Tag: 2025-07-18

8 Attack Reports | 111 Vulnerabilities

Attack reports

Android Cryptojacker Masquerades as Banking App to Mine Cryptocurrency on Locked Devices

A new Android malware campaign has been discovered, disguising itself as a banking app to covertly mine cryptocurrency on locked devices. The malware, distributed through a phishing website impersonating Axis Bank, downloads and executes a modified version of XMRig, a popular cryptocurrency mining …
phishing
android
xmrig
banking
cryptojacking
monero
2025-07-18
device-lock
battery-drain
overheating
android.dminer.a
Published: July 18, 2025
Downloadable IOCs: 1

From a Teams Call to a Ransomware Threat: Matanbuchus 3.0 MaaS Levels Up

Matanbuchus 3.0, a malware loader available as Malware-as-a-Service, has evolved with significant updates. It now employs sophisticated techniques including improved communication protocols, in-memory stealth capabilities, enhanced obfuscation, and support for WQL queries, CMD, and PowerShell rever…
ransomware
matanbuchus
microsoft teams
maas
2025-07-18
Published: July 18, 2025
Downloadable IOCs: 11

KAWA4096’s Ransomware Tide: Rising Threat With Borrowed Styles

KAWA4096, a new ransomware that emerged in June 2025, has claimed at least 11 victims, primarily targeting the United States and Japan. The malware features a leak site mimicking the Akira ransomware group's style and a ransom note format similar to Qilin's. KAWA4096 employs multithreading, semapho…
ransomware
multithreading
2025-07-18
shadow copy deletion
kawa4096
data leak site
Published: July 18, 2025
Downloadable IOCs: 0

The Linuxsys Cryptominer

A long-running cryptomining campaign exploiting multiple vulnerabilities has been active since 2021, using consistent attack methodologies. The attacker compromises legitimate websites to distribute malware, enabling stealthy delivery and detection evasion. The campaign targets various vulnerabilit…
xmrig
cryptomining
compromised websites
2025-07-18
linuxsys
Published: July 18, 2025
Downloadable IOCs: 0

Chinese Mobile Forensic Tooling Discovered

Lookout Threat Lab has uncovered a mobile forensics application called Massistant, used by Chinese law enforcement to extract extensive data from mobile devices. Believed to be the successor of MFSocket, Massistant requires physical access to install and is not distributed through official app stor…
surveillance
travel security
law enforcement
data collection
2025-07-18
mobile forensics
mfsocket
Published: July 18, 2025
Downloadable IOCs: 6

Ongoing SonicWall Secure Mobile Access (SMA) Exploitation Campaign using the OVERSTEP Backdoor

A financially-motivated threat actor, UNC6148, is targeting fully patched end-of-life SonicWall SMA 100 series appliances. They are using stolen credentials and OTP seeds from previous intrusions to regain access. The actor has deployed a new persistent backdoor/user-mode rootkit called OVERSTEP, w…
backdoor
rootkit
credential theft
vpn
data exfiltration
sonicwall
CVE-2025-32819
2025-07-18
overstep
CVE-2021-20038
CVE-2024-38475
CVE-2021-20039
CVE-2021-20035
sma
Published: July 18, 2025
Linked vulnerabilities : CVE-2025-32819 (CVSS 8.8), CVE-2021-20039, CVE-2023-44221, CVE-2021-20035, CVE-2024-38475, CVE-2021-20038
Downloadable IOCs: 4

Chinese Malware Delivery Domains: Part III

This report details an ongoing campaign by a threat actor operating during Chinese time zone hours, targeting Chinese-speaking individuals and entities globally. Since June 2023, the actor has created over 2,800 domains for malware delivery, primarily targeting Windows systems through fake applicat…
phishing
windows
cryptocurrency
2025-07-18
fake-updates
Published: July 18, 2025
Downloadable IOCs: 1159

