Tag: 2025-06-10

5 Attack Reports | 388 Vulnerabilities

Attack reports

Whispering in the dark

ESET researchers uncovered a cyberespionage campaign by BladedFeline, an Iran-aligned APT group likely tied to OilRig. The group has targeted Kurdish and Iraqi government officials since at least 2017, using various malicious tools including the Whisper backdoor, PrimeCache IIS module, and reverse …
backdoor
apt
iran
cyberespionage
iis module
iraq
kurdistan
whisper
shahmaran
slippery snakelet
2025-06-10
reverse tunnel
rdat
primecache
laret
pinar
flog
Published: June 10, 2025
Downloadable IOCs: 12

APT 41: Threat Intelligence Report and Malware Analysis

APT41, a sophisticated Chinese state-sponsored threat actor, blends cyber espionage with cybercrime tactics. They target various sectors globally, including healthcare, telecom, and government entities. Recently, APT41 was observed using Google Calendar for malware command-and-control on a Taiwanes…
state-sponsored
china
cyberespionage
spear-phishing
google calendar
plusdrop
2025-06-10
plusinject
Published: June 10, 2025
Downloadable IOCs: 10

Detecting PureLogs traffic with CapLoader

CapLoader's Port Independent Protocol Identification feature can now detect the C2 protocol used by PureLogs Stealer malware without relying on port numbers. This capability was added in the recent 2.0 release. The blog post demonstrates this functionality using a PCAP file from malware-traffic-ana…
purelogs
purelogs stealer
c2 traffic
2025-06-10
caploader
pipi
stealer malware
protocol identification
network forensics
Published: June 10, 2025
Downloadable IOCs: 3

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

The research outlines China-nexus threat actors targeting SentinelOne and other organizations between 2024 and 2025. It details intrusions into an IT services company managing SentinelOne's hardware logistics and reconnaissance of SentinelOne's servers. The attacks involved ShadowPad malware and a …
obfuscation
CVE-2024-1709
cyberespionage
backdoors
reconnaissance
shadowpad
infrastructure
CVE-2023-46747
CVE-2024-8190
CVE-2024-8963
vulnerabilities
unc5174
2025-06-10
apt15
goreshell
nailaolocker
nimbo-c2
Published: June 10, 2025
Linked vulnerabilities : CVE-2024-8190 (CVSS 7.2), CVE-2024-8963 (CVSS 9.1), CVE-2024-1709, CVE-2023-46747
Downloadable IOCs: 24

DanaBot C2 Server Memory Leak Bug

A critical vulnerability named DanaBleed was discovered in DanaBot's C2 server, causing memory leaks from June 2022 to early 2025. This bug, introduced in version 2380, exposed sensitive information including threat actor details, server data, and victim credentials. The leak resulted from uninitia…
vulnerability
cybercrime
danabot
malware-as-a-service
c2 server
smokeloader
operation endgame
information theft
2025-06-10
danableed
banking fraud
memory leak
Published: June 10, 2025
Downloadable IOCs: 2
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-1041

9.9
    Avaya
  • Call Management System
Published: June 10, 2025

CVE-2025-30220

9.9
    Osgeo
  • Geoserver
    Geotools
    Geonetwork
Published: June 10, 2025

CVE-2025-49455

9.8
    Loftocean
  • Tinysalt
Published: June 10, 2025

CVE-2025-49507

9.8
    Loftocean
  • Cozystay
Published: June 10, 2025

CVE-2024-57190

9.8
    Erxes
  • Erxes
Published: June 10, 2025

CVE-2025-2474

9.8
    Blackberry
  • Qnx Sdp
Published: June 10, 2025

CVE-2025-2884

9.8
    Tcg
  • Trusted Computing Group
Published: June 10, 2025

CVE-2025-42989

9.6
    Sap
  • Sap Application
Published: June 10, 2025

CVE-2025-40585

9.5
    Siemens
  • Energy Services
Published: June 10, 2025

CVE-2025-36852

9.4
    Amazon
  • Web Services
    Google
Published: June 10, 2025

CVE-2025-40654

9.3
    Dm Corporative
  • Dm Corporative Cms
Published: June 10, 2025

CVE-2025-40655

9.3
    Dm Corporative
  • Cms
Published: June 10, 2025

CVE-2025-40656

9.3
    Dm Corporative
  • Cms
Published: June 10, 2025

CVE-2025-40657

9.3
    Dmcorporative
  • Cms
Published: June 10, 2025

CVE-2024-34711

9.3
    Geoserver
  • Geoserver
Published: June 10, 2025

CVE-2025-43698

9.1
    Salesforce
  • Omnistudio
Published: June 10, 2025

CVE-2025-47110

9.1
    Adobe
  • Commerce
Published: June 10, 2025

CVE-2025-42982

8.8
    Sap
  • Grc
Published: June 10, 2025

CVE-2025-4387

8.8
    Woocommerce
  • Abandoned Cart Pro
Published: June 10, 2025

CVE-2025-4601

8.8
    Inspyry
  • Real Estate Wordpress Theme
Published: June 10, 2025

CVE-2025-4954

8.8
    Wordpress
  • Axle Demo Importer
Published: June 10, 2025

CVE-2025-27818

8.8
    Apache
  • Kafka
Published: June 10, 2025

CVE-2025-22455

8.8
    Ivanti
  • Workspace Control
Published: June 10, 2025

CVE-2025-5353

8.8
    Ivanti
  • Workspace Control
Published: June 10, 2025

CVE-2025-33053

8.8
    Microsoft
  • Windows 10 1507
  • Windows 10 1607
  • Windows 10 1809
  • Windows 10 21h2
  • Windows 10 22h2
  • Windows 11 22h2
  • Windows 11 23h2
  • Windows 11 24h2
  • Windows Server 2008
  • Windows Server 2012
  • Windows Server 2016
  • Windows Server 2019
  • Windows Server 2022
  • Windows Server 2022 23h2
  • Windows Server 2025
Published: June 10, 2025

CVE-2025-33064

8.8
    Microsoft
  • Windows Rras
Published: June 10, 2025

CVE-2025-33066

8.8
    Microsoft
  • Windows Routing And Remote Access Service
Published: June 10, 2025

CVE-2025-33073

8.8
    Microsoft
  • Windows Smb
Published: June 10, 2025

CVE-2025-47163

8.8
    Microsoft
  • Office Sharepoint
Published: June 10, 2025

CVE-2025-47166

8.8
    Microsoft
  • Office Sharepoint
Published: June 10, 2025

CVE-2025-47172

8.8
    Microsoft
  • Office Sharepoint
Published: June 10, 2025

CVE-2025-0051

8.7
    Purestorage
  • Flasharray
Published: June 10, 2025

CVE-2025-46837

8.7
    Adobe
  • Experience Manager
Published: June 10, 2025