UAT-9686

Reports per quarter

Techniques seen in the last two years

• T1059.006 1 report
• T1068 1 report
• T1070 1 report
• T1105 1 report
• T1190 1 report
• T1572 1 report
• T1573 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2025-20393 KEV

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 23 December 2025

   Zero-Day Crisis: CVE-2025-20393 Unpatched on Cisco Email Gateways, Exploited by China-Linked Hackers

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Zero-Day Crisis: CVE-2025-20393 Unpatched on Cisco Email Gateways, Exploited by China-Linked Hackers

2. 17 December 2025

   UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor UAT-9686 actively targets Cisco Secure Email Gateway and Secure Email and Web Manager

Newest first. Details opens the report in Explore.