Tag: 2025-08-27

9 Attack Reports | 85 Vulnerabilities

Attack reports

UAC-0057 Keeps Pressure on Ukraine and Poland

This report details recent cyber espionage campaigns targeting Ukraine and Poland, likely conducted by UAC-0057 (also known as UNC1151 or Ghostwriter). The threat actor used weaponized XLS spreadsheets with obfuscated VBA macros to drop first-stage DLL downloaders. C# and C++ downloaders were used …
cobalt strike
ukraine
cyber espionage
poland
vba macros
upx
confuserex
domain impersonation
downloaders
2025-08-27
Published: August 27, 2025
Linked vulnerabilities : CVE-2024-42009
Downloadable IOCs: 37

ZipLine Phishing Campaign Targets U.S. Manufacturing

A sophisticated phishing campaign called ZipLine is targeting U.S. manufacturing companies, especially those in supply chain-critical sectors. The attackers initiate contact through company contact forms, leading to weeks-long email conversations before delivering malicious payloads. They use legit…
phishing
dns tunneling
manufacturing
2025-08-27
zipline
mixshell
Published: August 27, 2025
Downloadable IOCs: 32

UNC Cluster Targeting South Asian Countries

A South Asian APT group has been consistently targeting Sri Lanka, Bangladesh, Pakistan, and Turkey. The operation involves phishing campaigns using military-themed lures to compromise phones of military personnel. The attackers employ various tactics, including PDF phishing documents, fake login p…
phishing
credential theft
remote access
rafel rat
information stealer
android malware
2025-08-27
military targets
south asian apt
Published: August 27, 2025
Downloadable IOCs: 0

SpyNote Malware Analysis

This analysis reveals the resurgence of SpyNote, a potent Android RAT, distributed through deceptive websites mimicking Google Play Store. The malware employs sophisticated techniques for surveillance, data exfiltration, and remote control. Recent changes include minor IP resolution adjustments and…
android
spynote
apk
malware delivery
2025-08-27
Published: August 27, 2025
Downloadable IOCs: 0

Virtual Infrastructure Abuse leads to SaaS Hijacks

This analysis examines a series of coordinated SaaS account compromises across multiple customer environments, involving suspicious logins from VPS-linked infrastructure followed by unauthorized inbox rule creation and deletion of phishing-related emails. The attackers leveraged virtual private ser…
phishing
session hijacking
2025-08-27
hyonix
inbox rules
saas compromise
vps abuse
Published: August 27, 2025
Downloadable IOCs: 0

Underground Ransomware Being Distributed Worldwide

The Underground ransomware gang is conducting global attacks against companies across various countries and industries. First identified in July 2023, the group resurfaced in May 2024 with a new Dedicated Leak Site. Their targets include multinational corporations from diverse sectors, with annual …
ransomware
data theft
encryption
2025-08-27
underground ransomware
striping method
global attacks
Published: August 27, 2025
Downloadable IOCs: 0

Belarus-Linked DSLRoot Proxy Network Deploys Hardware in U.S. Residences, Including Military Homes

DSLRoot, a residential proxy provider, operates a network of hardware devices deployed in U.S. homes across at least 20 states. The network is managed by a Belarusian national with ties to both Minsk and Moscow. Unlike typical proxy services, DSLRoot uses dedicated hardware in American residences, …
residential proxy
2025-08-27
anonymous routing
u.s. infrastructure
virtual credit cards
Published: August 27, 2025
Downloadable IOCs: 0

Like PuTTY in Admin's Hands

The LevelBlue Managed Detection and Response team handled incidents related to a malvertising campaign distributing trojanized versions of the PuTTY terminal emulator. The malicious software, masquerading as legitimate PuTTY, was downloaded by privileged users and exhibited behaviors such as Kerber…
malvertising
putty
kerberoasting
2025-08-27
oyster
broomstick
trojanized
Published: August 27, 2025
Downloadable IOCs: 0

The Price of Trust: Analyzing the Malware Campaign Exploiting TASPEN's Legacy to Target Indonesian Senior Citizens

A sophisticated mobile malware campaign is targeting Indonesian pensioners by impersonating TASPEN, the state pension fund. The attackers use a phishing website to distribute a malicious Android app that steals banking credentials, intercepts SMS messages for OTPs, and captures biometric data. The …
phishing
spyware
banking trojan
mobile malware
indonesia
senior citizens
2025-08-27
pension fund
taspen
Published: August 27, 2025
Downloadable IOCs: 7
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-50972

