BADCANDY webshell spread via vulnerable Cisco IOS XE device targeting

Threat actors were reported by the Australian Signals Directorate to have launched attacks exploiting the maximum severity Cisco IOS XE vulnerability, tracked as CVE-2023-20198, to deliver the BADCANDY webshell, according to Security Affairs.

More than 400 devices across Australia have been injected with the Lua-based BADCANDY webshell since July, over 150 of which remain exposed to the internet, reported the ASD.

"ASD believes actors are able to detect when the BADCANDY implant is removed and are re-exploiting the devices. This further highlights the need to patch against CVE-2023-20198 to avoid re-exploitation," said the agency's alert, which emphasized the importance of immediate patching and web UI access restrictions to prevent repeat abuse as attackers could use pilfered credentials to maintain access.

Organizations using impacted Cisco IOS XE devices have also been urged to assess and remove unauthorized privileged accounts, as well as monitor configuration changes and unknown tunnel interfaces to prevent compromise.