Tag: 2025-04-22

8 Attack Reports | 115 Vulnerabilities

Attack reports

Threat Infrastructure Uncovered Before Activation

Between November 2024 and April 2025, a set of domains and servers impersonating an Iraqi academic organization and fictitious UK tech firms were tracked. The infrastructure, while dormant, exhibited characteristics similar to APT34 (OilRig), including shared SSH keys, structured websites, and deco…
oilrig
infrastructure
apt34
domain impersonation
2025-04-22
ssh keys
pre-operational staging
http decoys
m247
Published: April 22, 2025
Downloadable IOCs: 15

Sophisticated backdoor mimicking secure networking software updates

A sophisticated backdoor targeting Russian organizations in government, finance, and industry sectors was discovered masquerading as updates for ViPNet secure networking software. The malware, distributed in LZH archives, exploits a path substitution technique to execute a malicious loader that dep…
backdoor
apt
russia
payload
c2 server
software updates
2025-04-22
targeted attack
secure networking
heur:trojan.win32.loader.gen
path substitution
vipnet
Published: April 22, 2025
Downloadable IOCs: 0

Case of Attacks Targeting MS-SQL Servers to Install Ammyy Admin

A series of attacks targeting poorly managed MS-SQL servers have been identified, involving the installation of Ammyy Admin, a remote control tool. The attackers exploit vulnerable servers, execute commands to gather system information, and use WGet to install additional malware. The installed malw…
privilege escalation
brute force
2025-04-22
ms-sql
wget
remote control
petitpotato
dictionary attack
ammyy admin
Published: April 22, 2025
Downloadable IOCs: 0

APT Group Profiles - Larva-24005

A new operation named Larva-24005, linked to the Kimsuky group, has been discovered by ASEC. The threat actors exploited RDP vulnerabilities to infiltrate systems, installing MySpy malware and RDPWrap for continuous remote access. They also deployed keyloggers to record user inputs. The group has b…
apt
phishing
kimsuky
south korea
CVE-2017-11882
keylogger
CVE-2019-0708
japan
2025-04-22
randomquery
rdp exploitation
bluekeep
myspy
kimalogger
Published: April 22, 2025
Downloadable IOCs: 0

DOGE Binary Loader Indicators of Compromise

This intelligence document provides a list of Indicators of Compromise (IoCs) associated with the DOGE Binary Loader. It includes several malicious URLs hosted on the domain 'hilarious-trifle-d9182e.netlify.app' along with their corresponding SHA-256 hashes. The listed files include PowerShell scri…
powershell
ioc
sha-256
2025-04-22
url
doge binary loader
netlify
Published: April 22, 2025
Downloadable IOCs: 0

Infostealer Malware FormBook Spread via Phishing Campaign – Part I

A phishing campaign delivering a malicious Word document exploiting CVE-2017-11882 was observed spreading a new FormBook variant. The campaign tricks recipients into opening an attached document, which extracts a 64-bit DLL file and exploits the vulnerability to execute it. The DLL acts as a downlo…
phishing
infostealer
formbook
CVE-2017-11882
process hollowing
2025-04-22
fileless malware
microsoft equation editor
Published: April 22, 2025
Linked vulnerabilities : CVE-2017-11882
Downloadable IOCs: 7

PE32 Ransomware: A New Telegram-Based Threat on the Rise

PE32 Ransomware is a new strain of malware that utilizes Telegram for command and control. Despite its amateur execution, it effectively encrypts files and causes significant damage. The ransomware features a unique two-tiered payment model, demanding one fee to unlock files and another to prevent …
encryption
telegram
c2 communication
2025-04-22
two-tiered ransom
amateur execution
pe32 ransomware
bot api
exposed infrastructure
Published: April 22, 2025
Downloadable IOCs: 5

Detecting Multi-Stage Infection Chains Madness

This analysis examines a complex multi-stage attack exploiting a resilient network infrastructure known as 'Cloudflare tunnel infrastructure to deliver multiple RATs' since February 2024. The infection chain involves multiple steps, including phishing emails with malicious attachments, execution of…
phishing
asyncrat
infection chain
multi-stage attack
evasion techniques
2025-04-22
cloudflare tunnel
cyber threat intelligence
detection rules
Published: April 22, 2025
Downloadable IOCs: 15
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-34028

