Tag: 2025-05-27

7 Attack Reports | 112 Vulnerabilities

Attack reports

NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign

A malware campaign using fake software installers to deliver Winos v4.0, a memory-resident malware, has been tracked throughout 2025. The campaign, dubbed Catena, employs trojanized NSIS installers, reflective DLL loading, and shellcode-embedded INI files to evade detection. It stages payloads enti…
nsis
winos
chinese-speaking targets
2025-05-27
srdi
memory-resident malware
winos v4.0
catena loader
reflective dll injection
trojanized installers
Published: May 27, 2025
Downloadable IOCs: 31

Russian Unit 26165 Targets Western Logistics and Technology Companies

Chihuahua Infostealer is a sophisticated .NET-based malware discovered in April 2025, targeting browser credentials and cryptocurrency wallet data. It employs multi-stage delivery through obfuscated PowerShell scripts, often using trusted platforms like Google Drive for initial distribution. The ma…
obfuscation
powershell
infostealer
persistence
data-exfiltration
2025-05-27
crypto-wallet-theft
chihuahua infostealer
browser-data-theft
.net-malware
Published: May 27, 2025
Downloadable IOCs: 10

TA-ShadowCricket: Emerging Malware Trends and IRC Server Tracking

The TA-ShadowCricket group, formerly known as Shadow Force, has been active in the Asia-Pacific region since 2012, targeting Windows servers and MS-SQL servers. They operate an IRC server with over 2,000 affected IPs in 72 countries. The group uses various malware and tools, including Upm, SqlShell…
malware
apt
china
botnet
sqlshell
irc
windows servers
miner
ms-sql
2025-05-27
credentialstealer
maggiescan
detofin
upm
pemodifier
sqldoor
maggie
wgdrop
shaduser
asia-pacific
Published: May 27, 2025
Downloadable IOCs: 13

The Sharp Taste of Mimo'lette: Analyzing Mimo's Latest Campaign targeting Craft CMS

Between February and May, multiple exploitations of CVE-2025-32432, a Remote Code Execution vulnerability in Craft CMS, were observed. The attack chain involves deploying a webshell, downloading an infection script, and executing malicious payloads including a loader, crypto miner, and residential …
xmrig
cryptomining
webshell
residential proxy
CVE-2025-32432
2025-05-27
minus ransomware
iproyal
craft cms
Published: May 27, 2025
Linked vulnerabilities : CVE-2024-46483 (CVSS 9.8), CVE-2025-32432 (CVSS 10.0)
Downloadable IOCs: 8

Malware or LLM? Silent Werewolf employs new loaders to attack Russian and Moldovan organizations

Silent Werewolf has launched two new campaigns targeting Russian and Moldovan organizations, utilizing sophisticated loaders to deliver malicious payloads. The attacks employ phishing emails with ZIP attachments containing obfuscated C# loaders. These loaders use legitimate tools and code obfuscati…
obfuscation
phishing
2025-05-27
c# loader
xdigo
Published: May 27, 2025
Downloadable IOCs: 28

Custom Arsenal Developed to Target Multiple Industries

Earth Lamia, an APT threat actor, has been targeting organizations in Brazil, India, and Southeast Asia since 2023. The group exploits web application vulnerabilities, particularly SQL injection, to gain access to targeted systems. They have developed custom tools like PULSEPACK backdoor and Bypass…
backdoor
apt
sql injection
cobalt strike
dll sideloading
vulnerability exploitation
brute ratel
multi-industry targeting
CVE-2024-9047
CVE-2024-51378
CVE-2024-51567
china-nexus
CVE-2024-56145
vshell
CVE-2025-31324
2025-05-27
CVE-2021-22205
CVE-2024-27199
CVE-2024-27198
CVE-2017-9805
pulsepack
bypassboss
custom tools
Published: May 27, 2025
Linked vulnerabilities : CVE-2024-9047 (CVSS 9.8), CVE-2024-51378 (CVSS 10.0), CVE-2024-51567 (CVSS 10.0), CVE-2024-56145, CVE-2025-31324 (CVSS 10.0), CVE-2017-9805, CVE-2024-27199, CVE-2024-27198, CVE-2021-22205
Downloadable IOCs: 185

