AI malware, Cisco ASA zero-days, and what practitioners should do now

TL;DR: Active exploitation of Cisco ASA zero-days, Chrome V8 abuse, Sudo privilege escalation, and the emergence of AI-enhanced malware show attackers are chaining infrastructure flaws with automation to widen blast radius, according to FireCompass. The operational lesson is that exposure management, privileged access, and device integrity controls now need to be treated as one control surface, not separate programmes.

NHIMG editorial — based on content published by FireCompass: Weekly Report on new hacking techniques and critical CVEs from 23 Sep to 29 Sep, 2025

By the numbers:

• The week of September 22-30, 2025 saw active exploitation of two Cisco ASA firewall zero-days, according to FireCompass.
• CISA added one critical Sudo flaw, CVE-2025-32463, to its Known Exploited Vulnerabilities catalog, according to FireCompass.

Questions worth separating out

Q: What fails when edge device zero-days are chained with authentication bypass and remote code execution?

A: The failure is the assumption that an edge device remains a bounded trust zone after one control is bypassed.

Q: Why do privilege escalation flaws create outsized operational risk in infrastructure environments?

A: Privilege escalation matters because it converts limited access into control over system settings, monitoring, and persistence mechanisms.

Q: How should security teams detect AI-driven malware when payloads keep changing?

A: Security teams should focus on behaviour, not just file signatures.

Practitioner guidance

• Prioritise edge-device exposure triage Inventory Cisco ASA and similar perimeter devices, confirm whether the affected versions are present, and isolate systems until compensating controls are verified.
• Tie privilege review to utility integrity Review administrative utilities such as sudo alongside firmware integrity checks, because escalation paths and persistence mechanisms can fail independently.
• Shift detections toward behaviour and execution context Add monitoring for unusual process behaviour, unexpected child execution, and anomalous administrative actions rather than relying only on signatures.

What's in the full article

FireCompass's full report covers the operational detail this post intentionally leaves for the source:

• Timeline-level breakdown of the Cisco ASA zero-day exploitation window and public disclosure sequence
• Discussion of the observed AI-enhanced malware characteristics that distinguish EvilAI from conventional commodity threats
• Additional context on underground-market activity, ransomware adaptation, and exploited utility tracking
• Source-led operational framing for CISOs who need incident triage detail rather than weekly synthesis

👉 Read FireCompass's weekly report on new hacking techniques and critical CVEs →

AI malware, Cisco ASA zero-days, and what practitioners should do now?

Explore further

View Full Forum →  |  NHI Foundation Course →