Cisco Devices Hacked with Evading Backdoor Implant and Zero-Day Exploits

The backdoor implant on hacked Cisco devices, which exploited zero-day flaws in IOS XE software, has been modified by the threat actor to evade detection. The implant now only responds if the correct Authorization HTTP header is set, making it harder to detect. Cisco has started rolling out security updates to address the issues, but the exact identity of the threat actor is unknown. The number of compromised devices has decreased from 40,000 to a few hundred, possibly due to under-the-hood changes. Over 37,000 devices are still observed to be compromised.