Amazon pins Cisco, Citrix zero-day attacks to APT group

Amazon’s threat intelligence detected a highly resourced APT exploiting zero-day vulnerabilities in Cisco Identity Services Engine (CVE-2025-20337) and Citrix NetScaler (CVE-2025-5777) before vendor disclosure; the actor used custom backdoors tailored to Cisco ISE with advanced evasion and conducted large-scale exploitation activity traced to May–July 2025, likely for espionage.