Tag: 2025-03-18

6 Attack Reports | 72 Vulnerabilities

Attack reports

South Korean Organizations Targeted by Cobalt Strike 'Cat' Delivered by a Rust Beacon

An exposed web server containing tools for an intrusion campaign targeting South Korean organizations was identified. The server hosted a Rust-compiled Windows executable delivering Cobalt Strike Cat, along with SQLMap, Web-SurvivalScan, and dirsearch. The threat actor used these tools to identify …
sql injection
south korea
reconnaissance
2025-03-18
rust beacon
cobalt strike cat
marte
mingw
open directory
marte shellcode
Published: March 18, 2025
Downloadable IOCs: 9

Operation AkaiRyū: Europe invited to Expo 2025 and ANEL backdoor revived

Chinese threat actor MirrorFace expanded its cyberespionage activities beyond Japan, targeting a Central European diplomatic institute in relation to Expo 2025. The group refreshed its tactics, introducing new tools like customized AsyncRAT and reviving the ANEL backdoor previously associated with …
spearphishing
asyncrat
apt10
anel
2025-03-18
windows sandbox
expo 2025
visual studio code
hiddenface
facexinjector
Published: March 18, 2025
Downloadable IOCs: 6

Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns

A Windows .lnk file vulnerability, ZDI-CAN-25373, has been extensively exploited by state-sponsored and cybercriminal groups. The vulnerability allows hidden command execution through crafted shortcut files, exposing organizations to data theft and cyber espionage risks. Nearly 1,000 malicious .lnk…
apt
espionage
windows
vulnerability
data theft
zero-day
lnk
raspberry robin
command execution
2025-03-18
shortcut
Published: March 18, 2025
Downloadable IOCs: 851

Legacy Driver Exploitation Through Bypassing Certificate Verification

A new security threat using the Legacy Driver Exploitation technique has been identified, focusing on remote system control via Gh0stRAT malware. The attack distributes malware through phishing and messaging apps, utilizing DLL side-loading for additional payloads. A modified TrueSight.sys driver b…
gh0strat
dll side-loading
avkiller
2025-03-18
padding manipulation
legacy driver exploitation
CVE-2013-3900
certificate verification
driver vulnerability
truesight.sys
Published: March 18, 2025
Downloadable IOCs: 3

Python Bot Delivered Through DLL Side-Loading

A sophisticated malware campaign employs DLL side-loading to deliver a Python bot. The attack begins with a ZIP archive containing a legitimate PDF reader executable and a hidden malicious DLL. When executed, the malicious DLL is loaded instead of the intended Microsoft one, altering the PDF reader…
persistence
dll side-loading
evasion techniques
bitbucket
2025-03-18
code obfuscation
pdf reader
python bot
Published: March 18, 2025
Downloadable IOCs: 0

ClearFake’s New Widespread Variant: Increased Web3 Exploitation for Malware Delivery

ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through drive-by downloads. Threat Actors compromise legitimate websites, injecting malicious JavaScript code that redirects users to convincing fake update pages for browsers like Chrome and Edge. Th…
javascript
clearfake
blockchain
2025-03-18
browserupdate
wateringhole
Published: March 18, 2025
Downloadable IOCs: 30
Click here to see more Attack Reports

