Tag: 2025-09-29

6 Attack Reports | 115 Vulnerabilities

Attack reports

From a Single Click: How Lunar Spider Enabled a Near Two-Month Intrusion

A user executed a malicious JavaScript file linked to Lunar Spider, initiating a two-month intrusion. The file downloaded a Brute Ratel DLL, which then injected Latrodectus malware. The threat actor used various tools including Cobalt Strike, BackConnect, and a custom .NET backdoor for persistence …
cobalt strike
javascript
latrodectus
data-exfiltration
lateral-movement
brute ratel c4
backconnect
credential-harvesting
cobalt-strike
2025-09-29
Published: September 29, 2025
Downloadable IOCs: 0

Eye of the Storm: Analyzing DarkCloud's Latest Capabilities

eSentire's Threat Response Unit detected a spear-phishing campaign targeting a manufacturing customer, attempting to deliver the DarkCloud information-stealing malware. The malware, distributed through a malicious zip archive, has undergone significant updates including a VB6 rewrite and enhanced e…
exfiltration
information stealer
evasion techniques
spear-phishing
darkcloud
2025-09-29
crypto-wallet targeting
vb6
Published: September 29, 2025
Downloadable IOCs: 0

New LockBit 5.0 Targets Windows, Linux, ESXi

Trend Research analyzed the latest version of LockBit ransomware, LockBit 5.0, which exhibits advanced obfuscation, anti-analysis techniques, and cross-platform capabilities for Windows, Linux, and ESXi systems. The Windows variant uses heavy obfuscation and packing, loading its payload through DLL…
obfuscation
ransomware
anti-analysis
encryption
cross-platform
esxi
virtualization
2025-09-29
dll reflection
lockbit 5.0
Published: September 29, 2025
Downloadable IOCs: 5

XWorm RAT Delivered via Shellcode: Multi-Stage Attack Analysis

This analysis details a sophisticated multi-stage attack delivering the XWorm RAT. The campaign begins with a phishing email containing a malicious .xlam file. The file harbors embedded shellcode that, when executed, retrieves a secondary payload. This payload is a .NET binary that reflectively loa…
obfuscation
xworm
rat
phishing
steganography
shellcode
.net
multi-stage attack
reflective dll injection
2025-09-29
Published: September 29, 2025
Downloadable IOCs: 8

Olymp Loader: A new Malware-as-a-Service written in Assembly

Olymp Loader is a recently emerged Malware-as-a-Service offering advertised on underground forums since June 2025. Developed by a team called OLYMPO, it's written in assembly language and marketed as fully undetectable. The loader executes other malware on victim systems and provides built-in steal…
loader
lummac2
stealer
amadey
malware-as-a-service
telegram
evasion techniques
crypter
raccoon
underground forums
2025-09-29
qasarrat
webrat
olymp loader
assembly
Published: September 29, 2025
Downloadable IOCs: 19

Potentially Unwanted Applications (PUAs) weaponized for covert delivery

A malware distribution campaign leveraging digitally signed binaries, deceptive packaging, and browser hijackers has been uncovered. The campaign centers around two malicious applications, ImageLooker.exe and Calendaromatic.exe, delivered via self-extracting 7-Zip archives. These artifacts align wi…
malvertising
seo-poisoning
CVE-2025-0411
7-zip
neutralinojs
2025-09-29
pua
imagelooker
digital-signing
trojanized-productivity-tools
code-signing-abuse
calendaromatic
browser-hijacker
Published: September 29, 2025
Linked vulnerabilities : CVE-2025-0411 (CVSS 7.0)
Downloadable IOCs: 6
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-34216

