UAT-9686 is a sophisticated Chinese-nexus APT group conducting an ongoing campaign targeting Cisco Secure Email Gateway and Secure Email and Web Manager devices running AsyncOS software. The attackers leverage non-standard or misconfigured deployments to execute arbitrary system-level commands, bypassing normal security controls. Central to their operation is the deployment of AquaShell, a Python-based backdoor that maintains persistence on compromised devices. AquaShell allows execution of encoded shell commands and facilitates communication with attacker-controlled infrastructure. Complementary tools include AquaTunnel, which establishes reverse SSH tunnels to enable remote access; chisel, a tool for TCP/UDP tunneling to bypass network restrictions; and AquaPurge, which clears logs to cover attacker activity and maintain stealth. The campaign uses techniques mapped to MITRE ATT&CK tactics such as T1190 (exploitation of remote services), T1133 (external remote services), T1562.002 (impair defenses: disabling or evading logs), T1572 (protocol tunneling), T1505.003 (server software component: web shell), T1090.002 (proxy: SSH proxy), T1059.006 (command and scripting interpreter: Python), and T1071.001 (application layer protocol: Web protocols). No specific vulnerable versions or CVEs have been disclosed, and no known exploits in the wild have been confirmed yet. The campaign's reliance on misconfigurations rather than zero-day vulnerabilities suggests that proper configuration and monitoring are critical defenses. The threat actor’s use of advanced tunneling and log clearing tools indicates a high level of operational security and intent to maintain long-term access to targeted email security infrastructure.

European organizations using Cisco Secure Email Gateway and Secure Email and Web Manager are at risk of persistent compromise, leading to potential interception, manipulation, or disruption of email communications. Successful exploitation could result in unauthorized access to sensitive email data, enabling espionage, intellectual property theft, or further network infiltration. The use of reverse tunnels and log purging complicates detection and incident response, increasing dwell time and potential damage. Disruption of email security infrastructure could degrade organizational communication reliability and trust. Given the critical role of email gateways in enterprise security, this threat could impact confidentiality, integrity, and availability of email services. The campaign’s medium severity rating reflects the current lack of known exploits and reliance on misconfigurations, but the potential for escalation and lateral movement within networks remains significant. European sectors with high reliance on Cisco email security products, such as government, finance, and critical infrastructure, face elevated risks of targeted espionage or sabotage.

1. Conduct immediate audits of Cisco Secure Email Gateway and Secure Email and Web Manager configurations to identify and remediate non-standard or insecure settings that could be exploited. 2. Implement strict access controls and network segmentation to limit exposure of management interfaces and reduce attack surface. 3. Deploy enhanced monitoring and logging with integrity checks to detect anomalous command executions, reverse tunnels, and log tampering attempts. 4. Use network intrusion detection systems (NIDS) and endpoint detection and response (EDR) solutions tuned to identify AquaShell, AquaTunnel, chisel, and AquaPurge indicators. 5. Regularly update and patch Cisco AsyncOS software as updates become available, even though no patches are currently released for this campaign. 6. Employ multi-factor authentication (MFA) and strong credential management to prevent unauthorized access. 7. Conduct threat hunting exercises focusing on the identified hashes and IP indicators to detect early signs of compromise. 8. Establish incident response plans specifically addressing email gateway compromises, including forensic analysis of logs and network traffic. 9. Collaborate with Cisco and cybersecurity communities for timely intelligence sharing and mitigation guidance. 10. Restrict outbound network connections from email gateway devices to only trusted destinations to hinder reverse tunneling.