Tag: 2025-02-28

7 Attack Reports | 93 Vulnerabilities

Attack reports

2024 Malicious Infrastructure Insights: Key Trends and Threats

The report highlights significant trends in malicious infrastructure for 2024, including the rise of malware-as-a-service infostealers, continued dominance of Cobalt Strike among offensive security tools, and increased use of legitimate services by threat actors. Key findings include LummaC2's domi…
lummac2
plugx
cobalt strike
asyncrat
cybercrime
infostealers
dcrat
latrodectus
botnets
mobile malware
malicious infrastructure
quasarrat
hook
gobrat
brute ratel c4
remote access trojans
2025-02-28
traffic distribution systems
mozi botnet
state-sponsored groups
command-and-control servers
solarmarker rat
offensive security tools
Published: February 28, 2025
Downloadable IOCs: 0

Russian campaign targeting Romanian WhatsApp numbers

A campaign originating from Russia has been identified, targeting Romanian WhatsApp users. The operation involves sending messages to victims, encouraging them to vote in a fake contest. When users click on the provided link, they are prompted to enter their WhatsApp number and an 8-character code,…
phishing
social engineering
whatsapp
russia
account takeover
2025-02-28
romania
Published: February 28, 2025
Downloadable IOCs: 0

Analysis of an incident involving a web shell used as a backdoor

A SOC investigation uncovered a web shell attack on a government SharePoint server in Southeast Asia. The attackers used certutil to download an ASPX payload disguised as a 404 page, then employed Potato tools for privilege escalation. Analysis revealed the web shell to be Behinder, a modular backd…
privilege escalation
badpotato
behinder
godpotato
web shell
southeast asia
2025-02-28
memory-based threats
sweetpotato
potato tools
Published: February 28, 2025
Downloadable IOCs: 0

DNS Early Detection - Fast Propagating Fake Captcha distributes LummaStealer

Between October 2024 and February 2025, LummaStealer malware was distributed via fake CAPTCHA pages, targeting users who store sensitive information in browsers and cryptocurrency wallets. The malware, available as a Malware-as-a-Service, collects data for fraud and unauthorized access. Threat acto…
lummac2
malware-as-a-service
information stealer
early detection
fake captcha
lummastealer
malicious domains
2025-02-27
dns traffic analysis
adtech
2025-02-28
dns monitoring
Published: February 28, 2025
Downloadable IOCs: 11

Long Live The Vo1d Botnet: New Variant Hits 1.6 Million TV Globally

The Vo1d botnet has infected 1.6 million Android TV devices across 200+ countries, posing a significant cybersecurity threat. This new variant demonstrates enhanced stealth and resilience, utilizing RSA encryption, DGA-based infrastructure, and a modified XXTEA algorithm. The botnet's scale and cap…
botnet
2025-02-28
vo1d
proxy network
android tv
set-top box
Published: February 28, 2025
Downloadable IOCs: 48

Sellers can get scammed too, and a rant about imposter syndrome

This report discusses two main topics: imposter syndrome in cybersecurity and scams targeting sellers. It highlights the prevalence of imposter syndrome among cybersecurity professionals, especially in high-performing teams, and offers advice on coping with self-doubt. The report also addresses sel…
sagerunex
2025-02-28
linux backdoor
fraud prevention
online scams
seller abuse
Published: February 28, 2025
Downloadable IOCs: 2

Your MFA Is No Match for Sneaky2FA

In early February 2025, the eSentire Threat Response Unit detected a user accessing a phishing site associated with Sneaky2FA, an Adversary-in-the-Middle Phishing-as-a-Service kit designed to bypass two-factor authentication. The attack involved a spam email with a link to a phishing PDF in OneDriv…
phishing
phaas
2fa bypass
office 365
2025-02-28
session cookies
sneaky2fa
Published: February 28, 2025
Downloadable IOCs: 15
Click here to see more Attack Reports

