Tag: 2025-08-08

15 Attack Reports | 19 Vulnerabilities

Attack reports

Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

A routine monitoring by researchers uncovered an exploitation attempt on a honeypot server running TeamCity, a CI/CD tool. The attack exploited an exposed Java Debug Wire Protocol (JDWP) interface, leading to remote code execution, deployment of cryptomining payload, and establishment of multiple p…

remote code execution

Published: August 8, 2025

Downloadable IOCs: 17

Phishing Attack: Deploying Malware on Indian Defense BOSS Linux

APT36, a Pakistan-based threat actor, has launched a sophisticated cyber-espionage campaign targeting the Indian defense sector. The group has adapted its tactics to focus on Linux-based environments, particularly BOSS Linux, used by Indian government agencies. The attack involves phishing emails w…

transparent tribe

cyber-espionage

Published: August 8, 2025

Downloadable IOCs: 8

Atomic macOS Stealer includes a backdoor for persistent access

The Atomic macOS Stealer (AMOS) has received a major update, now including an embedded backdoor for persistent access to compromised Mac devices. This upgrade allows attackers to maintain access, run remote tasks, and gain extended control over infected machines. The Russia-affiliated AMOS threat g…

data exfiltration

atomic macos stealer

command-and-control

persistent access

russia-affiliated

Published: August 8, 2025

Downloadable IOCs: 6

Statistics Report on Malware Targeting Windows Database Servers in Q2 2025

The analysis team has categorized attacks on MS-SQL and MySQL servers installed on Windows systems during Q2 2025. While the number of targeted systems remains stable, attacks on MS-SQL servers have been decreasing. MySQL servers saw a significant spike in attacks in June 2025. The report provides …

server security

ahnlab smart defense

attack statistics

Published: August 8, 2025

Downloadable IOCs: 9

CoinMiner Attacks Exploiting GeoServer Vulnerability

A critical remote code execution vulnerability (CVE-2024-36401) in GeoServer has been actively exploited by threat actors to install CoinMiner malware. The attacks target both Windows and Linux environments with unpatched GeoServer installations. In South Korea, attackers exploited the vulnerabilit…

remote code execution

Published: August 8, 2025

Downloadable IOCs: 4

Statistics Report on Malware Targeting Windows Web Servers in Q2 2025

AhnLab Security Intelligence Center analyzed attacks on Windows web servers during Q2 2025 using their Smart Defense infrastructure. The study focused on poorly managed servers, categorizing attack types and malware strains. It revealed that multiple threat actors often target vulnerable servers si…

remote code execution

vulnerabilities

Published: August 8, 2025

Downloadable IOCs: 4

650 Attack Tools, One Coordinated Campaign

The GreedyBear attack group has launched a massive crypto theft operation, utilizing 150 weaponized Firefox extensions, nearly 500 malicious executables, and numerous phishing websites. Their tactics include Extension Hollowing to bypass marketplace security, distributing various malware families, …

browser extensions

extension hollowing

Published: August 8, 2025

Downloadable IOCs: 111

GenAI Used to Impersonate Brazil's Government Websites

Threat actors are leveraging generative AI tools like DeepSite AI and BlackBox AI to create phishing templates that closely mimic official Brazilian government websites, such as the State Department of Traffic and Ministry of Education. These malicious replicas are boosted in search results using S…

government impersonation

Published: August 8, 2025

Downloadable IOCs: 7

Frozen in transit: Secret Blizzard's AiTM campaign against diplomats

Secret Blizzard, a Russian state actor, has been conducting a cyberespionage campaign targeting embassies in Moscow using an adversary-in-the-middle (AiTM) position to deploy ApolloShadow malware. This campaign, ongoing since 2024, poses a high risk to diplomatic entities relying on local internet …

root certificates

Published: August 8, 2025

Downloadable IOCs: 2

The Homograph Illusion: Not Everything Is As It Seems

Homograph attacks involve using non-Latin characters that visually resemble Latin characters to create words that appear legitimate but are actually different. This technique allows attackers to evade detection and analysis, crafting malicious emails that can lead to credential theft or malware inf…

social engineering

brand impersonation

character substitution

homograph attack

Published: August 8, 2025

Downloadable IOCs: 8

Efimer Trojan delivered via email and hacked WordPress websites

The Efimer Trojan is spreading through compromised WordPress sites, malicious torrents, and email campaigns impersonating lawyers. It steals cryptocurrency by replacing wallet addresses in the clipboard and can execute additional malicious scripts. The Trojan communicates with its command-and-contr…