Malware Identified in Attacks Exploiting Ivanti Connect Secure Vulnerabilities

The article details malware and tactics used in attacks targeting Ivanti Connect Secure vulnerabilities from December 2024 to July 2025. It describes MDifyLoader, a loader based on libPeConv, which deploys Cobalt Strike Beacon through DLL side-loading. The attackers also utilized vshell, a multi-pl…
cobalt strike
cobalt strike beacon
fscan
vshell
ivanti connect secure
2025-07-18
mdifyloader
Published: July 18, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-49746

9.9
    Microsoft
  • Azure Machine Learning
Published: July 18, 2025

CVE-2025-49747

9.9
    Microsoft
  • Azure Machine Learning
Published: July 18, 2025

CVE-2025-6222

9.8
    Woocommerce
  • Refund And Exchange With Rma
Published: July 18, 2025

CVE-2025-7444

9.8
    Wordpress
  • Loginpress Pro
Published: July 18, 2025

CVE-2025-54079

9.4
    Wegia
  • Wegia
Published: July 18, 2025

CVE-2025-7783

9.4
    Form-Data
  • Form-Data
Published: July 18, 2025

CVE-2025-7395

9.2
    Wolfssl
  • Wolfssl
Published: July 18, 2025

CVE-2025-7643

9.1
    Wordpress
  • Attachment Manager
Published: July 18, 2025

CVE-2025-47158

9.0
    Microsoft
  • Azure Devops
Published: July 18, 2025

CVE-2025-54309

9.0
    Crushftp
  • Crushftp
Published: July 18, 2025

CVE-2025-3740

8.8
    Wordpress
  • School Management System
Published: July 18, 2025

CVE-2025-6813

8.8
    Aapanel
  • Wptoolkit
Published: July 18, 2025

CVE-2025-6718

8.8
    Wordpress
  • B1 Lt Plugin
Published: July 18, 2025

CVE-2025-6185

8.7
    Leviton
  • Acquisuite
  • Energy Monitoring Hub
Published: July 18, 2025

CVE-2025-49484

8.7
    Joomla
  • Js Jobs
Published: July 18, 2025

CVE-2025-53762

8.7
    Microsoft
  • Purview
Published: July 18, 2025

CVE-2025-49485

8.6
    Joomla
  • Balbooa Forms
Published: July 18, 2025

CVE-2025-49486

8.6
    Joomla
  • Balbooa Gallery
Published: July 18, 2025

CVE-2025-54075

8.3
    Nuxtjs
  • Mdc
Published: July 18, 2025

CVE-2025-52164

8.2
    Software Gmbh
  • Agorum Core
Published: July 18, 2025

CVE-2025-6023

7.6
    Grafana
  • Grafana
Published: July 18, 2025

CVE-2025-7438

7.5
    Wordpress
  • Masterstudy Lms Pro
Published: July 18, 2025

CVE-2025-54073

7.5
    *
  • Mcp-Package-Docs
Published: July 18, 2025

CVE-2025-27209

7.5
    Nodejs
  • Node.Js
Published: July 18, 2025

CVE-2025-27210

7.5
    Nodejs
  • Node.Js
Published: July 18, 2025

CVE-2025-7790

7.4
    D-Link
  • Di-8100
Published: July 18, 2025

CVE-2025-7792

7.4
    Tenda
  • Fh451
Published: July 18, 2025

CVE-2025-7793

7.4
    Tenda
  • Fh451
Published: July 18, 2025

CVE-2025-7794

7.4
    Tenda
  • Fh451
Published: July 18, 2025

CVE-2025-7795

7.4
    Tenda
  • Fh451
Published: July 18, 2025

CVE-2025-7796

7.4
    Tenda
  • Fh451
Published: July 18, 2025

CVE-2025-7805

7.4
    Tenda
  • Fh451
Published: July 18, 2025

CVE-2025-7806

7.4
    Tenda
  • Fh451
Published: July 18, 2025

CVE-2025-7807

7.4
    Tenda
  • Fh451
Published: July 18, 2025

