Operation Zero Disco: Exploitation of Cisco SNMP Vulnerability CVE-2025-20352 for Rootkit Deployment

Attackers launched a coordinated campaign known as Operation Zero Disco, exploiting a critical vulnerability in Cisco's Simple Network Management Protocol (SNMP), identified as CVE-2025-20352. This vulnerability enables remote code execution (RCE) on affected Cisco switches, allowing threat actors to implant persistent Linux rootkits. The primary targets of this operation were Cisco 9400, 9300, and legacy 3750G series switches, particularly those running older Linux systems lacking modern endpoint detection and response (EDR) solutions. Attackers leveraged the SNMP flaw to gain unauthorized access, set universal passwords, and install hooks directly into the IOSd memory space, ensuring deep persistence and evasion from standard security monitoring. In addition to exploiting CVE-2025-20352, the attackers attempted to leverage a modified Telnet vulnerability, based on the older CVE-2017-3881, to further enable memory access and expand their foothold. The operation was characterized by the use of spoofed IP addresses and Mac email accounts to obfuscate the origin of the attacks and complicate attribution. Security researchers observed that the rootkits deployed were specifically designed to hide malicious activity and resist blue-team investigation, making detection and remediation more challenging. The campaign highlighted the risks associated with unpatched or unsupported network infrastructure, especially in environments where legacy devices are still in operation. Trend Micro's research emphasized the importance of advanced threat detection solutions, such as Trend Cloud One Network Security and Deep Discovery Inspector, which can identify Cisco-specific exploits and malicious controller communications. These tools utilize extended detection and response (XDR) capabilities and virtual patching to mitigate risks in hybrid cloud and traditional network environments. The incident underscores the need for organizations to promptly apply security advisories, update device firmware, and implement network segmentation to limit the impact of such exploits. Cisco's advisory on CVE-2025-20352 provided technical details and mitigation steps, but the operation demonstrated that attackers are quick to weaponize newly disclosed vulnerabilities. The use of rootkits on network devices represents a significant escalation in attacker sophistication, as it allows for long-term persistence and potential lateral movement within compromised environments. The campaign also serves as a warning for organizations relying on legacy hardware, which may not receive timely security updates or support. Security teams are advised to monitor for unusual SNMP activity, unauthorized configuration changes, and signs of rootkit installation on network devices. The Operation Zero Disco campaign is a stark reminder of the evolving threat landscape targeting network infrastructure and the critical importance of proactive vulnerability management.