Tag: 2025-10-10

7 Attack Reports | 125 Vulnerabilities

Attack reports

From infostealer to full RAT: dissecting the PureRAT attack chain

An investigation into what appeared at first glance to be a “standard” Python-based infostealer campaign took an interesting turn when it was discovered to culminate in the deployment of a full-featured, commercially available remote access trojan (RAT) known as PureRAT.
python
infostealer
purecrypter
service
purelogs
telegram
winrar
zip archive
purerat
pxa stealer
2025-10-10
lonenone
cryptoloader
netloader
pythonloader
Published: October 10, 2025
Downloadable IOCs: 7

The ClickFix Factory: First Exposure of IUAM ClickFix Generator

Palo Alto Unit42 have uncovered a phishing kit named the IUAM ClickFix Generator that automates the creation of these attacks. The kit is designed to generate highly customizable phishing pages that lure victims by mimicking browser verification challenges often used to block automated traffic. It …
rat
phishing
infostealer
macos
remote access
clickfix
deerstealer
captcha
odyssey
2025-10-10
clipboard
iuam
clickfix generator
Published: October 10, 2025
Downloadable IOCs: 59

Crimson Collective: A New Threat Group Observed Operating in the Cloud

Over the past few weeks, Rapid7 has observed increased activity of a new threat group attacking AWS cloud environments with the goal of data exfiltration and subsequent extortion of the victim. This threat group refers to itself as ‘Crimson Collective’ and has recently announced that it is behind a…
extortion
exfiltration
aws
trufflehog
iam
2025-10-10
crimson collective
amazon web services
valid accounts
s3 bucket
Published: October 10, 2025
Downloadable IOCs: 3

Blog Anatomy of a Hacktivist Attack: Russian-Aligned Group Targets OT/ICS

Forescout honeypot caught hacktivist activity targeting a decoy water treatment plant in Sept. 2025. A Russian-aligned group, TwoNet, claimed responsibility for the attack. The group logged into the human-machine interface (HMI) for: defacement, process disruption, manipulation, and evasion.
exploit
ransomware
russian
raas
hacktivist
defacement
2025-10-10
twonet
human-machine interface
overflame
modbus
megamedusa
Published: October 10, 2025
Downloadable IOCs: 10

A Vietnamese threat actor's shift from PXA Stealer to PureRAT

A Vietnamese threat actor has transitioned from using the PXA Stealer to deploying PureRAT, a commercial remote access trojan. The attack chain involves multiple stages, including phishing emails, Python-based infostealers, and .NET loaders. The campaign demonstrates a progression in complexity, ut…
purecrypter
remote access trojan
purerat
pxa stealer
pureminer
2025-10-10
pureclipper
vietnamese threat actor
Published: October 10, 2025
Downloadable IOCs: 4

ClayRat: A New Android Spyware Targeting Russia

ClayRat is a rapidly evolving Android spyware campaign primarily targeting Russian users. Distributed through Telegram channels and phishing sites, it masquerades as popular apps to lure victims. The spyware can exfiltrate SMS messages, call logs, notifications, and device information, as well as t…
phishing
spyware
2025-10-10
sms
clayrat
Published: October 10, 2025
Downloadable IOCs: 857

From Targeting Pwn2Own Vulnerabilities to Shotgunning Exploits

A large-scale RondoDox botnet campaign has been identified, exploiting over 50 vulnerabilities across more than 30 vendors. The campaign targets internet-exposed infrastructure, including routers, DVRs, NVRs, CCTV systems, and web servers. It began with exploiting a vulnerability from Pwn2Own Toron…
CVE-2023-1389
CVE-2024-12856
CVE-2024-3721
rondodox
2025-10-10
pwn2own
Published: October 10, 2025
Downloadable IOCs: 71
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-60306

