Tag: 2025-08-21

11 Attack Reports | 140 Vulnerabilities

Attack reports

Cherry pie, Douglas firs and the last trip of the summer

As summer winds down, a seasoned agent reflects on a journey through Seattle and the Olympic Peninsula, highlighting the importance of digital security during travel. The article provides practical cybersecurity tips for travelers, emphasizing the need to update devices, back up data, avoid public …
ransomware
xenorat
data breach
travel security
state-sponsored threats
data breaches
ps1bot
2025-08-21
network vulnerabilities
cisco devices
CVE-2018-0171
cybersecurity precautions
device protection
unpatched systems
embassy targets
cisco vulnerability
cybersecurity tips
5g attack
Published: August 21, 2025
Linked vulnerabilities : CVE-2018-0171
Downloadable IOCs: 0

APT36 Malware Campaign Using Desktop Entry Files and Google Drive Payload Delivery

Pakistan-linked APT36 (Transparent Tribe) launched a new cyber-espionage campaign targeting Indian government and defense entities. Active in August 2025, the group used phishing ZIP files containing malicious Linux “.desktop” shortcuts that downloaded payloads from Google Drive.
persistence
stealth
apt36
websocket
google drive
2025-08-21
syscall
icon data
ctfuft
linux desktop
stealth server
unix timestamp
Published: August 21, 2025
Downloadable IOCs: 6

Think before you Click(Fix): Analyzing the ClickFix social engineering technique

The ClickFix social engineering technique has gained popularity among threat actors, targeting thousands of devices globally. It tricks users into executing malicious commands on their devices by exploiting their tendency to solve minor technical issues. The technique often impersonates legitimate …
obfuscation
screenconnect
phishing
social engineering
malvertising
infostealer
macos
darkgate
lumma stealer
latrodectus
remote access tool
mintsloader
atomic macos stealer (amos)
lampion
2025-08-21
windows run dialog
Published: August 21, 2025
Downloadable IOCs: 10

Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your Bandwidth

Palo Alto Networks has identified and identified a threat that is exploiting a critical vulnerability in the GeoServer database, which allows criminals to gain passive income from exploiting victims' internet bandwidth and access to their bandwidth.
persistence
apache
geoserver
CVE-2024-36401
2025-08-21
ip address
jxpath
dart
cve202436401
sdk
Published: August 21, 2025
Linked vulnerabilities : CVE-2024-1182 (CVSS 7.0), CVE-2024-7587 (CVSS 7.8), CVE-2024-8299 (CVSS 7.8), CVE-2024-36401, CVE-2025-32433 (CVSS 10.0), CVE-2025-31324 (CVSS 10.0), CVE-2025-49704, CVE-2025-49706
Downloadable IOCs: 94

New Variant of ACRStealer Actively Distributed with Modifications

A modified version of the ACRStealer infostealer is being actively distributed, featuring enhanced detection evasion and analysis obstruction techniques. The malware uses the Heaven's Gate technique for executing x64 code in WoW64 processes and implements low-level NT functions for C2 communication…
infostealer
anti-analysis
c2 communication
heaven's gate
acrstealer
2025-08-21
data encryption
detection evasion
amaterastealer
Published: August 21, 2025
Downloadable IOCs: 0

Greedy Sponge Targets Mexico with AllaKore RAT and SystemBC

A financially motivated threat group dubbed Greedy Sponge has been targeting Mexican organizations since 2021 with a modified version of AllaKore RAT and SystemBC malware. The group uses spear-phishing and drive-by downloads to deliver custom packaged installers containing the RAT. Recent updates i…
allakore rat
financial fraud
credential theft
drive-by download
systembc
spear-phishing
geofencing
2025-08-21
mexico
Published: August 21, 2025
Downloadable IOCs: 0

Tracking GLOBAL GROUP Ransomware from Mamona to Market Scale

A new ransomware actor, GLOBAL GROUP, emerged on the Ramp4u cybercrime forum in June 2025, claiming to offer a fresh Ransomware-as-a-Service (RaaS) platform. However, forensic evidence reveals that GLOBAL is a rebranded continuation of the Mamona RIP and Black Lock ransomware families. The ransomwa…
ransomware
golang
cross-platform
raas
tor
initial access brokers
black lock
2025-08-21
chacha20-poly1305
mamona rip
global group
ai chatbot
Published: August 21, 2025
Linked vulnerabilities : CVE-2024-57727 (CVSS 7.5), CVE-2025-22457 (CVSS 9.0), CVE-2025-32433 (CVSS 10.0), CVE-2025-31324 (CVSS 10.0)
Downloadable IOCs: 6

