Tag: 2025-09-25

15 Attack Reports | 107 Vulnerabilities

Attack reports

From primitive crypto theft to sophisticated AI-based deception

The North Korea-aligned threat actor DeceptiveDevelopment employs social engineering tactics to target software developers, especially those in cryptocurrency and Web3 projects. They use fake job offers and trojanized code challenges to deliver malware like BeaverTail and InvisibleFerret. The group…
malware
social engineering
north korea
cryptocurrency
remote access
information theft
beavertail
identity theft
invisibleferret
ottercookie
job scams
tropidoor
multiplatform
2025-09-25
weaselstore
postnaptea
tsunamikit
job offers
akdoortea
2025-11-09
it worker fraud
ai-based deception
Published: November 9, 2025
Downloadable IOCs: 1

Beyond Signatures: Detecting Lumma Stealer with an ML-Powered Sandbox

This analysis focuses on a new variant of Lumma Stealer, a malware that reemerged after a brief hiatus following a law enforcement operation. The article details the malware's code obfuscation, evasion techniques, and persistence mechanisms. It describes Netskope's machine learning-based detection …
persistence
anti-analysis
lumma stealer
autoit
nsis
evasion techniques
machine learning
sandbox
2025-09-25
Published: September 25, 2025
Downloadable IOCs: 1

Botnet Loader-as-a-Service Infrastructure Distributing RondoDoX and Mirai Payloads

A sophisticated botnet operation employing a Loader-as-a-Service model was uncovered through exposed command and control logs spanning six months. The campaign systematically targets SOHO routers, IoT devices, and enterprise applications through command injection vulnerabilities in web interfaces. …
command injection
iot
botnet
mirai
cryptomining
soho routers
rondodox
2025-09-25
morte
CVE-2012-1823
CVE-2019-17574
CVE-2019-16759
loader-as-a-service
Published: September 25, 2025
Linked vulnerabilities : CVE-2019-17574, CVE-2019-16759, CVE-2012-1823
Downloadable IOCs: 341

How a new PlugX variant abuses DLL search order hijacking

A new campaign targeting telecommunications and manufacturing sectors in Central and South Asian countries has been discovered, delivering a new variant of PlugX. The campaign, active since 2022, shows overlaps between RainyDay and Turian backdoors, including the abuse of legitimate applications fo…
apt
plugx
rainyday
telecommunications
dll hijacking
manufacturing
chinese apt
2025-09-23
backdoordiplomacy
naikon
turian
2025-09-25
Published: September 25, 2025
Downloadable IOCs: 53

DeceptiveDevelopment: From primitive crypto theft to sophisticated AI-based deception

This analysis delves into the operations of DeceptiveDevelopment, a North Korea-aligned threat actor, and its connections to North Korean IT worker campaigns. The group targets software developers across major systems, focusing on cryptocurrency and Web3 projects. They use social engineering techni…
social engineering
north korea
cryptocurrency
remote access
information theft
beavertail
invisibleferret
ottercookie
tropidoor
multiplatform
2025-09-25
weaselstore
postnaptea
tsunamikit
job offers
akdoortea
Published: September 25, 2025
Downloadable IOCs: 33

Inside Salt Typhoon: China's State-Corporate Advanced Persistent Threat

Salt Typhoon is a Chinese state-sponsored cyber threat group aligned with the Ministry of State Security, specializing in long-term espionage operations targeting global telecommunications infrastructure. Active since 2019, it has demonstrated advanced capabilities in exploiting network edge device…
CVE-2024-3400
china
cyber espionage
telecommunications
china chopper
advanced persistent threat
demodex
CVE-2023-20198
2025-09-25
long-term persistence
infrastructure targeting
ministry of state security
sigrouter
CVE-2023-35082
contractor ecosystem
Published: September 25, 2025
Downloadable IOCs: 0