9.9
    Code-Projects
  • Simple Car Rental System
Published: October 10, 2025

CVE-2025-61929

9.6
    Cherry
  • Cherry Studio
Published: October 10, 2025

CVE-2025-60269

9.4
    Jeecgframework
  • Jeewms
Published: October 10, 2025

CVE-2025-21064

8.8
    Samsung
  • Smart Switch
Published: October 10, 2025

CVE-2025-25018

8.7
    Elastic
  • Kibana
Published: October 10, 2025

CVE-2025-61689

8.7
    Julia
  • Http.Jl
Published: October 10, 2025

CVE-2025-62159

8.7
    Beyondtrust
  • External Secrets Operator
Published: October 10, 2025

CVE-2025-48043

8.6
    Ash-Project
  • Ash
Published: October 10, 2025

CVE-2025-61871

8.4
    Buffalo
  • Nas Navigator2
Published: October 10, 2025

CVE-2025-61856

8.4
    Vsft
  • Vsft
Published: October 10, 2025

CVE-2025-61857

8.4
    Vsft
  • V-Sft
Published: October 10, 2025

CVE-2025-61858

8.4
    V-Sft
  • V-Sft
Published: October 10, 2025

CVE-2025-61859

8.4
    *
  • V-Sft
Published: October 10, 2025

CVE-2025-61860

8.4
    V-Sft
  • V-Sft
Published: October 10, 2025

CVE-2025-61861

8.4
    V-Soft
  • V-Sft
Published: October 10, 2025

CVE-2025-61862

8.4
    V-Sft
  • V-Sft
Published: October 10, 2025

CVE-2025-61863

8.4
    V-Sft
  • V-Sft
Published: October 10, 2025

CVE-2025-61864

8.4
    V-Sft
  • V-Sft
Published: October 10, 2025

CVE-2025-60880

8.3
    Bagisto
  • Bagisto
Published: October 10, 2025

CVE-2025-55903

8.3
    Perfex
  • Crm
Published: October 10, 2025

CVE-2025-25017

8.2
    Elastic
  • Kibana
Published: October 10, 2025

CVE-2025-52650

8.2
    Hcl
  • Aion
Published: October 10, 2025

CVE-2025-23309

8.2
    Nvidia
  • Nvidia Display Driver
Published: October 10, 2025

CVE-2025-60378

8.1
    Rise
  • Ultimate Project Manager And Crm
Published: October 10, 2025

CVE-2025-61930

8.1
    Emlog
  • Emlog Pro
Published: October 10, 2025

CVE-2025-21062

7.8
    Samsung
  • Smart Switch
Published: October 10, 2025

CVE-2025-11569

7.7
    Cross-Zip
  • Cross-Zip
Published: October 10, 2025

CVE-2025-59530

7.5
    Quic-Go
  • Quic-Go
Published: October 10, 2025

CVE-2025-61919

7.5
    Ruby
  • Rack
Published: October 10, 2025

CVE-2025-61920

7.5
    Authlib
  • Authlib
Published: October 10, 2025

CVE-2025-62162

7.5
    Cel-Rust
  • Cel-Rust
Published: October 10, 2025

CVE-2025-11586

7.4
    Tenda
  • Ac7
Published: October 10, 2025

CVE-2025-21058

7.3
    Samsung
  • Routines
Published: October 10, 2025

CVE-2025-30001

7.3
    Apache
  • Streampark
Published: October 10, 2025

CVE-2025-60869

7.3
    Publii
  • Publii Cms
Published: October 10, 2025

CVE-2025-61927

7.2
    Happy Dom
  • Happy Dom
Published: October 10, 2025

CVE-2025-21050

7.1
    Samsung
  • Contacts
Published: October 10, 2025

CVE-2025-21061

7.1
    Samsung
  • Smart Switch
Published: October 10, 2025

CVE-2025-23280

7.0
    Nvidia
  • Nvidia Display Driver
Published: October 10, 2025

CVE-2025-23282

7.0
    Nvidia
  • Display Driver
  • Linux
Published: October 10, 2025

CVE-2025-11582

6.9
    Code-Projects
  • Online Job Search Engine
Published: October 10, 2025

CVE-2025-11583

6.9
    Code-Projects
  • Online Job Search Engine
Published: October 10, 2025

CVE-2025-11584

6.9
    Code-Projects
  • Online Job Search Engine
Published: October 10, 2025

CVE-2025-11585

6.9
    Code-Projects
