Cisco SNMP Flaw Exploited to Install Linux Rootkits

A new campaign dubbed "Operation Zero Disco" is actively exploiting a high-severity SNMP vulnerability (CVE-2025-20352) in older Cisco IOS and IOS XE devices. Attackers leverage the flaw to achieve remote code execution and deploy sophisticated Linux rootkits on unprotected systems. Once compromised, the malware establishes persistent access by creating a universal backdoor password and installing fileless components that disappear after a reboot. The rootkit allows threat actors to hide their activity, bypass access controls, delete logs, and move laterally across segmented networks. While newer hardware offers some protection, detection remains difficult, requiring low-level firmware investigation for suspected compromises.