Tag: 2025-02-05

9 Attack Reports | 114 Vulnerabilities

Attack reports

Mobile Indian Cyber Heist: FatBoyPanel And His Massive Data Breach

A mobile malware campaign targeting Indian banks has been uncovered, comprising nearly 900 samples aimed at Android devices. The malware, distributed via WhatsApp as fake government or banking apps, steals sensitive financial and personal data, including Aadhar and PAN card details, credit card inf…
phishing
android
banking trojan
data breach
mobile malware
sms interception
2025-02-05
otp theft
firebase
fatboypanel
Published: February 5, 2025
Downloadable IOCs: 891

Chinese Hackers Attacking Linux Devices With New SSH Backdoor

Chinese hackers, specifically the DaggerFly espionage group, are targeting Linux devices with a sophisticated SSH backdoor called ELF/Sshdinjector.A!tr. The Lunar Peek campaign, active since mid-November 2024, primarily focuses on network appliances and IoT devices. The attack involves a dropper th…
linux
iot
c2 server
2025-02-05
ssh backdoor
network appliances
lunar peek campaign
Published: February 5, 2025
Downloadable IOCs: 3

Scalable Vector Graphics files pose a novel phishing threat

Cybercriminals are exploiting the SVG file format to conduct phishing attacks that bypass existing anti-spam and anti-phishing protection. These attacks involve email messages with .svg file attachments, which open in the default browser on Windows computers. The SVG files contain anchor tags and s…
phishing
social engineering
credential theft
evasion techniques
2025-02-05
nymeria
file format abuse
svg
browser-based attacks
troj/autoit-dhb
email attachments
Published: February 5, 2025
Downloadable IOCs: 0

Rat Race: ValleyRAT Malware Targets Organizations with New Delivery Techniques

ValleyRAT, a sophisticated multi-stage malware attributed to Silver Fox APT, has updated its tactics, techniques, and procedures. The malware targets key roles in finance, accounting, and sales departments using phishing emails, malicious websites, and instant messaging platforms. The infection cha…
phishing
persistence
valleyrat
keylogger
dll side-loading
c2 communication
anti-vm
2025-02-05
ghostrat
silver fox apt
Published: February 5, 2025
Downloadable IOCs: 12

Analysis of malicious HWP cases of 'APT37' group distributed through K messenger

The report details a sophisticated APT attack targeting South Korea, utilizing spear-phishing techniques and malicious HWP files distributed through a popular Korean messenger service. The APT37 group exploited trust-based tactics, using compromised accounts to spread malware through group chats. T…
powershell
rokrat
spear-phishing
2025-02-05
pcloud
ole
file-less
hwp
k messenger
Published: February 5, 2025
Downloadable IOCs: 0

Take my money: OCR crypto stealers in Google Play and App Store

Researchers discovered a new malware campaign dubbed 'SparkCat' targeting Android and iOS users through both official and unofficial app stores. The malware, embedded in various apps, uses OCR technology to scan users' image galleries for crypto wallet recovery phrases. Infected apps on Google Play…
ios
android
mobile malware
ocr
2025-02-05
sparkcat
app stores
crypto stealer
Published: February 5, 2025
Downloadable IOCs: 0

Blast from the Past

A large-scale campaign targeting Russian organizations across various industries has been detected. The attackers are using NOVA stealer, a commercial fork of SnakeLogger, distributed via phishing emails disguised as contract archives. NOVA, marketed as Malware-as-a-Service, is capable of stealing …
phishing
stealer
persistence
credential theft
data exfiltration
russian
maas
nova
snakelogger
2025-02-05
organizations
Published: February 5, 2025
Downloadable IOCs: 1

Unpacking the BADBOX Botnet

The BADBOX botnet, a newly discovered threat, targets Android devices, including high-end models like Yandex 4K QLED TVs. Over 190,000 infected devices have been observed, with malware often pre-installed from the factory or further down the supply chain. Using Censys, a suspicious SSL/TLS certific…
android
supply chain
iot
botnet
badbox
firmware
2025-02-05
censys
ssh host key
ssl/tls certificate
Published: February 5, 2025
Downloadable IOCs: 19

