Tag: 2025-03-12

6 Attack Reports | 103 Vulnerabilities

Attack reports

Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers

Mandiant discovered China-nexus espionage group UNC3886 deploying custom backdoors on Juniper Networks' Junos OS routers in mid-2024. The actor used TINYSHELL-based backdoors with various capabilities, including active and passive functions and log disabling. UNC3886 demonstrated advanced system kn…
espionage
china
persistence
medusa
backdoors
routers
process injection
gobrat
china-nexus
2025-03-12
CVE-2025-21590
reptile
tinyshell
pithook
network infrastructure
juniper
seaelf
busybox
ghosttown
2025-04-11
Published: April 11, 2025
Linked vulnerabilities : CVE-2025-21590 (CVSS 4.4), CVE-2022-41328, CVE-2025-22457 (CVSS 9.0)
Downloadable IOCs: 14

Remote Monitoring and Management (RMM) Tooling Increasingly an Attacker's First Choice

Threat actors are increasingly using legitimate remote monitoring and management (RMM) tools as initial payloads in email campaigns. This trend aligns with a decrease in the use of traditional loaders and botnets by initial access brokers. RMMs can be exploited for data collection, financial theft,…
screenconnect
rmm
remcos
lumma stealer
asyncrat
remote access
cybercrime
grandoreiro
email campaigns
netsupport
astaroth
initial access
2025-03-12
guildma
atera
mispadu
bluetrait
fleetdeck
Published: March 12, 2025
Downloadable IOCs: 15

JSPSpy and 'Filebroser': A Custom File Management Tool in Webshell Infrastructure

Researchers have identified a cluster of JSPSpy web shell servers featuring 'Filebroser', a modified version of the open-source File Browser project. The infrastructure spans multiple hosting providers in China and the United States, using both cloud services and traditional ISPs. JSPSpy, a Java-ba…
remote access
infrastructure
web shell
detection
2025-03-12
jspspy
file management
filebroser
http headers
Published: March 12, 2025
Downloadable IOCs: 4

APT37 - RokRat

APT37, a North Korean state-sponsored hacking group, has expanded its operations to target users on Windows and Android platforms through phishing campaigns. The group's attack vector involves malicious LNK files distributed via group chat platforms. The infection process begins with phishing email…
phishing
north korea
powershell
rokrat
cloud services
lnk files
remote access trojan
2025-03-12
Published: March 12, 2025
Downloadable IOCs: 9

Hundreds of thousands of rubles for your secrets: cyber spies disguise themselves as recruiters

Cybercriminals impersonating a real company are sending fake job descriptions to employees of targeted organizations. The attackers, known as Squid Werewolf, are offering substantial sums of money, potentially hundreds of thousands of rubles, in exchange for sensitive information. This sophisticate…
phishing
social engineering
impersonation
cyber espionage
2025-03-12
fake job offers
recruitment scam
Published: March 12, 2025
Downloadable IOCs: 6

Stopping Sobolan Malware with Aqua Runtime Protection

A new attack campaign targeting interactive computing environments like Jupyter Notebooks has been discovered. The attack involves downloading a compressed file from a remote server, which, when executed, deploys multiple malicious tools to exploit the server and establish persistence. The campaign…
evasion
persistence
cryptomining
cloud-native
2025-03-12
runtime protection
sobolan
jupyter notebooks
Published: March 12, 2025
Downloadable IOCs: 9
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-22954

