Loading malware…
AquaPurge is a log-clearing and anti-forensics utility used in post-compromise operations against Cisco Secure Email Gateway and Cisco Secure Email and Web Manager appliances running AsyncOS. It has been associated with the China-nexus threat actor UAT-9686 in campaigns exploiting CVE-2025-20393. The tool is used after successful intrusion to selectively remove attacker-related entries from system logs while preserving legitimate-looking activity, complicating forensic reconstruction and incident response. Reported behavior includes scrubbing logs by filtering out lines containing attacker-selected keywords, indicating a targeted approach to evidence removal rather than indiscriminate deletion. AquaPurge has been observed alongside other tooling in the same intrusion set, including the AquaShell Python backdoor for persistence and command execution, AquaTunnel and Chisel for tunneling and remote access, forming part of a broader stealth and access-maintenance toolkit used on compromised edge email-security infrastructure. Its primary role is defense evasion through log manipulation on affected appliances.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-20393 (CVSS skóre 10,0) Kritická zero-day zraniteľnosť zariadení Cisco SEG a Cisco SEWM je aktívna, keď má zariadenie povolenú a do internetu vystavenú funkcionalitu Spam Quarantine. Zraniteľnosť sa nachádza v operačnom systéme Cisco AsyncOS a vzdialený neautentifikovaný útočník by ju mohol zneužiť na vzdialené vykonanie systémových príkazov s oprávneniami root. Zraniteľnosť je aktívne zneužívaná minimálne od konca novembra 2025. | ...TPC/UDP Chisel a nástroja pre čistenie logov AquaPurge.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
11 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
25 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Log manipulation/cleaning utility used to erase or tamper with logs to hinder detection and forensics.
Log-purging tool used to delete/clear logs on compromised appliances to hinder detection and incident response.
A log-clearing tool used to delete or tamper with logs to reduce forensic visibility and hinder incident response.
A utility used to delete/clean logs on compromised appliances to reduce forensic visibility and hinder incident response.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.