  • Project Monitoring System
Published: October 10, 2025

CVE-2025-21048

6.7
    Samsung
  • Knox Enterprise
Published: October 10, 2025

CVE-2025-8886

6.7
    Usta Information Systems Inc
  • Aybs Interaktif
Published: October 10, 2025

CVE-2025-21065

6.6
    Samsung
  • Retail Mode
Published: October 10, 2025

CVE-2025-10124

6.5
    Wordpress
  • Booking Manager
Published: October 10, 2025

CVE-2025-52632

6.5
    Hcl
  • Aion
Published: October 10, 2025

CVE-2025-60868

6.5
    Statamic
  • Alt Redirect
Published: October 10, 2025

CVE-2025-61152

6.5
    Python-Jose
  • Python-Jose
Published: October 10, 2025

CVE-2025-60268

6.5
    Jeewms
  • Jeewms
Published: October 10, 2025

CVE-2025-60838

6.5
    Mcms
  • Mcms
Published: October 10, 2025

CVE-2025-61505

6.5
    E107
  • E107
Published: October 10, 2025

CVE-2025-61925

6.5
    Astro
  • Astro
Published: October 10, 2025

CVE-2025-7781

6.4
    Wordpress
  • Wp Jobhunt
  • Jobcareer
Published: October 10, 2025

CVE-2025-21059

6.2
    Samsung
  • Health
Published: October 10, 2025

CVE-2025-61319

6.1
    Renengine
  • Renengine
Published: October 10, 2025

CVE-2025-8887

6.1
    Usta Information Systems Inc
  • Aybs Interaktif
Published: October 10, 2025

CVE-2025-52647

6.1
    Hcl
  • Bigfix
Published: October 10, 2025

CVE-2025-52885

6.1
    Poppler
  • Poppler
Published: October 10, 2025

CVE-2025-61780

5.8
    Ruby
  • Rack
Published: October 10, 2025

CVE-2025-21044

5.7
    Samsung
  • Fingerprint Trustlet
Published: October 10, 2025

CVE-2025-37727

5.7
    Elastic
  • Elasticsearch
Published: October 10, 2025

CVE-2025-21049

5.5
    Samsung
  • Secsettings
Published: October 10, 2025

CVE-2025-21060

5.5
    Samsung
  • Smart Switch
Published: October 10, 2025

CVE-2025-11580

5.5
    Powerjob
  • Powerjob
Published: October 10, 2025

CVE-2025-11581

5.5
    Powerjob
  • Powerjob
  • Openapicontroller
Published: October 10, 2025

CVE-2025-61911

5.5
    Python
  • Python-Ldap
Published: October 10, 2025

CVE-2025-61912

5.5
    Python
  • Python-Ldap
Published: October 10, 2025

CVE-2025-11626

5.5
    Wireshark
  • Wireshark
Published: October 10, 2025

CVE-2025-52624

5.4
    Hcl
  • Aion
Published: October 10, 2025

CVE-2025-7374

5.4
    Wordpress
  • Wjob Hunt
    Jobcareer
Published: October 10, 2025

CVE-2025-11449

5.3
    Servicenow
  • Servicenow Ai Platform
Published: October 10, 2025

CVE-2025-11450

5.3
    Servicenow
  • Ai Platform
Published: October 10, 2025

CVE-2025-11579

5.3
    Nwaples
  • Rardecode
Published: October 10, 2025

CVE-2025-11616

5.3
    Freertos
  • Freertos Plus Tcp
Published: October 10, 2025

CVE-2025-11617

5.3
    Freertos
  • Freertos-Plus-Tcp
Published: October 10, 2025

CVE-2025-11618

5.3
    Freertos
  • Freertos-Plus-Tcp
Published: October 10, 2025

CVE-2025-11588

5.3
    Codeastro
  • Gym Management System
Published: October 10, 2025

CVE-2025-11589

5.3
    Codeastro
  • Gym Management System
Published: October 10, 2025

CVE-2025-21047

5.2
    Samsung
  • Knoxguard
Published: October 10, 2025

CVE-2025-40640

5.1
    Status Tracker Ltd
  • Energy Crm
Published: October 10, 2025

CVE-2025-41088

5.1
    Xibo
  • Xibo Cms
Published: October 10, 2025

CVE-2025-62245

5.1
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: October 10, 2025