APT Targets NetEase 163.com Users with Fake Download Pages & Spoofed Domains

The GreenSpot Advanced Persistent Threat group, operating from Taiwan since 2007, is targeting users of NetEase's 163.com email service. The group employs sophisticated phishing techniques, including spoofed domains and fake download pages, to steal login credentials. Researchers identified domains…
apt
phishing
credential theft
taiwan
spoofed domains
2025-02-05
fake download pages
163.com
netease
Published: February 5, 2025
Downloadable IOCs: 9
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-20124

9.9
    Cisco ISE
Published: February 5, 2025

CVE-2020-36084

9.8
    SourceCodester Responsive E-Learning System
Published: February 5, 2025

CVE-2024-57520

9.8
    asterisk
Published: February 5, 2025

CVE-2025-20125

9.1
    Cisco ISE
Published: February 5, 2025

CVE-2025-23114

9.0
    Veeam
Published: February 5, 2025

CVE-2025-20029

8.8
    F5 BIG-IP
Published: February 5, 2025

CVE-2025-23239

8.7
    F5 BIG-IP
Published: February 5, 2025

CVE-2025-1026

8.6
    spatie/browsershot
Published: February 5, 2025

CVE-2024-56131

8.4
    LoadMaster
    Multi-Tenant Hypervisor
    ECS
Published: February 5, 2025

CVE-2024-56132

8.4
    LoadMaster
Published: February 5, 2025

CVE-2024-56133

8.4
    LoadMaster
Published: February 5, 2025

CVE-2024-56134

8.4
    LoadMaster
    Multi-Tenant Hypervisor
    ECS
Published: February 5, 2025

CVE-2024-56135

8.4
    LoadMaster
Published: February 5, 2025

CVE-2025-1022

8.2
    spatie/browsershot
Published: February 5, 2025

CVE-2025-1028

8.1
    WordPress Contact Manager plugin
Published: February 5, 2025

CVE-2025-25246

8.1
    NETGEAR XR1000
    NETGEAR XR1000v2
    NETGEAR XR500
Published: February 5, 2025

CVE-2025-24320

8.0
    BIG-IP Configuration utility
Published: February 5, 2025

CVE-2025-0413

7.8
    Parallels Desktop
Published: February 5, 2025

CVE-2025-20169

7.7
    Cisco IOS XE Software
    Cisco IOS Software
Published: February 5, 2025

CVE-2025-20170

7.7
    Cisco IOS XE Software
    Cisco IOS Software
Published: February 5, 2025

CVE-2025-20171

7.7
    Cisco IOS XE Software
    Cisco IOS Software
Published: February 5, 2025

CVE-2025-20172

7.7
    Cisco IOS XE Software
    Cisco IOS XR Software
    Cisco IOS Software
Published: February 5, 2025

CVE-2025-20173

7.7
    Cisco IOS XE Software
    Cisco IOS Software
Published: February 5, 2025

CVE-2025-20174

7.7
    Cisco IOS XE Software
    Cisco IOS Software
Published: February 5, 2025

CVE-2025-20175

7.7
    Cisco IOS XE Software
    Cisco IOS Software
Published: February 5, 2025

CVE-2025-20176

7.7
    Cisco IOS XE Software
    Cisco IOS Software
Published: February 5, 2025

CVE-2025-1025

7.5
    cockpit
Published: February 5, 2025

CVE-2024-9631

7.5
    GitLab CE/EE
Published: February 5, 2025

CVE-2024-2878

7.5
    GitLab CE/EE
Published: February 5, 2025

CVE-2024-39564

7.5
    Juniper Networks Junos OS
    Juniper Networks Junos OS Evolved
Published: February 5, 2025

CVE-2025-20045

7.5
    F5 BIG-IP
Published: February 5, 2025

CVE-2025-20058

7.5
    F5 BIG-IP