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

Void Blizzard, a newly identified Russia-affiliated threat actor, has been conducting global cyberespionage operations since April 2024. Their primary targets are organizations in critical sectors, particularly in NATO member states and Ukraine, including government, defense, transportation, media,…
ukraine
cyberespionage
nato
spear phishing
evilginx
critical sectors
CVE-2025-27920
2025-05-27
azurehound
stolen credentials
russia-affiliated
cloud abuse
Published: May 27, 2025
Downloadable IOCs: 3
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-48827

10.0
    Vbulletin
  • Vbulletin
Published: May 27, 2025

CVE-2025-32440

10.0
    Netalertx
  • Netalertx
Published: May 27, 2025

CVE-2025-41651

9.8
    *
  • *
Published: May 27, 2025

CVE-2025-41652

9.8
    *
  • *
Published: May 27, 2025

CVE-2025-2407

9.3
    Mobatime
  • Amx Mtapi
Published: May 27, 2025

CVE-2025-48057

9.3
    Icinga
  • Icinga
    Openssl
Published: May 27, 2025

CVE-2025-48828

9.0
    Vbulletin
  • Vbulletin
Published: May 27, 2025

CVE-2025-5117

8.8
    Wordpress
  • Property Plugin
Published: May 27, 2025

CVE-2025-5063

8.8
    Google
  • Chrome
Published: May 27, 2025

CVE-2025-5280

8.8
    Google
  • Chrome
Published: May 27, 2025

CVE-2025-5215

8.7
    D-Link
  • Dcs-5020l
Published: May 27, 2025

CVE-2025-5228

8.7
    Dlink
  • Di-8100
Published: May 27, 2025

CVE-2025-27700

8.4
    Google
  • Android
Published: May 27, 2025

CVE-2025-48383

8.2
    Django
  • Django-Select2
Published: May 27, 2025

CVE-2025-41649

7.5
    *
  • *
Published: May 27, 2025

CVE-2025-41650

7.5
    *
  • *
Published: May 27, 2025

CVE-2025-41653

7.5
    *
  • *
Published: May 27, 2025

CVE-2025-5270

7.5
    Mozilla
  • Firefox
Published: May 27, 2025

CVE-2025-5272

7.3
    Mozilla
  • Firefox
  • Thunderbird
Published: May 27, 2025

CVE-2025-48796

7.3
    Gimp
  • Gimp
Published: May 27, 2025

CVE-2025-48797

7.3
    Gnome
  • Gimp
Published: May 27, 2025

CVE-2025-48798

7.3
    Gimp
  • Gimp
Published: May 27, 2025

CVE-2025-45529

7.1
    Sscms
  • Sscms
Published: May 27, 2025

CVE-2025-5222

7.0
    Intl Components For Unicode
  • Icu
Published: May 27, 2025

CVE-2025-5279

7.0
    Amazon
  • Redshift
Published: May 27, 2025

CVE-2025-5213

6.9
    Projectworlds
  • Responsive E-Learning System
Published: May 27, 2025

CVE-2025-5214

6.9
    Kashipara
  • Kashipara Responsive Online Learing Platform
Published: May 27, 2025

CVE-2025-5216

6.9
    Phpgurukul
  • Student Record System
Published: May 27, 2025

CVE-2025-5217

6.9
    Freefloat
  • Ftp Server
Published: May 27, 2025

CVE-2025-5218

6.9
    Freefloat
  • Ftp Server
Published: May 27, 2025

CVE-2025-5219

6.9
    Freefloat
  • Ftp Server
Published: May 27, 2025

CVE-2025-5220

6.9
    Freefloat
  • Ftp Server
Published: May 27, 2025

CVE-2025-5221

6.9
    Freefloat
  • Ftp Server
Published: May 27, 2025

CVE-2025-5224

6.9
    Campcodes
  • Online Hospital Management System