MuddyWater Leveraging DCHSpy For Israel-Iran Conflict

Iranian cyber espionage group MuddyWater, affiliated with Iran's Ministry of Intelligence and Security, is utilizing DCHSpy, an Android surveillanceware tool, in the context of the Israel-Iran conflict. DCHSpy collects extensive data from infected devices, including WhatsApp data, accounts, contact…
android
iran
vpn
telegram
2025-08-21
israel
dchspy
conflict
surveillanceware
sandstrike
starlink
Published: August 21, 2025
Linked vulnerabilities : CVE-2025-4609
Downloadable IOCs: 23

APT MuddyWater Targets CFOs with Multi-Stage Phishing & NetBird Abuse

A sophisticated spear-phishing campaign, likely linked to APT MuddyWater, is targeting CFOs and finance executives across multiple continents. The attackers use Firebase-hosted phishing pages with custom CAPTCHA challenges, malicious VBS scripts, and multi-stage payload delivery to deploy NetBird, …
apt
remote-access
finance
spear-phishing
multi-stage
vbs
firebase
2025-08-21
ateraagent
cfo
netbird
Published: August 21, 2025
Downloadable IOCs: 0

A Cereal Offender: Analyzing the CORNFLAKE.V3 Backdoor

This analysis details a campaign involving two threat groups, UNC5518 and UNC5774, deploying the CORNFLAKE.V3 backdoor. UNC5518 compromises legitimate websites to serve fake CAPTCHA pages, luring visitors to execute a downloader script. UNC5774 then uses this access to deploy CORNFLAKE.V3, a sophis…
backdoor
node.js
clickfix
php
2025-08-21
cornflake.v3
windytwist.sea
kerberoasting
Published: August 21, 2025
Downloadable IOCs: 0

Cybercriminals Abuse AI Website Creation App For Phishing

Cybercriminals are exploiting an AI-powered website creation platform called Lovable to generate fraudulent websites for credential phishing and malware delivery. The threat actors create or clone sites impersonating well-known brands, use CAPTCHA for filtering, and post stolen credentials to Teleg…
phishing
cryptocurrency
credential theft
zgrat
malware delivery
doiloader
tycoon
2025-08-21
ai-generated websites
lovable platform
Published: August 21, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-34158

