Global Honeypot Emerges: Cisco Vulnerability Exploited in ViciousTrap Cyber Attack

Summary

• Exploitation of Cisco vulnerability: Attackers are abusing CVE-2023-20118 in end-of-life Cisco Small Business RV routers.
• Rise of ViciousTrap: Sekoia researchers named the group behind it ViciousTrap.
• Global impact: About 5,300 edge devices in 84 countries were compromised.
• Urgent need for enhanced security: The affected routers are no longer supported, so replacing them is the real fix.

How ViciousTrap works

French security firm Sekoia reported in May 2025 that a threat actor it calls ViciousTrap had hijacked thousands of edge devices, mostly Cisco Small Business RV routers, and turned them into a global network that intercepts traffic. Sekoia’s working theory is that the network acts like a honeypot, watching attacks aimed at the compromised devices.

The Cisco flaw

The group exploits CVE-2023-20118, a command injection flaw in the web management interface of Cisco RV016, RV042, RV042G, RV082, RV320 and RV325 routers. These models have reached end of life. Cisco has said it will not patch them.

After breaking in, the attackers install a script Sekoia calls NetGhost. It redirects traffic on certain ports to infrastructure the attackers control, so they can watch what passes through.

Thousands of routers, 84 countries

Sekoia counted about 5,300 compromised devices across 84 countries. Macau had a large cluster. The researchers have not tied the activity to attacks on specific sectors. Nothing in the research shows a focus on government or financial networks.

The point seems to be observation. By sitting on thousands of exposed routers, ViciousTrap can see exploitation attempts from other attackers, collect their exploits and possibly reuse them.

What Sekoia found

Sekoia also saw the group hit some ASUS routers, though it was unclear what it did with them.

Infrastructure overlaps suggest a possible link to activity tracked under other names, but Sekoia did not attribute ViciousTrap to a known group.

How to protect your network

If you still run any of the affected RV models, replace them. They are past end of life and won’t be fixed. Until then, turn off remote management on the web interface and restrict who can reach it.

Watch for unusual outbound connections from edge devices and check router configurations for scripts you didn’t install.

Edge devices as a blind spot

Routers and other edge gear often get far less attention than servers and laptops. ViciousTrap is a reminder that an unpatched box at the edge can be quietly drafted into someone else’s operation.

Retire what can’t be patched

Inventory your edge devices, retire anything that no longer gets security updates and keep management interfaces off the open internet. That is cheaper than finding out your router has been working for someone else.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.