Tag: 2025-03-06

8 Attack Reports | 140 Vulnerabilities

Attack reports

Malvertising campaign leads to info stealers hosted on GitHub

A large-scale malvertising campaign impacting nearly one million devices globally was detected in December 2024. The attack originated from illegal streaming websites with embedded malvertising redirectors, leading users through multiple redirections to malware hosted on GitHub and other platforms.…
malvertising
lumma stealer
github
lumma
netsupport rat
information stealer
multi-stage attack
doenerium
2025-03-06
living-off-the-land
Published: March 6, 2025
Downloadable IOCs: 3

Medusa Ransomware Activity Continues to Increase

Medusa ransomware attacks jumped by 42% between 2023 and 2024. This increase in activity continues to escalate, with almost twice as many Medusa attacks observed in January and February 2025 as in the first two months of 2024.
ransomware
blackcat
anydesk
rclone
service
medusa
netscan
raas
medusalocker
psexec
simplehelp
2025-03-06
ttps
pdq deploy
pdq inventory
spearwing
navicat
avkiller
Published: March 6, 2025
Downloadable IOCs: 45

Unmasking GrassCall Campaign: The APT Behind Job Recruitment Cyber Scams

The GrassCall malware campaign is an advanced social engineering attack conducted by a Russian-speaking cybercriminal group called Crazy Evil. Targeting job seekers in the cryptocurrency and Web3 sectors, the campaign uses fake job interviews to compromise victims' systems and steal cryptocurrency …
rat
phishing
social engineering
rhadamanthys
cryptocurrency theft
amos
2025-03-06
job recruitment
atomic macos stealer (amos)
grasscall
Published: March 6, 2025
Downloadable IOCs: 14

Unmasking the new persistent attacks on Japan

An unknown attacker has been targeting organizations in Japan since January 2025, exploiting CVE-2024-4577, a remote code execution vulnerability in PHP-CGI on Windows. The attacker uses the Cobalt Strike kit 'TaoWu' for post-exploitation activities, including reconnaissance, privilege escalation, …
powershell
cobalt strike
persistence
credential theft
CVE-2024-4577
japan
2025-03-06
php-cgi
taowu
Published: March 6, 2025
Linked vulnerabilities : CVE-2024-4577 (CVSS 9.8)
Downloadable IOCs: 3

PrintSteal: Exposing unauthorized CSC-Impersonating Websites Engaging in Large-Scale KYC Document Generation Fraud

This investigation uncovers a massive criminal operation known as 'PrintSteal' that generates and distributes fake Indian KYC documents. The scheme involves over 1,800 fraudulent domains impersonating government websites, with at least 2,727 registered operators on one platform alone. Over 167,000 …
india
identity theft
government impersonation
2025-03-06
api abuse
financial crime
document forgery
kyc fraud
Published: March 6, 2025
Downloadable IOCs: 9

BADBOX 2.0 Targets Consumer Devices with Multiple Fraud Schemes

HUMAN's Satori Threat Intelligence team uncovered and partially disrupted BADBOX 2.0, a complex fraud operation targeting low-cost consumer devices. This operation, an expansion of the 2023 BADBOX scheme, infected over 1 million Android Open Source Project devices worldwide with a backdoor called B…
backdoor
iot
botnet
ad fraud
badbox
vo1d
2025-03-06
ctv
bb2door
residential proxy
click fraud
badbox 2.0
Published: March 6, 2025
Downloadable IOCs: 59

Stealers and backdoors are spreading under the guise of a DeepSeek client

Cybercriminals are exploiting the popularity of DeepSeek, a powerful reasoning large language model, by creating fake websites that mimic the official DeepSeek chatbot site and distribute malicious code disguised as a client. Three main schemes were identified: a Python stealer targeting user data …
backdoor
social engineering
typosquatting
powershell
stealer
dll sideloading
farfli
deepseek
2025-03-06
Published: March 6, 2025
Downloadable IOCs: 9

The Next Level: Typo DGAs Used in Malicious Redirection Chains

A new campaign leveraging newly registered domains (NRDs) and a novel variant of domain generation algorithms (DGAs) has been uncovered. The campaign used over 6,000 NRDs redirecting to domains resembling dictionary-based DGAs. These NRDs led to advertisements of potentially unwanted Android applic…
2025-03-06
dictionary dga
typo dga
newly registered domains
Published: March 6, 2025
Downloadable IOCs: 17
Click here to see more Attack Reports