10.0
    Koha
  • Koha
Published: March 12, 2025

CVE-2024-13446

9.8
    Wordpress
  • Workreap
Published: March 12, 2025

CVE-2025-1960

9.8
    Schneider Electric
  • Webhmi
Published: March 12, 2025

CVE-2025-27407

9.0
    Ruby
  • Graphql-Ruby
Published: March 12, 2025

CVE-2025-20138

8.8
    Cisco
  • Ios Xr Software
Published: March 12, 2025

CVE-2025-25711

8.8
    Dtp.Ae
  • Tnexus Airport View
Published: March 12, 2025

CVE-2025-20115

8.6
    Cisco
  • Ios Xr
Published: March 12, 2025

CVE-2025-20142

8.6
    Cisco
  • Asr 9000
  • Asr 9902
  • Asr 9903
  • Ios Xr
Published: March 12, 2025

CVE-2025-20146

8.6
    Cisco
  • Asr 9000
  • Asr 9902
  • Asr 9903
Published: March 12, 2025

CVE-2024-58087

8.1
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21855

7.8
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21856

7.8
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21858

7.8
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21863

7.8
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-1683

7.8
    1e
  • Client
Published: March 12, 2025

CVE-2025-25709

7.5
    Dtp.Ae
  • Tnexus Airport View
Published: March 12, 2025

CVE-2025-27788

7.5
    Ruby
  • Json
Published: March 12, 2025

CVE-2025-2240

7.5
    Smallrye
  • Smallrye-Fault-Tolerance
Published: March 12, 2025

CVE-2025-20209

7.5
    Cisco
  • Ios Xr
Published: March 12, 2025

CVE-2025-20141

7.4
    Cisco
  • Ios Xr
Published: March 12, 2025

CVE-2025-2219

7.3
    Lovecards
  • Lovecardsv2
Published: March 12, 2025

CVE-2025-27794

6.8
    Flarum
  • Flarum
Published: March 12, 2025

CVE-2025-0813

6.8
    Siemens
  • Epas-Ui
Published: March 12, 2025

CVE-2025-20143

6.7
    Cisco
  • Ios Xr
Published: March 12, 2025

CVE-2025-20177

6.7
    Cisco
  • Ios Xr
Published: March 12, 2025

CVE-2025-25774

6.5
    Open5gs
  • Open5gs
Published: March 12, 2025

CVE-2024-12589

6.4
    Woocommerce
  • Finale Lite
Published: March 12, 2025

CVE-2025-1527

6.4
    Wordpress
  • Shoplentor
  • Woocommerce Builder
Published: March 12, 2025

CVE-2025-2216

6.3
    Zzskzy
  • Warehouse Refinement Management System
Published: March 12, 2025

CVE-2025-2217

6.3
    Zzskzy
  • Warehouse Refinement Management System
Published: March 12, 2025

CVE-2025-2077

6.1
    Wordpress
  • Simple Amazon Affiliate
Published: March 12, 2025

CVE-2025-2002

6.0
    *
  • Ftp Server
  • Device
Published: March 12, 2025

CVE-2025-20145

5.8
    Cisco
  • Ios Xr
Published: March 12, 2025

CVE-2025-25566

5.6
    Softether
  • Softethervpn
Published: March 12, 2025

CVE-2025-25683

5.6
    Aleksis-Core
  • Aleksis-Core
Published: March 12, 2025

CVE-2024-13838

5.5
    Uncanny Automator
  • Uncanny Automator
Published: March 12, 2025

CVE-2024-58088

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2024-58089

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21844

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21845

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21846

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21847

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21848

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21849

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21850

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21852

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21853

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21854

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21857

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21859

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21861

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21862

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21864

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21865

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21866

5.5
