Tag: 2025-10-29

7 Attack Reports | 141 Vulnerabilities

Attack reports

Smoking Gun Uncovered: RPX Relay at PolarEdge's Core Exposed

A new component of PolarEdge's infrastructure, RPX_Client, has been discovered, revealing insights into the threat actor's relay operations. The investigation uncovered 140 VPS nodes acting as RPX Servers and over 25,000 infected devices serving as RPX Clients. The system uses a multi-hop design to…
evasion
iot
botnet
proxy
infrastructure
orb
command execution
polaredge
CVE-2023-20118
vps
2025-10-29
rpx_server
rpx_client
Published: October 29, 2025
Downloadable IOCs: 7

From Scripts to Systems: A Comprehensive Look at Tangerine Turkey Operations

Tangerine Turkey is a cryptomining campaign that uses VBScript worms to spread via USB drives, leveraging living-off-the-land binaries for execution and persistence. The group employs defense evasion techniques by modifying registry keys and masquerading malicious binaries as legitimate system file…
xmrig
worm
usb
persistence
cryptomining
vbscript
living-off-the-land
2025-10-29
defense-evasion
Published: October 29, 2025
Downloadable IOCs: 3

Major October 2025 Cyber Attacks Your SOC Can't Ignore

October 2025 saw a surge in sophisticated cyber attacks, including phishing campaigns exploiting Google Careers and ClickUp, abuse of Figma for credential theft, the emergence of LockBit 5.0 targeting ESXi and Linux systems, and the discovery of TyKit, a new phishing kit. Attackers increasingly abu…
phishing
ransomware
lockbit
credential theft
cloud abuse
lockbit 5.0
2025-10-29
tykit
clickup
google careers
figma
Published: October 29, 2025
Downloadable IOCs: 10

Suspected Nation-State Threat Actor Uses New Airstalk Malware in a Supply Chain Attack

A new Windows-based malware family called Airstalk has been discovered, available in PowerShell and .NET variants. It is believed to be used by a nation-state threat actor in a supply chain attack. Airstalk misuses the AirWatch API for mobile device management to establish covert command-and-contro…
supply chain
nation-state
2025-10-29
airstalk
Published: October 29, 2025
Downloadable IOCs: 6

Analysis of Trigona Threat Actor's Latest Attack Cases

The Trigona threat actor continues to target MS-SQL servers through brute-force and dictionary attacks, exploiting weak credentials. They use CLR Shell for additional payloads and employ various tools like BCP, Curl, Bitsadmin, and PowerShell to install malware. The attackers utilize remote control…
ransomware
trigona
remote-control
2025-10-29
Published: October 29, 2025
Downloadable IOCs: 5

GHOSTGRAB ANDROID MALWARE

GhostGrab is a sophisticated Android malware that combines cryptocurrency mining with extensive data theft. It exploits device resources for mining while harvesting sensitive information, including banking credentials, debit card details, and OTPs. The malware uses advanced persistence techniques, …
android
banking trojan
cryptocurrency mining
sms interception
2025-10-29
ghostgrab
Published: October 29, 2025
Downloadable IOCs: 9

Team46 and TaxOff: Two Sides of the Same Coin

This intelligence report reveals that Team46 and TaxOff are likely the same APT group, now referred to as Team46. The analysis compares their attack methods, including the use of similar PowerShell commands, URL patterns, and loader functionality. Both groups utilized zero-day exploits and develope…
cobalt strike
dante
trinper
2025-10-29
taxoff
team46
Published: October 29, 2025
Linked vulnerabilities : CVE-2024-6473 (CVSS 7.8), CVE-2025-2783 (CVSS 8.3)
Downloadable IOCs: 9
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-12476

