Tag: 2025-03-05

7 Attack Reports | 143 Vulnerabilities

Attack reports

The Evolution of Dark Caracal Tools: Campaign Analysis Using the Poco RAT

Attacks using the Poco RAT are a continuation of the Dark Caracal group's campaign. This campaign was launched in 2022 and is aimed at Spanish-speaking countries in Latin America.
rat
phishing
windows
2025-03-05
vmware
bandook
poco rat
ultimate packer
executables
virtualbox
dark caracal
poco c++
Published: March 5, 2025
Downloadable IOCs: 41

New DDoS Botnet Discovered: Over 30,000 Hacked Devices, Majority of Observed Activity Traced to Iran

A new botnet that infects tens of thousands of internet-connected devices has been identified as being linked to Iran, according to research by GreyNoise and Nokia Deepfield. and Censys.
ddos
botnet
2025-03-05
team
telnet
greynoise
eleven11bot
deepfield
nvrs
Published: March 5, 2025
Downloadable IOCs: 1428

Beneath the Surface: Detecting and Blocking Hidden Malicious Traffic Distribution Systems

This analysis explores the use of traffic distribution systems (TDS) by threat actors to redirect network traffic for illicit purposes like phishing and malvertising. TDS act as central hubs, obfuscating final destinations and hindering detection. The study found that malicious TDS exhibit distinct…
phishing
malvertising
2025-03-05
cloaking
darknet
traffic distribution systems
Published: March 5, 2025
Downloadable IOCs: 0

Winos 4.0 Spreads via Impersonation of Official Email to Target Users in Taiwan

An advanced malware framework known as Winos4.0 was used to target companies in Taiwan in January 2025.
phishing
pdf
c2 server
valleyrat
wechat
screen capture
agent
2025-03-05
team
uacme
corrupt
Published: March 5, 2025
Downloadable IOCs: 55

Astrill VPN and DPRK Remote Worker Fraud

Spur Engineering is releasing a comprehensive list of IP addresses associated with the Astrill VPN service to help companies protect against fraud and abuse from the Democratic Republic of Korea (DPRK) in the future.
north korea
fraud
vpn
dprk
infrastructure
astrill vpn
2025-03-05
Published: March 5, 2025
Downloadable IOCs: 2360

Remcos RAT Targets Europe: New AMSI and ETW Evasion Tactics Uncovered

This week, the SonicWall threat research team discovered a new update in the Remcos infection chain aimed at enhancing its stealth by patching AMSI scanning and ETW logging to evade detection. This loader was seen distributing Async RAT in the past but now it has extended its functionality to Remco…
rat
phishing
powershell
remcos
2025-03-05
zip
vb script
Published: March 5, 2025
Downloadable IOCs: 7

SilentCryptoMiner distributed as a bypass tool

A mass malware campaign is infecting users with a cryptocurrency miner disguised as a tool for bypassing internet restrictions. The campaign has affected over 2,000 victims in Russia, utilizing YouTube channels to spread malicious links. Attackers are blackmailing content creators to post videos wi…
xworm
xmrig
njrat
dcrat
stealth techniques
cryptocurrency mining
silentcryptominer
2025-03-05
phemedrone
blackmail
restriction bypass
python loader
Published: March 5, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-25015

9.9
    Kibana
Published: March 5, 2025

CVE-2025-1316

9.8
    Edimax IC-7100
Published: March 5, 2025

CVE-2025-23410

9.8
    GMOD Apollo
Published: March 5, 2025

CVE-2025-24924

9.8
    GMOD Apollo
Published: March 5, 2025

CVE-2025-27638

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27640

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27641

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27642

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27643

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27645

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27646

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27647

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27648

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27649

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27650

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27651

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27652

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27655

9.8
    Vasion Print (PrinterLogic)
Published: March 5, 2025

CVE-2025-27656

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27657

9.8
    Vasion Print
Published: March 5, 2025

CVE-2025-27658

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27659

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27662

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27663

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27665

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27666

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27667

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27668

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27670

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27671

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27672

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27674

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27675

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27677

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host
Published: March 5, 2025

CVE-2025-27678

9.8
    Vasion Print (formerly PrinterLogic)
Published: March 5, 2025

CVE-2025-27681

9.8
    Vasion Print (formerly PrinterLogic) Virtual Appliance Host