9.8
    Abantecart
  • Abantecart
Published: August 27, 2025

CVE-2025-52122

9.8
    Craftcms
  • Freeform
Published: August 27, 2025

CVE-2025-43728

9.6
    Dell
  • Thin Os
Published: August 27, 2025

CVE-2025-2313

9.4
    *
  • Print.Pl
Published: August 27, 2025

CVE-2025-30056

9.4
    *
  • *
Published: August 27, 2025

CVE-2025-30057

9.4
    Uhcrtfdoc
  • Uhcrtfdoc
Published: August 27, 2025

CVE-2025-30063

9.4
    *
  • *
Published: August 27, 2025

CVE-2025-34157

9.4
    Coolify
  • Coolify
Published: August 27, 2025

CVE-2025-34159

9.4
    Coolify
  • Coolify
Published: August 27, 2025

CVE-2025-34161

9.4
    Coolify
  • Coolify
Published: August 27, 2025

CVE-2025-30039

9.0
    *
  • Clininet
Published: August 27, 2025

CVE-2025-30040

9.0
    Clinet
  • Clinet
Published: August 27, 2025

CVE-2025-30041

9.0
    Clinet
  • Clinet Prd
  • Utils
Published: August 27, 2025

CVE-2025-30055

9.0
    Software
  • *
Published: August 27, 2025

CVE-2025-9523

8.9
    Tenda
  • Ac1206
Published: August 27, 2025

CVE-2025-30036

8.8
    *
  • Oddzial
Published: August 27, 2025

CVE-2025-30037

8.8
    *
  • *
Published: August 27, 2025

CVE-2025-30064

8.8
    *
  • *
Published: August 27, 2025

CVE-2025-50989

8.8
    Opnsense
  • Opnsense
Published: August 27, 2025

CVE-2025-55422

8.8
    Foxcms
  • Foxcms
Published: August 27, 2025

CVE-2025-57797

8.5
    Fuji Xerox
  • Scansnap Manager
Published: August 27, 2025

CVE-2025-57846

8.5
    I-Filter
  • *
Published: August 27, 2025

CVE-2025-43730

8.4
    Dell
  • Thin Os
Published: August 27, 2025

CVE-2025-50983

8.3
    Readarr
  • Readarr
Published: August 27, 2025

CVE-2025-43729

7.8
    Dell
  • Thin Os
Published: August 27, 2025

CVE-2025-43882

7.8
    Dell
  • Thin Os
Published: August 27, 2025

CVE-2025-53105

7.5
    Glpi
  • Glpi
Published: August 27, 2025

CVE-2025-9525

7.4
    Linksys
  • E1700
Published: August 27, 2025

CVE-2025-9526

7.4
    Linksys
  • E1700
Published: August 27, 2025

CVE-2025-9527

7.4
    Linksys
  • E1700
Published: August 27, 2025

CVE-2025-20241

7.4
    Cisco
  • Nx-Os
  • Nexus 3000
  • Nexus 9000
Published: August 27, 2025

CVE-2025-30038

7.3
    Cgm
  • Clininet
Published: August 27, 2025

CVE-2025-20317

7.1
    Cisco
  • Integrated Management Controller
  • Ucs Manager
Published: August 27, 2025

CVE-2025-51667

7.0
    Simple-Admin
  • Simple-Admin-Core
Published: August 27, 2025

CVE-2025-9502

6.9
    Campcodes
  • Online Loan Management System
Published: August 27, 2025

CVE-2025-9503

6.9
    Campcodes
  • Online Loan Management System
Published: August 27, 2025

CVE-2025-9504

6.9
    Campcodes
  • Online Loan Management System
Published: August 27, 2025

CVE-2025-9505

6.9
    Campcodes
  • Online Loan Management System
Published: August 27, 2025

CVE-2025-9506

6.9
    Campcodes
  • Online Loan Management System
Published: August 27, 2025

CVE-2025-9507

6.9
    Itsourcecode
  • Apartment Management System
Published: August 27, 2025

CVE-2025-9508

6.9
    Itsourcecode
  • Apartment Management System
Published: August 27, 2025

CVE-2025-9509

6.9
    Itsourcecode
  • Apartment Management System
Published: August 27, 2025

CVE-2025-9510

6.9
    Itsourcecode
  • Apartment Management System
Published: August 27, 2025

CVE-2025-9511

6.9
    Itsourcecode
  • Apartment Management System
Published: August 27, 2025

CVE-2025-30058

