Tag: 2025-09-04

8 Attack Reports | 61 Vulnerabilities

Attack reports

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

ESET researchers have identified a new threat actor named GhostRedirector that has compromised at least 65 Windows servers, primarily in Brazil, Thailand, and Vietnam. The actor utilizes two previously undocumented tools: a passive C++ backdoor called Rungan and a malicious Internet Information Ser…
backdoor
privilege escalation
iis module
windows servers
china-aligned
2025-09-04
zunput
comdai
seo fraud
rungan
gamshen
2025-09-08
Published: September 8, 2025
Downloadable IOCs: 24

Operation BarrelFire: Targeting Kazakhstan Oil & Gas

A threat group dubbed NoisyBear has been targeting Kazakhstan's oil and gas sector since April 2025. The campaign focuses on KazMunaiGas employees, using spear-phishing emails with malicious attachments. The infection chain involves a ZIP file containing a malicious LNK file and decoy document, whi…
powershell
infrastructure
spear-phishing
kazakhstan
central asia
russian threat actor
dll injection
amsi bypass
oil and gas
2025-09-04
2025-09-05
downshell
Published: September 5, 2025
Downloadable IOCs: 14

From Compromised Keys to Phishing Campaigns: Inside a Cloud Email Service Takeover

An AWS access key compromise led to a sophisticated SES abuse campaign in May 2025. The attacker exploited the stolen key to bypass SES restrictions, verify new sender identities, and conduct a large-scale phishing operation. They used multi-regional PutAccountDetails requests to escape the SES san…
phishing
cloud security
aws
sandbox escape
2025-09-04
email service
Published: September 4, 2025
Downloadable IOCs: 4

An Analysis of the AMOS Stealer Campaign Targeting macOS via 'Cracked' Apps

This analysis examines a campaign distributing Atomic macOS Stealer (AMOS), targeting macOS users through fake 'cracked' applications. Attackers use two main delivery methods: malicious .dmg installers and terminal commands that bypass Gatekeeper protection. AMOS employs rotating domains to evade d…
social engineering
stealer
persistence
macos
data exfiltration
amos
atomic macos stealer
2025-09-04
cracked apps
gatekeeper bypass
Published: September 4, 2025
Downloadable IOCs: 0

ViewState Deserialization Zero-Day Vulnerability in Sitecore Products (CVE-2025-53690)

A critical ViewState deserialization vulnerability (CVE-2025-53690) was discovered in Sitecore products, affecting deployments using an exposed sample machine key. The attacker exploited this to achieve remote code execution, progressing from initial compromise to privilege escalation. Key events i…
viewstate
lateral movement
reconnaissance
privilege escalation
earthworm
remote code execution
sharphound
deserialization
2025-09-04
CVE-2025-53690
sitecore
dwagent
weepsteel
Published: September 4, 2025
Downloadable IOCs: 0

Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms

North Korean threat actors associated with the Contagious Interview campaign cluster are actively monitoring cyber threat intelligence platforms to detect infrastructure exposure and scout for new assets. They operate in coordinated teams, likely using Slack for real-time collaboration, and leverag…
social engineering
north korea
cryptocurrency
cyber espionage
lazarus
clickfix
2025-09-04
job seeker targeting
infrastructure monitoring
contagiousdrop
Published: September 4, 2025
Downloadable IOCs: 0

Not Safe for Work: Tracking and Investigating Stealerium and Phantom Infostealers

Proofpoint researchers have observed an increase in cybercriminals using Stealerium-based malware, an open-source infostealer available on GitHub. Multiple stealers share code with Stealerium, including Phantom Stealer. Campaigns delivering Stealerium have used various lures and file types, targeti…
infostealer
anti-analysis
cybercrime
data exfiltration
snake keylogger
stealerium
2025-09-04
warp stealer
phantom stealer
Published: September 4, 2025
Downloadable IOCs: 8

Ethereum smart contracts used to push malicious code on npm

A novel technique utilizing Ethereum smart contracts was discovered in two npm packages to conceal malicious commands for installing downloader malware. The packages, colortoolsv2 and mimelib2, are part of a larger campaign targeting npm and GitHub. The attackers created sophisticated GitHub reposi…
social engineering
cryptocurrency
npm
supply chain attack
ethereum
2025-09-04
smart contracts
colortoolsv2
mimelib2
Published: September 4, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-36890