XCSSET evolves again: Analyzing the latest updates to XCSSET's inventory

A new variant of the XCSSET malware, designed to infect Xcode projects, has been identified with key changes in browser targeting, clipboard hijacking, and persistence mechanisms. This variant employs sophisticated encryption and obfuscation techniques, uses run-only compiled AppleScripts for steal…
persistence
macos
applescript
xcsset
xcode
firefox
clipboard hijacking
2025-09-25
browser targeting
launchdaemon
Published: September 25, 2025
Downloadable IOCs: 31

Bookworm to Stately Taurus Using the Attribution Framework

This analysis examines the Bookworm malware family and its connection to the Chinese APT group Stately Taurus. Using a structured attribution framework, the study evaluates tactics, tooling, operational security, infrastructure, victimology and timelines to establish a high-confidence link between …
malware
apt
china
infrastructure
toneshell
pubload
southeast asia
bookworm
2025-09-25
victimology
attribution
Published: September 25, 2025
Downloadable IOCs: 0

Shai-Hulud worm infects npm packages

A self-propagating malware called Shai-Hulud has infected over 500 npm packages, including one with over two million weekly downloads. The worm steals sensitive data, exposes private repositories, and hijacks victim credentials to spread further. It executes when an infected package is installed, c…
worm
data-theft
npm
github
supply-chain-attack
package-infection
shai-hulud
2025-09-25
self-propagating
Published: September 25, 2025
Downloadable IOCs: 0

SystemBC – Bringing the Noise

The SystemBC botnet, composed of over 80 C2s and 1,500 daily victims, primarily targets VPS systems from commercial providers. It creates proxies enabling high volumes of malicious traffic for various criminal threat groups. The network is used by multiple proxy services, including REM Proxy, which…
ransomware
icedid
botnet
cybercrime
proxy
infrastructure
ngioweb
systembc
morpheus
trickbot
transferloader
vps
2025-09-25
avoslocker
rem proxy
malicious traffic
Published: September 25, 2025
Downloadable IOCs: 158

Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware

This research explores the challenges posed by LLM-enabled malware, which can generate malicious logic at runtime. The study identifies characteristics of such malware, including embedded API keys and specific prompt structures. Notable cases like PromptLock and APT28's LameHug are examined. The re…
threat hunting
lamehug
promptlock
2025-09-25
rkor
llm-enabled malware
offensive tools
api keys
malterminal
prompts
Published: September 25, 2025
Downloadable IOCs: 39

Operation Rewrite: Chinese-Speaking Threat Actors Deploy BadIIS in a Wide Scale SEO Poisoning Campaign

A Chinese-speaking threat actor group, tracked as CL-UNK-1037, has been conducting a large-scale SEO poisoning campaign called Operation Rewrite. The attackers use a malicious IIS module named BadIIS to intercept and alter web traffic on compromised servers, manipulating search engine results to re…
seo poisoning
vietnam
iis module
dragonrank
chinese threat actor
badiis
chinese-speaking
web shells
2025-09-23
operation rewrite
iis modules
group 9
2025-09-25
Published: September 25, 2025
Downloadable IOCs: 71

The Most Powerful Ever? Inside the 11.5Tbps-Scale Mega Botnet AISURU

The AISURU botnet has emerged as a formidable threat, capable of launching massive DDoS attacks reaching 11.5 Tbps. First disclosed in 2024, it expanded significantly in 2025 by compromising a router firmware update server. The botnet, with approximately 300,000 nodes, is operated by a group of thr…
encryption
ddos
botnet
router
cybercrime
proxy
CVE-2022-35733
CVE-2023-50381
vulnerabilities
firmware
airashi
aisuru
CVE-2024-3721
2025-09-25
CVE-2017-5259
CVE-2013-5948
CVE-2013-1599
CVE-2023-28771
CVE-2022-44149
CVE-2013-3307
Published: September 25, 2025
Linked vulnerabilities : CVE-2023-50381 (CVSS 7.2), CVE-2023-28771, CVE-2024-3721, CVE-2022-35733, CVE-2013-1599, CVE-2022-44149, CVE-2013-5948, CVE-2013-3307, CVE-2017-5259
Downloadable IOCs: 11