6.9
    *
  • Patient Service
Published: August 27, 2025

CVE-2025-30059

6.9
    *
  • Preparecdexportjson
  • Sql Injection
Published: August 27, 2025

CVE-2025-30060

6.9
    *
  • *
  • Returnuserunitsxml
Published: August 27, 2025

CVE-2025-30061

6.9
    *
  • Reporter
Published: August 27, 2025

CVE-2025-9529

6.9
    Campcodes
  • Payroll Management System
Published: August 27, 2025

CVE-2025-9533

6.9
    Totolink
  • T10
Published: August 27, 2025

CVE-2025-5187

6.7
    Kubernetes
  • Kubernetes
Published: August 27, 2025

CVE-2021-4459

6.5
    Solaredge
  • Sunny Boy
Published: August 27, 2025

CVE-2025-20294

6.5
    Cisco
  • Ucs Manager
Published: August 27, 2025

CVE-2025-20344

6.5
    Cisco
  • Nexus Dashboard
Published: August 27, 2025

CVE-2025-7732

6.4
    Wordpress
  • Lazy Load For Videos
Published: August 27, 2025

CVE-2025-9513

6.3
    Editso
  • Fuso
Published: August 27, 2025

CVE-2025-9514

6.3
    Macrozheng
  • Mall
Published: August 27, 2025

CVE-2025-50978

6.1
    Gitblit
  • Gitblit
Published: August 27, 2025

CVE-2025-20295

6.0
    Cisco
  • Ucs Manager
Published: August 27, 2025

CVE-2025-49035

5.9
    Chaimchaikin
  • Admin Menu Groups
Published: August 27, 2025

CVE-2025-49039

5.9
    Mibuthu
  • Link View
Published: August 27, 2025

CVE-2025-56694

5.8
    Lumasoft
  • Fotoshare
Published: August 27, 2025

CVE-2025-50985

5.6
    Diskover
  • Diskover Web
Published: August 27, 2025

CVE-2025-50986

5.6
    Diskover
  • Diskover Web
Published: August 27, 2025

CVE-2025-20290

5.5
    Cisco
  • Nx-Os
  • Nexus 3000
  • Nexus 9000
  • Ucs 6400
  • Ucs 6500
  • Ucs 9108 100g
Published: August 27, 2025

CVE-2025-20296

5.4
    Cisco
  • Ucs Manager Software
Published: August 27, 2025

CVE-2025-20342

5.4
    Cisco
  • Integrated Management Controller
  • Ucs Manager
Published: August 27, 2025

CVE-2025-20347

5.4
    Cisco
  • Nexus Dashboard
  • Nexus Dashboard Fabric Controller
Published: August 27, 2025

CVE-2025-48081

5.3
    Printeers
  • Print And Ship
Published: August 27, 2025

CVE-2025-30048

5.3
    *
  • *
Published: August 27, 2025

CVE-2025-9531

5.3
    Portabilis
  • I-Educar
Published: August 27, 2025

CVE-2025-9532

5.3
    Portabilis
  • I-Educar
Published: August 27, 2025

CVE-2025-9528

5.1
    Linksys
  • E1700
Published: August 27, 2025

CVE-2025-20262

5.0
    Cisco
  • Nexus 3000 Series
  • Nexus 9000 Series
Published: August 27, 2025

CVE-2025-20348

5.0
    Cisco
  • Nexus Dashboard
  • Nexus Dashboard Fabric Controller
Published: August 27, 2025

CVE-2025-8490

4.4
    Wordpress
  • All-In-One Wp Migration And Backup
Published: August 27, 2025

CVE-2025-20292

4.4
    Cisco
  • Nx-Os
Published: August 27, 2025

CVE-2025-49040

4.3
    Backup Bolt
  • Backup Bolt
Published: August 27, 2025

CVE-2025-58192

4.3
    Xylus Themes
  • Wp Bulk Delete
Published: August 27, 2025

CVE-2025-57821

4.2
    Basecamp
  • Google Sign-In
Published: August 27, 2025

CVE-2025-50984

None
    Diskover
  • Diskover-Web
Published: August 27, 2025

CVE-2025-54598

None
    Bevy
  • Bevy Event Service
Published: August 27, 2025

CVE-2025-50428

None
    Raspap
  • Raspap-Webgui
Published: August 27, 2025

CVE-2025-50977

None
    Unknown
  • Framework Wicket
  • Angular
Published: August 27, 2025

CVE-2025-50979

None
    Nodebb
  • Nodebb
Published: August 27, 2025
Click here to see more Vulnerabilities