Vulnerabilities

CVE-2024-56346

10.0
    Ibm
  • Aix
Published: March 18, 2025

CVE-2023-47539

9.8
    Fortinet
  • Fortimail
Published: March 18, 2025

CVE-2024-8997

9.8
    Vestel
  • Evc04 Configuration Interface
Published: March 18, 2025

CVE-2024-56347

9.6
    Ibm
  • Aix
Published: March 18, 2025

CVE-2024-23943

9.1
    *
  • *
Published: March 18, 2025

CVE-2025-25220

8.8
    +F
  • Fs010m
Published: March 18, 2025

CVE-2024-12563

8.8
    Wordpress
  • S2member Pro
Published: March 18, 2025

CVE-2025-24801

8.5
    Glpi
  • Glpi
Published: March 18, 2025

CVE-2025-0755

8.4
    Mongodb
  • Libbson
  • Mongodb Server
Published: March 18, 2025

CVE-2024-21760

8.4
    Fortinet
  • Fortisoar
Published: March 18, 2025

CVE-2025-2449

7.8
    National Instruments
  • Flexlogger
Published: March 18, 2025

CVE-2025-2450

7.8
    National Instruments
  • Vision Builder Ai
Published: March 18, 2025

CVE-2025-27688

7.8
    Dell
  • Thinos
Published: March 18, 2025

CVE-2025-1468

7.5
    Codesys
  • Codesys Opc Ua Server
Published: March 18, 2025

CVE-2025-24799

7.5
    Glpi-Project
  • Glpi
Published: March 18, 2025

CVE-2025-2472

7.3
    Phpgurukul
  • Apartment Visitors Management System
Published: March 18, 2025

CVE-2025-2473

7.3
    Phpgurukul
  • Visitor Management System
Published: March 18, 2025

CVE-2025-2262

7.3
    Wordpress
  • Logo Slider
Published: March 18, 2025

CVE-2025-25585

7.3
    yimioa
Published: March 18, 2025

CVE-2025-24306

7.2
    Plusf
  • Fs010m
Published: March 18, 2025

CVE-2024-23942

7.1
    *
  • *
Published: March 18, 2025

CVE-2025-0694

6.6
    Codesys
  • Control
Published: March 18, 2025

CVE-2025-2471

6.3
    Phpgurukul
  • Boat Booking System
Published: March 18, 2025

CVE-2025-25580

6.1
    Yimioa
  • Yimioa
Published: March 18, 2025

CVE-2025-27080

6.0
    Hpe
  • Aos-Cx
Published: March 18, 2025

CVE-2024-41975

5.3
    Plc
  • Plc Device
Published: March 18, 2025

CVE-2025-2487

4.9
    Redhat
  • 389-Ds-Base
  • Ldap Server
Published: March 18, 2025

CVE-2025-25042

4.3
    Hpe
  • Aos-Cx
Published: March 18, 2025

CVE-2024-49822

4.1
    Ibm
  • Qradar Advisor
Published: March 18, 2025

CVE-2025-25040

3.3
    Hpe
  • Aos-Cx
Published: March 18, 2025

CVE-2025-2490

2.4
    Dromara
  • Ujcms
Published: March 18, 2025

CVE-2025-2491

2.4
    Dromara
  • Ujcms
Published: March 18, 2025

CVE-2025-2489

None
    Ntfs-Tools
  • Ntfs Tools
Published: March 18, 2025

CVE-2025-2493

None
    Sytel
  • Softdial Contact Center
Published: March 18, 2025

CVE-2025-2494

None
    Sytel
  • Softdial Contact Center
Published: March 18, 2025

CVE-2025-2495

None
    Sytel
  • Softdial Contact Center
Published: March 18, 2025

CVE-2025-25500

None
    Cosmwasm
  • Cosmwasm
Published: March 18, 2025

CVE-2025-30106

None
    Iroad
  • V9
Published: March 18, 2025

CVE-2024-44313

None
    Tastyigniter
  • Tastyigniter
Published: March 18, 2025

CVE-2024-44314

None
    Tastyigniter
  • Tastyigniter
Published: March 18, 2025

CVE-2025-25590

None
    Yimioa
  • Yimioa
Published: March 18, 2025

CVE-2025-30107

None
    Iroad
  • V9
Published: March 18, 2025

CVE-2025-30109

None
    Iroad
  • Iroad Apk
Published: March 18, 2025

CVE-2025-30110

None
    Iroad
  • X5
Published: March 18, 2025

CVE-2025-30111

None
    Iroad
  • Dashcam
Published: March 18, 2025

CVE-2025-30113

None
    Forvia
  • Hella Driving Recorder Dr 820
Published: March 18, 2025

CVE-2025-30114

None
    Forvia
  • Hella Driving Recorder
Published: March 18, 2025

CVE-2025-30115

None
    Forvia
  • Hella Driving Recorder
Published: March 18, 2025

CVE-2025-30116

None
    Forvia
  • Hella Driving Recorder Dr 820
Published: March 18, 2025

CVE-2025-30117

None
    Forvia
  • Hella Driving Recorder Dr 820
Published: March 18, 2025

CVE-2025-30122

None
    Roadcam
  • Roacdm X3
Published: March 18, 2025

CVE-2025-30123

None
    Roadcam
  • Viidure
Published: March 18, 2025

CVE-2025-30132

None
    Iroad
  • Dashcam V
Published: March 18, 2025

CVE-2024-57169

None
    So-Planning
  • So-Planning
Published: March 18, 2025

CVE-2024-57170

None
    Soplanning
  • Soplanning
Published: March 18, 2025

CVE-2025-25582

None
    Yimioa
  • Yimioa
Published: March 18, 2025

CVE-2025-25586

None
    Yimioa
  • Yimioa
Published: March 18, 2025

CVE-2025-25589

None
    Yimioa
  • Yimioa
Published: March 18, 2025

CVE-2025-25595

None
    Safe App
  • Safe App
Published: March 18, 2025

CVE-2025-26137

None
    Systemic Risk Value
  • Systemic Risk Value
Published: March 18, 2025

CVE-2025-26138

None
    Systemic
  • Risk Value
Published: March 18, 2025

CVE-2025-21619

None
    Glpi
  • Glpi
Published: March 18, 2025

CVE-2025-29790

None
    Contao
  • Contao
Published: March 18, 2025

CVE-2025-29907

None
    Parallax
  • Jspdf
Published: March 18, 2025

CVE-2025-29930

None
    Impresscms
  • Imfaq
Published: March 18, 2025

CVE-2025-30137

None
    G-Net
  • Gnet Apk
Published: March 18, 2025

CVE-2025-30138

None
    G-Net
  • G-Net Dashcam Bbgonx
Published: March 18, 2025

CVE-2025-30139

None
    G-Net
  • Dashcam
Published: March 18, 2025

CVE-2025-30141

None
    G-Net
  • Dashcam Bb Gonx
Published: March 18, 2025

CVE-2025-30142

None
    G-Net
  • G-Net Dashcam Bb Gonx
Published: March 18, 2025

CVE-2024-57151

None
    Rainrocka
  • Xinhu
Published: March 18, 2025

CVE-2025-30140

None
    G-Net
  • G-Net Dashcam
Published: March 18, 2025
Click here to see more Vulnerabilities