10.0
    Plex
  • Plex Media Server
Published: August 21, 2025

CVE-2025-53251

9.9
    An-Themes
  • Pin Wp
Published: August 21, 2025

CVE-2025-24285

9.8
    Ubiquiti
  • Unifi Connect Ev Station Lite
Published: August 21, 2025

CVE-2025-27214

9.8
    Ubiquiti
  • Unifi Connect Ev Station Pro
Published: August 21, 2025

CVE-2025-8895

9.8
    Wordpress
  • Wp Webhooks
Published: August 21, 2025

CVE-2025-52395

9.8
    Roadcute
  • Api
Published: August 21, 2025

CVE-2025-57754

9.8
    Eslint
  • Eslint
  • Eslint Ban Moment
Published: August 21, 2025

CVE-2025-52352

9.8
    Aikaan
  • Iot Management Platform
Published: August 21, 2025

CVE-2025-53763

9.8
    Microsoft
  • Azure Databricks
Published: August 21, 2025

CVE-2025-57761

9.4
    Wegia
  • We
Published: August 21, 2025

CVE-2010-20112

9.3
    Amlib
  • Netopacs
    Microsoft
Published: August 21, 2025

CVE-2010-20121

9.3
    Easyftp
  • Easyftp
    Uplusftp
Published: August 21, 2025

CVE-2025-3128

9.3
    Mitsubishi
  • Smartrtu
Published: August 21, 2025

CVE-2010-20113

9.3
    Easyftp
  • Easyftp
    Uplusftp
Published: August 21, 2025

CVE-2010-20115

9.3
    Arcane Software
  • Vermilion Ftp Daemon
Published: August 21, 2025

CVE-2010-20122

9.3
    Netdisk
  • Xftp
Published: August 21, 2025

CVE-2025-27217

9.1
    Uisp
  • Uisp Application
Published: August 21, 2025

CVE-2025-7390

9.1
    Opc
  • Opc Https
Published: August 21, 2025

CVE-2024-45438

9.1
    Titanhq
  • Spamtitan
Published: August 21, 2025

CVE-2025-53795

9.1
    Microsoft
  • Pc Manager
Published: August 21, 2025

CVE-2025-27216

8.8
    Uisp
  • Uisp
Published: August 21, 2025

CVE-2025-43300

8.8
    Apple
  • Macos Sonoma
  • Macos Ventura
  • Ipad Os
  • Macos Sequoia
  • Ios
Published: August 21, 2025

CVE-2025-55368

8.8
    Jsherp
  • Jsherp
Published: August 21, 2025

CVE-2025-55370

8.8
    Jsherp
  • Jsherp
Published: August 21, 2025

CVE-2025-55420

8.8
    Foxcms
  • Foxcms
Published: August 21, 2025

CVE-2025-52351

8.8
    Aikaan
  • Aikaan Iot Management Platform
Published: August 21, 2025

CVE-2010-20109

8.7
    Barracuda
  • Barracuda Spam And Virus Firewall
  • Barracuda Ssl Vpn
  • Barracuda Web Application Firewall
Published: August 21, 2025

CVE-2025-27721

8.7
    Infinitt
  • Pacssystemmanager
Published: August 21, 2025

CVE-2025-55383

8.6
    Moss
  • Moss
Published: August 21, 2025

CVE-2010-20119

8.6
    Communicrypt
  • Mail
  • Ansmtp
  • Aosmtp
Published: August 21, 2025

CVE-2010-20007

8.5
    Seagull Software
  • Seagull Ftp Client
Published: August 21, 2025

CVE-2010-20034

8.5
    Gekko
  • Manager Ftp Client
Published: August 21, 2025

CVE-2010-20107

8.5
    Ftp Synchronizer
  • Ftp Synchronizer Professional
Published: August 21, 2025

CVE-2010-10015

8.4
    Aol
  • Aol
Published: August 21, 2025

CVE-2010-20111

8.4
    Digital Music Pad
  • Digital Music Pad
Published: August 21, 2025

CVE-2009-20002

8.4
    Millenium
  • Mp3 Studio
Published: August 21, 2025

CVE-2009-20003

8.4
    Xenorate
  • Xenorate
Published: August 21, 2025

CVE-2009-20004

8.4
    Galan
  • Galan
Published: August 21, 2025

CVE-2010-20108

8.4
    Ftppad
  • Ftppad
Published: August 21, 2025

CVE-2010-20114

8.4
    Varicad
  • Varicad
Published: August 21, 2025

CVE-2010-20120

8.4
    Maplesoft
  • Maple
Published: August 21, 2025

CVE-2010-20123

8.4
    Steinberg
  • Mymp3player
Published: August 21, 2025

CVE-2025-7051

8.3
    N-Able
  • N-Central
Published: August 21, 2025

CVE-2025-27215

8.1
    Ubnt
  • Unifi Connect Display Cast
  • Unifi Connect Display Cast Pro
  • Unifi Connect Display Cast Lite
Published: August 21, 2025