Vulnerabilities

CVE-2024-8420

9.8
    Sitesao
  • Dhvc Form
Published: February 28, 2025

CVE-2024-8425

9.8
    Wpswings
  • Woocommerce Ultimate Gift Card
Published: February 28, 2025

CVE-2024-9193

9.8
    WHMpress - WHMCS WordPress Integration Plugin
Published: February 28, 2025

CVE-2025-25379

9.6
    07FLYCMS
Published: February 28, 2025

CVE-2025-0159

9.1
    IBM FlashSystem
Published: February 28, 2025

CVE-2024-12811

8.8
    Traveler theme for WordPress
Published: February 28, 2025

CVE-2025-1682

8.8
    WordPress Cardealer theme
Published: February 28, 2025

CVE-2025-1687

8.8
    Cardealer theme for WordPress
Published: February 28, 2025

CVE-2025-0975

8.8
    IBM MQ
Published: February 28, 2025

CVE-2024-9195

8.8
    Whmpress
  • Whmcs Client Area
Published: February 28, 2025

CVE-2025-26326

8.8
    NVDA (Nonvisual Desktop Access)
Published: February 28, 2025

CVE-2025-25723

8.4
    GPAC
Published: February 28, 2025

CVE-2025-25477

8.1
    SysPass
Published: February 28, 2025

CVE-2025-1570

8.1
    Wpwax
  • Directorist
Published: February 28, 2025

CVE-2025-0160

8.1
    IBM FlashSystem
Published: February 28, 2025

CVE-2025-25428

8.0
    TRENDnet TEW-929DRU
Published: February 28, 2025

CVE-2025-25609

8.0
    TOTOlink A3002R
Published: February 28, 2025

CVE-2025-25610

8.0
    TOTOlink A3002R
Published: February 28, 2025

CVE-2025-25635

8.0
    TOTOlink A3002R
Published: February 28, 2025

CVE-2025-25729

7.5
    UNKNOWN
    Bosscomm IF740 Firmware
Published: February 28, 2025

CVE-2025-20060

7.5
    Dario Health application
Published: February 28, 2025

CVE-2025-1513

7.2
    Contest-Gallery
  • Contest Gallery
Published: February 28, 2025

CVE-2024-13831

7.2
    Wpbranch
  • Tabs For Woocommerce
Published: February 28, 2025

CVE-2025-24849

7.1
    UNKNOWN
Published: February 28, 2025

CVE-2024-44754

6.8
    Minut M2
Published: February 28, 2025

CVE-2025-24318

6.8
    UNKNOWN
Published: February 28, 2025

CVE-2025-22491

6.7
    Foreseer Reporting Software (FRS)
Published: February 28, 2025

CVE-2024-56340

6.5
    IBM Cognos Analytics
Published: February 28, 2025

CVE-2025-0823

6.5
    IBM Cognos Analytics
Published: February 28, 2025

CVE-2025-23225

6.5
    IBM MQ
Published: February 28, 2025

CVE-2025-0764

6.5
    Gvectors
  • Wpforo Forum
Published: February 28, 2025

CVE-2025-1572

6.5
    Iqonic
  • Kivicare
Published: February 28, 2025

CVE-2025-27410

6.5
    PwnDoc
Published: February 28, 2025

CVE-2025-27413

6.5
    PwnDoc
Published: February 28, 2025

CVE-2025-25478

6.5
    Syspass
Published: February 28, 2025

CVE-2025-1757

6.4
    Portfoliohub
  • Portfoliohub
Published: February 28, 2025

CVE-2024-12820

6.4
    Webtamarin
  • Mk Google Directions
Published: February 28, 2025

CVE-2025-1405

6.4
    Implecode
  • Product Catalog Simple
Published: February 28, 2025

CVE-2025-1571

6.4
    Exclusiveaddons
  • Exclusive Addons For Elementor
Published: February 28, 2025

CVE-2024-13469

6.4
    Pickplugins
  • Pricing Table
Published: February 28, 2025

CVE-2024-9019

6.4
    Secupress
  • Secupress
Published: February 28, 2025

CVE-2025-1560

6.4
    Darkosxrc
  • Wow Entrance Effects \(Wee\!\)
Published: February 28, 2025

CVE-2025-1662

6.4
    Apprhyme
  • Url Media Uploader
Published: February 28, 2025

CVE-2025-1319

6.4
    Elementor
  • Site Mailer
Published: February 28, 2025

CVE-2025-22492

6.3
    Foreseer Reporting Software (FRS)
Published: February 28, 2025

CVE-2025-1505

6.1
    Berocket
  • Advanced Ajax Product Filters
Published: February 28, 2025

CVE-2025-1511

6.1
    Wpeverest
