• Macao Special Administrative Region
• Vicioustrap
• North America
• CVE-2023-20118
• United States
• Cisco
• Eastern Asia
• Cve-2023-20118
• Asia
• Technology

Vicioustrap Threat Actor Compromises Thousands of Network Devices

Cybersecurity researchers have uncovered a threat actor known as Vicioustrap, who has compromised approximately 5,300 network edge devices across 84 countries, primarily in Macau. This actor exploits a critical vulnerability (CVE-2023-20118) in various Cisco routers to redirect traffic to a honeypot-like infrastructure, allowing them to monitor and intercept network flows. The attack chain involves executing a shell script that facilitates adversary-in-the-middle attacks, with indications that the actor may be of Chinese-speaking origin. The ultimate goal of the Vicioustrap operation remains uncertain, although it is believed to be focused on creating a honeypot network.