Published: August 8, 2025

Downloadable IOCs: 16

Unveiling a New Variant of the DarkCloud Campaign

A new DarkCloud campaign was observed in July 2025, targeting Windows users with a sophisticated infection chain. The attack begins with a phishing email containing a RAR archive, which leads to the execution of obfuscated JavaScript and PowerShell code. This code downloads and deploys a fileless .…

credential-theft

process-hollowing

information-stealer

Published: August 8, 2025

Downloadable IOCs: 2

Observed Malicious Driver Use Associated with Akira SonicWall Campaign

Akira affiliates have been observed exploiting two common drivers as part of a suspected AV/EDR evasion effort following initial access involving SonicWall abuse. The drivers, rwdrv.sys and hlpdrv.sys, are being used to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Dr…

Published: August 8, 2025

Downloadable IOCs: 2

New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer

Unit 42 researchers have observed changes in the distribution and obfuscation techniques of DarkCloud Stealer. The new infection chain, first seen in April 2025, involves ConfuserEx obfuscation and a final payload written in Visual Basic 6. The attack begins with a phishing email containing an arch…

infection chain

process hollowing

darkcloud stealer

Published: August 8, 2025

Downloadable IOCs: 10

Unmasking SocGholish: Untangling the Malware Web Behind the 'Pioneer of Fake Updates' and Its Operator

SocGholish, operated by TA569, functions as a Malware-as-a-Service vendor, employing deceptive 'fake browser update' lures to compromise systems. It leverages Traffic Distribution Systems like Parrot TDS and Keitaro TDS to filter and redirect victims. TA569 acts as an Initial Access Broker, enablin…

malware-as-a-service

initial access broker

raspberry robin

traffic distribution system

domain shadowing

Published: August 8, 2025

Downloadable IOCs: 33

Click here to see more Attack Reports

Vulnerabilities

CVE-2025-54887

Ruby

Jwe

Published: August 8, 2025

CVE-2025-54886

Skops

Published: August 8, 2025

CVE-2025-54368

Uv

Published: August 8, 2025

CVE-2024-58257

Enzoh

Published: August 8, 2025

CVE-2025-54793

Astro

Published: August 8, 2025

CVE-2025-8702

Woes Intelligent Optimization Energy Saving System

Published: August 8, 2025

CVE-2025-8703

Woes Intelligent Optimization Energy Saving System

Published: August 8, 2025

CVE-2025-8704

Woes Intelligent Optimization Energy Saving System

Published: August 8, 2025

CVE-2025-8705

Woes Intelligent Optimization Energy Saving System

Published: August 8, 2025

CVE-2025-8706

Woes Intelligent Optimization Energy Saving System

Published: August 8, 2025

CVE-2025-54958

Powered Blue

Powered Blue

Published: August 8, 2025

CVE-2025-54959

Powered Blue

Powered Blue Server

Published: August 8, 2025

CVE-2024-58255

Enzo H

Published: August 8, 2025

CVE-2025-8707

Box App

Published: August 8, 2025

CVE-2025-54940

Advanced Custom Fields

Advanced Custom Fields

Published: August 8, 2025

CVE-2024-58256

Enzoh

Published: August 8, 2025

CVE-2025-8708

White-Jotter

Published: August 8, 2025

CVE-2025-54952

Executorch

Published: August 8, 2025

CVE-2025-6572

Openstreetmap

Plugin

Visual Composer

Published: August 8, 2025

Click here to see more Vulnerabilities