CVE-2025-52169

7.1
    Agorum Software Gmbh
  • Agorum Core Open
Published: July 18, 2025

CVE-2025-53945

7.0
    Apko
  • Apko
Published: July 18, 2025

CVE-2025-7394

7.0
    Wolfssl
  • Wolfssl
Published: July 18, 2025

CVE-2025-50057

6.9
    Joomla
  • Rsfiles
Published: July 18, 2025

CVE-2025-7801

6.9
    Bosssoft
  • Crm
Published: July 18, 2025

CVE-2025-7814

6.9
    Code-Projects
  • Food Ordering Review System
Published: July 18, 2025

CVE-2025-6233

6.8
    Mattermost
  • Mattermost
Published: July 18, 2025

CVE-2024-27779

6.7
    Fortinet
  • Fortisandbox
  • Fortiisolation
Published: July 18, 2025

CVE-2025-53888

6.6
    Riot
  • Riot Os
Published: July 18, 2025

CVE-2025-6717

6.5
    Wordpress
  • Plugin
    B1.Lt
Published: July 18, 2025

CVE-2025-7772

6.5
    Malcure
  • Malware Scanner
Published: July 18, 2025

CVE-2025-6226

6.5
    Mattermost
  • Mattermost
Published: July 18, 2025

CVE-2025-46002

6.5
    Filemanager
  • Filemanager
Published: July 18, 2025

CVE-2025-7784

6.5
    Redhat
  • Keycloak
Published: July 18, 2025

CVE-2025-46000

6.5
    Filemanager
  • Filemanager
Published: July 18, 2025

CVE-2025-54076

6.5
    Wegia
  • Wegia
Published: July 18, 2025

CVE-2025-54077

6.5
    Wegia
  • Wegia
Published: July 18, 2025

CVE-2025-54078

6.5
    Wegia
  • Wegia
Published: July 18, 2025

CVE-2025-45157

6.5
    Splashin
  • Splashin
Published: July 18, 2025

CVE-2025-47995

6.5
    Microsoft
  • Azure Machine Learning
Published: July 18, 2025

CVE-2025-50586

6.5
    Studentmanage
  • Studentmanage
Published: July 18, 2025

CVE-2025-52162

6.5
    Agorum
  • Agorum Core
Published: July 18, 2025

CVE-2025-52166

6.5
    Software Gmbh
  • Agorum Core
Published: July 18, 2025

CVE-2025-52168

6.5
    Agorum Software Gmbh
  • Agorum Core
Published: July 18, 2025

CVE-2025-52163

6.5
    Agorum Software Gmbh
  • Agorum Core
Published: July 18, 2025

CVE-2025-7648

6.4
    Wordpress
  • Ruven Themes Shortcodes
Published: July 18, 2025

CVE-2025-7660

6.4
    Wordpress
  • Map My Locations
Published: July 18, 2025

CVE-2025-5752

6.4
    Wordpress
  • Vertical Scroll Image Slideshow Gallery
Published: July 18, 2025

CVE-2025-5754

6.4
    Wordpress
  • Useful Tab Block
Published: July 18, 2025

CVE-2025-5767

6.4
    Woocommerce
  • Crowdfunding
Published: July 18, 2025

CVE-2025-5800

6.4
    Wordpress
  • Testimonial Post Type
Published: July 18, 2025

CVE-2025-7789

6.3
    Xuxueli
  • Xxl-Job
Published: July 18, 2025

CVE-2025-6053

6.1
    Zuppler
  • Zuppler Online Ordering
Published: July 18, 2025

CVE-2025-7396

5.6
    Wolfssl
  • Wolfssl
Published: July 18, 2025

CVE-2024-13175

5.5
    Vidco Software
  • Voc Tester
Published: July 18, 2025

CVE-2025-7797

5.5
    Gpac
  • Gpac
Published: July 18, 2025

CVE-2025-46732

5.4
    Opencti
  • Opencti
Published: July 18, 2025

CVE-2025-33014

5.4
    Ibm
  • Sterling B2b Integrator
  • Sterling File Gateway
Published: July 18, 2025

CVE-2025-5811

5.3
    Wordpress
  • Plugin
Published: July 18, 2025

