Tag: 2025-08-07

24 Attack Reports | 92 Vulnerabilities

Attack reports

New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer

Unit 42 researchers have observed changes in the distribution and obfuscation techniques of DarkCloud Stealer. The new infection chain, first seen in April 2025, involves ConfuserEx obfuscation and a final payload written in Visual Basic 6. The attack begins with a phishing email containing an arch…
obfuscation
infostealer
anti-analysis
infection chain
process hollowing
confuserex
darkcloud stealer
2025-08-07
visual basic 6
runpe
2025-08-08
Published: August 8, 2025
Downloadable IOCs: 10

Unmasking the SVG Threat: How Hackers Use Vector Graphics for Phishing Attacks

Attackers are exploiting Scalable Vector Graphics (SVG) files to execute sophisticated phishing attacks. SVGs, typically used for scalable images, can contain embedded JavaScript that executes when opened in a browser. The attack chain involves sending SVG attachments via spear-phishing emails or c…
phishing
javascript
credential theft
captcha
svg
email attachments
2025-08-07
cloud storage
browser execution
Published: August 7, 2025
Downloadable IOCs: 2

Odyssey Stealer Malware Attacks macOS Users

A phishing campaign targeting macOS users employs a ClickFix technique to deliver the Odyssey Stealer malware. The attack uses a fake CAPTCHA verification page that executes without dropping a binary on the system. When users follow the instructions, they unknowingly execute a malicious AppleScript…
phishing
macos
credential theft
clickfix
applescript
odyssey stealer
2025-08-07
crypto wallet
Published: August 7, 2025
Downloadable IOCs: 3

Shared secret: EDR killer in the kill chain

This intelligence report analyzes a sophisticated tool designed to disable endpoint security solutions, particularly EDR systems, on infected systems. The tool, known as AVKiller, has been observed in multiple ransomware attacks since 2022. It is heavily protected, targets various security vendors,…
ransomware
edr
ransomhub
compromise
blacksuit
qilin
dragonforce
medusalocker
driver
heartcrypt
lynx
avkiller
2025-08-07
inc
crytox
threat-sharing
Published: August 7, 2025
Downloadable IOCs: 56

Email-Delivered RMM: Abusing PDFs for Silent Initial Access

A targeted campaign has been observed since November 2024, primarily affecting organizations in France and Luxembourg. The attackers use socially engineered emails to deliver PDF documents containing embedded links to Remote Monitoring and Management (RMM) tool installers. This method bypasses many…
phishing
social engineering
rmm
pdf
initial access
france
2025-08-07
luxembourg
Published: August 7, 2025
Downloadable IOCs: 51

RoKRAT Shellcode and Steganographic Threats: Analysis and EDR Response Strategies

A new variant of RoKRAT malware used by APT37 has been identified, employing a two-stage encrypted shellcode injection method and steganography to conceal malicious code in image files. The malware uses shortcut files with embedded commands to execute its attack, distributed via compressed archives…
apt
dropbox
rokrat
cloud
injection
steganography
shellcode
edr
fileless
xor
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 0

New Arsenal: LAMEHUG, the First AI-Powered Malware

APT28, a Russian threat group, has developed LAMEHUG, a Python-based malware that utilizes AI to generate and execute system commands. This malware, targeting Ukraine's security and defense sector, begins with a phishing email containing a malicious attachment. LAMEHUG employs the Qwen 2.5-Coder-32…
phishing
python
ukraine
reconnaissance
data exfiltration
2025-08-07
ai-powered malware
hugging face api
lamehug
Published: August 7, 2025
Downloadable IOCs: 0

PlayPraetor's evolving threat: How Chinese-speaking actors globally scale an Android RAT

A large-scale Malware-as-a-Service operation, orchestrated by Chinese-speaking threat actors, has infected over 11,000 Android devices globally with the PlayPraetor Remote Access Trojan. The campaign primarily targets Europe, with significant presence in Portugal, Spain, and France, but also affect…
rat
android
cryptocurrency
botnet
banking
maas
accessibility services
2025-08-07
playpraetor
Published: August 7, 2025
Downloadable IOCs: 0

From Reconnaissance to Control: The Operational Blueprint of Kimsuky APT for Cyber Espionage

This report details a cyber-espionage campaign attributed to Kimsuky, a North Korean APT group, targeting South Korean entities. The attack uses malicious Windows shortcut files as initial access, followed by obfuscated scripts and a sophisticated malware framework. The malware performs extensive s…
obfuscation
apt43
powershell
keylogging
data exfiltration
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 0

