Persistence Mechanisms

China-Linked Hackers Exploit Cisco Email Zero-Day With No Patch as CISA Flags Active Threat

Talos links the activity to UAT-9686, with Cisco urging restricted exposure pending rebuilds until a fix arrives.