Loading threat actor…
UAT-9686 is a China-nexus advanced persistent threat actor assessed by Cisco Talos with moderate confidence to have exploited CVE-2025-20393, a maximum-severity vulnerability in Cisco AsyncOS appliances, from at least late November 2025. The activity targeted internet-exposed Cisco Secure Email Gateway and Secure Email and Web Manager appliances with exposed Spam Quarantine functionality, obtaining root-level command execution. UAT-9686 deployed the AquaShell lightweight Python backdoor for persistence and remote command execution, used AquaTunnel/ReverseSSH and Chisel for reverse tunneling and pivoting, and employed AquaPurge to remove evidence from logs. Its tooling and operational tradecraft overlap with tools previously associated with China-linked clusters including APT41 and UNC5174, but UAT-9686 is tracked as a distinct actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
11 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducted an espionage-oriented compromise campaign against Cisco AsyncOS email-security appliances beginning no later than late November 2025, exploiting CVE-2025-20393 to obtain root-level access and deploying persistence, reverse-tunneling, and log-erasure tooling.
China-nexus APT exploiting a Cisco AsyncOS zero-day to target Cisco Secure Email Gateway / Secure Email and Web Manager appliances.
China-linked APT actor exploiting a Cisco AsyncOS zero-day against secure email gateway products.
Activity cluster associated (by Talos) with deployment of the AquaShell Python backdoor against Cisco Secure Management Appliance (SMA) environments; observed behavior included backdoor deployment with no follow-on activity in the described incident.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.