Operation Zero Disco: Attackers Exploit Cisco SNMP Vulnerability to Deploy Rootkits

Summary: A targeted campaign dubbed Operation Zero Disco has been observed exploiting a Cisco SNMP vulnerability to gain footholds and deploy rootkits on compromised systems. This post explains the risk, prioritized mitigations, and concrete detection/remediation steps your organization should take now. If you manage network devices or run SNMP anywhere in your environment, read this and act.

What happened

Attackers leveraged weaknesses in SNMP-enabled Cisco devices to gain unauthorized access, then moved laterally to deliver and install rootkit-capable tooling. The campaign uses off-the-shelf and custom artifacts (archives and tools) to maintain persistence and evade detection. The intent: long-term data access, covert monitoring, or enabling further compromise.

Note: this post focuses on defensive measures. We will not describe exploit code or step‑by‑step attacker techniques.

Why your business should care

SNMP is widely used for network management, many organizations leave SNMP open or configured with weak community strings.
A single compromised network device can provide attackers with rich telemetry and privileged network access.
Rootkits installed on servers or network appliances enable persistent, stealthy data theft and long recovery timelines.

Immediate actions
1. Patch and update
Ensure all Cisco devices (and network infrastructure) are patched to the latest vendor-recommended firmware. Apply Cisco security advisories immediately.

2. Limit SNMP exposure

Disable SNMP where it’s not needed.
For required SNMP: restrict access to specific management IPs, use SNMPv3 with authentication and encryption (avoid v1/v2c).
Apply ACLs to block SNMP from untrusted networks (especially the Internet).

3. Block and remediate identified artifacts (IOCs)
Add the provided SHA256 hashes to your EDR/AV blocklist, quarantine policies, and SIEM detection lists. See the IOC table below.

4. Harden device management
Use out-of-band management or a dedicated management VLAN; enforce MFA for management consoles and change default credentials.

5. Deploy/validate detection tooling
Ensure endpoint detection & response (EDR), network IDS/IPS, and journaling/audit logging are active. Create detections for unusual SNMP traffic, unexpected archive extraction, and new persistent modules (rootkit-like behavior).

6. Incident readiness
If you detect any of the IOCs or suspicious SNMP activity, isolate affected systems, preserve forensic data, and engage an incident response team.

IOC Table, add to blocklists / detection lists

Recommended deployment notes for IOCs

Add SHA256 values to your EDR/AV signature blocklist and ensure quarantine action.
Configure your SIEM to alert on any file downloads or process creations where file hash matches the above.
If any matches are found, isolate the host immediately and collect memory/disk images for forensic review.

Detection ideas

Monitor for unexpected SNMP sessions from external or unusual internal IPs and alert on SNMPv1/v2c usage.
Alert on creation or extraction of new archive files (.tar, .zip) on critical hosts outside normal change windows.
Watch for suspicious ARP activity or tools associated with ARP spoofing (network anomalies indicating a2p-like behavior).
EDR: alert on processes that inject into kernel or manipulate device drivers, common for rootkit behavior.

How we can help (our services)

At Alpha Cyber, we offer a full lifecycle defensive program tailored to threats like Operation Zero Disco:

• Vulnerability management & patch orchestration, prioritize and apply vendor fixes to network appliances.
• Network hardening & SNMP best-practices, design least‑privilege SNMP deployments.Incident Response & Forensics, containment, remediation, and root cause analysis if an infection is found.
• Penetration Testing & Red Teaming, identify gaps before adversaries exploit them.

Take action now

Don’t wait for an intrusion to find out you were vulnerable. Schedule a vulnerability review or request an urgent SNMP exposure assessment.

Learn more / Book a consultation