Cisco Talos has detailed how a Chinese-linked group is exploiting an unpatched zero-day in email security appliances since late November 2025, deploying backdoors and log-wiping tools for persistent access.
Building on initial reports from December 19, Cisco Talos researchers revealed more on the zero-day campaign targeting email security appliances. The suspected Chinese-linked group roots devices to install backdoors and tools that erase logs, enabling stealthy persistence likely for espionage.
No patch is available yet, prompting urgent monitoring for anomalous activity. This aligns with patterns of state-sponsored attacks on network hardware, emphasizing zero-day risks in enterprise defenses.
