Tag: 2025-05-16

8 Attack Reports | 1 Vulnerabilities

Attack reports

How Interlock Ransomware Affects the Defense Industrial Base Supply Chain

Interlock Ransomware has recently targeted National Defense Corporation and its subsidiaries, impacting the defense industrial base supply chain. The group's attack on AMTEC, a manufacturer of ammunition and explosives, has exposed sensitive information about global defense contractors and their su…
supply chain
data leak
double extortion
interlock ransomware
2025-05-16
defense industrial base
national security
cmmc
geopolitical influence
intellectual property
Published: May 16, 2025
Downloadable IOCs: 11

The Good, the Bad and the Ugly in Cybersecurity – Week 20

This intelligence update covers recent cybersecurity events. In positive developments, global authorities disrupted a major botnet, arrested a ransomware actor, and dismantled a dark web marketplace. On the negative side, a malicious NPM package was discovered hiding multi-stage malware using Unico…
ransomware
zero-day
botnet
npm
dns hijacking
dark web
CVE-2025-27920
omserverservice.exe
omclientservice.exe
output messenger
2025-05-16
kurdish military
doppelpaymer
Published: May 16, 2025
Linked vulnerabilities : CVE-2025-27920 (CVSS 9.8)
Downloadable IOCs: 1

Shared SSH Keys Expose Phishing Infrastructure Targeting Kuwait

An ongoing phishing campaign targeting Kuwait's fisheries, telecommunications, and insurance sectors has been identified, utilizing over 100 domains for credential harvesting. The operation, observed since early 2025, employs cloned login portals and impersonated web pages. The infrastructure share…
phishing
credential harvesting
telecommunications
infrastructure
insurance
domain impersonation
ssh keys
2025-05-16
fisheries
kuwait
Published: May 16, 2025
Downloadable IOCs: 77

Mass Scanning and Exploit Campaigns

Trustwave SpiderLabs has identified ongoing malicious activities originating from Proton66 ASN, including vulnerability scanning, exploit attempts, and phishing campaigns. The investigation revealed connections between Proton66 and bulletproof hosting services advertised on underground forums. Mass…
ransomware
vulnerability exploitation
CVE-2024-41713
CVE-2024-10914
CVE-2024-55591
CVE-2025-24472
CVE-2025-0108
superblack
bulletproof hosting
2025-05-16
exploit campaigns
critical vulnerabilities
mass scanning
underground forums
Published: May 16, 2025
Linked vulnerabilities : CVE-2024-41713 (CVSS 7.5), CVE-2024-10914 (CVSS 8.1), CVE-2024-55591 (CVSS 9.8), CVE-2025-24472 (CVSS 8.1), CVE-2025-0108 (CVSS 9.1)
Downloadable IOCs: 22

Pixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks

The Trustwave SpiderLabs Email Security team has identified a significant increase in SVG image-based attacks, where seemingly harmless graphics are used to conceal dangerous links. Cybercriminals are exploiting the ability of SVG files to embed JavaScript, which can execute automatically upon open…
obfuscation
phishing
social engineering
phaas
javascript
cybersecurity
email security
svg
2025-05-16
ursnif
tycoon2fa
Published: May 16, 2025
Downloadable IOCs: 4

Part 2: Compromised WordPress Pages and Malware Campaigns

This analysis focuses on malware campaigns linked to Proton66, particularly those targeting Android devices through compromised WordPress websites. The threat actors used redirector scripts to target users from various countries, mimicking the Google Play Store. Additionally, the XWorm campaign tar…
xworm
phishing
ransomware
android
remcos
wordpress
credential theft
strela stealer
proton66
weaxor
2025-05-16
Published: May 16, 2025
Downloadable IOCs: 45

Yet Another NodeJS Backdoor (YaNB): A Modern Challenge

A resurgence in malicious campaigns exploiting deceptive CAPTCHA verifications has been observed, tricking users into executing NodeJS-based backdoors and deploying sophisticated Remote Access Trojans. The attack begins with a malicious NodeJS script connecting to attacker-controlled infrastructure…
backdoor
rat
persistence
captcha
anti-vm
xor encryption
system reconnaissance
2025-05-16
nodejs
socks5 proxy
nodejs rat
kongtuke
Published: May 16, 2025
Downloadable IOCs: 11

Actionable threat hunting with Threat Intelligence (I) - Hunting malicious desktop files

This analysis explores the detection of malicious .desktop files used by threat actors to infect Linux systems. It explains the structure of these files and how they are manipulated to obfuscate malicious content. The report details the execution process of these files, which often involve opening …
linux
obfuscation
pdf
threat hunting
google drive
2025-05-16
xfce
desktop files
kde
google threat intelligence
gnome
Published: May 16, 2025
Downloadable IOCs: 3
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-47930

5.3
    Zulip
  • Zulip
Published: May 16, 2025
Click here to see more Vulnerabilities