Tag: 2025-08-01

9 Attack Reports | 112 Vulnerabilities

Attack reports

Frozen in transit: Secret Blizzard's AiTM campaign against diplomats

Secret Blizzard, a Russian state actor, has been conducting a cyberespionage campaign targeting embassies in Moscow using an adversary-in-the-middle (AiTM) position to deploy ApolloShadow malware. This campaign, ongoing since 2024, poses a high risk to diplomatic entities relying on local internet …
aitm
russia
cyberespionage
embassies
diplomats
2025-08-01
root certificates
apolloshadow
2025-08-08
isp
Published: August 8, 2025
Downloadable IOCs: 2

Active Exploitation of CVE-2025-5394 in Alone WordPress Theme

A critical arbitrary file-upload vulnerability (CVE-2025-5394) in the Alone - Charity Multipurpose Non-profit WordPress theme versions 7.8.3 and earlier is being actively exploited. The flaw, with a CVSS score of 9.8, allows unauthenticated attackers to upload malicious ZIP archives containing PHP …
vulnerability
wordpress
remote code execution
web shells
CVE-2025-5394
2025-08-01
theme
alone theme
arbitrary file upload
Published: August 1, 2025
Downloadable IOCs: 0

Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing

Proofpoint has uncovered a sophisticated phishing campaign utilizing fake Microsoft OAuth applications to bypass multifactor authentication and steal credentials. The threat actors impersonate various enterprise apps like RingCentral, SharePoint, Adobe, and DocuSign to lure victims. The attack chai…
phishing
aitm
credential theft
mfa bypass
microsoft 365
oauth
2025-08-01
application impersonation
tycoon
Published: August 1, 2025
Downloadable IOCs: 0

Behind Random Words: DoubleTrouble Mobile Banking Trojan Revealed

A sophisticated mobile banking trojan, DoubleTrouble, has evolved in distribution methods and capabilities. Initially spread through phishing websites impersonating European banks, it now utilizes Discord channels for distribution. The malware employs advanced obfuscation techniques, abuses Android…
android
discord
keylogger
2025-08-01
mobile banking trojan
Published: August 1, 2025
Downloadable IOCs: 40

Indian Infrastructure Targeted with Desktop Lures and Poseidon Backdoor

APT36, a Pakistan-linked threat group, has expanded its operations to target Indian government and civilian infrastructure, including railways, oil & gas, and the Ministry of External Affairs. The group employs sophisticated phishing techniques and novel payload strategies, using .desktop files dis…
phishing
india
poseidon
infrastructure
government impersonation
2025-08-01
poseidon backdoor
mythic framework
desktop lures
Published: August 1, 2025
Downloadable IOCs: 36

Exploring Storm-2603's Previous Ransomware Operations

A focused analysis of Storm-2603, a threat actor linked to recent ToolShell exploitations alongside other Chinese APT groups, reveals their use of a custom malware C2 framework called 'ak47c2'. This framework includes HTTP and DNS-based clients. The group likely targeted organizations in Latin Amer…
ransomware
windows
lockbit
lockbit black
microsoft
april
virustotal
sharepoint
psexec
iocs
toolshell
2025-08-01
storm2603
io control
dllhijacking
warlock
Published: August 1, 2025
Linked vulnerabilities : CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706
Downloadable IOCs: 25

RAVEN STEALER UNMASKED: Telegram-Based Data Exfiltration

Raven Stealer is a modern information-stealing malware developed in Delphi and C++, designed to extract sensitive data from victim machines. It targets Chromium-based browsers, extracting passwords, cookies, payment details, and autofill information. The malware uses a modular architecture and a bu…
infostealer
credential theft
information-stealing
data exfiltration
github
telegram
c++
browser data
delphi
octalyn stealer
2025-07-26
raven stealer
upx packing
2025-08-01
Published: August 1, 2025
Downloadable IOCs: 0

Religious symbols weaponized, group uses Microsoft SharePoint RCE vulnerability to deliver 4L4MD4r ransomware

