In late August 2025, security researchers observed a highly coordinated reconnaissance campaign targeting Cisco Adaptive Security Appliances (ASA). Unlike routine internet background noise, this wave was centrally managed, automated, and launched from abuse-tolerant bulletproof hosting networks. The operation represents a critical precursor to exploitation, mapping vulnerable ASA devices for subsequent denial-of-service, credential theft, and remote code execution attacks.
Severity Level: High
Campaign Characteristics
- Scale & Timing: Nearly 350,000 ASA-related events logged in August 2025, peaking on August 28 with ~200,000 probes in just 20 hours.
- Automation Fingerprints: 342 source IPs each delivered an identical workload (~10,102 requests), indicating scripted, centrally controlled scanning.
- Recon Methods:
- WebVPN probes (GET /+CSCOE+/, POST /+webvpn+/)
- IKEv2 sweeps over UDP/500 & UDP/4500
- Parameter fuzzing for version fingerprinting
- Exploitation Mapping: Recon matched to known Cisco ASA CVEs,
- DoS: CVE-2025-20182, CVE-2025-20134
- Info Disclosure: CVE-2024-20353, CVE-2020-3452
- RCE: CVE-2020-3452, CVE-2018-0101
Malicious Infrastructure
- AS401116 (NYBULA):
- US-registered (Alaska) but uses Seychelles IP space.
- Listed on Spamhaus ASN-DROP
- Flagged by ThreatFox with 668 malware-related IOCs
- Reported on AbuseIPDB for scanning and unauthorized access attempts.
- Role in Campaign: The largest contributor to the reconnaissance wave (~70,707 hits), acting as the primary staging ground for automated scanning.
- AS401120 (CHEAPY-HOST)
- US-registered (Virginia), Seychelles IP space. Created in May 2024.
- Also, on Spamhaus ASN-DROP list
- Flagged by ThreatFox with 769 malware-related IOCs
- Role in Campaign: The second-largest contributor (~30,290 hits). Operationally linked to NYBULA, with shared upstream connectivity via AS401110.
- AS215540 (Global Connectivity Solutions LLP)
- UK LLP backed by Seychelles shells. Linked to Yevgeniy Marinko (“dimetr50”) and Kirils Pestuns (Russian Laundromat).
- Used for disinformation (Doppelganger) and Gamaredon/BoneSpy C2.
- Smaller but high-value contributor (~9k hits).
- AS401110 (Sovy Cloud Services):
The upstream provider for NYBULA and CHEAPY-HOST. Acts as the backbone enabling disposable malicious ASNs.
Strategic Intent
The campaign was not exploitation but target reconnaissance. By fingerprinting Cisco ASA appliances, attackers prepared a curated list of vulnerable systems for:
- Denial of Service attacks for extortion/disruption.
- Credential theft via VPN config disclosure.
- Full device takeover (RCE) enabling lateral movement and ransomware.
Recommendations
- Ensure all ASA/FTD appliances are updated to the latest fixed releases, paying special attention to the IKEv2 and SSL/TLS advisories from May and August 2025.
- Add traffic to/from AS401116 (NYBULA), AS401120 (CHEAPY-HOST), and AS215540 (Global Connectivity Solutions LLP) to high-priority watchlists or block lists at firewalls, edge routers, or BGP filtering. These are confirmed abuse-tolerant bulletproof networks.
- Use the following example KQL queries to hunt for this activity in your own logs:
- Hostile ASNs — geoip.asn: (401116 or 401120 or 215540)
- ASA WebVPN Probes — geoip.asn: (401116 or 401120 or 215540) and destination.port: (443 or 8443) and payload_printable: (“GET /+CSCOE+/” or “POST /+webvpn+/”)
- Query Fuzzing — geoip.asn: (401116 or 401120 or 215540) and payload_printable: ?
- IKEv2 Sweeps — geoip.asn: (401116 or 401120 or 215540) and network.transport: udp and destination.port: (500 or 4500)
- Treat traffic from any ASN listed on Spamhaus ASN-DROP list as hostile by default.
Source:
- https://medium.com/@Nadsec/honeypot-report-a-coordinated-reconnaissance-wave-against-cisco-asa-appliances-ddc49b6664ae
- https://github.com/Rat5ak/Anatomy-of-a-Reconnaissance-Campaign-Deconstructing-Bullet-Proof-Host—AS401116-AS401120-AS215540/blob/main/README.md
- https://bsky.app/profile/nadsec.online/post/3lxkjwjzhnk2v
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.