Tag: 2025-07-09

3 Attack Reports | 0 Vulnerabilities

Attack reports

Malicious pull request infects VS Code extension

A VS Code extension for Ethereum smart contract development, ETHcode, was compromised through a GitHub pull request. The attacker, using a newly created account, submitted a PR that introduced a malicious dependency and code to execute it. The compromise was subtle, involving only two lines of code…
github
vs code
supply chain attack
ethereum
javascript obfuscation
2025-07-09
ethcode
keythereum-utils
pull request
Published: July 9, 2025
Downloadable IOCs: 0

Exploitation of Leaked Machine Keys by Initial Access Broker

An initial access broker exploited leaked Machine Keys on ASP.NET sites to gain unauthorized access to organizations. The group, tracked as TGR-CRI-0045, targeted industries in Europe and the U.S. including finance, manufacturing, and technology. They used ASP.NET View State deserialization to exec…
in-memory execution
privilege escalation
post-exploitation
iis
initial access broker
asp.net
machine keys
2025-07-09
txportmap
updf
view state deserialization
Published: July 9, 2025
Downloadable IOCs: 21

Spyware Targets Employees via Weaponized Word Documents Delivering Malware Payloads

An unidentified spyware called Batavia has been targeting Russian industrial organizations since July 2024 through a sophisticated phishing operation. The campaign uses bait emails disguised as contract agreements to trick employees into downloading malicious scripts, initiating a multi-stage infec…
phishing
spyware
data exfiltration
evasion tactics
multi-stage attack
batavia
2025-07-09
c++ malware
persistence mechanisms
russian targets
vbs scripts
delphi executable
Published: July 9, 2025
Downloadable IOCs: 2
Click here to see more Attack Reports