A serious remote code execution vulnerability in Microsoft SharePoint servers was exploited by hackers, affecting tens of thousands of servers globally. The mimo attack group, a financially motivated threat actor, utilized this vulnerability to deliver the 4L4MD4r ransomware, written in Golang and …
ransomware
microsoft
golang
sharepoint
rce
CVE-2025-53770
CVE-2025-53771
CVE-2025-49704
CVE-2025-49706
2025-08-01
4l4md4r
religious symbols
Published: August 1, 2025
Linked vulnerabilities : CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706
Downloadable IOCs: 2

Unmasking LockBit: A Deep Dive into DLL Sideloading and Masquerading Tactics

This analysis explores the sophisticated tactics employed by LockBit ransomware attackers, focusing on DLL sideloading and masquerading techniques. These methods allow attackers to evade detection and maximize impact. DLL sideloading involves tricking legitimate applications into loading malicious …
ransomware
evasion
lockbit
persistence
encryption
dll sideloading
2025-08-01
masquerading
Published: August 1, 2025
Downloadable IOCs: 11
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-5954

9.8
    Wordpress
  • Service Finder Sms System
Published: August 1, 2025

CVE-2025-5947

9.8
    Wordpress
  • Service Finder Bookings
Published: August 1, 2025

CVE-2025-8454

9.8
    Debian
  • Devscripts
Published: August 1, 2025

CVE-2025-50460

9.8
    Ms-Swift
  • Ms-Swift
    Pyyaml
Published: August 1, 2025

CVE-2025-50472

9.8
    Modelscope
  • Ms-Swift
Published: August 1, 2025

CVE-2025-45150

9.8
    Langchain
  • Langchain-Chatglm-Webui
Published: August 1, 2025

CVE-2025-50870

9.8
    Institute-Of-Current-Students
  • Institute-Of-Current-Students
Published: August 1, 2025

CVE-2013-10060

9.4
    Netgear
  • Dgn2200b
Published: August 1, 2025

CVE-2025-41370

9.3
    Tesi
  • Gandia Integra Total
Published: August 1, 2025

CVE-2025-41371

9.3
    Tesi
  • Gandia Integra Total
Published: August 1, 2025

CVE-2025-54574

9.3
    Squid
  • Squid
Published: August 1, 2025

CVE-2013-10047

9.3
    Miniweb
  • Http Server
Published: August 1, 2025

CVE-2013-10048

9.3
    D-Link
  • Dir-300
  • Dir-600
Published: August 1, 2025

CVE-2013-10049

9.3
    Raidsonic
  • Nas
  • Ib-Nas5220
  • Ib-Nas4220
Published: August 1, 2025

CVE-2013-10051

9.3
    Instantcms
  • Instantcms
Published: August 1, 2025

CVE-2013-10055

9.3
    Havalite
  • Havalite Cms
Published: August 1, 2025

CVE-2025-54792

9.3
    Localsend
  • Localsend
Published: August 1, 2025

CVE-2025-52390

9.1
    Saurus
  • Saurus Cms
Published: August 1, 2025

CVE-2025-6000

9.1
    Hashicorp
  • Vault
Published: August 1, 2025

CVE-2025-41372

8.7
    Tesi
  • Gandia Integra Total
Published: August 1, 2025

CVE-2025-41373

8.7
    Tesi
  • Gandia Integra Total
Published: August 1, 2025

CVE-2025-41374

8.7
    Tesi
  • Gandia Integra Total
Published: August 1, 2025

CVE-2025-41375

8.7
    Tesi
  • Gandia Integra Total
Published: August 1, 2025

CVE-2025-41376

8.7
    Tesi
  • Gandia Integra Total
Published: August 1, 2025

CVE-2013-10044

8.7
    Openemr
  • Openemr
Published: August 1, 2025

CVE-2013-10050

8.7
    D-Link
  • Dir-300
  • Dir-615
Published: August 1, 2025

CVE-2013-10053

8.7
    Zpanel
  • Zpanel
Published: August 1, 2025

CVE-2013-10058

8.6
    Linksys
  • Wrt160n V2
Published: August 1, 2025