CVE-2025-8592

8.1
    Wordpress
  • Inspiro Theme
Published: August 21, 2025

CVE-2025-57755

8.1
    Claude
  • Claude-Code-Router
Published: August 21, 2025

CVE-2024-50641

8.1
    Pandoranext
  • Tokens Tool
Published: August 21, 2025

CVE-2025-55742

8.0
    Unopim
  • Unopim
    Laravel
Published: August 21, 2025

CVE-2025-38743

7.8
    Dell
  • Idrac Service Module
Published: August 21, 2025

CVE-2025-55230

7.8
    Microsoft
  • Windows Mbt Transport Driver
Published: August 21, 2025

CVE-2025-57751

7.7
    Pyload
  • Pyload
Published: August 21, 2025

CVE-2025-48978

7.5
    Ubiquiti
  • Edgemax Edgeswitch
Published: August 21, 2025

CVE-2025-55564

7.5
    Tenda
  • Ac15
Published: August 21, 2025

CVE-2025-48956

7.5
    Github
  • Vllm
Published: August 21, 2025

CVE-2025-52194

7.5
    Libsndfile
  • Libsndfile
Published: August 21, 2025

CVE-2025-55231

7.5
    Microsoft
  • Windows Storage
Published: August 21, 2025

CVE-2025-9297

7.4
    Tenda
  • I22
Published: August 21, 2025

CVE-2025-9298

7.4
    Tenda
  • M3
Published: August 21, 2025

CVE-2025-9299

7.4
    Tenda
  • Tenda M3
Published: August 21, 2025

CVE-2025-9303

7.4
    Totolink
  • A720r
Published: August 21, 2025

CVE-2025-55743

7.3
    Unopim
  • Unopim
    Laravel
Published: August 21, 2025

CVE-2025-55524

7.3
    Agent-Zero
  • Agent-Zero
Published: August 21, 2025

CVE-2025-41415

7.1
    *
  • *
Published: August 21, 2025

CVE-2025-54460

7.1
    *
  • Text File
    Apache
Published: August 21, 2025

CVE-2025-9302

6.9
    Phpgurukul
  • User Management System
Published: August 21, 2025

CVE-2025-9304

6.9
    Sourcecodester
  • Online Bank Management System
Published: August 21, 2025

CVE-2025-9305

6.9
    Sourcecodester
  • Online Bank Management System
Published: August 21, 2025

CVE-2025-55744

6.9
    Unopim
  • Unopim
    Laravel
Published: August 21, 2025

CVE-2025-9307

6.9
    Phpgurukul
  • Online Course Registration
Published: August 21, 2025

CVE-2025-43756

6.9
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: August 21, 2025

CVE-2025-7969

6.9
    Markdown-It
  • Markdown-It
Published: August 21, 2025

CVE-2025-9311

6.9
    Itsourcecode
  • Apartment Management System
Published: August 21, 2025

CVE-2025-43754

6.9
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: August 21, 2025

CVE-2025-57768

6.9
    Phproject
  • Phproject
Published: August 21, 2025

CVE-2025-36530

6.8
    Mattermost
  • Mattermost
Published: August 21, 2025

CVE-2025-49222

6.8
    Mattermost
  • Mattermost
Published: August 21, 2025

CVE-2025-8023

6.8
    Mattermost
  • Mattermost
Published: August 21, 2025

CVE-2025-51818

6.5
    Mccms
  • Mccms
Published: August 21, 2025

CVE-2025-50860

6.5
    Easyhostingcontrolpanel
  • Ehcp
Published: August 21, 2025

CVE-2025-55521

6.5
    Akaunting
  • Akaunting
Published: August 21, 2025

CVE-2025-55522

6.5
    Akaunting
  • Akaunting
Published: August 21, 2025

CVE-2025-57764

6.5
    Wegia
  • Wegia
Published: August 21, 2025

CVE-2025-57765

6.5
    Wegia
  • Wegia
Published: August 21, 2025

CVE-2025-8607

6.4
    Funnelkit
  • Slingblocks Gutenberg Blocks
Published: August 21, 2025

CVE-2025-8064

6.4
    Wordpress
  • Bible Supersearch
Published: August 21, 2025

CVE-2025-57762

6.4
    Wegia
  • Wegia
Published: August 21, 2025

CVE-2025-57763

6.4
    Wegia
  • Wegia
Published: August 21, 2025

CVE-2025-57753

6.0
    Vite
  • Vite-Plugin-Static-Copy
Published: August 21, 2025

CVE-2025-9310

5.5
    Yeqifu
  • Carrental
    Unknown
Published: August 21, 2025

CVE-2025-9264

5.3
    Xuxueli
  • Xxl-Job
Published: August 21, 2025

CVE-2025-48355

5.3
    Provesource
  • Provesource Social Proof
Published: August 21, 2025

CVE-2025-53505

5.3
    Intermesh
  • Group-Office
Published: August 21, 2025

CVE-2025-47184

5.3