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-27914

5.4
    Zimbra
  • Zimbra Collaboration
Published: March 12, 2025

CVE-2025-27915

5.4
    Zimbra
  • Zimbra Collaboration
Published: March 12, 2025

CVE-2025-2218

5.3
    Lovecards
  • Lovecards
Published: March 12, 2025

CVE-2025-1508

5.3
    Wordpress
  • Wp Crowdfunding
Published: March 12, 2025

CVE-2024-13498

5.3
    Wordpress
  • Nex-Forms
Published: March 12, 2025

CVE-2025-2239

5.3
    Hillstone Networks
  • Hillstone Next Generation Firewall
Published: March 12, 2025

CVE-2025-29904

5.3
    Jetbrains
  • Ktor
Published: March 12, 2025

CVE-2024-27763

5.3
    Xpixelgroup
  • Basicsr
Published: March 12, 2025

CVE-2025-29903

5.2
    Jetbrains
  • Runtime
Published: March 12, 2025

CVE-2025-1984

5.2
    Xerox
  • Desktop Print Experience
Published: March 12, 2025

CVE-2025-2215

4.7
    Doufox
  • Doufox
Published: March 12, 2025

CVE-2025-2076

4.4
    Wordpress
  • Binlayerpress
Published: March 12, 2025

CVE-2025-2078

4.4
    Wordpress
  • Plugin
Published: March 12, 2025

CVE-2025-2205

4.4
    Wordpress
  • Gdpr Cookie Compliance
Published: March 12, 2025

CVE-2025-21590

4.4
    Juniper
  • Juniper Junos Os
Published: March 12, 2025

CVE-2024-13430

4.3
    Wordpress
  • Plugin
Published: March 12, 2025

CVE-2024-52362

4.3
    Ibm
  • App Connect Enterprise Certified Container
Published: March 12, 2025

CVE-2025-29891

4.2
    Apache
  • Camel
Published: March 12, 2025

CVE-2024-34398

4.2
    Bmc Remedy
  • Mid Tier
Published: March 12, 2025

CVE-2025-20144

4.0
    Cisco
  • Ios Xr
Published: March 12, 2025

CVE-2025-24912

3.7
    Hostapd
  • Hostapd
Published: March 12, 2025

CVE-2025-2214

3.5
    Microweber
  • Microweber
Published: March 12, 2025

CVE-2025-2220

3.3
    Odyssey
  • Cms
Published: March 12, 2025

CVE-2025-21851

3.3
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2025-21860

3.3
    Linux
  • Linux Kernel
Published: March 12, 2025

CVE-2024-13870

None
    Bitdefender
  • Box
Published: March 12, 2025

CVE-2024-13871

None
    Bitdefender
  • Box 1
Published: March 12, 2025

CVE-2024-13872

None
    Bitdefender
  • Box
Published: March 12, 2025

CVE-2024-10838

None
    Eclipse
  • Eclipse
Published: March 12, 2025

CVE-2025-0883

None
    Opentext
  • Service Manager
Published: March 12, 2025

CVE-2025-0884

None
    Opentext
  • Service Manager
Published: March 12, 2025

CVE-2025-25565

None
    Softether
  • Softether Vpn
Published: March 12, 2025

CVE-2025-25567

None
    Softether
  • Softether Vpn
Published: March 12, 2025

CVE-2025-25568

None
    Softether
  • Softether Vpn
Published: March 12, 2025

CVE-2025-26260

None
    Plenti
  • Plenti
Published: March 12, 2025

CVE-2025-27867

None
    Apache
  • Felix Http Webconsole Plugin
Published: March 12, 2025

CVE-2025-27017

None
    Apache
  • Ni-Fi
Published: March 12, 2025

CVE-2025-0114

None
    Palo Alto Networks
  • Pan-Os
Published: March 12, 2025

CVE-2025-0115

None
    Paloaltonetworks
  • Pan-Os
Published: March 12, 2025

CVE-2025-0116

None
    Palo Alto Networks
  • Pan-Os
Published: March 12, 2025

CVE-2025-0117

None
    Palo Alto Networks
  • Globalprotect
Published: March 12, 2025

CVE-2025-0118

None
    Palo Alto Networks
  • Globalprotect
Published: March 12, 2025

CVE-2025-22870

None
    Golang
  • Go
Published: March 12, 2025

CVE-2025-25975

None
    Parse-Git-Config
  • Parse-Git-Config
Published: March 12, 2025

CVE-2024-26290

None
    Avid
  • Nexis E Series
  • Nexis F Series
  • Nexis Pro Plus
  • System Director Appliance
Published: March 12, 2025

CVE-2025-25291

None
    Ruby
  • Saml
Published: March 12, 2025

CVE-2025-25292

None
    Ruby-Saml
  • Ruby-Saml
Published: March 12, 2025

CVE-2025-25293

None
    Ruby-Saml
  • Ruby-Saml
Published: March 12, 2025
Click here to see more Vulnerabilities