CVE-2013-10059

8.6
    D-Link
  • Dir-615h1
Published: August 1, 2025

CVE-2013-10061

8.6
    Netgear
  • Dgn1000b
  • Netgear Router
Published: August 1, 2025

CVE-2012-10022

8.5
    Kloxo
  • Kloxo
Published: August 1, 2025

CVE-2013-10046

8.5
    Agnitum
  • Outpost Internet Security
Published: August 1, 2025

CVE-2025-7443

8.1
    Berqwp
  • Berqwp
Published: August 1, 2025

CVE-2025-54424

8.1
    1panel
  • 1panel
Published: August 1, 2025

CVE-2025-8480

8.0
    Alpine
  • Ilx-507
    Tidal
Published: August 1, 2025

CVE-2025-54564

7.8
    Chargepoint
  • Home Flex
Published: August 1, 2025

CVE-2025-51504

7.6
    Microweber
  • Microweber Cms
Published: August 1, 2025

CVE-2023-32256

7.5
    Linux
  • Linux Kernel
Published: August 1, 2025

CVE-2013-10057

7.5
    Synactis
  • Pdf In-The-Box
Published: August 1, 2025

CVE-2025-2824

7.4
    Ibm
  • Operational Decision Manager
Published: August 1, 2025

CVE-2025-8472

7.4
    Alpine
  • Ilx-507
Published: August 1, 2025

CVE-2025-8475

7.4
    Alpine
  • Ilx-507
Published: August 1, 2025

CVE-2025-8477

7.4
    Alpine
  • Ilx-507
Published: August 1, 2025

CVE-2025-54595

7.3
    Alienator88
  • Pearcleaner
Published: August 1, 2025

CVE-2025-7725

7.2
    Wordpress
  • Ecommerce Contest Gallery
  • Plugin
Published: August 1, 2025

CVE-2025-54593

7.2
    Freshrss
  • Freshrss
Published: August 1, 2025

CVE-2025-5999

7.2
    Hashicorp
  • Vault Community Edition
  • Vault Enterprise
Published: August 1, 2025

CVE-2025-8476

7.1
    Alpine
  • Ilx-507
    Tidal
Published: August 1, 2025

CVE-2025-45767

7.0
    Jose
  • Jose
Published: August 1, 2025

CVE-2025-8431

6.9
    Phpgurukul
  • Boat Booking System
Published: August 1, 2025

CVE-2025-53399

6.9
    Sipwise
  • Rtpengine
Published: August 1, 2025

CVE-2025-8434

6.9
    Code-Projects
  • Online Movie Streaming
Published: August 1, 2025

CVE-2025-8435

6.9
    Code-Projects
  • Online Movie Streaming
Published: August 1, 2025

CVE-2025-8436

6.9
    Projectworlds
  • Online Admission System
Published: August 1, 2025

CVE-2025-8437

6.9
    Code-Projects
  • Kitchen Treasure
Published: August 1, 2025

CVE-2025-8438

6.9
    Code-Projects
  • Wazifa System
Published: August 1, 2025

CVE-2025-8439

6.9
    Code-Projects
  • Wazifa System
Published: August 1, 2025

CVE-2025-8441

6.9
    Code-Projects
  • Online Medicine Guide
Published: August 1, 2025

CVE-2025-8442

6.9
    Code-Projects
  • Online Medicine Guide
Published: August 1, 2025

CVE-2025-8443

6.9
    Code-Projects
  • Online Medicine Guide
Published: August 1, 2025

CVE-2025-54590

6.9
    Webfinger
  • Webfinger.Js
Published: August 1, 2025

CVE-2013-10062

6.9
    Linksys
  • E1500
  • Router
Published: August 1, 2025

CVE-2013-10063

6.9
    Netgear
  • Sph200d
Published: August 1, 2025

CVE-2025-6037

6.8
    Hashicorp
  • Vault
  • Vault Enterprise
Published: August 1, 2025

CVE-2025-8474

6.8
    Alpine
  • Ilx-507
Published: August 1, 2025

CVE-2025-6398

6.7
    Asus
  • Ai Suite 3
  • Iomap64.Sys
Published: August 1, 2025

CVE-2025-4523

6.5
    Wordpress
  • Idonate
Published: August 1, 2025

CVE-2025-49832

6.5
    Asterisk
  • Asterisk
Published: August 1, 2025

CVE-2025-50868

6.5
    Cloudclassroom
  • Cloudclassroom Php Project
Published: August 1, 2025

CVE-2025-6014

6.5
    Hashicorp
