluster 4)
- ip212[.]83[.]162[.]37Exploitation and webshell interaction IP (Cluster 3)
- ip23[.]27[.]143[.]170Sliver C2 server IP address
- ip38[.]181[.]52[.]89Exploitation and webshell interaction IP (Cluster 1)
- ip38[.]60[.]214[.]92Attributed IP (Cluster 4)
- ip47[.]104[.]248[.]7IP related to Miner activity (Cluster 9)
- ip65[.]20[.]67[.]134Attributed IP (Cluster 4)
- ip71[.]80[.]85[.]135Exploitation and webshell interaction IP (Cluster 2)
- ip79[.]135[.]105[.]208Attacker IP that downloaded the Nim-based backdoor
- ip83[.]229[.]126[.]195Remote location hosting XMRig payloads and configuration files
- ip89[.]125[.]244[.]33Exploitation and webshell interaction IP (Cluster 1)
- ip89[.]125[.]244[.]51Exploitation and webshell interaction IP (Cluster 1)
- sha25602654acfb21f83485393ba8b14bd8862b919b9ec966fc6768f6aac1338a45ee8Sliver adversarial emulation framework payload
- sha2560c87871642f84e09e8d3fb23ec36bf55601323e31151a7017a85dbec929cf15dNim-based backdoor payload (agent1)
- sha2560ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed0XMRig downloader script
- sha25617302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe925Check for root escalation script
- sha25618d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a80KScan scanning tool
- sha2565bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f8gsocket secret file
- sha25672f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060Check for root escalation script
- sha2567aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb1XMRig configuration
- sha256
- sha256b0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3vManage credential extractor script
- sha256
- sha256f6f8e0d790645395188fc521039385b7c4f42fa8b426fd035f489f6cda9b5da1AdaptixC2 malware agent payload
- urlhxxp://13[.]62[.]52[.]206:5004C2 URL for Nim-based backdoor
- urlhxxp://194[.]163[.]175[.]135:4445AdaptixC2 C2 server URL
- urlhxxp://83[.]229[.]126[.]195:8081/config[.]jsonXMRig configuration file remote download URL
- urlhxxp://83[.]229[.]126[.]195:8081/xmrigXMRig remote download URL
- urlhxxps://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]dev/downloadDownload URL for the Nim-based backdoor
Detection / HunterGoogle
What Happened
Cybersecurity researchers have identified hackers actively attacking Cisco Catalyst SD-WAN systems, which are used to manage corporate networks. The attackers are exploiting several software vulnerabilities to bypass login screens and gain full control over the affected devices. This matters because once inside, the hackers can steal sensitive credentials, install malicious software, or use the network's resources to mine cryptocurrency. Organizations using these Cisco products should immediately apply the security updates released by Cisco to protect their networks.
Key Takeaways
- Active exploitation of CVE-2026-20182 by threat actor UAT-8616 to gain administrative privileges on Cisco Catalyst SD-WAN systems.
- Widespread exploitation of chained vulnerabilities (CVE-2026-20133, CVE-2026-20128, CVE-2026-20122) by multiple distinct threat clusters.
- Attackers are deploying various JSP webshells, including XenShell, Godzilla, and Behinder variants, to establish persistence.
- Post-exploitation activities include deploying C2 frameworks (Sliver, AdaptixC2, Mythic), cryptominers (XMRig), and credential stealers.
Affected Systems
- Cisco Catalyst SD-WAN Controller (formerly vSmart)
- Cisco Catalyst SD-WAN Manager (formerly vManage)
Vulnerabilities (CVEs)
- CVE-2026-20182
- CVE-2026-20133
- CVE-2026-20128
- CVE-2026-20122
- CVE-2026-20127
Attack Chain
Attackers gain initial access by exploiting vulnerabilities in Cisco Catalyst SD-WAN Manager and Controller, either via CVE-2026-20182 or a chain of CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122. Following successful exploitation, attackers deploy JSP webshells such as XenShell, Godzilla, or Behinder to establish persistence and execute arbitrary commands. Post-exploitation activities vary by cluster but include deploying C2 frameworks like Sliver and AdaptixC2, installing XMRig cryptominers, and executing scripts to steal credentials and escalate privileges to root.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: Yes
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: Snort, ClamAV
Cisco Talos has provided Snort SIDs for network-based detection of the exploits and ClamAV signatures for the associated malicious tooling.
Detection Engineering Assessment
EDR Visibility: Medium — EDR agents deployed on underlying Linux hosts can detect webshell file creation, suspicious child processes spawned from web services, and execution of known post-exploitation tools like XMRig or Sliver. Network Visibility: High — Exploitation occurs over the network targeting specific web application endpoints, and post-exploitation involves downloading payloads and communicating with external C2 servers. Detection Difficulty: Moderate — While the initial exploit targets specific paths, the variety of webshells and post-exploitation tools requires a defense-in-depth approach monitoring for anomalous web server behavior and unexpected outbound connections.
Required Log Sources
- Web Access Logs
- Process Creation Logs
- Network Traffic Logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for web server processes (e.g., Tomcat, Java) spawning unexpected shell processes (bash, sh) which may indicate webshell execution. | Process Creation Logs | Execution | Low |
| Evaluate whether there are unexpected .jsp files created in web-accessible directories, particularly those with randomized or suspicious names like sysv.jsp or conf.jsp. | File Creation Logs | Persistence | Low |
| If you have network visibility, consider hunting for outbound connections from SD-WAN infrastructure to unknown or untrusted IP addresses on non-standard ports. | Network Traffic Logs | Command and Control | Medium |
| Consider hunting for the execution of commands related to privilege escalation checks, such as 'su root -c id', originating from low-privileged user contexts. | Process Creation Logs | Privilege Escalation | Low |
Control Gaps
- Lack of network segmentation for management interfaces
- Missing file integrity monitoring on web directories
Key Behavioral Indicators
- Java/Tomcat processes spawning bash/sh
- Creation of .jsp files in web directories
- Execution of curl/wget to download files into /tmp
- Processes executing with hidden or masqueraded names (e.g., exec -a '[mm_percpu_wq]')
False Positive Assessment
- Low
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting.