10.0
    Commvault
  • Command Center Innovation Release
Published: April 22, 2025

CVE-2025-28038

9.8
    Totolink
  • Ex1200t
Published: April 22, 2025

CVE-2025-28039

9.8
    Totolink
  • Ex1200t
Published: April 22, 2025

CVE-2024-58250

9.3
    Pppd
  • Pppd
Published: April 22, 2025

CVE-2025-1950

9.3
    Ibm
  • Hardware Management Console
Published: April 22, 2025

CVE-2025-32965

9.3
    Xrpl
  • Xrpl.Js
Published: April 22, 2025

CVE-2025-3616

8.8
    Greenshift
  • Animation And Page Builder Blocks
Published: April 22, 2025

CVE-2025-23176

8.8
    *
  • *
Published: April 22, 2025

CVE-2025-3854

8.6
    H3c
  • Gr-3000ax
Published: April 22, 2025

CVE-2025-1951

8.4
    Ibm
  • Hardware Management Console
Published: April 22, 2025

CVE-2025-46241

8.2
    Codepeople
  • Appointment Booking Calendar
Published: April 22, 2025

CVE-2025-2594

8.1
    Wordpress
  • User Registration Membership
Published: April 22, 2025

CVE-2025-1731

7.8
    Zyxel
  • Usg Flex H Series
    Postgresql
Published: April 22, 2025

CVE-2024-33452

7.7
    Openresty
  • Lua-Nginx-Module
Published: April 22, 2025

CVE-2025-46242

7.6
    Bob Watu
  • Watu Quiz
Published: April 22, 2025

CVE-2025-46252

7.6
    Kofimokome
  • Message Filter For Contact Form 7
Published: April 22, 2025

CVE-2025-23249

7.6
    Nvidia
  • Nemo Framework
Published: April 22, 2025

CVE-2025-23250

7.6
    Nvidia
  • Nemo Framework
Published: April 22, 2025

CVE-2025-23251

7.6
    Nvidia
  • Nemo Framework
Published: April 22, 2025

CVE-2024-40445

7.3
    Forkosh
  • Mime Tex
Published: April 22, 2025

CVE-2024-46546

7.3
    Nexut
  • Fleta Ax1500 Wifi6 Router
Published: April 22, 2025

CVE-2025-43947

7.3
    Codemers
  • Klims
Published: April 22, 2025

CVE-2025-43948

7.3
    Codemers
  • Klims
Published: April 22, 2025

CVE-2025-29621

7.3
    Francois Jacquet
  • Rosariosis
Published: April 22, 2025

CVE-2025-3767

7.2
    Centreon
  • Centreon Bam
Published: April 22, 2025

CVE-2024-46899

7.1
    Hitachi
  • Ops Center Common Services
  • Ops Center Analyzer
Published: April 22, 2025

CVE-2024-13569

7.1
    Wordpress
  • Front End Users
Published: April 22, 2025

CVE-2025-46251

7.1
    Vikwp
  • Vikrestaurants
Published: April 22, 2025

CVE-2025-2092

7.1
    Checkmk
  • Checkmk
Published: April 22, 2025

CVE-2025-3519

7.0
    Unblu
  • Spark
Published: April 22, 2025

CVE-2025-29547

7.0
    Rollback
  • Rollback Rx Professional
Published: April 22, 2025

CVE-2025-32963

6.9
    Minio
  • Minio Operator
    Kubernetes
Published: April 22, 2025

CVE-2025-1732

6.7
    Zyxel
  • Usg Flex H Series Uos Firmware
Published: April 22, 2025

CVE-2025-46225

6.5
    Elementor
  • Post In Page
Published: April 22, 2025

CVE-2025-46226

6.5
    Ferranfg
  • Mpl-Publisher
Published: April 22, 2025

CVE-2025-46227

6.5
    Brecht
  • Custom Related Posts
Published: April 22, 2025

CVE-2025-46228

6.5
    Bastien Ho
  • Event Post
Published: April 22, 2025

CVE-2025-46233

6.5
    Sirv
  • Sirv
Published: April 22, 2025

CVE-2025-46235

6.5
    Sonalsinha21
  • Skt Blocks
Published: April 22, 2025

CVE-2025-46236

6.5
    Link Software
  • Html Forms
Published: April 22, 2025