Vulnerabilities

CVE-2024-12144

9.8
    Finder Fire Safety Finder ERP/CRM (Old System)
Published: March 6, 2025

CVE-2025-25361

9.8
    PublicCMS
Published: March 6, 2025

CVE-2025-25763

9.8
    crmeb CRMEB-KY
Published: March 6, 2025

CVE-2024-42844

8.1
    EPICOR Prophet 21 (P21)
Published: March 6, 2025

CVE-2025-25497

8.1
    Netsweeper Server
Published: March 6, 2025

CVE-2025-22447

7.8
    RemoteView Agent (for Windows)
Published: March 6, 2025

CVE-2025-24864

7.8
    RemoteView Agent (for Windows)
Published: March 6, 2025

CVE-2024-58060

7.8
    Linux kernel
Published: March 6, 2025

CVE-2024-12742

7.8
    NI G Web Development Software
Published: March 6, 2025

CVE-2024-7872

7.6
    ExtremePACS Extreme XDS
Published: March 6, 2025

CVE-2024-12146

7.5
    Finder Fire Safety Finder ERP/CRM (New System)
Published: March 6, 2025

CVE-2024-51476

7.5
    IBM Concert Software
Published: March 6, 2025

CVE-2024-52923

7.5
    Samsung Exynos Processors
Published: March 6, 2025

CVE-2024-52924

7.5
    Samsung NRMM in Mobile Processor, Wearable Processor, and Modem Exynos
Published: March 6, 2025

CVE-2024-50600

7.5
    Samsung Mobile Processor and Wearable Processor Exynos
Published: March 6, 2025

CVE-2025-25381

7.5
    KSRTC AWATAR app of Karnataka State Road Transport Corporation
Published: March 6, 2025

CVE-2025-26167

7.5
    Buffalo LS520D
Published: March 6, 2025

CVE-2025-27598

7.5
    ImageSharp
Published: March 6, 2025

CVE-2025-20903

7.3
    SecSettingsIntelligence
Published: March 6, 2025

CVE-2025-20929

7.3
    Samsung Notes
Published: March 6, 2025

CVE-2025-20931

7.3
    Samsung Notes
Published: March 6, 2025

CVE-2025-2030

7.3
    Seeyon Zhiyuan Interconnect FE Collaborative Office Platform
Published: March 6, 2025

CVE-2025-2034

7.3
    PHPGurukul Pre-School Enrollment System
Published: March 6, 2025

CVE-2025-2038

7.3
    Blood Bank Management System
Published: March 6, 2025

CVE-2025-20908

6.5
    Auracast
Published: March 6, 2025

CVE-2024-13897

6.5
    Moving Media Library plugin for WordPress
Published: March 6, 2025

CVE-2025-0337

6.5
    ServiceNow
Published: March 6, 2025

CVE-2024-57972

6.5
    Microsoft HoloLens
Published: March 6, 2025

CVE-2025-1979

6.4
    ray
Published: March 6, 2025

CVE-2024-38311

6.3
    Apache Traffic Server
Published: March 6, 2025

CVE-2024-56195

6.3
    Apache Traffic Server
Published: March 6, 2025

CVE-2024-56196

6.3
    Apache Traffic Server
Published: March 6, 2025

CVE-2025-2031

6.3
    ChestnutCMS
Published: March 6, 2025

CVE-2025-2033

6.3
    Blood Bank Management System
Published: March 6, 2025

CVE-2025-2035

6.3
    UNKNOWN
Published: March 6, 2025

CVE-2025-2036

6.3
    s-a-zhd Ecommerce-Website-using-PHP
Published: March 6, 2025

CVE-2025-2037

6.3
    Blood Bank Management System
Published: March 6, 2025

CVE-2025-2040

6.3
    zhijiantianya ruoyi-vue-pro
Published: March 6, 2025

CVE-2025-2041

6.3
    UNKNOWN
Published: March 6, 2025

CVE-2025-2046

6.3
    SourceCodester Best Employee Management System
Published: March 6, 2025

CVE-2025-20910

6.2
    Samsung Galaxy Watch Gallery
Published: March 6, 2025

CVE-2025-20912

6.2
    DiagMonAgent
Published: March 6, 2025

CVE-2024-13868

6.1
    URL Shortener | Conversion Tracking | AB Testing | WooCommerce WordPress plugin
Published: March 6, 2025

CVE-2025-20913

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20914

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20915

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20916

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20917

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20918

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20919

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20920

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20921

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20922

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20925

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20926

5.5
    My Files
Published: March 6, 2025

CVE-2025-20927

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20928

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20930

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20932

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-20933

5.5
    Samsung Notes
Published: March 6, 2025

CVE-2025-1672

5.5
    Notibar - Notification Bar for WordPress plugin
Published: March 6, 2025

CVE-2025-27506

5.4
    NocoDB
Published: March 6, 2025

CVE-2025-2029

5.3
    MicroDicom DICOM Viewer
Published: March 6, 2025

CVE-2025-25294

5.3
    Envoy Gateway
Published: March 6, 2025

CVE-2025-25450

5.1
    MyTaag
Published: March 6, 2025

CVE-2025-25451

5.1
    MyTaag
Published: March 6, 2025

CVE-2025-25452

5.1
    MyTaag
Published: March 6, 2025

CVE-2025-26699

5.0
