China’s ‘Velvet Ant’ hackers caught exploiting new zero-day in Cisco devices

Sygnia and Cisco disclosed exploitation of a zero-day vulnerability (CVE-2024-20399) in Cisco NX-OS affecting Nexus switches; state-backed Chinese group Velvet Ant leveraged administrator credentials to install custom malware, gain remote control, and maintain long-term access for espionage. Cisco released updates to remediate the flaw, noting active exploitation in April and no available workaround.