APT Group Exploits Zero-Days in Cisco and Citrix Systems

Amazon’s threat intelligence division uncovered an advanced persistent threat (APT) group exploiting zero-day vulnerabilities in Cisco and Citrix systems. The attackers targeted critical identity and network access control infrastructure, using undisclosed flaws before vendors issued patches. Amazon’s MadPot honeypot service detected the exploitation attempts, leading to the identification of CVE-2025-5777 and CVE-2025-20337. The threat actor deployed a custom web shell disguised as a legitimate component, operating in-memory and using Java reflection for stealth. Security teams are advised to implement defense-in-depth strategies and closely monitor for anomalous activity.