10.0
    Vasion Print
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-34218

10.0
    Vasion Print
  • Virtual Appliance
  • Application
Published: September 29, 2025

CVE-2025-34221

10.0
    Vation
  • Vation Print
    Printerlogic
Published: September 29, 2025

CVE-2025-34222

10.0
    Printerlogic
  • Vasion Print
  • Vasion Print Application
Published: September 29, 2025

CVE-2025-34223

10.0
    Printerlogic
  • Print
  • Virtual Appliance Host
Published: September 29, 2025

CVE-2025-34224

10.0
    Vasion Print
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-8868

9.8
    Progress
  • Chef Automate
Published: September 29, 2025

CVE-2024-13150

9.8
    Fayton Software
  • Fayton.Pro Erp
Published: September 29, 2025

CVE-2025-57266

9.8
    Thvirex
  • Blogging Framework
Published: September 29, 2025

CVE-2025-54875

9.8
    Freshrss
  • Freshrss
Published: September 29, 2025

CVE-2025-34235

9.5
    Printerlogic
  • Vp Host
  • Application
Published: September 29, 2025

CVE-2025-34209

9.4
    Printerlogic
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-34215

9.4
    Vasion Print
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-34196

9.3
    Vasion Print
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-30247

9.3
    Western Digital
  • My Cloud
Published: September 29, 2025

CVE-2025-34211

9.3
    Vasion Print
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-34234

9.2
    Printerlogic
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-11126

8.9
    Apeman
  • Id71
Published: September 29, 2025

CVE-2025-48006

8.8
    Dataspider
  • Servista
Published: September 29, 2025

CVE-2025-6724

8.8
    Progress
  • Chef Automate
Published: September 29, 2025

CVE-2025-34225

8.8
    Vasion Print
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-34228

8.8
    Vasion Print
  • Vasion Print
  • Vasion Print Application
Published: September 29, 2025

CVE-2025-34231

8.8
    Vasion Print
  • Virtual Appliance
  • Application
Published: September 29, 2025

CVE-2025-54592

8.8
    Freshrss
  • Freshrss
Published: September 29, 2025

CVE-2025-36245

8.8
    Ibm
  • Infosphere
  • Information Server
Published: September 29, 2025

CVE-2025-9648

8.7
    Civetweb
  • Civetweb
Published: September 29, 2025

CVE-2025-34212

8.7
    Vasion Print
  • Vasion Print Virtual Appliance
  • Vasion Print Application
Published: September 29, 2025

CVE-2025-11130

8.6
    Ihongren
  • Pptp-Vpn
Published: September 29, 2025

CVE-2025-35030

8.6
    Medical Informatics Engineering
  • Enterprise Health
Published: September 29, 2025

CVE-2025-41250

8.5
    Vmware
  • Vcenter
Published: September 29, 2025

CVE-2025-34233

8.5
    Vasion Print
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-59937

8.2
    Go-Mail
  • Go-Mail
Published: September 29, 2025

CVE-2025-57483

8.1
    Tawk.To
  • Chatbox
Published: September 29, 2025

CVE-2025-41251

8.1
    Vmware
  • Nsx
  • Nsx-T
  • Cloud Foundation
Published: September 29, 2025

CVE-2025-34207

7.9
    Vasion Print
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-41244

7.8
    Vmware
  • Aria Operations
  • Vmware Tools
Published: September 29, 2025

CVE-2025-41246

7.6
    Vmware
  • Vmware Tools
Published: September 29, 2025

CVE-2025-51495

7.5
    Mongoose
  • Mongoose
Published: September 29, 2025

CVE-2025-41252

7.5
    Vmware
  • Nsx
  • Nsx-T
  • Cloud Foundation
Published: September 29, 2025

CVE-2025-45376

7.5
    Dell
  • Repository Manager
Published: September 29, 2025

CVE-2025-54591

7.5
    Freshrss
  • Freshrss
Published: September 29, 2025

CVE-2025-59942

7.5
    Go-F3
  • Go-F3
Published: September 29, 2025

CVE-2025-57424

7.3
    Lta
  • Mycourts
Published: September 29, 2025

CVE-2025-9904

6.9
    Generic
  • Plus Pcl6 Printer Driver
  • Plus Ufr Ii Printer Driver
  • Plus Lips4 Printer Driver
  • Plus Lipslx Printer Driver
  • Plus Ps Printer Driver
Published: September 29, 2025