CVE-2025-11570

4.8
    Drupal
  • Pattern-Lab Unified-Twig-Extensions
  • Unified Twig Ext
Published: October 10, 2025

CVE-2025-41089

4.8
    Xibo
  • Xibo Cms
Published: October 10, 2025

CVE-2025-62237

4.8
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: October 10, 2025

CVE-2025-62238

4.8
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: October 10, 2025

CVE-2025-21063

4.6
    Samsung
  • Samsung Voice Recorder
Published: October 10, 2025

CVE-2025-62239

4.6
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: October 10, 2025

CVE-2025-21055

4.3
    Samsung
  • Libimagecodec.Quram
Published: October 10, 2025

CVE-2025-62292

4.3
    Sonarsource
  • Sonarqube
Published: October 10, 2025

CVE-2025-60308

4.1
    Code-Projects
  • Simple Online Hotel Reservation System
Published: October 10, 2025

CVE-2025-21045

4.0
    Samsung
  • Galaxy Watch
Published: October 10, 2025

CVE-2025-21051

4.0
    Samsung
  • Libpadm
Published: October 10, 2025

CVE-2025-21052

4.0
    Samsung
  • Libpadm
Published: October 10, 2025

CVE-2025-21053

4.0
    Samsung
  • Libpadm
Published: October 10, 2025

CVE-2025-21054

4.0
    Samsung
  • Libpadm
Published: October 10, 2025

CVE-2025-21057

4.0
    Samsung
  • Samsung Notes
Published: October 10, 2025

CVE-2025-21066

4.0
    Samsung
  • Samsung Notes
Published: October 10, 2025

CVE-2025-21067

4.0
    Samsung
  • Samsung Notes
Published: October 10, 2025

CVE-2025-21068

4.0
    Samsung
  • Samsung Notes
Published: October 10, 2025

CVE-2025-21069

4.0
    Samsung
  • Samsung Notes
Published: October 10, 2025

CVE-2025-21070

4.0
    Samsung
  • Samsung Notes
Published: October 10, 2025

CVE-2025-52630

3.7
    Hcl
  • Aion
Published: October 10, 2025

CVE-2025-52634

3.7
    Hcl
  • Aion
Published: October 10, 2025

CVE-2025-52625

3.7
    Hcl
  • Aion
Published: October 10, 2025

CVE-2025-52635

3.7
    Hcl
  • Aion
Published: October 10, 2025

CVE-2025-52655

3.1
    Hcl
  • Myxalytics
Published: October 10, 2025

CVE-2025-61921

2.7
    Ruby
  • Sinatra
Published: October 10, 2025

CVE-2025-62158

2.7
    Frappe
  • Learning
Published: October 10, 2025

CVE-2025-21046

2.4
    Samsung
  • Samsung Dex
Published: October 10, 2025

CVE-2025-11188

None
    Kiwire
  • Kiwire Captive Portal
Published: October 10, 2025

CVE-2025-11189

None
    Kiwire
  • Captive Portal
Published: October 10, 2025

CVE-2025-11190

None
    Kiwire
  • Kiwire Captive Portal
Published: October 10, 2025

CVE-2025-60305

None
    Sourcecodester
  • Online Student Clearance System
Published: October 10, 2025

CVE-2025-60307

None
    Code-Projects
  • Computer Laboratory System
Published: October 10, 2025

CVE-2025-8093

None
    Drupal
  • Authenticator Login
Published: October 10, 2025

CVE-2025-9549

None
    Drupal
  • Facets
Published: October 10, 2025

CVE-2025-9550

None
    Drupal
  • Facets
Published: October 10, 2025

CVE-2025-9551

None
    Drupal
  • Protected Pages
Published: October 10, 2025

CVE-2025-9552

None
    Drupal
  • Synchronize Composer.Json
Published: October 10, 2025

CVE-2025-9553

None
    Drupal
  • Api Key Manager
Published: October 10, 2025

CVE-2025-9554

None
    Drupal
  • Owl Carousel
Published: October 10, 2025
Click here to see more Vulnerabilities