  • User Registration
Published: February 28, 2025

CVE-2025-1300

6.1
    CodeChecker
Published: February 28, 2025

CVE-2025-1746

6.1
    OpenCart
Published: February 28, 2025

CVE-2025-1776

6.1
    Soteshop
Published: February 28, 2025

CVE-2024-13638

5.9
    Directsoftware
  • Order Attachments For Woocommerce
Published: February 28, 2025

CVE-2025-26466

5.9
    Openbsd
  • Openssh
    Canonical
    Debian
Published: February 28, 2025

CVE-2025-20049

5.8
    Dario Health portal service application
Published: February 28, 2025

CVE-2024-13851

5.5
    Internet-Formation
  • Modal Portfolio
Published: February 28, 2025

CVE-2024-54175

5.5
    IBM MQ
Published: February 28, 2025

CVE-2025-0985

5.5
    IBM MQ
Published: February 28, 2025

CVE-2025-1681

5.4
    Cardealer theme for WordPress
Published: February 28, 2025

CVE-2025-25916

5.4
    wuzhicms
Published: February 28, 2025

CVE-2025-25461

5.4
    SeedDMS
Published: February 28, 2025

CVE-2025-25476

5.4
    SysPass
Published: February 28, 2025

CVE-2024-13796

5.3
    Pickplugins
  • Post Grid
Published: February 28, 2025

CVE-2025-23405

5.3
    UNKNOWN
Published: February 28, 2025

CVE-2025-24316

5.3
    Dario Health Internet-based server infrastructure
Published: February 28, 2025

CVE-2025-26047

5.1
    Loggrove
Published: February 28, 2025

CVE-2025-26263

5.1
    GeoVision ASManager Windows desktop application
Published: February 28, 2025

CVE-2025-24843

5.1
    UNKNOWN
Published: February 28, 2025

CVE-2025-25430

4.8
    Trendnet TEW-929DRU
Published: February 28, 2025

CVE-2025-25431

4.8
    Trendnet TEW-929DRU
Published: February 28, 2025

CVE-2025-27408

4.8
    Manifest
Published: February 28, 2025

CVE-2025-25429

4.8
    Trendnet TEW-929DRU
Published: February 28, 2025

CVE-2024-54173

4.7
    IBM MQ
Published: February 28, 2025

CVE-2025-1747

4.7
    OpenCart
Published: February 28, 2025

CVE-2025-1748

4.7
    OpenCart
Published: February 28, 2025

CVE-2025-1749

4.7
    OpenCart
Published: February 28, 2025

CVE-2025-0801

4.3
    Ratemyagent
  • Ratemyagent
Published: February 28, 2025

CVE-2025-1506

4.3
    Wpmet
  • Wp Social Login And Register Social Counter
Published: February 28, 2025

CVE-2024-13716

4.3
    Tarbor
  • Forex Calculators
Published: February 28, 2025

CVE-2024-13832

4.3
    Uncodethemes
  • Ultra Addons Lite For Elementor
Published: February 28, 2025

CVE-2024-10860

4.3
    Xlplugins
  • Nextmove
Published: February 28, 2025

CVE-2025-27400

2.9
    Magento Long Term Support (LTS)
Published: February 28, 2025

CVE-2025-25727

None
    Bosscomm IF740
Published: February 28, 2025

CVE-2025-25728

None
    Bosscomm IF740 Firmware
Published: February 28, 2025

CVE-2025-1744

None
    radare2
Published: February 28, 2025

CVE-2025-1413

None
    DaVinci Resolve
Published: February 28, 2025

CVE-2025-22270

None
    CyberArk Endpoint Privilege Manager
Published: February 28, 2025

CVE-2025-22271

None
    CyberArk Endpoint Privilege Manager
Published: February 28, 2025

CVE-2025-22272

None
    CyberArk Endpoint Privilege Manager in SaaS
Published: February 28, 2025

CVE-2025-22273

None
    CyberArk Endpoint Privilege Manager
Published: February 28, 2025

CVE-2025-22274

None
    CyberArk Endpoint Privilege Manager
Published: February 28, 2025

CVE-2025-1795

None
    Python
Published: February 28, 2025

CVE-2025-0769

None
    PixelYourSite
Published: February 28, 2025

CVE-2025-27414

None
    MinIO
Published: February 28, 2025

CVE-2024-1509

None
    Brocade ASCG Web Interface
Published: February 28, 2025
Click here to see more Vulnerabilities