Hackers used Cisco zero-day to plant rootkits on network switches (CVE-2025-20352) Threat actors have leveraged a recently patched IOS/IOS XE vulnerability (CVE-2025-20352) to deploy Linux rootkits on vulnerable Cisco network devices. “The operation targeted victims running older Linux systems that do not have endpoint detection response solutions,” Trend Micro researchers shared. Once a rootkit was implanted, it would set a universal password (containing the word “disco”) and install several hooks onto the IOSd (process) memory space, to make fileless components disappear after a reboot. About CVE-2025-20352 In late September 2025, Cisco fixed an IOS/IOS XE vulnerability (CVE-2025-20352) exploited by attackers in zero-day attacks, but did not share additional details about the attacks.…