Published: February 5, 2025

CVE-2025-21087

7.5
    F5 BIG-IP Local Traffic Manager (LTM)
Published: February 5, 2025

CVE-2025-21091

7.5
    F5 BIG-IP
Published: February 5, 2025

CVE-2025-22846

7.5
    F5 BIG-IP
Published: February 5, 2025

CVE-2025-22891

7.5
    F5 BIG-IP
Published: February 5, 2025

CVE-2025-23412

7.5
    F5 BIG-IP APM
Published: February 5, 2025

CVE-2025-24312

7.5
    F5 BIG-IP AFM
Published: February 5, 2025

CVE-2025-24326

7.5
    BIG-IP Advanced WAF/ASM
Published: February 5, 2025

CVE-2025-24497

7.5
    F5 BIG-IP
Published: February 5, 2025

CVE-2024-57063

7.5
    php-date-formatter
Published: February 5, 2025

CVE-2024-57064

7.5
    @syncfusion/ej2-spreadsheet
Published: February 5, 2025

CVE-2024-57065

7.5
    utile
Published: February 5, 2025

CVE-2024-57066

7.5
    @ndhoule/defaults
Published: February 5, 2025

CVE-2024-57067

7.5
    dot-qs
Published: February 5, 2025

CVE-2024-57068

7.5
    @tanstack/form-core
Published: February 5, 2025

CVE-2024-57069

7.5
    expand-object
Published: February 5, 2025

CVE-2024-57071

7.5
    php-parser
Published: February 5, 2025

CVE-2024-57072

7.5
    module-from-string
Published: February 5, 2025

CVE-2024-57078

7.5
    cli-util
Published: February 5, 2025

CVE-2024-57080

7.5
    vxe-table
Published: February 5, 2025

CVE-2024-57084

7.5
    dot-properties
Published: February 5, 2025

CVE-2024-57086

7.5
    node-opcua-alarm-condition
Published: February 5, 2025

CVE-2024-57699

7.5
    Netplex Json-smart
Published: February 5, 2025

CVE-2025-0725

7.3
    libcurl
Published: February 5, 2025

CVE-2025-24372

7.3
    CKAN
Published: February 5, 2025

CVE-2024-49352

7.1
    IBM Cognos Analytics
Published: February 5, 2025

CVE-2025-21117

6.6
    Dell Avamar
Published: February 5, 2025

CVE-2023-6386

6.5
    GitLab CE/EE
Published: February 5, 2025

CVE-2024-3976

6.5
    GitLab CE/EE
Published: February 5, 2025

CVE-2025-20184

6.5
    Cisco Secure Web Appliance
    Cisco Secure Email Gateway
Published: February 5, 2025

CVE-2024-7595

6.5
    Ietf
  • Generic Routing Encapsulation
  • Generic Routing Encapsulation6
Published: February 5, 2025

CVE-2024-7596

6.5
    Ietf
  • Generic Udp Encapsulation
Published: February 5, 2025

CVE-2025-24319

6.5
    BIG-IP Next Central Manager
Published: February 5, 2025

CVE-2024-57082

6.5
    @rpldy/uploader
Published: February 5, 2025

CVE-2024-57598

6.5
    Bento4
Published: February 5, 2025

CVE-2024-52365

6.4
    IBM Cloud Pak for Business Automation
Published: February 5, 2025

CVE-2024-56472

6.4
    IBM Aspera Shares
Published: February 5, 2025

CVE-2023-52925

6.2
    Linux Kernel
Published: February 5, 2025

CVE-2025-20179

6.1
    Cisco Expressway Series
Published: February 5, 2025

CVE-2025-20183

5.8
    Cisco Secure Web Appliance
Published: February 5, 2025

CVE-2024-42207

5.5
    HCL iAutomate
Published: February 5, 2025

CVE-2024-53962

5.4
    Adobe
  • Experience Manager
Published: February 5, 2025

CVE-2024-53963

5.4
    Adobe
  • Experience Manager
Published: February 5, 2025

CVE-2024-53964

5.4
    Adobe
  • Experience Manager