Fake Online Speedtest Application

An analysis of several Windows applications masquerading as legitimate utilities reveals a covert malware operation. These apps, including fake speed testers and AI search tools, install a Node.js runtime and execute obfuscated JavaScript via scheduled tasks. The malware communicates with a command…
node.js
scheduled tasks
evilai
fake applications
2025-09-25
javascript payload
Published: September 25, 2025
Downloadable IOCs: 170

An emerging DDoS for hire botnet

Darktrace uncovered a sophisticated cybercrime-as-a-service campaign utilizing Python and Go-based malware, Docker containerization, and a full operator UI. The attack combines DDoS techniques with targeted exploitation, featuring HTTP/2 rapid reset, Cloudflare UAM bypass, and large-scale HTTP floo…
python
botnet
docker
go
api
cloud-native
2025-09-25
shadowv2
cybercrime-as-a-service
containerization
ddos-as-a-service
http2
Published: September 25, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-59823

9.9
    Gardener
  • Gardener Extensions Aws
  • Gardener Extensions Azure
  • Gardener Extensions Openstack
  • Gardener Extensions Gcp
Published: September 25, 2025

CVE-2025-59832

9.9
    Horilla
  • Horilla
Published: September 25, 2025

CVE-2025-20333

9.9
    Cisco
  • Adaptive Security Appliance Software
  • Firepower Threat Defense
Published: September 25, 2025

CVE-2025-59834

9.8
    Adb
  • Mcp Server
Published: September 25, 2025

CVE-2025-10542

9.8
    Imonitor
  • Eam
Published: September 25, 2025

CVE-2025-59841

9.8
    Flag Forge
  • Flag Forge
Published: September 25, 2025

CVE-2020-36851

9.5
    Cors-Anywhere
  • Cors-Anywhere
Published: September 25, 2025

CVE-2025-11005

9.3
    Totolink
  • X6000r
Published: September 25, 2025

CVE-2025-20363

9.0
    Cisco
  • Secure Firewall Adaptive Security Appliance
  • Secure Firewall Threat Defense
  • Ios
  • Ios Xe
  • Ios Xr
Published: September 25, 2025

