Tag: 2025-09-03

10 Attack Reports | 43 Vulnerabilities

Attack reports

New malware campaign discovered via ManualFinder

A global malware infection of Windows computers has been uncovered, stemming from software users installed themselves. The malware, disguised as legitimate PDF editors and manual finders, turns infected systems into residential proxies for malicious actors. The infection chain starts with deceptive…
windows
javascript
certificate abuse
residential proxy
2025-09-03
onestart browser
pdf-editor
manualfinder
trojan:win64/infostealer!msr
trojan:win32/malgent!msr
Published: September 3, 2025
Downloadable IOCs: 41

Three Lazarus RATs coming for your cheese

This report analyzes three remote access trojans (RATs) used by a Lazarus subgroup targeting financial and cryptocurrency organizations: PondRAT, ThemeForestRAT, and RemotePE. It details an incident response case from 2024 involving social engineering and possible zero-day exploitation. PondRAT is …
rat
social engineering
cryptocurrency
zero-day
poolrat
pondrat
financial
2025-09-02
remotepe
themeforestrat
2025-09-03
Published: September 3, 2025
Downloadable IOCs: 0

Malicious Campaign Targeting Diplomatic Assets

An Iranian-aligned spear-phishing campaign masquerading as Omani Ministry of Foreign Affairs communications targeted global government entities. The operation used compromised mailboxes to distribute malicious Word documents containing VBA macros. When executed, these macros decoded and deployed a …
espionage
iran
diplomacy
vba macros
spear-phishing
oman mfa
2025-09-03
sysprocupdate
Published: September 3, 2025
Downloadable IOCs: 1

Tax refund scam targets Californians

The California Franchise Tax Board has issued a warning about a tax scam targeting taxpayers through text messages. The scam involves fraudulent links mimicking official FTB web pages to steal personal and banking information. The messages claim to be about approved tax refunds and request recipien…
phishing
2025-09-03
california
franchise tax board
text messages
tax refund scam
Published: September 3, 2025
Downloadable IOCs: 11

Dire Wolf Ransomware: Threat Combining Data Encryption and Leak Extortion

The DireWolf ransomware group emerged in May 2025, targeting various industries globally. They employ a double extortion technique, encrypting data and threatening leaks. The ransomware uses Curve25519 key exchange and ChaCha20 encryption, generating unique keys for each file. It implements anti-re…
ransomware
encryption
chacha20
double extortion
self-deletion
dire wolf
2025-09-03
curve25519
anti-recovery
data leakage
Published: September 3, 2025
Downloadable IOCs: 2

Analyzing NotDoor: Inside APT28's Expanding Arsenal

LAB52 has identified a new backdoor called NotDoor, attributed to APT28, a Russian intelligence-linked threat group. NotDoor is a VBA macro for Outlook that monitors incoming emails for specific trigger words, enabling data exfiltration, file uploads, and command execution on victim computers. The …
backdoor
obfuscation
exfiltration
persistence
nato
dll side-loading
outlook
vba macro
2025-09-03
notdoor
Published: September 3, 2025
Downloadable IOCs: 2

Russian Influence Assets Converge on Moldovan Elections

Multiple Russia-linked influence operations are targeting Moldova's September 2025 parliamentary elections, aiming to destabilize the process and impede Moldova's EU accession. These operations, including Operation Overload, Operation Undercut, Foundation to Battle Injustice, and Portal Kombat, are…
russia
disinformation
elections
moldova
social media manipulation
influence operations
2025-09-03
eu integration
Published: September 3, 2025
Downloadable IOCs: 43

Google Salesforce Breach: A Deep dive into the chain and extent of the compromise

In June 2025, Google's Salesforce instance was breached by UNC6040 & UNC6240 using vishing, OAuth app abuse, and anonymity layers. The attackers stole business data of small and medium-sized clients. A parallel attack by UNC6395 compromised Salesloft Drift's Salesforce integration, affecting hundre…
social engineering
vishing
cloud security
data exfiltration
tor
oauth
2025-09-03
salesforce
saas security
Published: September 3, 2025
Downloadable IOCs: 19

Dissecting RapperBot Botnet: From Infection to DDoS & More

This report details the analysis of RapperBot, a sophisticated botnet targeting IoT devices, particularly Network Video Recorders (NVRs). The malware exploits vulnerabilities in these devices to create a large-scale DDoS infrastructure. The analysis covers the botnet's infection process, command an…
exploit
dns
encryption
ddos
iot
botnet
infrastructure
2025-09-03
nvr
rapperbot
Published: September 3, 2025
Downloadable IOCs: 84