  • Vault Community Edition
  • Vault Enterprise
Published: August 1, 2025

CVE-2025-7845

6.4
    Wordpress
  • Plugin
Published: August 1, 2025

CVE-2025-7646

6.4
    Plus-Addons
  • Elementor-Addons
Published: August 1, 2025

CVE-2025-4684

6.4
    Wordpress
  • Blockspare
Published: August 1, 2025

CVE-2025-6228

6.4
    Elementor
  • Sina Extension
Published: August 1, 2025

CVE-2025-33118

6.4
    Ibm
  • Qradar Siem
Published: August 1, 2025

CVE-2025-8473

6.4
    Alpine
  • Ilx-507
Published: August 1, 2025

CVE-2025-54131

6.4
    Cursor
  • Cursor
Published: August 1, 2025

CVE-2025-45778

6.1
    Language Sloth
  • Language Sloth Web Application
Published: August 1, 2025

CVE-2025-51501

6.1
    Microweber
  • Microweber
Published: August 1, 2025

CVE-2025-51502

6.1
    Microweber
  • Microweber Cms
Published: August 1, 2025

CVE-2025-50869

6.1
    Institute-Of-Current-Students
  • Institute-Of-Current-Students
Published: August 1, 2025

CVE-2019-19145

5.8
    Quantum
  • Superloader
Published: August 1, 2025

CVE-2025-5921

5.8
    Wordpress
  • Sureforms
Published: August 1, 2025

CVE-2025-6015

5.7
    Hashicorp
  • Vault
  • Vault Enterprise
Published: August 1, 2025

CVE-2025-53009

5.5
    Materialx
  • Materialx
Published: August 1, 2025

CVE-2025-53012

5.5
    Materialx
  • Materialx
Published: August 1, 2025

CVE-2025-46018

5.4
    Csc
  • Pay Mobile App
Published: August 1, 2025

CVE-2025-8433

5.3
    Code-Projects
  • Document Management System
Published: August 1, 2025

CVE-2025-54939

5.3
    Litespeed
  • Lsquic
Published: August 1, 2025

CVE-2025-6004

5.3
    Hashicorp
  • Vault
Published: August 1, 2025

CVE-2025-31716

5.1
    Unisoc
  • Bootloader
Published: August 1, 2025

CVE-2025-48074

4.6
    Openexr
  • Openexr
Published: August 1, 2025

CVE-2025-54132

4.4
    Cursor
  • Cursor
Published: August 1, 2025

CVE-2025-6011

3.7
    Hashicorp
  • Vault
  • Vault Enterprise
Published: August 1, 2025

CVE-2023-44976

3.2
    Hangzhou Shunwang
  • Rentdrv2
Published: August 1, 2025

CVE-2025-53010

2.0
    Materialx
  • Materialx
Published: August 1, 2025

CVE-2025-53011

2.0
    Materialx
  • Materialx
Published: August 1, 2025

CVE-2024-13978

2.0
    Libtiff
  • Libtiff
Published: August 1, 2025

CVE-2025-54657

None
    Fortinet
  • *
Published: August 1, 2025

CVE-2025-54839

None
    Fortinet
  • Fortigate
Published: August 1, 2025

CVE-2025-54840

None
    Fortinet
  • Fortinet
Published: August 1, 2025

CVE-2025-54841

None
    Fortinet
  • Fortigate
Published: August 1, 2025

CVE-2025-54842

None
    Fortinet
  • Fortigate
Published: August 1, 2025

CVE-2025-54843

None
    Fortinet
  • Fortinet
Published: August 1, 2025

CVE-2025-54844

None
    Fortinet
  • Fortinet
Published: August 1, 2025

CVE-2025-54845

None
    Fortinet
  • Fortinet
Published: August 1, 2025

CVE-2025-54846

None
    Fortinet
  • Fortinet
Published: August 1, 2025

CVE-2025-54847

None
    Fortinet
  • Fortinet
Published: August 1, 2025

CVE-2019-19144

None
    Quantum
  • Dxi6702
Published: August 1, 2025

CVE-2025-44139

None
    Emlog
  • Emlog Pro
Published: August 1, 2025

CVE-2025-52327

None
    Restaurant Order System
  • Restaurant Order System
Published: August 1, 2025

CVE-2025-52361

None
    Ak-Nord
  • Usb-Server-Lxl
Published: August 1, 2025
Click here to see more Vulnerabilities