CVE-2025-50126

5.3
    Joomla
  • Rsblog
Published: July 18, 2025

CVE-2025-7785

5.3
    Thinkgem
  • Jeesite
Published: July 18, 2025

CVE-2025-7787

5.3
    Xuxueli
  • Xxl-Job
Published: July 18, 2025

CVE-2025-7788

5.3
    Xuxueli
  • Xxl-Job
Published: July 18, 2025

CVE-2025-45156

5.3
    Splashin
  • Splashin
Published: July 18, 2025

CVE-2025-7798

5.3
    Beijing Shenzhou Shihan Technology
  • Multimedia Integrated Business Display System
Published: July 18, 2025

CVE-2025-7767

5.1
    Phpgurukul
  • Art Gallery Management System
Published: July 18, 2025

CVE-2025-2425

5.1
    Eset
  • Eset Security Software
Published: July 18, 2025

CVE-2025-50056

5.1
    Joomla
  • Rsmail!
Published: July 18, 2025

CVE-2025-50058

5.1
    Joomla
  • Rsdirectory!
  • Joomla
Published: July 18, 2025

CVE-2025-7786

5.1
    Gnuboard
  • Gnuboard
Published: July 18, 2025

CVE-2025-7791

5.1
    Phpgurukul
  • Online Security Guards Hiring System
Published: July 18, 2025

CVE-2025-7800

5.1
    Cgpandey
  • Hotelmis
Published: July 18, 2025

CVE-2025-7802

5.1
    Phpgurukul
  • Complaint Management System
Published: July 18, 2025

CVE-2025-7803

5.1
    Descreekert
  • Wx-Discuz
Published: July 18, 2025

CVE-2025-7638

4.9
    Wordpress
  • Forminator
Published: July 18, 2025

CVE-2025-7431

4.4
    Wordpress
  • Knowledge Base Plugin
Published: July 18, 2025

CVE-2025-6719

4.4
    Wordpress
  • Terms Descriptions Plugin
  • Wordpress
Published: July 18, 2025

CVE-2025-54059

4.4
    Melange
  • Melange
Published: July 18, 2025

CVE-2025-5816

4.3
    Wordpress
  • Plugin
    Woocommerce
Published: July 18, 2025

CVE-2025-6781

4.3
    Copymatic
  • Copymatic
Published: July 18, 2025

CVE-2025-6726

4.3
    Wordpress
  • Block Editor Gallery Slider
Published: July 18, 2025

CVE-2024-32124

4.3
    Fortinet
  • Fortiisolator
Published: July 18, 2025

CVE-2025-6197

4.2
    Grafana
  • Grafana
Published: July 18, 2025

CVE-2025-54310

4.0
    Qbittorrent
  • Qbittorrent
Published: July 18, 2025

CVE-2025-53901

3.5
    Wasmtime
  • Wasmtime
Published: July 18, 2025

CVE-2025-6227

2.2
    Mattermost
  • Mattermost
Published: July 18, 2025

CVE-2025-29572

None
Published: July 18, 2025

CVE-2025-26854

None
    Joomla
  • Articles Good Search
Published: July 18, 2025

CVE-2025-26855

None
    Joomla
  • Articles Calendar
Published: July 18, 2025

CVE-2025-38349

None
    Linux
  • Kernel
Published: July 18, 2025

CVE-2025-46001

None
    Filemanager
  • Filemanager
Published: July 18, 2025

CVE-2025-50585

None
    Studentmanage
  • Studentmanage
Published: July 18, 2025

CVE-2025-50584

None
    Studentmanage
  • Studentmanage
Published: July 18, 2025

CVE-2025-50708

None
    Perplexity Ai
  • Gpt-4
Published: July 18, 2025

CVE-2025-50581

None
    Mrcms
  • Mrcms
Published: July 18, 2025

CVE-2025-50582

None
    Studentmanage
  • Studentmanage
Published: July 18, 2025

CVE-2025-50583

None
    Studentmanage
  • Studentmanage
Published: July 18, 2025
Click here to see more Vulnerabilities