Tag: 2025-09-10

8 Attack Reports | 54 Vulnerabilities

Attack reports

EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company

A Chinese APT group compromised a Philippine military company using a new, fileless malware framework called EggStreme. This sophisticated multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading. The core compone…
backdoor
apt
espionage
dll sideloading
keylogger
military
stowaway
fileless malware
2025-09-10
philippines
eggstremefuel
eggstremereflectiveloader
eggstreme
eggstremewizard
eggstremeloader
eggstremekeylogger
eggstremeagent
Published: September 10, 2025
Downloadable IOCs: 12

CVE-2025-31324: Critical SAP Vulnerability & How to Protect Your Enterprise

A critical remote code execution vulnerability (CVE-2025-31324) affects SAP NetWeaver Development Server, allowing attackers to upload malicious files through the metadatauploader endpoint. This vulnerability enables unauthenticated remote code execution, potentially leading to enterprise network c…
exploit
vulnerability
remote code execution
auto-color
CVE-2025-31324
2025-09-10
netweaver
metadatauploader
sap
Published: September 10, 2025
Downloadable IOCs: 4

Technical Analysis of kkRAT

A malware campaign targeting Chinese-speaking users has been identified, delivering three types of malware: ValleyRAT, FatalRAT, and kkRAT. The campaign uses fake installer pages to distribute the malware. kkRAT, a new Remote Access Trojan, shares similarities with Ghost RAT and Big Bad Wolf. It em…
valleyrat
byovd
remote access trojan
chinese-speaking
fatalrat
ghost rat
2025-09-10
kkrat
big bad wolf
Published: September 10, 2025
Downloadable IOCs: 0

AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks

AdaptixC2, an open-source post-exploitation and adversarial emulation framework, has been observed being used in real-world attacks. This versatile tool allows threat actors to execute commands, transfer files, and perform data exfiltration on compromised systems. Its open-source nature enables eas…
social engineering
foggyweb
data exfiltration
open-source
post-exploitation
c2 framework
tunneling
adaptixc2
2025-09-10
ai-generated scripts
adversarial emulation
Published: September 10, 2025
Downloadable IOCs: 0

Learn about ChillyHell, a modular Mac backdoor

ChillyHell is a sophisticated macOS backdoor discovered in 2021 that has evaded detection by antivirus vendors. It is a modular C++ malware targeting Intel architectures, using multiple persistence mechanisms and communication protocols. The backdoor performs host profiling, establishes persistence…
backdoor
dns
persistence
macos
modular
matanbuchus
c2
http
2025-09-10
password-cracking
notarized
chillyhell
Published: September 10, 2025
Downloadable IOCs: 0

ZynorRAT technical analysis: Reverse engineering a novel, Turkish Go-based RAT

ZynorRAT is a newly discovered Go-based Remote Access Trojan that provides a full suite of command and control capabilities for Linux and Windows systems. It was first identified in July 2025 and is believed to be of Turkish origin. The malware uses Telegram as its C2 infrastructure and offers feat…
linux
windows
c2
telegram
remote access trojan
go-based
2025-09-10
zynorrat
turkish
Published: September 10, 2025
Downloadable IOCs: 48

Unmasked: Salat Stealer – A Deep Dive into Its Advanced Persistence Mechanisms and C2 Infrastructure

Salat Stealer, also known as WEB_RAT, is a sophisticated Go-based infostealer targeting Windows systems. It exfiltrates browser credentials, cryptocurrency wallet data, and session information while employing advanced evasion techniques. The malware uses UPX packing, process masquerading, registry …
evasion
windows
infostealer
cryptocurrency
persistence
malware-as-a-service
maas
russian-speaking
browser credentials
2025-09-06
salat stealer
web_rat
go-based
2025-09-10
Published: September 10, 2025
Downloadable IOCs: 14

Threat Spotlight: Speed, Scale, and Stealth: How Axios Powers Automated Phishing

Axios user agent activity has surged by 241% from June to August 2025, outpacing other flagged user agents. Attacks combining Axios with Direct Send achieved a 70% success rate in recent campaigns, significantly higher than non-Axios campaigns. The combination exploits Direct Send's trusted nature …
phishing
credential theft
qr codes
automation
axios
api exploitation
direct send
2025-09-10
user agent
Published: September 10, 2025
Downloadable IOCs: 14
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-10220