- Apply the security updates provided by Cisco for CVE-2026-20182, CVE-2026-20133, CVE-2026-20128, and CVE-2026-20122 immediately.
- Consider isolating affected Cisco Catalyst SD-WAN Controllers and Managers from the internet if patching cannot be performed immediately.
Infrastructure Hardening
- Evaluate whether management interfaces for SD-WAN infrastructure can be restricted to trusted internal IP ranges or accessed only via VPN.
- Consider implementing File Integrity Monitoring (FIM) on critical web application directories to detect unauthorized webshell deployments.
User Protection
- Consider enforcing strict least privilege access controls for administrative accounts on SD-WAN infrastructure.
Security Awareness
- Ensure network administrators are aware of the critical need to promptly patch edge and management infrastructure.
MITRE ATT&CK Mapping
- T1190 - Exploit Public-Facing Application
- T1505.003 - Server Software Component: Web Shell
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- T1068 - Exploitation for Privilege Escalation
- T1003 - OS Credential Dumping
- T1496 - Resource Hijacking
Additional IOCs
- Ips:
38[.]181[.]52[.]89- Exploitation and webshell interaction IP (Cluster 1)89[.]125[.]244[.]33- Exploitation and webshell interaction IP (Cluster 1)89[.]125[.]244[.]51- Exploitation and webshell interaction IP (Cluster 1)71[.]80[.]85[.]135- Exploitation and webshell interaction IP (Cluster 2)212[.]83[.]162[.]37- Exploitation and webshell interaction IP (Cluster 3)38[.]60[.]214[.]92- Attributed IP (Cluster 4)65[.]20[.]67[.]134- Attributed IP (Cluster 4)104[.]233[.]156[.]1- Attributed IP (Cluster 4)194[.]233[.]100[.]40- Attributed IP (Cluster 4)79[.]135[.]105[.]208- Attacker IP that downloaded the Nim-based backdoor176[.]65[.]139[.]31- IP related to Nim-based backdoor and KScan activity47[.]104[.]248[.]7- IP related to Miner activity (Cluster 9)
- Urls:
hxxp://194[.]163[.]175[.]135:4445- AdaptixC2 C2 server URLmtls://23[.]27[.]143[.]170:443- Sliver C2 over mTLShxxp://83[.]229[.]126[.]195:8081/xmrig- XMRig remote download URLhxxp://83[.]229[.]126[.]195:8081/config.json- XMRig configuration file remote download URLhxxps://1a820b09-95ba-44eb-b350-417e8241b725-00-1lgwuuen9b77p[.]worf[.]replit[.]dev/download- Download URL for the Nim-based backdoorhxxp://13[.]62[.]52[.]206:5004- C2 URL for Nim-based backdoor
- File Hashes:
0ed72d52347bfe4a78afff8a6982a64050c8fc86d8957a20eeb3e0f3f5342ed0(sha256) - XMRig downloader script96fc528ca5e7d1c2b3add5e31b8797cb126f704976c8fbeaecdbf0aa4309ad46(sha256) - XMRig sample7aa88a64a527ade7d93c20faf23b54f2ee33ad9b1246cdc2f8ded2ab639affb1(sha256) - XMRig configuration18d77c9c5bbb5b9d5bdfd366fdfcf26bad9e64c63ca865fad711bcce8e3d5a80(sha256) - KScan scanning toold94f75a70b5cabaf786ac57177ed841732e62bdcc9a29e06e5b41d9be567bcfa(sha256) - gsocket tool5bc5998161056b7c8f70c9724d8a63abc7ff8c3843b91c30cffab0899e39b7f8(sha256) - gsocket secret fileb0f51b098842cd630097b462aab0ec357e2c7824af37cca6d08165265da2c2d3(sha256) - vManage credential extractor script72f570ce97de3eaaffef33d90b0c337a153fc9690cc34ee207b557d868360060(sha256) - Check for root escalation script17302d903baf182f94dc3be40ab1e0874dd0eb2ec5255bf9131fd53591efe925(sha256) - Check for root escalation script
- Command Lines:
- Purpose: Downloading XMRig payload and configuration via curl | Tools:
curl,bash| Stage: Execution |curl -sL -o /tmp/xmrig - Purpose: Downloading Nim-based backdoor (agent1) via curl | Tools:
curl,bash| Stage: Execution |curl -s https://... -o /tmp/agent1 - Purpose: Executing privilege escalation check using hardcoded credentials | Tools:
su| Stage: Privilege Escalation |su root -c id - Purpose: Executing XMRig miner in the background | Tools:
bash| Stage: Execution |/tmp/moneroocean/miner.sh --config=/tmp/moneroocean/config_background.json - Purpose: Executing gsocket tool with masqueraded process name | Tools:
bash,pkill| Stage: Defense Evasion |exec -a '[mm_percpu_wq]' '/tmp/.config/htop/defunct'
- Purpose: Downloading XMRig payload and configuration via curl | Tools:
- Other:
conf.jsp- Behinder webshell variant filenamesysinit.jsp- Behinder webshell variant filenamevmurnp_ikp.jsp- Godzilla webshell variant filenamesystemd-resolved- AdaptixC2 payload filenameCWan- Sliver payload filenameagent1- Nim-based backdoor filenamedefunct.dat- gsocket configuration filenameloot_run.sh- Credential stealer script filename