    Django
Published: March 6, 2025

CVE-2025-0877

4.7
    AtaksAPP Reservation Management System
Published: March 6, 2025

CVE-2025-2039

4.7
    Blood Bank Management System
Published: March 6, 2025

CVE-2025-2043

4.7
    LinZhaoguan pb-cms
Published: March 6, 2025

CVE-2025-2044

4.7
    Blood Bank Management System
Published: March 6, 2025

CVE-2025-20924

4.6
    Samsung Notes
Published: March 6, 2025

CVE-2025-20911

4.4
    Samsung Galaxy Watch
Published: March 6, 2025

CVE-2024-56202

4.3
    Apache Traffic Server
Published: March 6, 2025

CVE-2025-1383

4.3
    Podlove Podcast Publisher plugin for WordPress
Published: March 6, 2025

CVE-2025-1666

4.3
    WordPress Cookie banner plugin - Cookiebot CMP by Usercentrics
Published: March 6, 2025

CVE-2025-2045

4.3
    GitLab EE
Published: March 6, 2025

CVE-2025-2042

4.3
    UNKNOWN
Published: March 6, 2025

CVE-2025-20909

4.0
    Samsung Galaxy devices
Published: March 6, 2025

CVE-2025-20923

4.0
    Galaxy Wearable
Published: March 6, 2025

CVE-2025-2032

3.5
    ChestnutCMS
Published: March 6, 2025

CVE-2025-2047

3.5
    PHPGurukul Art Gallery Management System
Published: March 6, 2025

CVE-2025-2049

3.5
    Blood Bank System
Published: March 6, 2025

CVE-2025-1540

3.1
    GitLab CE/EE
Published: March 6, 2025

CVE-2024-13902

2.4
    huang-yk student-manage
Published: March 6, 2025

CVE-2025-22623

None
    Ad Inserter
Published: March 6, 2025

CVE-2025-1696

None
    Docker Desktop
Published: March 6, 2025

CVE-2024-13892

None
    Smartwares cameras CIP-37210AT
    other cameras with the same firmware
Published: March 6, 2025

CVE-2024-13893

None
    Smartwares cameras CIP-37210AT
    Smartwares cameras C724IP
Published: March 6, 2025

CVE-2024-13894

None
    Smartwares cameras CIP-37210AT
    C724IP
Published: March 6, 2025

CVE-2024-58051

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58052

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58053

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58054

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58055

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58056

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58057

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58058

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58059

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58061

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58062

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58063

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58064

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58065

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58066

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58067

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58068

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58069

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58070

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58071

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58072

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58073

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58074

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58075

None
    Linux kernel
Published: March 6, 2025

CVE-2025-21825

None
    Linux Kernel
Published: March 6, 2025

CVE-2025-21826

None
    Linux kernel
Published: March 6, 2025

CVE-2025-21827

None
    Linux kernel
Published: March 6, 2025

CVE-2025-21828

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58076

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58077

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58078

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58079

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58080

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58081

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58082

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58083

None
    Linux Kernel
Published: March 6, 2025

CVE-2024-58084

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58085

None
    Linux kernel
Published: March 6, 2025

CVE-2024-58086

None
    Linux kernel
Published: March 6, 2025

CVE-2025-21829

None
    Linux kernel
Published: March 6, 2025

CVE-2025-21830

None
    Linux Kernel
Published: March 6, 2025

CVE-2025-21831

None
    Linux Kernel
Published: March 6, 2025

CVE-2025-21832

None
    Linux kernel
Published: March 6, 2025

CVE-2025-21833

None
    Linux kernel
Published: March 6, 2025

CVE-2025-21834

None
    Linux kernel
Published: March 6, 2025

CVE-2025-24796

None
    Collabora Online
Published: March 6, 2025

CVE-2025-25191

None
    Group-Office
Published: March 6, 2025

CVE-2025-27509

None
    fleet
Published: March 6, 2025

CVE-2025-27600

None
    FastGPT
Published: March 6, 2025
Click here to see more Vulnerabilities