Tag: 2025-05-15

8 Attack Reports | 1 Vulnerabilities

Attack reports

Operation RoundPress targeting high-value webmail servers

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023…

credential theft

data exfiltration

spypress.roundcube

spypress.mdaemon

spypress.zimbra

Published: May 18, 2025

Linked vulnerabilities : CVE-2024-27443, CVE-2024-11182 (CVSS 6.1), CVE-2020-35730, CVE-2023-23397, CVE-2023-43770

Downloadable IOCs: 16

Unfiltered look into LockBit’s operations

A breach of LockBit's dark web affiliate panels exposed a rare glimpse into their operations. The leaked data included Bitcoin addresses, admin credentials, and a chat log revealing negotiation tactics and ransom demands. Ransom amounts varied widely, with some victims confused about the demands. T…

initial access brokers

affiliate panels

negotiation tactics

Published: May 15, 2025

Downloadable IOCs: 3

Fileless Execution: PowerShell Based Shellcode Loader Executes Remcos RAT

A new PowerShell-based shellcode loader has been discovered, designed to execute a variant of Remcos RAT. The attack chain begins with malicious LNK files in ZIP archives, using mshta.exe for initial execution. The loader employs fileless techniques, executing code directly in memory to evade tradi…

process hollowing

evasion techniques

shellcode loader

tls communication

fileless execution

Published: May 15, 2025

Downloadable IOCs: 5

Backdoor implant discovered on PyPI posing as debugging utility

A sophisticated malicious package named 'dbgpkg' was detected on PyPI, masquerading as a Python debugging utility. The package implants a backdoor on systems, enabling execution of malicious code and data exfiltration. It uses function wrapping techniques to evade detection and is believed to be pa…

supply chain attack

function wrapping

global socket toolkit

Published: May 15, 2025

Downloadable IOCs: 0

Excel(ent) Obfuscation: Regex Gone Rogue

A new Excel-based attack technique leverages recently introduced regex functions for advanced code obfuscation. The proof-of-concept demonstrates how malicious actors can use REGEXEXTRACT to hide PowerShell commands within large text blocks, significantly reducing antivirus detection rates. This me…

Published: May 15, 2025

Downloadable IOCs: 3

Inside the DPRK: Spotting Malicious Remote IT Applicants

The Democratic People’s Republic of Korea (DPRK) deploys skilled IT workers remotely to organizations globally funding its weapons of mass destruction (WMD) and missile programs, violating sanctions. In recent weeks, the techniques leveraged to evade detection have evolved, reducing reliance on tra…

Published: May 15, 2025

Downloadable IOCs: 376

Web Scanning SonicWall for CVE-2021-20016 - Update

There has been a significant increase in scanning activity targeting SonicWall devices, specifically looking for CVE-2021-20016 vulnerability. The activity has grown tenfold over the past 14 days, with multiple sources reporting probes related to two specific URLs. The most active IP addresses orig…

network security

Published: May 15, 2025

Linked vulnerabilities : CVE-2021-20016

Downloadable IOCs: 6

Technical Analysis of TransferLoader

TransferLoader is a newly identified malware loader active since February 2025. It comprises multiple components including a downloader, backdoor, and specialized loader. The malware employs various anti-analysis techniques and code obfuscation to hinder reverse engineering. TransferLoader has been…

Published: May 15, 2025

Downloadable IOCs: 7

Click here to see more Attack Reports

Vulnerabilities

CVE-2025-4579

Wp Content Security Plugin

Published: May 15, 2025

Click here to see more Vulnerabilities