    Exagid
  • Exagid Ex10
Published: August 21, 2025

CVE-2025-55366

5.3
    Jsherp
  • Jsherp
Published: August 21, 2025

CVE-2025-55367

5.3
    Jsherp
  • Jsherp
Published: August 21, 2025

CVE-2025-55371

5.3
    Jsherp
  • Jsherp
Published: August 21, 2025

CVE-2025-38742

5.3
    Dell
  • Idrac Service Module
Published: August 21, 2025

CVE-2025-24489

5.3
    Vendor
  • Service
Published: August 21, 2025

CVE-2025-27714

5.3
    *
  • *
Published: August 21, 2025

CVE-2025-55229

5.3
    Microsoft
  • Windows Certificates
Published: August 21, 2025

CVE-2025-55297

5.2
    Espressif
  • Esp-Idf
Published: August 21, 2025

CVE-2025-9296

5.1
    Emlog
  • Emlog Pro
Published: August 21, 2025

CVE-2025-9306

5.1
    Sourcecodester
  • Advanced School Management System
Published: August 21, 2025

CVE-2025-43755

5.1
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: August 21, 2025

CVE-2025-27213

4.9
    Ubiquiti
  • Unifi Connect Ev Station Pro
  • Unifi Connect Display
  • Unifi Connect Display Cast
  • Unifi Connect Display Cast Pro
  • Unifi Connect Display Cast Lite
Published: August 21, 2025

CVE-2025-9162

4.9
    Keycloak
  • Keycloak-Model-Storage-Service
Published: August 21, 2025

CVE-2025-8402

4.9
    Mattermost
  • Mattermost
Published: August 21, 2025

CVE-2025-53504

4.8
    Intermesh
  • Group-Office
Published: August 21, 2025

CVE-2025-9300

4.8
    Saitoha
  • Libsixel
Published: August 21, 2025

CVE-2025-9301

4.8
    Cmake
  • Cmake
Published: August 21, 2025

CVE-2025-9308

4.8
    Yarnpkg
  • Yarn
Published: August 21, 2025

CVE-2025-55103

4.8
    Esri
  • Portal For Arcgis Enterprise Sites
Published: August 21, 2025

CVE-2025-55104

4.8
    Esri
  • Arcgis Hub
  • Arcgis Enterprise Sites
Published: August 21, 2025

CVE-2025-55105

4.8
    Esri
  • Portal For Arcgis Enterprise
Published: August 21, 2025

CVE-2025-55106

4.8
    Esri
  • Portal For Arcgis Enterprise Sites
Published: August 21, 2025

CVE-2025-55107

4.8
    Esri
  • Portal For Arcgis Enterprise Sites
Published: August 21, 2025

CVE-2025-43747

4.8
    Liferay
  • Liferay Dxp
Published: August 21, 2025

CVE-2025-7221

4.3
    Givewp
  • Donation Plugin
Published: August 21, 2025

CVE-2025-47870

4.3
    Mattermost
  • Mattermost
Published: August 21, 2025

CVE-2025-6465

4.3
    Mattermost
  • Mattermost
Published: August 21, 2025

CVE-2025-53971

3.8
    Mattermost
  • Mattermost
Published: August 21, 2025

CVE-2025-47700

3.5
    Mattermost
  • Server
Published: August 21, 2025

CVE-2025-49810

3.5
    Mattermost
  • Mattermost
Published: August 21, 2025

CVE-2025-55523

3.5
    Agent-Zero
  • Agent-Zero
Published: August 21, 2025

CVE-2025-43753

2.1
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: August 21, 2025

CVE-2025-9309

2.0
    Tenda
  • Ac10
Published: August 21, 2025

CVE-2025-57824

None
    Fortinet
  • *
Published: August 21, 2025

CVE-2025-57825

None
    Fortinet
  • Fortinet
Published: August 21, 2025

CVE-2025-57826

None
    Fortinet
  • Fortinet
Published: August 21, 2025

CVE-2025-57827

None
    Fortinet
  • Fortigate
Published: August 21, 2025

CVE-2025-57828

None
    Fortinet
  • Fortinet
Published: August 21, 2025

CVE-2025-57829

None
    Fortinet
  • Fortinet
Published: August 21, 2025

CVE-2025-57830

None
    Fortinet
  • Fortinet
Published: August 21, 2025

CVE-2025-57831

None
    Fortinet
  • *
Published: August 21, 2025

CVE-2025-57832

None
    Fortinet
  • Fortinet
Published: August 21, 2025

CVE-2025-51989

None
    Evolution Consulting Kft
  • Hrmaster
Published: August 21, 2025

CVE-2025-51606

None
    Hippo4j
  • Hippo4j
Published: August 21, 2025

CVE-2023-3948

None
Published: August 21, 2025

CVE-2023-4131

None
Published: August 21, 2025

CVE-2023-4143

None
Published: August 21, 2025
Click here to see more Vulnerabilities