ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE Vulnerability
Source The Hacker News
Exploited in the wild · KEV due 20 Oct 2023 · public exploit available (Metasploit) : apply the vendor's fix or mitigations to affected systems now.
Data as of 11/08/2025, 02:53:06 UTC
- Exploitation
Actively exploited – in CISA KEV since 10/16/2023
- KEV deadline
- 10/20/2023 US federal agencies must patch by this date; a sensible deadline for everyone else.
- Public exploits
- 3 Metasploit modules, a Nuclei detection templatePublic attack or detection tooling exists; see Public exploits below.
Exploitation evidence
Disclosed: evidence found.
Public CVE; its cve.org publication date is not in this record
Detectable: evidence found.
Weaponised: evidence found.
Exploited in the wild: evidence found.
In CISA KEV since 16 Oct 2023
Observed by OffSeq Mirage: no evidence on record.
1 exposed host seen; no attack traffic recorded
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), CISA KEV, the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
AI-suggested
1. Immediately apply all Cisco patches addressing CVE-2023-20198 to eliminate the vulnerability. 2. Restrict public internet exposure of Cisco IOS XE management interfaces, especially web user interfaces, using firewalls, VPNs, or access control lists. 3. Conduct thorough audits of running configurations to identify and remove unauthorized privileged accounts, particularly those with suspicious names such as "cisco_tac_admin," "cisco_support," or accounts with random strings. 4. Review and remove unknown or unauthorized tunnel interfaces that may indicate backdoors or unauthorized network paths. 5. Enable and monitor TACACS+ AAA command accounting logs to detect unauthorized configuration changes and suspicious activities. 6. Implement network segmentation to isolate critical Cisco devices from general user networks and reduce attack surface. 7. Regularly reboot devices after patching to clear any non-persistent implants like BADCANDY, but understand reboot alone is insufficient without patching. 8. Employ continuous monitoring and threat hunting focused on Cisco IOS XE devices to detect signs of compromise or re-infection attempts. 9. Collaborate with Cisco and cybersecurity communities for updated hardening guidelines and threat intelligence. 10. Educate network administrators on recognizing indicators of compromise related to this threat and enforce strict credential management policies.
Public exploits and detection
Metasploit modules
Nuclei detection templates
Public tooling indexed from Metasploit Framework, Exploit-DB and ProjectDiscovery nuclei-templates. Its existence raises the odds of exploitation; it does not confirm attacks.
Description
The Australian Signals Directorate (ASD) has issued a bulletin about ongoing cyber attacks targeting unpatched Cisco IOS XE devices in the country with a previously undocumented implant known as BADCANDY. The activity, per the intelligence agency, involves the exploitation of CVE-2023-20198 (CVSS score: 10.0), a critical vulnerability that allows a remote, unauthenticated attacker to create an
Impact
For European organizations, especially telecommunications providers, internet service providers, and critical infrastructure operators relying on Cisco IOS XE devices, this threat poses a severe risk. Successful exploitation can lead to full device compromise, enabling attackers to manipulate network traffic, intercept sensitive communications, disrupt services, or establish persistent footholds within networks. The ability to create privileged accounts without authentication undermines device integrity and confidentiality, potentially facilitating further lateral movement and espionage. Given the critical role of Cisco IOS XE in enterprise and carrier-grade network equipment, compromised devices could impact availability and reliability of essential services. The ongoing nature of attacks and the attackers’ capability to detect implant removal increase the risk of repeated intrusions. European organizations with internet-exposed Cisco IOS XE devices that remain unpatched or improperly configured are particularly vulnerable. The geopolitical context, including tensions involving China-linked threat actors, heightens the risk for strategic sectors in Europe. Disruptions could affect not only commercial networks but also government and defense communications, amplifying potential economic and national security consequences.