Chinese cyber espionage group uses Cisco zero-day flaw to deploy malware
Take action: Intially the patch was an advisory and a long shot of exploit. Now it's serious, because real life exploits are detected. Time to patch.
Learn More
A Chinese cyber espionage group known as Velvet Ant has been observed exploiting a critical zero-day vulnerability in Cisco's NX-OS to deploy custom malware.
The vulnerability, tracked as CVE-2024-20399 (CVSS score 6.7), is a command injection flaw that allows attackers with administrator credentials to escape the NX-OS command line interface (CLI) and execute arbitrary commands on the underlying Linux operating system. The vulnerability is considered severe due to its potential to give attackers full control over Cisco Nexus-series switch appliances.
Velvet Ant leveraged the vulnerability to install a custom malware dubbed "VelvetShell," which is a hybrid version of two open-source tools: TinyShell, a Unix backdoor, and 3proxy, a proxy tool. This malware runs stealthily on the underlying operating system and is invisible to common security detection mechanisms, enabling long-term persistence and allowing Velvet Ant to pivot to other network devices.
Cisco released a patch for CVE-2024-20399 on July 1, 2024. Shortly after, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.