9.8
    Google
  • Privilege Elevation
Published: September 4, 2025

CVE-2025-36896

9.8
    Google
  • Android
  • Pixel
Published: September 4, 2025

CVE-2025-36897

9.8
    Google
  • Cd Cnmsgcodec
Published: September 4, 2025

CVE-2025-36904

9.8
    Google
  • Android
Published: September 4, 2025

CVE-2025-58357

9.6
    5ire
  • 5ire
Published: September 4, 2025

CVE-2025-36891

8.8
    Google
  • Privilege Elevation
Published: September 4, 2025

CVE-2025-36901

8.8
    Google
  • Android
  • Pixel
Published: September 4, 2025

CVE-2025-2411

8.6
    Akinsoft
  • Taskpano
Published: September 4, 2025

CVE-2025-2417

8.6
    Akinsoft
  • E-Mutabakat
Published: September 4, 2025

CVE-2025-36899

8.4
    *
  • *
Published: September 4, 2025

CVE-2024-56190

7.8
    Google
  • Wifi Component
Published: September 4, 2025

CVE-2025-36887

7.8
    Google
  • Wl Cfgscan
Published: September 4, 2025

CVE-2025-36898

7.8
    Google
  • Unknown
Published: September 4, 2025

CVE-2025-36903

7.8
    Google
  • Lwis Io Buffer
Published: September 4, 2025

CVE-2025-36905

7.8
    Google
  • Gxp
Published: September 4, 2025

CVE-2025-58355

7.7
    Soft Serve
  • Soft Serve
Published: September 4, 2025

CVE-2024-56189

7.5
    Saemm
  • Saemm
Published: September 4, 2025

CVE-2025-36892

7.5
    *
  • *
Published: September 4, 2025

CVE-2025-36894

7.5
    Vendor
  • Tbd
Published: September 4, 2025

CVE-2025-36895

7.5
    *
  • *
Published: September 4, 2025

CVE-2025-58358

7.5
    Markdownify
  • Markdownify
Published: September 4, 2025

CVE-2025-6984

7.5
    Langchain-Ai
  • Langchain
Published: September 4, 2025

CVE-2025-9938

7.4
    D-Link
  • Di-8400
Published: September 4, 2025

CVE-2025-36907

7.3
    Google
  • Android
Published: September 4, 2025

CVE-2025-6085

7.2
    Wordpress
  • Make Connector
Published: September 4, 2025

CVE-2025-9517

7.2
    Wordpress
  • Atec Debug Plugin
Published: September 4, 2025

CVE-2025-9518

7.2
    Wordpress
  • Atec Debug Plugin
Published: September 4, 2025

CVE-2025-9519

7.2
    Wordpress
  • Easy Timer
Published: September 4, 2025

CVE-2025-43772

7.1
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: September 4, 2025

CVE-2025-58057

6.9
    Netty
  • Netty
  • Netty Codec Compression
  • Netty Codec
Published: September 4, 2025

CVE-2025-9930

6.9
    1000projects
  • Beauty Parlour Management System
Published: September 4, 2025

CVE-2025-9932

6.9
    Phpgurukul
  • Beauty Parlour Management System
Published: September 4, 2025

CVE-2025-9933

6.9
    Phpgurukul
  • Beauty Parlour Management System
Published: September 4, 2025

CVE-2025-9935

6.9
    Totolink
  • N600r
Published: September 4, 2025

CVE-2025-36900

6.7
    Google
  • Lwis Device Test
Published: September 4, 2025

CVE-2025-36902

6.7
    Google
  • Syna
Published: September 4, 2025

CVE-2025-36908

6.7
    Lwis
  • *
Published: September 4, 2025

CVE-2025-36893

5.5
    Google
  • Gxp
Published: September 4, 2025

CVE-2025-36909

5.3
    Google
  • Information Disclosure
Published: September 4, 2025

CVE-2025-9467

5.3
    Vaadin
  • Vaadin
  • Vaadin-Upload-Flow
Published: September 4, 2025

CVE-2025-9616

5.3
    Wordpress
  • Popad
Published: September 4, 2025

CVE-2025-9931

5.3
    Jinher
  • Oa
Published: September 4, 2025

CVE-2025-9934

5.3
    Totolink
  • X5000r
Published: September 4, 2025

CVE-2025-9936

5.3
    Fuyang Lipengjun
  • Fuyang Lipengjun Platform
Published: September 4, 2025

CVE-2025-9937

5.3
    Elunez
  • Eladmin
Published: September 4, 2025

CVE-2025-9939

5.1
    Codeastro
  • Real Estate Management System
Published: September 4, 2025

CVE-2025-9516

4.9
    Wordpress
  • Plugin
Published: September 4, 2025

CVE-2025-9929

4.8
    Code-Projects
  • Responsive Blog Site
Published: September 4, 2025

CVE-2024-13073

4.7
    Akinsoft
  • Taskpano
Published: September 4, 2025

CVE-2024-13071

4.3
    Akinsoft
  • E-Mutabakat
Published: September 4, 2025

CVE-2025-58064

2.3
    Ckeditor
  • Ckeditor5
  • Ckeditor5-Clipboard
Published: September 4, 2025

CVE-2025-36906

None
    Google
  • Darwinn Mlir
Published: September 4, 2025

CVE-2025-58171

None
    *
  • *
Published: September 4, 2025

CVE-2025-58694

None
    Fortinet
  • Fortigate
Published: September 4, 2025

CVE-2025-58695

None
    Fortinet
  • Fortinet
Published: September 4, 2025

CVE-2025-58696

None
    Fortinet
  • *
Published: September 4, 2025

CVE-2025-58697

None
    Fortinet
  • Fortinet
Published: September 4, 2025

CVE-2025-58698

None
    Fortinet
  • *
Published: September 4, 2025

CVE-2025-58699

None
    Fortinet
  • Fortinet
Published: September 4, 2025

CVE-2025-58700

None
    Fortinet
  • *
Published: September 4, 2025

CVE-2025-58701

None
    Fortinet
  • Fortinet
Published: September 4, 2025
Click here to see more Vulnerabilities