Smart Contract Scams | Ethereum Drainers Pose as Trading Bots to Steal Crypto

SentinelLABS has uncovered a series of cryptocurrency scams where threat actors distribute malicious smart contracts disguised as trading bots to drain user wallets. The campaign has stolen over $900,000 US and uses aged YouTube accounts with curated comment sections to create a false sense of legi…
obfuscation
cryptocurrency
youtube
scam
ai-generated content
ethereum
solidity
2025-08-05
mev bot
smart contract
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 0

From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira

A sophisticated cyber attack campaign leveraged SEO poisoning to compromise organizations through trojanized IT management tool installers. The attack began when users searching for ManageEngine OpManager were directed to a malicious website, downloading a compromised MSI file that installed Bumble…
ransomware
seo poisoning
credential theft
lateral movement
data exfiltration
akira
bumblebee
2025-08-07
rustdesk
it management tools
adaptixc2
Published: August 7, 2025
Downloadable IOCs: 0

Tracking Updates to Raspberry Robin

Raspberry Robin, an advanced malware downloader active since 2021, has undergone significant updates. The malware now employs improved obfuscation methods, including multiple initialization loops and obfuscated stack pointers, making analysis more challenging. It has switched from AES-CTR to ChaCha…
obfuscation
evasion
privilege-escalation
encryption
downloader
CVE-2024-38196
tor
raspberry robin
roshtyak
2025-08-07
usb-spread
Published: August 7, 2025
Linked vulnerabilities : CVE-2024-38196 (CVSS 7.8)
Downloadable IOCs: 121

SLOW#TEMPEST Cobalt Strike Loader

An ISO image containing a malicious Cobalt Strike loader was discovered, targeting Chinese-speaking users. The infection chain involves a deceptive LNK file, which executes a legitimate Alibaba executable to sideload a malicious DLL. The loader implements anti-analysis techniques, decrypts an embed…
cobalt strike
anti-analysis
dll-sideloading
2025-08-07
beacon
entry-point-patching
chinese-targets
cobalt-strike
iso-image
Published: August 7, 2025
Downloadable IOCs: 9

Infrastructure of Interest: Medium Confidence Detection

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and e…
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 1579

Infrastructure of Interest: Medium Confidence FastFlux

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous DNS patterns, behavioral analysis of rapid IP rotation, and cross-referenced intelligence from global sinkhole data …
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 43

Infrastructure of Interest: Medium Confidence InfoStealer

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and e…
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 352

Infrastructure of Interest: Medium Confidence Command And Control

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and e…
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 448

Infrastructure of Interest: Medium Confidence Phishing

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and e…
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 177

Infrastructure of Interest: High Confidence

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and e…
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 0

Infrastructure of Interest: High Confidence Detection

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and e…
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 5110

Infrastructure of Interest: High Confidence FastFlux

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous DNS patterns, behavioral analysis of rapid IP rotation, and cross-referenced intelligence from global sinkhole data …
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 30

Infrastructure of Interest: High Confidence InfoStealer

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and e…
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 76

Infrastructure of Interest: High Confidence Command And Control

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and e…
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 797

Infrastructure of Interest: High Confidence Phishing

These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and e…
2025-08-07
Published: August 7, 2025
Downloadable IOCs: 417
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-53767