UNVEILING A PYTHON STEALER – INF0S3C STEALER

Inf0s3c Stealer is a sophisticated Python-based malware designed to collect system information and user data. It systematically gathers host identifiers, CPU information, network configuration, and captures screenshots. The malware enumerates running processes, generates directory views, and compil…
python
stealer
discord
data exfiltration
pyinstaller
system reconnaissance
upx packing
2025-09-03
windows api
blank grabber
inf0s3c stealer
umbral-stealer
Published: September 3, 2025
Downloadable IOCs: 1
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-58176

8.8
    Dive
  • Dive
Published: September 3, 2025

CVE-2025-58163

8.6
    Freescout
  • Freescout
    Laravel
Published: September 3, 2025

CVE-2023-21480

8.5
    Samsung
  • Certbyte
Published: September 3, 2025

CVE-2023-21475

8.0
    Samsung
  • Libaudiosaplus Sec
Published: September 3, 2025

CVE-2023-21476

8.0
    Samsung
  • Libaudiosaplus Sec
Published: September 3, 2025

CVE-2023-21477

7.9
    Samsung
  • Tigerf
Published: September 3, 2025

CVE-2025-9785

7.7
    Papercut
  • Print Deploy
Published: September 3, 2025

CVE-2025-54588

7.5
    Envoy
  • Envoy
Published: September 3, 2025

CVE-2025-57806

6.9
    Local Deep Research
  • Local Deep Research
Published: September 3, 2025

CVE-2025-9848

6.9
    Scriptandtools
  • Real Estate Management System
Published: September 3, 2025

CVE-2025-58351

6.8
    Outline
  • Outline
Published: September 3, 2025

CVE-2023-21472

6.8
    Samsung
  • Exynos
  • Fastboot
Published: September 3, 2025

CVE-2023-21473

6.8
    Samsung
  • Exynos Fastboot
Published: September 3, 2025

CVE-2025-9260

6.5
    Wpfluent
  • Fluent Forms
Published: September 3, 2025

CVE-2023-21483

6.4
    Samsung
  • Galaxy Store
Published: September 3, 2025

CVE-2023-21474

6.3
    Samsung
  • Secsettings
Published: September 3, 2025

CVE-2023-21482

6.1
    Samsung
  • Camera
Published: September 3, 2025

CVE-2023-21478

6.0
    Samsung
  • Tigerf Trustlet
Published: September 3, 2025

CVE-2023-21468

5.9
    Samsung
  • Telephony
Published: September 3, 2025

CVE-2025-9842

5.5
    Das Parking Management System
  • Parking Management System
Published: September 3, 2025

CVE-2025-9843

5.5
    Das Parking Management System
  • Das Parking Management System
Published: September 3, 2025

CVE-2023-21481

5.4
    Samsung
  • Samsung Account
Published: September 3, 2025

CVE-2025-9841

5.3
    Code-Projects
  • Mobile Shop Management System
Published: September 3, 2025

CVE-2025-9847

5.3
    Scriptandtools
  • Real Estate Management System
Published: September 3, 2025

CVE-2023-21466

5.3
    Samsung
  • Framework
Published: September 3, 2025

CVE-2023-21479

5.3
    Samsung
  • Android
Published: September 3, 2025

CVE-2025-9845

5.1
    Code-Projects
  • Fruit Shop Management System
Published: September 3, 2025

CVE-2025-21025

5.1
    Samsung
  • Mars Exemption Manager
Published: September 3, 2025

CVE-2025-21027

5.1
    Samsung
  • Imsservice
Published: September 3, 2025

CVE-2023-21467

4.6
    Samsung
  • Exynos
Published: September 3, 2025

CVE-2023-21469

4.0
    Samsung
  • Slocation
Published: September 3, 2025

CVE-2023-21470

4.0
    Samsung
  • S Location
Published: September 3, 2025

CVE-2023-21471

4.0
    Samsung
  • Semclipboard
Published: September 3, 2025

CVE-2025-21026

4.0
    Samsung
  • Imsservice
Published: September 3, 2025

CVE-2025-7039

3.7
    Glib
  • Glib
Published: September 3, 2025

CVE-2025-58164

None
    Github
  • Github
Published: September 3, 2025

CVE-2025-58165

None
Published: September 3, 2025

CVE-2025-58166

None
    *
  • *
Published: September 3, 2025

CVE-2025-58167

None
    *
  • *
Published: September 3, 2025

CVE-2025-58168

None
    Github
  • Security Advisories
Published: September 3, 2025

CVE-2025-58169

None
    *
  • *
Published: September 3, 2025

CVE-2025-58170

None
    Github
  • Unknown
Published: September 3, 2025

CVE-2023-3666

None
    Wordpress
  • Sticky Side Buttons
Published: September 3, 2025
Click here to see more Vulnerabilities