{"id":59518,"date":"2025-10-15T00:00:00","date_gmt":"2025-10-15T00:00:00","guid":{"rendered":"urn:uuid:dacf0061-0a29-8653-de40-0336f0691441"},"modified":"2025-10-15T00:00:00","modified_gmt":"2025-10-15T00:00:00","slug":"operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/","title":{"rendered":"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits"},"content":{"rendered":"<p><img decoding=\"async\" src=\"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/thumb-disco:Large?qlt=80\"><\/p>\n<div><img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/thumbnails\/25\/thumb-disco.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<ul>\n<li><span class=\"rte-red-bullet\">Hides certain running-config items in memory (disabled by default). <span>When enabled, the rootkit hides specified account names, EEM scripts, and ACLs from the running configuration. Trend investigations revealed some hidden account names such as observed:<\/span><\/span><\/li>\n<\/ul>\n<p><span class=\"blockquote\">dg3y8dpk dg4y8epk dg5y8fpk dg6y8gpk dg7y8hpk&nbsp;<br \/>Hidden EEM scripts: CiscoEMX-1 to CiscoEMX-5&nbsp;<br \/>Hidden ACLs: EnaQWklg0, EnaQWklg1, EnaQWklg2<\/span><\/p>\n<ul>\n<li><span class=\"rte-red-bullet\">Allows VTY ACL bypass (disabled by default). <span>The cisco VTY refers to the virtual interface on a Cisco device (like a router or switch) that allows remote access via protocols such as telnet or ssh. Administrators can apply ACLs to control access to VTY lines, but if VTY is enabled, any ACL bound to it will be ignored.<\/span><\/span><\/li>\n<li><span class=\"rte-red-bullet\">Toggles or deletes device logs. <span>This function allows an attacker to temporarily disable log history by setting the log size to zero.<\/span><\/span><\/li>\n<li><span class=\"rte-red-bullet\">Resets last running-config write timestamp. <span>This is used to hide changes, so it appears the configuration was never modified.<\/span><\/span><\/li>\n<\/ul>\n<p><span class=\"body-subhead-title\">Detection and security recommendations<\/span><\/p>\n<p>Currently there is no universal automated tool that can reliably determine whether a Cisco switch has been successfully compromised by the ZeroDisco operation. If you suspect a switch is affected, we recommend contacting Cisco TAC immediately and asking the vendor to assist with a low-level investigation of firmware\/ROM\/boot regions.<\/p>\n<p>For early detection Trend recommends utilizing <a href=\"https:\/\/cloudone.trendmicro.com\/\">Trend Cloud One\u2122 Network Security<\/a>&nbsp;which provides deep inspection of cloud network traffic using virtual patching, intrusion prevention (IPS), and post-compromise detection to prevent malware and zero-day attacks.\u202fIt offers real-time threat intelligence, custom rule sets, behavioral analytics, and supports hybrid cloud environments, integrating with other\u202fTrend Cloud One services\u202fand\u202f<a href=\"https:\/\/www.google.com\/search?cs=0&amp;rlz=1C1GCEV_enPH1118PH1118&amp;sca_esv=9541cb1f2f7b383d&amp;sxsrf=AE3TifPWFMaBuMc7mnKNCmPS4I6_aw_4qQ%3A1759814333422&amp;q=Trend+Micro+Vision+One&amp;sa=X&amp;ved=2ahUKEwiGlbehq5GQAxWjpa8BHUHHABMQxccNegQIBBAC&amp;mstk=AUtExfCdbFzPCN5afHiuGKmb5gna_2438vazaHco04VMSIKGEPyQLx40lwD1KyDHnNeAVGXM7RTV68Ie-S5wrI-uGHXJlHwFvBBlH2QfOjIsAgslSBCLD8DQIGtd_zr_0r4c9BtggarFpfREYNOsaURGtwlmOv9bjgo8v29lxj_jpl47c44xFUkLCvVOuh9XcIujTktHt8nb4W_ApEFNgjSjBalC5Fodu-vEyTGeQPy18fJVoIL_hLt9cwrDHC9-eayOf7bV2sdeqIeBwGpsMqCKKwx_&amp;csui=3\">Trend Vision One<\/a>\u2122\u202ffor extended detection and response (XDR).\u202f<\/p>\n<p>Trend Micro\u2122&nbsp;<a href=\"https:\/\/www.trendmicro.com\/en_us\/business\/products\/network\/advanced-threat-protection\/inspector.html\">Deep Discovery<\/a>\u2122&nbsp;can also help mitigate risk by detecting the Cisco exploit and UDP controller communication. Deep Discovery uses virtual patching and intelligent threat detection to inspect inbound and outbound network traffic for advanced threats, ransomware, and targeted attacks.<\/p>\n<p><b>Trend Cloud One Network Security and TippingPoint Threat Protection System<\/b><\/p>\n<ul>\n<li><span class=\"rte-circle-bullet\">46396 <span>&#8211;<\/span>&nbsp;<span>SNMP: Cisco IOS XE Software Authframework OID Get-Request Buffer Overflow Vulnerability<\/span><\/span><\/li>\n<\/ul>\n<p><b>Deep Discovery Rules<\/b><\/p>\n<ul>\n<li><span class=\"rte-circle-bullet\">5497 <span>&#8211; UDP_CONTROLLER_REQUEST<\/span><\/span><\/li>\n<li>&nbsp;<\/li>\n<li><span class=\"rte-circle-bullet\">5488 <span>&#8211; SNMP_CISCO_AUTHFRAMEWORK_OID_REQUEST<\/span><\/span><\/li>\n<\/ul>\n<p><b>Trend Vision One\u2122 Endpoint Security Vision One Workbench<\/b><\/p>\n<ul>\n<li><span class=\"rte-circle-bullet\">Multiple Suspicious UDP Payload Sent Using Shell and Netcat<\/span><\/li>\n<\/ul>\n<p><span class=\"body-subhead-title\">Proactive security with Trend Vision One\u2122\u202f<\/span><\/p>\n<p><a href=\"https:\/\/www.trendmicro.com\/en_us\/business\/products\/one-platform.html\" title=\"https:\/\/www.trendmicro.com\/en_us\/business\/products\/one-platform.html\">Trend Vision One<\/a>\u2122 is the only AI-powered enterprise cybersecurity platform that centralizes cyber risk exposure management and security operations, delivering robust layered protection across on-premises, hybrid, and multi-cloud environments.<\/p>\n<p><b>Trend Vision One\u2122 Threat Intelligence\u202f<\/b><\/p>\n<p>To stay ahead of evolving threats, Trend customers can access\u202f<a href=\"https:\/\/www.trendmicro.com\/en_us\/business\/products\/threat-intelligence.html\">Trend Vision One\u2122 Threat Insights<\/a>\u202fwhich provides the latest insights from Trend \u2122 Research on emerging threats and threat actors.