CVE-2025-46237

6.5
    Yannick Lefebvre
  • Link Library
Published: April 22, 2025

CVE-2025-46238

6.5
    Rbaer
  • List Last Changes
Published: April 22, 2025

CVE-2025-46239

6.5
    Jeff Starr
  • Theme Switcha
Published: April 22, 2025

CVE-2025-46240

6.5
    Jeff Starr
  • Simple Download Counter
Published: April 22, 2025

CVE-2025-46253

6.5
    Ataur R
  • Gutenkit
Published: April 22, 2025

CVE-2025-46254

6.5
    Visual Composer
  • Visual Composer Website Builder
Published: April 22, 2025

CVE-2025-3472

6.5
    Wordpress
  • Ocean Extra
Published: April 22, 2025

CVE-2025-28031

6.5
    Totolink
  • A810r
Published: April 22, 2025

CVE-2025-32950

6.5
    Jmix
  • Jmix
Published: April 22, 2025

CVE-2025-32952

6.5
    Jmix
  • Jmix
Published: April 22, 2025

CVE-2025-32959

6.5
    Cuba
  • Cuba Platform
Published: April 22, 2025

CVE-2025-29743

6.5
    D-Link
  • Dir-816
Published: April 22, 2025

CVE-2025-2839

6.4
    Wordpress
  • Wp Import Export Lite
Published: April 22, 2025

CVE-2025-3814

6.4
    Wordpress
  • Tax Switch For Woocommerce
Published: April 22, 2025

CVE-2025-3457

6.4
    Wordpress
  • Ocean Extra Plugin
Published: April 22, 2025

CVE-2025-3458

6.4
    Wordpress
  • Ocean Extra Plugin
Published: April 22, 2025

CVE-2025-32951

6.4
    Jmix
  • Jmix
Published: April 22, 2025

CVE-2025-32960

6.4
    Cuba
  • Cuba Rest Api
Published: April 22, 2025

CVE-2025-32961

6.4
    Cuba
  • Cuba Jpa
Published: April 22, 2025

CVE-2025-3850

6.3
    Yxj2018
  • Springboot-Vue-Onlineexam
Published: April 22, 2025

CVE-2025-23175

6.1
    *
  • *
Published: April 22, 2025

CVE-2025-43952

6.1
    Mettler Toledo
  • Freeweight.Net Web Reports Viewer
Published: April 22, 2025

CVE-2025-26159

6.1
    Laravel
  • Laravel Starter
Published: April 22, 2025

CVE-2025-46229

5.9
    Israpil
  • Textmetrics
Published: April 22, 2025

CVE-2025-46250

5.9
    Vikas Ratudi
  • Vform
Published: April 22, 2025

CVE-2025-2300

5.5
    Hitachi
  • Ops Center Common Services
Published: April 22, 2025

CVE-2025-46231

5.4
    Servit Software Solutions
  • Affiliate-Toolkit
Published: April 22, 2025

CVE-2024-53569

5.4
    Volmarg
  • Personal Management System
Published: April 22, 2025

CVE-2025-3849

5.3
    Yxj2018
  • Springboot-Vue-Onlineexam
Published: April 22, 2025

CVE-2025-3855

5.3
    Codecanyon
  • Rise Ultimate Project Manager
Published: April 22, 2025

CVE-2025-3856

5.3
    Xxyopen
  • Novel-Plus
Published: April 22, 2025

CVE-2025-3518

5.3
    *
  • *
Published: April 22, 2025

CVE-2025-46244

5.3
    Patchstack
  • Advanced Linked Variations For Woocommerce
Published: April 22, 2025

CVE-2025-46247

5.3
    Codepeople
  • Appointment Booking Calendar
Published: April 22, 2025

CVE-2024-11299

5.3
    Memberpress
  • Plugin
Published: April 22, 2025

CVE-2025-3577

4.9
    Zyxel
  • Amg1302-T10b
Published: April 22, 2025

CVE-2025-32964

4.6
    Mediawiki
  • Managewiki
Published: April 22, 2025

CVE-2025-31328

4.6
    Sap
  • Learning Solution
Published: April 22, 2025

CVE-2025-46232

4.3
    Alttextai
  • Download Alt Text Ai
Published: April 22, 2025

CVE-2025-46243

4.3
    Sonalsinha21