CVE-2025-10467

8.9
    Proliz
  • Obs
Published: September 25, 2025

CVE-2025-59814

8.8
    Zenitel
  • Icx500
  • Icx510
Published: September 25, 2025

CVE-2025-10957

8.7
    Syrotech
  • Sy-Gpon-2010-Wadont
Published: September 25, 2025

CVE-2025-40698

8.7
    Nedatec
  • Prevengos
Published: September 25, 2025

CVE-2025-27261

8.7
    Ericsson
  • Indoor Connect
Published: September 25, 2025

CVE-2025-59831

8.7
    Git-Commiters
  • Git-Commiters
Published: September 25, 2025

CVE-2025-40836

8.7
    Ericsson
  • Indoor Connect 8855
Published: September 25, 2025

CVE-2025-40837

8.7
    Ericsson
  • Indoor Connect
Published: September 25, 2025

CVE-2025-10879

8.7
    Dingtian
  • Dt-R002
Published: September 25, 2025

CVE-2025-10880

8.7
    Dingtian
  • Dtingtian Dt-R002
Published: September 25, 2025

CVE-2025-10438

8.6
    Yordam
  • Yordam Katalog
Published: September 25, 2025

CVE-2025-10449

8.6
    Saysis Computer Systems Trade Ltd Co
  • Saysis Web Portal
Published: September 25, 2025

CVE-2025-59839

8.6
    Mediawiki
  • Embedvideo
Published: September 25, 2025

CVE-2025-34227

8.6
    Nagios
  • Nagios Xi
Published: September 25, 2025

CVE-2025-10941

8.5
    Topaz
  • Servcore Teller
Published: September 25, 2025

CVE-2025-27262

8.5
    Ericsson
  • Indoor Connect
Published: September 25, 2025

CVE-2025-59815

8.4
    Zenitel
  • Icx500
  • Icx510
Published: September 25, 2025

CVE-2025-59817

8.4
    *
  • *
Published: September 25, 2025

CVE-2025-10541

7.8
    Imonitor
  • Eam
Published: September 25, 2025

CVE-2025-43993

7.8
    Dell
  • Wireless 5932e
    Qualcomm
Published: September 25, 2025

CVE-2025-26278

7.5
    Dref
  • Dref
Published: September 25, 2025

CVE-2025-57317

7.5
    Apidoc
  • Apidoc-Core
Published: September 25, 2025

CVE-2025-59830

7.5
    Ruby
  • Rack
Published: September 25, 2025

CVE-2024-48014

7.5
    Dell
  • Bsafe Micro Edition Suite
Published: September 25, 2025

CVE-2025-55558

7.5
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-55560

7.5
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-57446

7.5
    O-Ran
  • Ric-Plt-Submgr
Published: September 25, 2025

CVE-2025-48707

7.5
    Stormshield
  • Stormshield Network Security
Published: September 25, 2025

CVE-2025-57632

7.5
    Libsmb2
  • Libsmb2
Published: September 25, 2025

CVE-2025-59404

7.5
    Flock Safety
  • Bravo Edge Ai Compute Device
Published: September 25, 2025

CVE-2025-10942

7.4
    H3c
  • H3c Magic B3
Published: September 25, 2025

CVE-2025-10948

7.4
    Mikrotik
  • Routeros
Published: September 25, 2025

CVE-2025-10953

7.4
    Utt
  • Utt 1200gw
  • Utt 1250gw
Published: September 25, 2025

CVE-2025-59816

7.3
    Unknown
  • Billing Admin Database
Published: September 25, 2025

CVE-2025-59408

7.3
    Flock Safety
  • Bravo Edge Ai Compute Device
Published: September 25, 2025

CVE-2025-10951

6.9
    Geyang
  • Ml Logger
Published: September 25, 2025

CVE-2025-10967

6.9
    Mufen-Mker
  • Php-Usermm
Published: September 25, 2025

CVE-2025-43816

6.9
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: September 25, 2025

CVE-2025-10973

6.9
    Jackiedyh
  • Resume-Management-System
Published: September 25, 2025

CVE-2025-43943

6.7
    Dell
  • Cloud Disaster Recovery
Published: September 25, 2025

CVE-2025-21056

6.6
    Samsung
  • Retail Mode
Published: September 25, 2025

CVE-2025-10540

6.5
    Imonitor
  • Eam
Published: September 25, 2025

CVE-2025-20362

6.5
    Cisco
  • Adaptive Security Appliance Software
  • Firepower Threat Defense
Published: September 25, 2025

CVE-2025-55556

6.5
    Tensorflow
  • Tensorflow
Published: September 25, 2025

CVE-2025-29155

6.5
    *
  • Petstore
Published: September 25, 2025

CVE-2025-29157

6.5
    Petstore
  • Petstore
Published: September 25, 2025

CVE-2025-56769

6.5
    Chinabugotech
  • Hutool
Published: September 25, 2025

CVE-2025-60249

6.4
    Vulnerability-Lookup
  • Vulnerability-Lookup
