Ongoing Cyber Attacks Targeting Cisco IOS XE Devices in Australia

The Australian Signals Directorate (ASD) has issued a warning regarding ongoing cyber attacks exploiting a critical vulnerability in unpatched Cisco IOS XE devices. The attacks utilize a previously undocumented implant known as BADCANDY, which leverages the CVE-2023-20198 vulnerability, rated at a maximum CVSS score of 10.0. This flaw allows remote, unauthenticated attackers to create accounts with elevated privileges, enabling them to take control of affected systems. Since July 2025, over 400 devices in Australia have been compromised, with 150 infections reported in October 2025 alone.

ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE VulnerabilityBadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian governmentAttackers Exploit Cisco IOS XE Vulnerability to Deploy BADCANDY Web ShellCISA issues security warnings for Exchange Server, VMwareCISA and NSA Issue Urgent Guidance to Secure WSUS and Microsoft Exchange ServersCISA, NSA, partners publish Microsoft Exchange server hardening guide to prevent compromise and data theftForbesCyber agencies produce ‘long overdue’ best practices for securing Microsoft Exchange Server

BADCANDY is characterized as a low-equity, Lua-based web shell that is non-persistent after a device reboot. However, attackers can regain access by reintroducing the malware if the device remains unpatched and exposed to the internet. ASD has observed that threat actors can detect when the BADCANDY implant is removed, leading to repeated infections of previously compromised devices. This ongoing cycle of re-exploitation underscores the critical need for system operators to apply security patches and limit public exposure of the web user interface.

Attackers Exploit Cisco IOS XE Vulnerability to Deploy BADCANDY Web ShellASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE VulnerabilityBadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian governmentCISA and NSA Issue Urgent Guidance to Secure WSUS and Microsoft Exchange ServersCISA issues security warnings for Exchange Server, VMwareCISA, NSA, partners publish Microsoft Exchange server hardening guide to prevent compromise and data theftForbes

To combat the BADCANDY threat, ASD recommends that organizations take several proactive measures. These include:

BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government

• Applying the necessary patches to address CVE-2023-20198.

ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE Vulnerability

• Limiting access to the web user interface of Cisco IOS XE devices.

Attackers Exploit Cisco IOS XE Vulnerability to Deploy BADCANDY Web Shell

• Reviewing device configurations for unauthorized accounts, particularly those with privilege 15 access.

CISA, NSA, partners publish Microsoft Exchange server hardening guide to prevent compromise and data theft

• Monitoring for unknown tunnel interfaces and suspicious configuration changes.

Attackers Exploit Cisco IOS XE Vulnerability to Deploy BADCANDY Web Shell

Cisco has published security advisories detailing fixed software releases for affected IOS XE versions, emphasizing the importance of adhering to these guidelines to prevent future exploitation.

Attackers Exploit Cisco IOS XE Vulnerability to Deploy BADCANDY Web Shell

Despite the ASD's warnings and recommendations, the ongoing nature of these attacks raises concerns about the effectiveness of current cybersecurity measures in place. Critics argue that the persistence of the BADCANDY threat indicates a failure to adequately secure critical infrastructure, highlighting the need for more robust and immediate responses from organizations and cybersecurity agencies.

CISA, NSA, partners publish Microsoft Exchange server hardening guide to prevent compromise and data theft

The ASD has stated, “BADCANDY is a low equity Lua-based web shell... the presence of the BADCANDY implant indicates compromise of the Cisco IOS XE device.” They emphasize the importance of patching and hardening guidelines to prevent future exploitation attempts. Additionally, they continue to notify affected entities and provide guidance on incident response and remediation.

BadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian government

While ASD reports over 400 compromised devices, the exact number of devices currently infected remains unclear, with estimates stabilizing around 150 as of late October 2025. This discrepancy suggests that while some remediation efforts have been successful, the threat actors are continuously scanning for and exploiting vulnerable systems.

Attackers Exploit Cisco IOS XE Vulnerability to Deploy BADCANDY Web Shell

The ongoing exploitation of Cisco IOS XE devices through the BADCANDY implant highlights significant vulnerabilities within critical infrastructure. Organizations must prioritize patching and security hardening to mitigate these risks effectively. The ASD continues to monitor the situation and provide guidance to ensure the security of affected systems.

Attackers Exploit Cisco IOS XE Vulnerability to Deploy BADCANDY Web ShellASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE VulnerabilityBadCandy Webshell threatens unpatched Cisco IOS XE devices, warns Australian governmentCISA issues security warnings for Exchange Server, VMwareCISA, NSA, partners publish Microsoft Exchange server hardening guide to prevent compromise and data theftCISA and NSA Issue Urgent Guidance to Secure WSUS and Microsoft Exchange Servers