10.0
    Microsoft
  • Azure Openai
Published: August 7, 2025

CVE-2025-34148

9.4
    Shenzhen
  • Aitemi M300 Wifi Repeater
Published: August 7, 2025

CVE-2025-34149

9.4
    Shenzhen
  • Aitemi M300 Wifi Repeater
Published: August 7, 2025

CVE-2025-34150

9.4
    Shenzhen
  • Aitemi M300
Published: August 7, 2025

CVE-2025-34151

9.4
    Shenzhen
  • Aitemi M300 Wifi Repeater
Published: August 7, 2025

CVE-2025-34152

9.4
    Shenzhen
  • Aitemi M300
Published: August 7, 2025

CVE-2025-53792

9.1
    Microsoft
  • Azure Portal
Published: August 7, 2025

CVE-2025-54785

8.8
    Suitecrm
  • Suitecrm
Published: August 7, 2025

CVE-2025-54788

8.8
    Suitecrm
  • Suitecrm
Published: August 7, 2025

CVE-2025-8576

8.8
    Google
  • Chrome
Published: August 7, 2025

CVE-2025-8578

8.8
    Google
  • Chrome
Published: August 7, 2025

CVE-2025-29866

8.8
    Tagfree
  • X-Free Uploader
Published: August 7, 2025

CVE-2025-24000

8.8
    Wpexperts
  • Post Smtp
Published: August 7, 2025

CVE-2023-41520

8.8
    *
  • Student Attendance Management System
Published: August 7, 2025

CVE-2023-41521

8.8
    Student Attendance Management System
  • Student Attendance Management System
Published: August 7, 2025

CVE-2023-41531

8.8
    *
  • Hospital Management System
Published: August 7, 2025

CVE-2023-41532

8.8
    Hospital Management System
  • Hospital Management System
Published: August 7, 2025

CVE-2025-51629

8.8
    Agenzia Impresa Eccobook
  • Agenzia Impresa Eccobook
Published: August 7, 2025

CVE-2025-29865

8.7
    Tagfree
  • X-Free Uploader
Published: August 7, 2025

CVE-2025-35970

8.7
    Seiko Epson
  • *
    Fuji Film
Published: August 7, 2025

CVE-2025-7054

8.7
    Cloudflare
  • Quiche
Published: August 7, 2025

CVE-2025-54784

8.6
    Suitecrm
  • Suitecrm
Published: August 7, 2025

CVE-2025-53787

8.2
    Microsoft
  • Microsoft 365 Copilot
Published: August 7, 2025

CVE-2025-55137

7.4
    Linkjoin
  • Linkjoin
Published: August 7, 2025

CVE-2025-55138

7.4
    Linkjoin
  • Linkjoin
Published: August 7, 2025

CVE-2025-54882

7.1
    Himmelblau
  • Himmelblau
Published: August 7, 2025

CVE-2025-3770

7.0
    Edk2
  • Edk2 Bios
Published: August 7, 2025

CVE-2025-47907

7.0
    Golang
  • Golang
Published: August 7, 2025

CVE-2025-26513

7.0
    Netapp
  • San Host Utilities
Published: August 7, 2025

CVE-2025-54885

6.9
    Thinbus
  • Javascript Secure Remote Password
Published: August 7, 2025

CVE-2025-8533

6.9
    Fantastical
  • Fantastical
Published: August 7, 2025

CVE-2025-44779

6.6
    Ollama
  • Ollama
Published: August 7, 2025

CVE-2024-55401

6.5
    4c Strategies
  • Exonaut
Published: August 7, 2025

CVE-2025-47188

6.5
    Mitel
  • 6800 Series
  • 6900 Series
  • 6900w Series
  • 6970 Conference Unit
  • Sip Phones
Published: August 7, 2025

