UAT-9686
UAT-9686 is classified as state-sponsored.
- Type
- State-sponsored
- Origin
- China
UAT-9686 is a Chinese state-sponsored APT known for targeting networking infrastructure and edge appliances through a sophisticated espionage campaign. They exploit a critical flaw in the Cisco AsyncOS Spam Quarantine interface to gain root access and deploy custom malware, including AquaShell, along with Python scripts that execute natively. Their operations involve reverse tunneling and log purging, demonstrating a methodical approach to compromising communication infrastructure. Talos has observed overlaps in TTPs and tooling with other Chinese-nexus threat actors, indicating a consistent operational pattern.
The group's reported origin is China.
Published reports on this actor:
- https://www.secpod.com/blog/zero-day-crisis-cve-2025-20393-unpatched-on-cisco-email-gateways-exploited-by-china-linked-hackers/
- https://blog.talosintelligence.com/uat-9686/
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.