\u202f\u202f\u202f<\/p>\n<p><b><i>Trend Vision One Threat Insights\u202f\u202f<\/i><\/b><\/p>\n<p><b><i>Trend Vision One Intelligence Reports (IOC Sweeping)<\/i><\/b><\/p>\n<p><span class=\"body-subhead-title\">Hunting Queries\u202f\u202f<\/span><\/p>\n<p><b>Trend Vision One Search App\u202f\u202f<\/b><\/p>\n<p>Trend Vision One customers can use the Search App to match or hunt the malicious indicators mentioned in this blog post with data in their environment.\u202f<\/p>\n<p><span class=\"blockquote\">(ruleId: (5497 OR 5488) AND eventId:100119) OR (subRuleId: 46396 AND eventName:INTRUSION_DETECTION) AND LogType: detection<\/span><\/p>\n<p><span class=\"body-subhead-title\">Indicators of Compromise (IoCs)\u202f<\/span><\/p>\n<p>Indicators of Compromise can be found <a href=\"https:\/\/documents.trendmicro.com\/images\/uploads\/Operation%20Zero%20Disco%20IoCs-wpV04Mt.txt\">here<\/a>.&nbsp;<\/p>\n<p><b><i>With contributions from Joey Chen, Cisco TALOS Team<\/i><\/b><\/p>\n<p> Read More <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/25\/j\/operation-zero-disco-cisco-snmp-vulnerability-exploit.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Trend\u2122 Research has uncovered an attack campaign exploiting the Cisco SNMP vulnerability CVE-2025-20352, allowing remote code execution and rootkit deployment on unprotected devices, with impacts observed on Cisco 9400, 9300, and legacy 3750G series. Read More HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[61],"tags":[9510,9511,9555,9534,9509],"class_list":["post-59518","post","type-post","status-publish","format-standard","hentry","category-trendmicro","tag-trend-micro-research-articles-news-reports","tag-trend-micro-research-cyber-threats","tag-trend-micro-research-exploitsvulnerabilities","tag-trend-micro-research-latest-news","tag-trend-micro-research-research"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-15T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/thumb-disco:Large?qlt=80\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits\",\"datePublished\":\"2025-10-15T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/\"},\"wordCount\":542,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/thumb-disco:Large?qlt=80\",\"keywords\":[\"Trend Micro Research : Articles, News, Reports\",\"Trend Micro Research : Cyber Threats\",\"Trend Micro Research : Exploits&amp;Vulnerabilities\",\"Trend Micro Research : Latest News\",\"Trend Micro Research : Research\"],\"articleSection\":[\"TrendMicro\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/\",\"name\":\"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/thumb-disco:Large?qlt=80\",\"datePublished\":\"2025-10-15T00:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/#primaryimage\",\"url\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/thumb-disco:Large?qlt=80\",\"contentUrl\":\"https:\\\/\\\/trendmicro.scene7.com\\\/is\\\/image\\\/trendmicro\\\/thumb-disco:Large?qlt=80\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trend Micro Research : Articles, News, Reports\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/trend-micro-research-articles-news-reports\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/","og_locale":"en_US","og_type":"article","og_title":"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2025-10-15T00:00:00+00:00","og_image":[{"url":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/thumb-disco:Large?qlt=80","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits","datePublished":"2025-10-15T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/"},"wordCount":542,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/#primaryimage"},"thumbnailUrl":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/thumb-disco:Large?qlt=80","keywords":["Trend Micro Research : Articles, News, Reports","Trend Micro Research : Cyber Threats","Trend Micro Research : Exploits&amp;Vulnerabilities","Trend Micro Research : Latest News","Trend Micro Research : Research"],"articleSection":["TrendMicro"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/","url":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/","name":"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/#primaryimage"},"thumbnailUrl":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/thumb-disco:Large?qlt=80","datePublished":"2025-10-15T00:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/#primaryimage","url":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/thumb-disco:Large?qlt=80","contentUrl":"https:\/\/trendmicro.scene7.com\/is\/image\/trendmicro\/thumb-disco:Large?qlt=80"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/operation-zero-disco-attackers-exploit-cisco-snmp-vulnerability-to-deploy-rootkits\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Trend Micro Research : Articles, News, Reports","item":"https:\/\/www.threatshub.org\/blog\/tag\/trend-micro-research-articles-news-reports\/"},{"@type":"ListItem","position":3,"name":"Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/59518","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=59518"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/59518\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=59518"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=59518"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=59518"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}