<p>周三，思科透露，一组由中国政府支持的黑客正在利用一个漏洞，针对使用该公司一些最受欢迎产品的企业客户。</p>
<p>思科并未透露有多少客户已经遭到黑客攻击，或可能正在运行易受攻击的系统。现在，安全研究人员表示，有数百个思科客户可能会受到攻击。</p>
<p>负责扫描和监控互联网黑客活动的非营利组织 Shadowserver Foundation 的首席执行官 Piotr Kijewski 告诉 TechCrunch，曝光的规模 “似乎更多在几百个，而不是几千或几万。”</p>
<p>Kijewski 表示，该基金会并未看到广泛的活动，推测是因为 “当前的攻击是有针对性的。”</p>
<p>Shadowserver 有一个页面，跟踪因思科披露的漏洞（正式命名为 CVE-2025-20393）而暴露和易受攻击的系统数量。该漏洞被称为零日漏洞，因为该缺陷在公司有时间发布补丁之前就被发现。截至发稿时，印度、泰国和美国的境内共有数十个受影响的系统。</p>
<p>监控互联网黑客活动的网络安全公司 Censys 也发现了有限数量的受影响思科客户。根据一篇博客文章，Censys 观察到 220 个暴露在互联网的思科邮件网关，这是已知的易受攻击产品之一。</p>
<h4>联系我们</h4>
<p>您是否有关于此次黑客活动的更多信息？例如，哪些公司被针对？您可以通过非工作设备安全地联系 Lorenzo Franceschi-Bicchierai，电话是 +1 917 257 1382，或通过 Telegram 和 Keybase @lorenzofb，或发送电子邮件。</p>
<p>在本周早些时候发布的安全建议中，思科表示，该漏洞存在于多个产品的软件中，包括其安全邮件网关和安全邮件与网络管理器。</p>
<p>思科表示，这些系统只有在可以从互联网访问，并且启用了其 “垃圾邮件隔离” 功能时才会易受攻击。根据思科的说法，这两个条件默认情况下均未启用，这也解释了为什么在互联网上似乎没有那么多易受攻击的系统。</p>
<p>思科未对请求发表评论，询问该公司是否可以证实 Shadowserver 和 Censys 所看到的数字。</p>
<p>此次黑客活动的更大问题在于没有可用的补丁。思科建议客户清除并 “将受影响的设备恢复到安全状态”，作为补救任何漏洞的方式。</p>
<p>“​​在确认受到攻击的情况下，重建设备目前是消除威胁行为者持久机制的唯一可行选项，” 该公司在其建议中写道。</p>
<p>根据思科的威胁情报部门 Talos 的说法，这次黑客活动自 “至少 2025 年 11 月底” 以来一直在进行。</p>

思科

<p>思科披露了一项被中国政府支持的黑客利用的漏洞，目标是其企业客户。数百个系统可能受到影响，受影响的产品包括安全电子邮件网关和网络管理器。该漏洞，CVE-2025-20393，是一个零日漏洞，目前没有可用的补丁。思科建议将受影响的系统恢复到安全状态。该攻击活动自 2025 年 11 月以来一直在进行，观察到的广泛活动有限</p>