Published: May 27, 2025

CVE-2025-5225

6.9
    Campcodes
  • Advanced Online Voting System
Published: May 27, 2025

CVE-2025-5226

6.9
    Phpgurukul
  • Small Crm
Published: May 27, 2025

CVE-2025-5227

6.9
    Phpgurukul
  • Small Crm
Published: May 27, 2025

CVE-2025-5229

6.9
    Campcodes
  • Online Hospital Management System
Published: May 27, 2025

CVE-2025-5230

6.9
    Phpgurukul
  • Online Nurse Hiring System
Published: May 27, 2025

CVE-2025-5231

6.9
    Phpgurukul
  • Visitor Management System
Published: May 27, 2025

CVE-2025-5246

6.9
    Campcodes
  • Online Hospital Management System
Published: May 27, 2025

CVE-2025-5247

6.9
    Gowabby
  • Hwish
Published: May 27, 2025

CVE-2025-5248

6.9
    Phpgurukul
  • Company Visitor Management System
Published: May 27, 2025

CVE-2025-5249

6.9
    Phpgurukul
  • News Portal Project
Published: May 27, 2025

CVE-2025-5250

6.9
    Phpgurukul
  • News Portal
Published: May 27, 2025

CVE-2025-5251

6.9
    Phpgurukul
  • News Portal
Published: May 27, 2025

CVE-2025-5252

6.9
    Phpgurukul
  • News Portal
Published: May 27, 2025

CVE-2024-13966

6.9
    Zkteco
  • Biotime
Published: May 27, 2025

CVE-2025-48054

6.8
    Radashi
  • Radashi
Published: May 27, 2025

CVE-2025-33079

6.5
    Ibm
  • Controller
Published: May 27, 2025

CVE-2025-5266

6.5
    Mozilla
  • Firefox
  • Firefox Esr
Published: May 27, 2025

CVE-2025-5268

6.5
    Mozilla
  • Firefox
  • Thunderbird
  • Firefox Esr
Published: May 27, 2025

CVE-2025-5269

6.5
    Mozilla
  • Firefox
  • Thunderbird
Published: May 27, 2025

CVE-2025-5271

6.5
    Mozilla
  • Firefox
Published: May 27, 2025

CVE-2025-5065

6.5
    Google
  • Chrome
Published: May 27, 2025

CVE-2025-5066

6.5
    Google
  • Chrome
Published: May 27, 2025

CVE-2025-40911

6.5
    Perl
  • Net
Published: May 27, 2025

CVE-2024-11185

6.5
    Arista
  • Arista Eos
Published: May 27, 2025

CVE-2025-4783

6.4
    Wordpress
  • Exclusive Addons For Elementor
Published: May 27, 2025

CVE-2025-48744

6.4
    Sigb
  • Pmb
Published: May 27, 2025

CVE-2025-4682

6.4
    Wordpress
  • Essential Blocks
Published: May 27, 2025

CVE-2025-46173

6.1
    Code-Projects
  • Online Exam Mastering System
Published: May 27, 2025

CVE-2025-3704

5.9
    Dbar Productions
  • Volunteer Sign Up Sheets
Published: May 27, 2025

CVE-2025-23393

5.6
    Suse
  • Spacewalk-Java
  • Suse Manager
  • Suse Manager Server Module
Published: May 27, 2025

CVE-2025-27701

5.5
    *
  • *
Published: May 27, 2025

CVE-2024-45094

5.5
    Ibm
  • Ds8900f
  • Ds8a00 Hardware Management Console
Published: May 27, 2025

CVE-2025-48742

5.4
    Sigb
  • Pmb
Published: May 27, 2025

CVE-2025-5267

5.4
    Mozilla
  • Firefox
  • Firefox Esr
Published: May 27, 2025

CVE-2025-5064

5.4
    Google
  • Chrome
Published: May 27, 2025

CVE-2025-5067

5.4
    Google
  • Chrome
Published: May 27, 2025

CVE-2025-5281

5.4
    Google
  • Chrome
Published: May 27, 2025

CVE-2025-5283

5.4
    Google
  • Chrome
Published: May 27, 2025