  • Recover Abandoned Cart For Woocommerce
Published: April 22, 2025

CVE-2025-46245

4.3
    Creativemindssolutions
  • Cm Ad Changer
Published: April 22, 2025

CVE-2025-46246

4.3
    Creativemindssolutions
  • Cm Answers
Published: April 22, 2025

CVE-2025-46249

4.3
    Michael
  • Simple Calendar For Elementor
Published: April 22, 2025

CVE-2025-32788

4.3
    Octoprint
  • Octoprint
Published: April 22, 2025

CVE-2025-31327

4.3
    Sap
  • Field Logistics
Published: April 22, 2025

CVE-2025-27907

4.1
    Ibm
  • Websphere Application Server
Published: April 22, 2025

CVE-2025-2987

3.8
    Ibm
  • Maximo Asset Management
Published: April 22, 2025

CVE-2025-23253

2.5
    Nvidia
  • Nvcontainer
Published: April 22, 2025

CVE-2025-26413

None
    Apache
  • Kvrocks
Published: April 22, 2025

CVE-2024-40446

None
    Forkosh
  • Mime Tex
Published: April 22, 2025

CVE-2025-28032

None
    Totolink
  • A800r
  • A810r
  • A830r
  • A950rg
  • A3000ru
  • A3100r
Published: April 22, 2025

CVE-2025-28033

None
    Totolink
  • A800r
  • A810r
  • A830r
  • A950rg
  • A3000ru
  • A3100r
Published: April 22, 2025

CVE-2025-28034

None
    Totolink
  • A800r
  • A810r
  • A830r
  • A950rg
  • A3000ru
  • A3100r
Published: April 22, 2025

CVE-2025-28024

None
    Totolink
  • A810r
Published: April 22, 2025

CVE-2025-28030

None
    Totolink
  • A810r
Published: April 22, 2025

CVE-2025-28037

None
    Totolink
  • A810r
  • A950rg
Published: April 22, 2025

CVE-2025-29339

None
    Open5gs
  • Upf
Published: April 22, 2025

CVE-2023-43378

None
    Hoteldruid
  • Hoteldruid
Published: April 22, 2025

CVE-2023-43958

None
    Hospital Management System
  • Hospital Management System
Published: April 22, 2025

CVE-2023-44752

None
    Student Study Center
  • Desk Management System
Published: April 22, 2025

CVE-2023-44753

None
    Student Management System
  • Student Management System
Published: April 22, 2025

CVE-2023-44755

None
    Sacco
  • Sacco Management System
Published: April 22, 2025

CVE-2025-28026

None
    Totolink
  • A830r
  • A950rg
  • A3000ru
  • A3100r
Published: April 22, 2025

CVE-2025-28027

None
    Totolink
  • A830r
  • A950rg
  • A3000ru
  • A3100r
Published: April 22, 2025

CVE-2025-28029

None
    Totolink
  • A830r
  • A950rg
  • A3000ru
  • A3100r
Published: April 22, 2025

CVE-2025-28035

None
    Totolink
  • A830r
Published: April 22, 2025

CVE-2025-28036

None
    Totolink
  • A950rg
Published: April 22, 2025

CVE-2025-43946

None
    Tcpwave
  • Ddi
Published: April 22, 2025

CVE-2025-43949

None
    Mensch Und Maschine
  • Mapedit
  • Mapedit Web
Published: April 22, 2025

CVE-2025-43950

None
    Dpmadirektpro
  • Dpmadirektpro
Published: April 22, 2025

CVE-2025-43951

None
    Labvantage
  • Labvantage
Published: April 22, 2025

CVE-2024-53568

None
    Volmarg
  • Personal Management System
Published: April 22, 2025

CVE-2025-37087

None
    Hpe
  • Hpe Performance Cluster Manager
Published: April 22, 2025

CVE-2025-27087

None
    Hpe
  • Cray Operating System
Published: April 22, 2025

CVE-2025-37088

None
    Hpe
  • Cray Data Virtualization Service
Published: April 22, 2025
Click here to see more Vulnerabilities