Chinese state-backed hacking group Velvet Ant targeted Cisco network switches with NX-OS software impacted by the newly discovered zero-day, tracked as CVE-2024-20399, as part of a cyberespionage attack in April, according to The Record, a news site by cybersecurity firm Recorded Future. Exploitation of the vulnerability, which was reported by Sygnia researchers and has since been addressed by Cisco, enabled threat actors with admin-level credentials to compromise susceptible Cisco switches with custom malware that facilitated remote connections with impacted devices, file uploads, and code execution, said Sygnia Incident Response Research Manager Amnon Kushir.

Source: SC Magazine