9.3
    Axxonsoft
  • Axxon One Vms
Published: September 10, 2025

CVE-2025-10226

9.3
    Axxonsoft
  • Axxon One
    Postgresql
Published: September 10, 2025

CVE-2025-41714

8.8
    *
  • *
Published: September 10, 2025

CVE-2025-7049

8.8
    Wordpress
  • Wpgym
Published: September 10, 2025

CVE-2025-7718

8.8
    Resideo
  • Resideo Plugin
Published: September 10, 2025

CVE-2025-56407

8.8
    Huangdou
  • Utcms
Published: September 10, 2025

CVE-2025-56413

8.8
    1panel
  • 1panel
Published: September 10, 2025

CVE-2025-36759

8.7
    Solax
  • Cloud
Published: September 10, 2025

CVE-2025-10225

8.7
    Axxonsoft
  • Axxon One
Published: September 10, 2025

CVE-2025-43884

8.2
    Dell
  • Powerprotect Data Manager
Published: September 10, 2025

CVE-2025-43725

7.8
    Dell
  • Powerprotect Data Manager
Published: September 10, 2025

CVE-2025-10040

7.7
    Wordpress
  • Wp Import Ultimate Csv Xml Importer
Published: September 10, 2025

CVE-2025-56404

7.5
    Mariadb
  • Mariadb Mcp
Published: September 10, 2025

CVE-2025-56405

7.5
    Litmusautomation
  • Litmus-Mcp-Server
Published: September 10, 2025

CVE-2025-56406

7.5
    Mcp-Neo4j
  • Mcp-Neo4j
Published: September 10, 2025

CVE-2025-20340

7.4
    Cisco
  • Ios Xr Software
Published: September 10, 2025

CVE-2025-10001

7.2
    Wordpress
  • Import Any Xml Csv Or Excel File
Published: September 10, 2025

CVE-2025-10049

7.2
    Responsive Filterable Portfolio
  • Responsive Filterable Portfolio
Published: September 10, 2025

CVE-2025-10213

7.0
    *
  • Updf
Published: September 10, 2025

CVE-2025-10214

7.0
    Updf
  • Updf
Published: September 10, 2025

CVE-2025-10215

7.0
    *
  • Updf
Published: September 10, 2025

CVE-2025-40979

7.0
    Microsoft
  • Windows 11
Published: September 10, 2025

CVE-2025-10231

7.0
    N-Able
  • N-Central
  • N-Central Probe
Published: September 10, 2025

CVE-2025-10221

6.7
    Axxonsoft
  • Axxon One
  • Axxon Net
Published: September 10, 2025

CVE-2025-6189

6.5
    Wordpress
  • Duplicate Page And Post Plugin
Published: September 10, 2025

CVE-2025-7826

6.5
    Wordpress
  • Testimonial
Published: September 10, 2025

CVE-2025-9463

6.5
    Woocommerce
  • Woocommerce
    Wordpress
Published: September 10, 2025

CVE-2025-8388

6.4
    Powerpack
  • Elementor Addons
Published: September 10, 2025

CVE-2025-10126

6.4
    Wp
  • Mybrain Utilities
Published: September 10, 2025

CVE-2025-7843

6.4
    Wordpress
  • Plugin
Published: September 10, 2025

CVE-2025-9857

6.4
    Heateor
  • Heateor Login Social Login Plugin
Published: September 10, 2025

CVE-2025-36757

6.3
    Solax
  • Solax Cloud
Published: September 10, 2025

CVE-2025-36758

6.3
    Solax
  • Solax Cloud
Published: September 10, 2025

CVE-2025-20248

6.0
    Cisco
  • Ios Xr Software
Published: September 10, 2025

CVE-2025-36756

5.8
    Solax
  • Solax Cloud
Published: September 10, 2025

CVE-2025-9367

5.5
    Welcart
  • Welcart E-Commerce
Published: September 10, 2025

CVE-2025-10197

5.3
    Hjsoft
  • Hcm Human Resources Management System
Published: September 10, 2025

CVE-2025-10223

5.3
    Axxonsoft
  • Axxon One
Published: September 10, 2025

CVE-2025-10224

5.3
    Axxonsoft
  • Axxon One
Published: September 10, 2025

CVE-2025-20159

5.3
    Cisco
  • Ios Xr
Published: September 10, 2025

CVE-2025-40725

5.1
    Azon
  • Dominator
Published: September 10, 2025

CVE-2025-10227

5.1
    Axxonsoft
  • Axxon One
Published: September 10, 2025

CVE-2025-10142

4.9
    Pagbank
  • Pagseguro Connect
    Wordpress
Published: September 10, 2025

CVE-2025-10195

4.8
    Seismic
  • Seismic App
Published: September 10, 2025

CVE-2025-10222

4.8
    Axxonsoft
  • Axxon One Vms
Published: September 10, 2025

CVE-2025-8778

4.3
    Wordpress
  • Nitropack
Published: September 10, 2025

CVE-2025-9622

4.3
    Wordpress
  • Wp Blast
Published: September 10, 2025

CVE-2025-9888

4.3
    Maspik
  • Ultimate Spam Protection
Published: September 10, 2025

CVE-2025-9979

4.3
    Wordpress
  • Maspik
Published: September 10, 2025

CVE-2025-9943

None
    Shibboleth
  • Shibboleth Service Provider
Published: September 10, 2025

CVE-2025-10219

None
Published: September 10, 2025

CVE-2025-56466

None
    *
  • Dietly
Published: September 10, 2025

CVE-2025-56578

None
    Rtsp2web
  • Rtsp2web
Published: September 10, 2025

CVE-2025-29592

None
    Oasys
  • Oasys
Published: September 10, 2025
Click here to see more Vulnerabilities