CVE-2025-11135

6.9
    Pmticket
  • Project-Management-Software
Published: September 29, 2025

CVE-2025-11140

6.9
    Bjskzy
  • Bjskzy Zhiyou Erp
Published: September 29, 2025

CVE-2025-34220

6.9
    Vasion
  • Printerlogic Virtual Appliance Host
  • Printerlogic Application
Published: September 29, 2025

CVE-2025-34229

6.9
    Vasion Print
  • Virtual Appliance Host
  • Application
Published: September 29, 2025

CVE-2025-34230

6.9
    Vasion Print
  • Vasion Print
    Printerlogic
Published: September 29, 2025

CVE-2025-34232

6.9
    Vasion
  • Print
  • Print Application
Published: September 29, 2025

CVE-2025-43813

6.9
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: September 29, 2025

CVE-2025-11155

6.8
    Device
  • Web Server
Published: September 29, 2025

CVE-2025-61659

6.8
    Bash-Git-Prompt
  • Bash-Git-Prompt
Published: September 29, 2025

CVE-2025-59948

6.7
    Freshrss
  • Freshrss
Published: September 29, 2025

CVE-2025-59940

6.5
    Mkdocs
  • Mkdocs Include Markdown Plugin
Published: September 29, 2025

CVE-2025-36352

6.4
    Ibm
  • License Metric Tool
Published: September 29, 2025

CVE-2025-43400

6.3
    Apple
  • Ipados
  • Iphone Os
  • Macos
  • Visionos
Published: September 29, 2025

CVE-2025-35033

6.3
    Medical Informatics Engineering
  • Enterprise Health
Published: September 29, 2025

CVE-2025-35032

6.2
    Medical Informatics Engineering
  • Enterprise Health
Published: September 29, 2025

CVE-2024-5200

6.1
    Wordpress
  • Postie
Published: September 29, 2025

CVE-2025-56795

6.1
    Mealie
  • Mealie
Published: September 29, 2025

CVE-2025-56807

6.1
    Fairsktch
  • Rising Ultimate Project Manager Crm
Published: September 29, 2025

CVE-2025-57872

6.1
    Esri
  • Arcgis
Published: September 29, 2025

CVE-2025-57878

6.1
    Esri
  • Portal For Arcgis
Published: September 29, 2025

CVE-2025-57879

6.1
    Esri
  • Portal For Arcgis
Published: September 29, 2025

CVE-2025-57197

6.0
    Payeer
  • Payeer Android Application
Published: September 29, 2025

CVE-2025-7698

5.9
    Generic Plus
  • Pcl6 Printer Driver
  • Ufr Ii Printer Driver
  • Lips4 Printer Driver
  • Lipslx Printer Driver
  • Ps Printer Driver
Published: September 29, 2025

CVE-2025-9903

5.9
    Generic Plus
  • Pcl6 Printer Driver
  • Ufr Ii Printer Driver
  • Lips4 Printer Driver
  • Lipslx Printer Driver
  • Ps Printer Driver
Published: September 29, 2025

