Tag: 2025-07-24

6 Attack Reports | 0 Vulnerabilities

Attack reports

AI-Generated Malware in Panda Image Hides Persistent Linux Threat

A sophisticated Linux malware campaign called Koske has been discovered, showing signs of AI-assisted development. The threat exploits misconfigured servers to install backdoors and download weaponized JPEG images containing malicious payloads. The malware uses polyglot file abuse to hide shellcode…

Published: July 24, 2025

Downloadable IOCs: 2

Novel Use of "mount" Spotted in Hikvision Attacks

Attackers are exploiting CVE-2021-36260, a command injection vulnerability in Hikvision devices, using a novel technique involving the 'mount' command as a GTFOBin. This method allows them to mount a remote NFS share and execute malicious files, bypassing common network signatures. The technique ha…

command injection

Published: July 24, 2025

Linked vulnerabilities : CVE-2021-36260

Downloadable IOCs: 6

Pausing for a "Sanctuary Moon" marathon

This newsletter discusses the debut of the 'Humans of Talos' series, which highlights the people behind Cisco Talos' research and operations. It draws parallels between sci-fi characters and cybersecurity professionals, emphasizing the importance of human creativity and insight in advanced technolo…

machine learning

sharepoint vulnerability

Published: July 24, 2025

Linked vulnerabilities : CVE-2025-53770 (CVSS 9.8)

Downloadable IOCs: 7

Gunra Ransomware Emerges with New DLS

A new ransomware group called Gunra has emerged with a Dedicated Leak Site (DLS) in April 2025. Gunra's code shows similarities to the infamous Conti ransomware, suggesting it may be leveraging Conti's leaked source code. The group employs aggressive tactics, including a time-based pressure techniq…

volume shadow copy

Published: July 24, 2025

Downloadable IOCs: 3

Multiplatform Cryptomining Campaign Uses Fake Error Pages to Hide Payload

A new iteration of a broad cryptomining campaign, dubbed Soco404, has been identified. The attackers exploit vulnerabilities in cloud environments, particularly targeting PostgreSQL misconfigurations, to deploy cryptominers on both Linux and Windows systems. They use process masquerading, achieve p…

compromised-servers

process-masquerading

Published: July 24, 2025

Downloadable IOCs: 0

Operation Cargotalon: Targeting Russian Aerospace Defense Using Eaglet Implant

UNG0901, a threat group targeting Russian aerospace and defense sectors, has been discovered conducting a spear-phishing campaign against the Voronezh Aircraft Production Association. The operation, dubbed 'CargoTalon', utilizes a custom DLL implant called EAGLET, which is disguised as a ZIP file c…

Published: July 24, 2025

Downloadable IOCs: 16

Click here to see more Attack Reports