Published: February 5, 2025

CVE-2024-53965

5.4
    Adobe
  • Experience Manager
Published: February 5, 2025

CVE-2024-53966

5.4
    Adobe
  • Experience Manager
Published: February 5, 2025

CVE-2024-52364

5.4
    IBM Cloud Pak for Business Automation
Published: February 5, 2025

CVE-2024-54853

5.4
    Skybox Change Manager
Published: February 5, 2025

CVE-2024-56470

5.4
    IBM Aspera Shares
Published: February 5, 2025

CVE-2024-56471

5.4
    IBM Aspera Shares
Published: February 5, 2025

CVE-2024-13829

5.3
    Tripetto plugin for WordPress
Published: February 5, 2025

CVE-2024-56473

5.3
    Ibm
  • Aspera Shares
Published: February 5, 2025

CVE-2025-20180

4.8
    Cisco AsyncOS Software
Published: February 5, 2025

CVE-2025-20204

4.8
    Cisco Identity Services Engine
Published: February 5, 2025

CVE-2025-20205

4.8
    Cisco Identity Services Engine (ISE)
Published: February 5, 2025

CVE-2024-38317

4.8
    IBM Aspera Shares
Published: February 5, 2025

CVE-2024-38318

4.8
    IBM Aspera Shares
Published: February 5, 2025

CVE-2024-6356

4.4
    GitLab EE
Published: February 5, 2025

CVE-2025-23413

4.4
    F5 BIG-IP Next Central Manager
Published: February 5, 2025

CVE-2024-1539

4.3
    GitLab EE
Published: February 5, 2025

CVE-2024-49348

4.3
    IBM Cloud Pak for Business Automation
Published: February 5, 2025

CVE-2025-20207

4.3
    Cisco Secure Email and Web Manager
    Cisco Secure Web Appliance
    Cisco Secure Email Gateway
Published: February 5, 2025

CVE-2025-23419

4.3
    Nginx
Published: February 5, 2025

CVE-2024-38316

4.3
    Ibm
  • Aspera Shares
Published: February 5, 2025

CVE-2024-5528

3.5
    GitLab CE/EE
Published: February 5, 2025

CVE-2024-9097

3.5
    ManageEngine Endpoint Central
Published: February 5, 2025

CVE-2025-0167

3.4
    curl
Published: February 5, 2025

CVE-2025-20185

3.4
    Cisco Secure Email and Web Manager
    Cisco Secure Web Appliance
    Cisco Secure Email Gateway
    Cisco AsyncOS Software
Published: February 5, 2025

CVE-2025-23415

3.1
    BIG-IP APM
Published: February 5, 2025

CVE-2023-52924

None
    Linux Kernel
Published: February 5, 2025

CVE-2025-0665

None
    libcurl
    libcurl
Published: February 5, 2025

CVE-2025-0858

None
    Poly Edge E devices
Published: February 5, 2025

CVE-2025-24803

None
    Mobile Security Framework (MobSF)
Published: February 5, 2025

CVE-2025-24804

None
    Mobile Security Framework (MobSF)
Published: February 5, 2025

CVE-2025-24805

None
    Mobile Security Framework (MobSF)
Published: February 5, 2025

CVE-2024-48394

None
    NDD Print solution
Published: February 5, 2025

CVE-2024-57074

None
    xe-utils
Published: February 5, 2025

CVE-2024-57075

None
    eazy-logger
Published: February 5, 2025

CVE-2024-57076

None
    ajax-request
Published: February 5, 2025

CVE-2024-57077

None
    utils-extend
Published: February 5, 2025

CVE-2024-57079

None
    @zag-js/core
Published: February 5, 2025

CVE-2024-57081

None
    underscore-contrib
Published: February 5, 2025

CVE-2024-57085

None
    @stryker-mutator/util
Published: February 5, 2025
Click here to see more Vulnerabilities