CVE-2025-59941

5.9
    Go-F3
  • Go-F3
Published: September 29, 2025

CVE-2025-10504

5.7
    Abb
  • Terra Ac Wallbox
Published: September 29, 2025

CVE-2025-11125

5.3
    Langleyfcu
  • Online Banking System
Published: September 29, 2025

CVE-2025-11138

5.3
    Mirweiye
  • Wenkucms
Published: September 29, 2025

CVE-2025-11139

5.3
    Bjskzy
  • Zhiyou Erp
Published: September 29, 2025

CVE-2025-10341

5.3
    Perfex
  • Perfex Crm
Published: September 29, 2025

CVE-2025-10342

5.3
    Perfex
  • Crm
Published: September 29, 2025

CVE-2025-10343

5.3
    Perfex
  • Crm
Published: September 29, 2025

CVE-2025-10344

5.3
    Perfex
  • Crm
Published: September 29, 2025

CVE-2025-10345

5.3
    Perfex
  • Crm
Published: September 29, 2025

CVE-2025-10346

5.3
    Perfex
  • Crm
Published: September 29, 2025

CVE-2025-56764

5.3
    Trivision
  • Nc-227wf
Published: September 29, 2025

CVE-2025-57769

5.3
    Freshrss
  • Freshrss
Published: September 29, 2025

CVE-2025-11136

5.1
    Yifang
  • Cms
Published: September 29, 2025

CVE-2025-11137

5.1
    Gstarsoft
  • Gstarcad
Published: September 29, 2025

CVE-2025-11141

5.1
    Ruijie
  • Nbr2100g-E
Published: September 29, 2025

CVE-2025-11146

5.1
    Apt-Cacher-Ng
  • Apt-Cacher-Ng
Published: September 29, 2025

CVE-2025-11147

5.1
    Apt-Cacher-Ng
  • Apt-Cacher-Ng
Published: September 29, 2025

CVE-2025-35034

5.1
    Medical Informatics Engineering
  • Enterprise Health
Published: September 29, 2025

CVE-2025-43815

5.1
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: September 29, 2025

CVE-2025-59933

5.1
    Libvips
  • Libvips
Published: September 29, 2025

CVE-2025-41245

4.9
    Vmware
  • Aria Operations
Published: September 29, 2025

CVE-2025-36099

4.9
    Ibm
  • Websphere Application Server
Published: September 29, 2025

CVE-2025-11134

4.8
    Cudy
  • Tr1200
Published: September 29, 2025

CVE-2025-57871

4.8
    Esri
  • Portal For Arcgis
Published: September 29, 2025

CVE-2025-57873

4.8
    Esri
  • Portal For Arcgis
Published: September 29, 2025

CVE-2025-57874

4.8
    Esri
  • Portal For Arcgis
Published: September 29, 2025

CVE-2025-57875

4.8
    Esri
  • Portal For Arcgis
Published: September 29, 2025

CVE-2025-57876

4.8
    Esri
  • Portal For Arcgis
Published: September 29, 2025

CVE-2025-57877

4.8
    Esri
  • Portal For Arcgis
Published: September 29, 2025

CVE-2025-43811

4.8
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: September 29, 2025

CVE-2025-43818

4.8
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: September 29, 2025

CVE-2025-43820

4.8
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: September 29, 2025

CVE-2025-43812

4.8
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: September 29, 2025

CVE-2025-43817

4.8
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: September 29, 2025

CVE-2025-35031

4.6
    Medical Informatics Engineering
  • Enterprise Health
Published: September 29, 2025

CVE-2025-36351

4.3
    Ibm
  • License Metric Tool
Published: September 29, 2025

CVE-2025-7104

4.3
    Danny-Avila
  • Librechat
Published: September 29, 2025

CVE-2025-55795

3.5
    Openml
  • Openml
Published: September 29, 2025

CVE-2025-59163

2.1
    Github
  • Vet
Published: September 29, 2025

CVE-2025-11150

None
    *
  • *
Published: September 29, 2025

CVE-2025-57428

None
    Italy Wireless
  • Minirouter V28k
  • Minirouter
Published: September 29, 2025

CVE-2025-56449

None
    Obsidian
  • Obsidian Scheduler
Published: September 29, 2025

CVE-2025-57516

None
    Publiccms
  • Publiccms
Published: September 29, 2025

CVE-2024-57412

None
    Sun
  • Solaris
    Omnios
Published: September 29, 2025

CVE-2025-56233

None
    Openindiana
  • Openindiana
    Sun
Published: September 29, 2025

CVE-2025-56234

None
    Nanda Automation Technology
  • At Na2000
Published: September 29, 2025
Click here to see more Vulnerabilities