Hackers have exploited a remote code execution vulnerability (CVE-2025-20352) in Cisco networking devices to deploy rootkits targeting unprotected Linux systems. The attacks, tracked as 'Operation Zero Disco', involved the use of compromised Cisco devices to manipulate logs and network configurations, posing significant risks even to newer switches due to persistent targeting. Currently, there are no reliable tools to detect these compromises, making low-level investigations essential for suspected breaches.