ZeroDisco Strikes: Unpatched Cisco Devices Fall Victim to Hilarious Rootkit Rave!
Older Cisco devices, unpatched against a zero-day vulnerability, are now starring in Operation ZeroDisco. This campaign transforms your hardware into a dance party for rootkits, thanks to a universal password featuring the word “disco.” Trend Micro reports that this security breach is no joke, but it sure comes with a catchy tune.
Hot Take:
In an epic battle of Cisco vs. Disco, it seems the hackers are bringing the boogie to the network party with a rootkit in their back pocket. Just when you thought the ’70s were safely in the rearview mirror, Trend Micro reports that these cybercriminals are grooving their way through unpatched Cisco devices, dancing past defenses, and causing quite the ruckus. It’s like Saturday Night Fever, but for network admins – minus the iconic dance moves.
Key Points:
- Cisco devices’ zero-day vulnerability, CVE-2025-20352, is being exploited in the wild.
- The campaign, dubbed Operation ZeroDisco, uses a rootkit and a universal password with ‘disco’.
- Older, vulnerable Cisco devices such as the 9400, 9300, and 3750G series are targeted.
- The threat actors leverage SNMP and Telnet exploits for remote code execution and backdoor access.
- There’s no universal tool to detect compromise; Cisco TAC assistance is recommended.