CVE-2025-50952

6.5
    Openjpeg
  • Openjpeg
Published: August 7, 2025

CVE-2024-42048

6.5
    Openorange
  • Business Framework
Published: August 7, 2025

CVE-2023-40992

6.5
    Hospital Management System
  • Hospital Management System
Published: August 7, 2025

CVE-2025-53774

6.5
    Microsoft
  • Microsoft 365 Copilot
Published: August 7, 2025

CVE-2025-55133

6.4
    Agora Foundation
  • Agora
Published: August 7, 2025

CVE-2025-55134

6.4
    Agora
  • Agora
Published: August 7, 2025

CVE-2025-55135

6.4
    Agora Foundation
  • Agora
  • Agora Fall23 Alpha1
Published: August 7, 2025

CVE-2024-52680

6.1
    Eyou
  • Eyoucms
Published: August 7, 2025

CVE-2025-54392

6.1
    Netwrix
  • Directory Manager
Published: August 7, 2025

CVE-2025-54395

6.1
    Netwrix
  • Directory Manager
    Imanami
Published: August 7, 2025

CVE-2023-41519

6.1
    *
  • Student Attendance Management System
Published: August 7, 2025

CVE-2023-41529

6.1
    Hospital Management System
  • Hospital Management System
Published: August 7, 2025

CVE-2025-55136

5.7
    Erc
  • Emotion Recognition In Conversation
Published: August 7, 2025

CVE-2025-47808

5.6
    Gstreamer
  • Gstreamer
Published: August 7, 2025

CVE-2025-54393

5.4
    Netwrix
  • Directory Manager
Published: August 7, 2025

CVE-2025-54396

5.4
    Netwrix
  • Directory Manager
    Imanami
Published: August 7, 2025

CVE-2025-54786

5.3
    Suitecrm
  • Suitecrm
Published: August 7, 2025

CVE-2025-54394

5.3
    Netwrix
  • Directory Manager
    Imanami
Published: August 7, 2025

CVE-2025-51533

5.3
    Sage
  • Sage Dpw
Published: August 7, 2025

CVE-2025-55077

5.3
    Tyler Technologies
  • Erp Pro
Published: August 7, 2025

CVE-2025-8697

5.3
    Agentuniverse
  • Agentuniverse
Published: August 7, 2025

CVE-2025-8701

5.3
    Wanzhou
  • Woes Intelligent Optimization Energy Saving System
Published: August 7, 2025

CVE-2025-7195

5.2
    Red Hat
  • Operator-Sdk
Published: August 7, 2025

CVE-2025-54783

5.1
    Suitecrm
  • Suitecrm
Published: August 7, 2025

CVE-2025-8698

4.8
    Open5gs
  • Open5gs
Published: August 7, 2025

CVE-2025-8577

4.3
    Google
  • Chrome
Published: August 7, 2025

CVE-2025-8579

4.3
    Google
  • Chrome
Published: August 7, 2025

CVE-2025-8580

4.3
    Google
  • Chrome
Published: August 7, 2025

CVE-2025-8581

4.3
    Google
  • Chrome
Published: August 7, 2025

CVE-2025-8582

4.3
    Google
  • Chrome
Published: August 7, 2025

CVE-2025-8583

4.3
    Google
  • Chrome
Published: August 7, 2025

CVE-2025-54397

4.3
    Netwrix
  • Directory Manager
Published: August 7, 2025

CVE-2025-32094

4.0
    Akamai
  • Ghost
Published: August 7, 2025

CVE-2024-56339

3.7
    Ibm
  • Websphere Application Server
  • Websphere Application Server Liberty
Published: August 7, 2025

CVE-2025-54787

3.7
    Suitecrm
  • Suitecrm
Published: August 7, 2025

CVE-2025-54798

2.5
    Npm
  • Tmp
Published: August 7, 2025

CVE-2025-54799

2.3
    Letsencrypt
  • Lego
Published: August 7, 2025

CVE-2023-41522

None
    Student Attendance Management System
  • Student Attendance Management System
Published: August 7, 2025

CVE-2023-41523

None
    Student Attendance Management System
  • Student Attendance Management System
Published: August 7, 2025

CVE-2023-41524

None
    *
  • Student Attendance Management System
Published: August 7, 2025

CVE-2023-41525

None
    Hospital Management System
  • Hospital Management System
Published: August 7, 2025

CVE-2023-41526

None
    Hospital Management System
  • Hospital Management System
Published: August 7, 2025

CVE-2023-41527

None
    Hospital Management System
  • Hospital Management System
Published: August 7, 2025

CVE-2023-41528

None
    Hospital Management System
  • Hospital Management System
Published: August 7, 2025

CVE-2023-41530

None
    Hospital Management System
  • Hospital Management System
Published: August 7, 2025

CVE-2025-50675

None
    Gpmaw
  • Gpmaw
Published: August 7, 2025

CVE-2025-50692

None
    Foxcms
  • Foxcms
Published: August 7, 2025

CVE-2025-47183

None
    Gstreamer
  • Isomp4
Published: August 7, 2025

CVE-2025-47219

None
    Gstreamer
  • Gstreamer
Published: August 7, 2025

CVE-2025-47806

None
    Gstreamer
  • Gstreamer
Published: August 7, 2025

CVE-2025-47807

None
    Gstreamer
  • Gstreamer
Published: August 7, 2025

CVE-2025-48709

None
    Bmc
  • Control-M
Published: August 7, 2025

CVE-2025-45765

None
    Ruby
  • Jwt
Published: August 7, 2025

CVE-2025-30404

None
    Executorch
  • Executorch
Published: August 7, 2025

CVE-2025-30405

None
    Executorch
  • Executorch
Published: August 7, 2025

CVE-2025-54949

None
    Executorch
  • Executorch
Published: August 7, 2025

CVE-2025-54950

None
    Executorch
  • Executoch
Published: August 7, 2025

CVE-2025-54951

None
    Executorch
  • Executorch
Published: August 7, 2025
Click here to see more Vulnerabilities