Published: September 25, 2025

CVE-2025-29156

6.1
    Petstore
  • Petstore
Published: September 25, 2025

CVE-2025-59422

6.0
    Dify
  • Dify
Published: September 25, 2025

CVE-2025-26333

5.9
    Dell
  • Crypto-J
Published: September 25, 2025

CVE-2025-10947

5.5
    Sistemas Pleno
  • Gestao De Locacao
Published: September 25, 2025

CVE-2025-10911

5.5
    Gnome
  • Libxslt
Published: September 25, 2025

CVE-2025-10952

5.5
    Geyang
  • Ml-Logger
Published: September 25, 2025

CVE-2025-59402

5.4
    Flock
  • Bravo Edge Ai Compute Device
    Thundercomm
Published: September 25, 2025

CVE-2025-10950

5.3
    Geyang
  • Ml-Logger
Published: September 25, 2025

CVE-2025-46148

5.3
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-46149

5.3
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-46150

5.3
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-46152

5.3
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-46153

5.3
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-55554

5.3
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-10958

5.3
    Wavlink
  • Nu516u1
Published: September 25, 2025

CVE-2025-10959

5.3
    Nu516u1
  • M16u1 V240425
Published: September 25, 2025

CVE-2025-10960

5.3
    Nu516u1
  • *
Published: September 25, 2025

CVE-2025-57623

5.3
    Totolink
  • N600r
Published: September 25, 2025

CVE-2025-10962

5.3
    Nu516u1
  • *
Published: September 25, 2025

CVE-2025-10963

5.3
    Wavlink
  • Nu516u1
Published: September 25, 2025

CVE-2025-10964

5.3
    Wavlink
  • Nu516u1
Published: September 25, 2025

CVE-2025-10965

5.3
    Lazyagi
  • Lazyllm
Published: September 25, 2025

CVE-2025-10974

5.3
    Giantspatula
  • Sewkinect
Published: September 25, 2025

CVE-2025-10975

5.3
    Guanxinglu
  • Vlarl
    Zeromq
Published: September 25, 2025

CVE-2025-10978

5.3
    Jeecg
  • Jeecgboot
Published: September 25, 2025

CVE-2025-10979

5.3
    Jeecgboot
  • Jeecgboot
Published: September 25, 2025

CVE-2025-10943

5.1
    Mikecen
  • Wechat-Face-Recognition
Published: September 25, 2025

CVE-2025-10944

5.1
    Yi-Ge
  • Get-Header-Ip
Published: September 25, 2025

CVE-2025-10945

5.1
    Nuz007
  • Smsboom
Published: September 25, 2025

CVE-2025-10946

5.1
    Nuz007
  • Smsboom
Published: September 25, 2025

CVE-2025-10961

5.1
    Wavlink
  • Nu516u1
Published: September 25, 2025

CVE-2025-26482

4.9
    Dell
  • Poweredge Server Bios
  • Idrac9
Published: September 25, 2025

CVE-2025-10940

4.8
    Totaljs
  • Total.Js Cms
Published: September 25, 2025

CVE-2025-10949

4.8
    Changsha Developer Technology
  • Iview Editor
Published: September 25, 2025

CVE-2025-60018

4.8
    Glib-Networking
  • Glib-Networking
    Openssl
Published: September 25, 2025

CVE-2025-33116

4.4
    Ibm
  • Watson Studio
Published: September 25, 2025

CVE-2025-59426

4.3
    Lobe
  • Lobe Chat
Published: September 25, 2025

CVE-2025-36601

4.0
    Dell
  • Powerscale Onefs
Published: September 25, 2025

CVE-2025-5494

3.9
    Zoho
  • Manageengine Endpoint Central
Published: September 25, 2025

CVE-2025-60019

3.7
    Glib-Networking
  • Glib-Networking
Published: September 25, 2025

CVE-2025-36857

3.3
    Rapid7
  • Appspider Pro
Published: September 25, 2025

CVE-2025-59838

2.4
    Monkeytype
  • Monkeytype
Published: September 25, 2025

CVE-2025-10976

2.3
    Jeecg
  • Jeecgboot
Published: September 25, 2025

CVE-2025-10977

2.3
    Jeecg
  • Jeecgboot
Published: September 25, 2025

CVE-2025-40838

2.0
    Ericsson
  • Indoor Connect
Published: September 25, 2025

CVE-2025-55551

None
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-55552

None
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-55553

None
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-55557

None
    Pytorch
  • Pytorch
Published: September 25, 2025

CVE-2025-55559

None
    Tensorflow
  • Tensorflow
Published: September 25, 2025
Click here to see more Vulnerabilities