CVE-2025-48743

5.3
    Sigb
  • Pmb
Published: May 27, 2025

CVE-2024-38866

5.3
    Nagvis
  • Nagvis
Published: May 27, 2025

CVE-2025-2796

5.3
    Arista
  • Eos
Published: May 27, 2025

CVE-2025-5232

5.1
    Phpgurukul
  • Student Study Center Management System
Published: May 27, 2025

CVE-2024-47090

5.1
    Nagvis
  • Nagvis
Published: May 27, 2025

CVE-2025-5198

5.0
    Redhat
  • Stackrox
  • Kubernetes
Published: May 27, 2025

CVE-2025-4412

4.8
    Sparklabs
  • Viscosity
Published: May 27, 2025

CVE-2025-5244

4.8
    Gnu
  • Binutils
Published: May 27, 2025

CVE-2025-5264

4.8
    Mozilla
  • Firefox
  • Firefox Esr
Published: May 27, 2025

CVE-2025-5265

4.8
    Mozilla
  • Firefox
  • Firefox Esr
Published: May 27, 2025

CVE-2025-5245

4.8
    Gnu
  • Binutils
Published: May 27, 2025

CVE-2025-23247

4.4
    Nvidia
  • Cuda Toolkit
Published: May 27, 2025

CVE-2025-5278

4.4
    Gnu
  • Coreutils
Published: May 27, 2025

CVE-2025-4683

4.3
    Wordpress
  • Mstore Api
Published: May 27, 2025

CVE-2025-5263

4.3
    Mozilla
  • Firefox
Published: May 27, 2025

CVE-2025-26211

3.7
    Gibbon
  • Gibbon
Published: May 27, 2025

CVE-2025-48370

2.7
    Supabase
  • Auth-Js
Published: May 27, 2025

CVE-2025-2826

2.6
    Arista
  • Arista Eos
Published: May 27, 2025

CVE-2025-2236

2.1
    Opentext
  • Advanced Authentication
Published: May 27, 2025

CVE-2025-48382

1.2
    Codelibs
  • Fess
Published: May 27, 2025

CVE-2025-48786

None
    Fortinet
  • Fortinet
Published: May 27, 2025

CVE-2025-48787

None
    Fortinet
  • Fortinet
Published: May 27, 2025

CVE-2025-48788

None
    Fortinet
  • Fortigate
Published: May 27, 2025

CVE-2025-48789

None
    Fortinet
  • Fortinet
Published: May 27, 2025

CVE-2025-48790

None
    Fortinet
  • Fortinet
Published: May 27, 2025

CVE-2025-48791

None
    Fortinet
  • Fortinet
Published: May 27, 2025

CVE-2025-48792

None
    Fortinet
  • Fortinet
Published: May 27, 2025

CVE-2025-48793

None
    Fortinet
  • Fortinet
Published: May 27, 2025

CVE-2025-48794

None
    Fortinet
  • Fortiguard
Published: May 27, 2025

CVE-2025-5262

None
    Mozilla
  • Firefox
  • Firefox Esr
Published: May 27, 2025

CVE-2022-0003

None
Published: May 27, 2025

CVE-2022-21138

None
Published: May 27, 2025

CVE-2024-56193

None
    Google
  • Bluetooth Adapter
Published: May 27, 2025

CVE-2024-49196

None
    Samsung
  • Exynos 1480
  • Exynos 2400
Published: May 27, 2025

CVE-2025-22377

None
    Samsung
  • Samsung Mobile Processor
  • Modem
Published: May 27, 2025

CVE-2024-49197

None
    Samsung
  • Exynos 980
  • Exynos 850
  • Exynos 1080
  • Exynos 1280
  • Exynos 1330
  • Exynos 1380
  • Exynos 1480
  • Exynos W920
  • Exynos W930
  • Exynos W1000
Published: May 27, 2025

CVE-2025-45475

None
    Maccms
  • Maccms10
Published: May 27, 2025

CVE-2025-2872

None
    Wordpress
  • *
Published: May 27, 2025

CVE-2022-21150

None
Published: May 27, 2025

CVE-2022-21200

None
Published: May 27, 2025
Click here to see more Vulnerabilities