<p>On Wednesday, Cisco revealed that a group of Chinese government-backed hackers is exploiting a vulnerability to target its enterprise customers who use some of the company’s most popular products.</p>
<div class="lb-trans"><p>周三，思科透露，一组由中国政府支持的黑客正在利用一个漏洞，针对使用该公司一些最受欢迎产品的企业客户。</p>
</div><p>Cisco has not said how many of its customers have already been hacked, or may be running vulnerable systems. Now, security researchers say there are hundreds of Cisco customers who could potentially be hacked.</p>
<div class="lb-trans"><p>思科并未透露有多少客户已经遭到黑客攻击，或可能正在运行易受攻击的系统。现在，安全研究人员表示，有数百个思科客户可能会受到攻击。</p>
</div><p>Piotr Kijewski, the chief executive of the nonprofit Shadowserver Foundation that scans and monitors the internet for hacking campaigns, told TechCrunch that the scale of exposure “seems more in the hundreds rather than thousands or tens of thousands.”</p>
<div class="lb-trans"><p>负责扫描和监控互联网黑客活动的非营利组织 Shadowserver Foundation 的首席执行官 Piotr Kijewski 告诉 TechCrunch，曝光的规模 “似乎更多在几百个，而不是几千或几万。”</p>
</div><p>Kijewski said the foundation was not seeing widespread activity, presumably because “current attacks are targeted.”</p>
<div class="lb-trans"><p>Kijewski 表示，该基金会并未看到广泛的活动，推测是因为 “当前的攻击是有针对性的。”</p>
</div><p>Shadowserver has a page where it’s tracking the number of systems that are exposed and vulnerable to the flaw disclosed by Cisco, named officially as CVE-2025-20393. The vulnerability is known as a zero-day, because the flaw was discovered before the company had time to make patches available. As of press time, India, Thailand, and the United States collectively have dozens of affected systems within their borders.</p>
<div class="lb-trans"><p>Shadowserver 有一个页面，跟踪因思科披露的漏洞（正式命名为 CVE-2025-20393）而暴露和易受攻击的系统数量。该漏洞被称为零日漏洞，因为该缺陷在公司有时间发布补丁之前就被发现。截至发稿时，印度、泰国和美国的境内共有数十个受影响的系统。</p>
</div><p>Censys, a cybersecurity firm that monitors hacking activities across the internet, is also seeing a limited number of affected Cisco customers. According to a blog post, Censys has observed 220 internet-exposed Cisco email gateways, one of the products known to be vulnerable.</p>
<div class="lb-trans"><p>监控互联网黑客活动的网络安全公司 Censys 也发现了有限数量的受影响思科客户。根据一篇博客文章，Censys 观察到 220 个暴露在互联网的思科邮件网关，这是已知的易受攻击产品之一。</p>
</div><h4>Contact Us</h4>
<div class="lb-trans"><h4>联系我们</h4>
</div><p>Do you have more information about this hacking campaign? Such as what companies were targeted? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.</p>
<div class="lb-trans"><p>您是否有关于此次黑客活动的更多信息？例如，哪些公司被针对？您可以通过非工作设备安全地联系 Lorenzo Franceschi-Bicchierai，电话是 +1 917 257 1382，或通过 Telegram 和 Keybase @lorenzofb，或发送电子邮件。</p>
</div><p>In its security advisory published earlier this week, Cisco said that the vulnerability is present in software found in several products, including its Secure Email Gateway and its Secure Email and Web Manager.</p>
<div class="lb-trans"><p>在本周早些时候发布的安全建议中，思科表示，该漏洞存在于多个产品的软件中，包括其安全邮件网关和安全邮件与网络管理器。</p>
</div><p>Cisco said these systems are only vulnerable if they are reachable from the internet, and have its “spam quarantine” feature enabled. Neither of those two conditions are enabled by default, per Cisco, which would explain why there appears to be, relatively speaking, not that many vulnerable systems on the internet.</p>
<div class="lb-trans"><p>思科表示，这些系统只有在可以从互联网访问，并且启用了其 “垃圾邮件隔离” 功能时才会易受攻击。根据思科的说法，这两个条件默认情况下均未启用，这也解释了为什么在互联网上似乎没有那么多易受攻击的系统。</p>
</div><p>Cisco did not respond to a request for comment, asking if the company could corroborate the numbers seen by Shadowserver and Censys.</p>
<div class="lb-trans"><p>思科未对请求发表评论，询问该公司是否可以证实 Shadowserver 和 Censys 所看到的数字。</p>
</div><p>The bigger problem with this hacking campaign is that there are no patches available. Cisco recommends that customers wipe and “restore an affected appliance to a secure state,” as a way to remediate any breach.</p>
<div class="lb-trans"><p>此次黑客活动的更大问题在于没有可用的补丁。思科建议客户清除并 “将受影响的设备恢复到安全状态”，作为补救任何漏洞的方式。</p>
</div><p>“​​In case of confirmed compromise, rebuilding the appliances is, currently, the only viable option to eradicate the threat actors persistence mechanism from the appliance,” the company wrote in its advisory.</p>
<div class="lb-trans"><p>“​​在确认受到攻击的情况下，重建设备目前是消除威胁行为者持久机制的唯一可行选项，” 该公司在其建议中写道。</p>
</div><p>According to Cisco’s threat intelligence arm Talos, the hacking campaign has been ongoing since “at least late November 2025.”</p>
<div class="lb-trans"><p>根据思科的威胁情报部门 Talos 的说法，这次黑客活动自 “至少 2025 年 11 月底” 以来一直在进行。</p>
</div>

研究人员称，数百家思科客户面临新的中国黑客活动的威胁