10.0
    Blu
  • Blu-Ic2
  • Blu-Ic4
Published: October 29, 2025

CVE-2025-12477

10.0
    Blu
  • Blu-Ic2
  • Blu-Ic4
Published: October 29, 2025

CVE-2025-12478

10.0
    Blu
  • Blu-Ic2
  • Blu-Ic4
Published: October 29, 2025

CVE-2025-12479

10.0
    Blu
  • Blu-Ic2
  • Blu-Ic4
Published: October 29, 2025

CVE-2024-45162

9.8
    Blu-Castle
  • Bcum221e
Published: October 29, 2025

CVE-2025-11202

9.8
    Win-Cli-Mcp-Server
  • Win-Cli-Mcp-Server
Published: October 29, 2025

CVE-2025-4665

9.6
    Wordpress
  • Contact Form Cfdb7
Published: October 29, 2025

CVE-2018-25120

9.3
    D-Link
  • Dns-343
Published: October 29, 2025

CVE-2025-64140

8.8
    Jenkins
  • Azure Cli Plugin
Published: October 29, 2025

CVE-2025-61429

8.8
    Ncr
  • Atleos Terminal Manager
Published: October 29, 2025

CVE-2025-64103

8.7
    Zitadel
  • Zitadel
Published: October 29, 2025

CVE-2025-54459

8.7
    Hospital Manager
  • Backend Services
    Aspnet
Published: October 29, 2025

CVE-2025-62797

8.6
    Rathena
  • Fluxcp
Published: October 29, 2025

CVE-2025-11702

8.5
    Gitlab
  • Gitlab
Published: October 29, 2025

CVE-2025-62776

8.4
    Wtw
  • Eagle
Published: October 29, 2025

CVE-2025-61161

8.4
    Evope
  • Collector
  • Evope.Service
Published: October 29, 2025

CVE-2025-10932

8.2
    Progress
  • Moveit Transfer
Published: October 29, 2025

CVE-2025-64101

8.1
    Zitadel
  • Zitadel
Published: October 29, 2025

CVE-2025-11200

8.1
    Mlflow
  • Mlflow
Published: October 29, 2025

CVE-2025-11201

8.1
    Mlflow
  • Mlflow
Published: October 29, 2025

CVE-2025-57227

7.8
    Kingosoft
  • Kingo Root
Published: October 29, 2025

CVE-2025-10920

7.8
    Gimp
  • Gimp
Published: October 29, 2025

CVE-2025-10921

7.8
    Gimp
  • Gimp
Published: October 29, 2025

CVE-2025-10922

7.8
    Gnome
  • Gimp
Published: October 29, 2025

CVE-2025-10923

7.8
    Gimp
  • Gimp
Published: October 29, 2025

CVE-2025-10924

7.8
    Gnome
  • Gimp
Published: October 29, 2025

CVE-2025-10925

7.8
    Gnome
  • Gimp
Published: October 29, 2025

CVE-2025-10934

7.8
    Gimp
  • Gimp
Published: October 29, 2025

CVE-2025-11463

7.8
    Ashlar-Vellum
  • Cobalt Xe
Published: October 29, 2025

CVE-2025-11464

7.8
    Ashlar-Vellum
  • Cobalt
Published: October 29, 2025

CVE-2025-11465

7.8
    Ashlar-Vellum
  • Cobalt
Published: October 29, 2025

CVE-2025-9869

7.8
    Razer
  • Synapse 3
Published: October 29, 2025

CVE-2025-9870

7.8
    Razer
  • Razer Synapse
Published: October 29, 2025

CVE-2025-9871

7.8
    Razer
  • Razer Synapse 3
Published: October 29, 2025

CVE-2025-64102

7.7
    Zitadel
  • Zitadel
Published: October 29, 2025

CVE-2025-64195

7.6
    Thimpress
  • Eduma
Published: October 29, 2025

CVE-2025-64216

7.5
    Themesphere
  • Smartmag
Published: October 29, 2025

CVE-2025-64284

7.5
    Majestic Support
  • Majestic Support
Published: October 29, 2025

CVE-2025-64131

7.5
    Jenkins
  • Jenkins Saml Plugin
Published: October 29, 2025

CVE-2025-56558

7.5
    Dyson
  • Dyson App
Published: October 29, 2025

CVE-2025-11232

7.5
    Isc
  • Kea
Published: October 29, 2025

CVE-2024-14012

7.3
    Flexera
  • Installshield
Published: October 29, 2025

CVE-2025-64104

7.3
    Langgraph
  • Langgraph
Published: October 29, 2025

CVE-2025-60075

7.1
    Allegro Marketing
  • Hpb Seo
Published: October 29, 2025

CVE-2025-64134

7.1
    Jenkins
  • Jenkins Jdepend Plugin
  • Jdepend Maven Plugin
Published: October 29, 2025

CVE-2025-12461

6.9
    Epsilonnet
  • Application
Published: October 29, 2025

CVE-2025-12142

6.9
    Abb
  • Terra Ac Wallbox
Published: October 29, 2025

CVE-2025-62785

6.9
    Wazuh
  • Wazuh
Published: October 29, 2025

CVE-2025-62789

6.9
    Wazuh
  • Wazuh
Published: October 29, 2025

CVE-2025-62790

6.9
    Wazuh
  • Wazuh
Published: October 29, 2025

CVE-2025-62791

6.9
    Wazuh
  • Wazuh
Published: October 29, 2025

CVE-2025-62792

6.9
    Wazuh
  • Wazuh
Published: October 29, 2025

CVE-2025-61959

6.9
    Hospital Manager
  • Backend Services
    Microsoft
Published: October 29, 2025

CVE-2025-11705

6.5
    Wordpress
  • Anti-Malware Security And Brute-Force Firewall
Published: October 29, 2025

CVE-2025-9544

6.5
    Wpforms
  • Wpforms
    Doppler Forms
Published: October 29, 2025

CVE-2025-64194

6.5
    Thimpress
  • Eduma
Published: October 29, 2025

CVE-2025-64197

6.5
    Sizam
  • Rehub
Published: October 29, 2025

CVE-2025-64202

6.5
    Tielabs
  • Sahifa
Published: October 29, 2025

CVE-2025-64204

6.5
    Themesphere
  • Smartmag
Published: October 29, 2025

CVE-2025-64208

6.5
    Tielabs
  • Jannah Extensions
Published: October 29, 2025

CVE-2025-64220

6.5
    Reycommerce
  • Rey Core
Published: October 29, 2025

CVE-2025-64283

6.5
    Rometheme
  • Rtmkit
Published: October 29, 2025

CVE-2025-54384

6.3
    Ckan
  • Ckan
Published: October 29, 2025

CVE-2025-62786

6.3
    Wazuh
  • Wazuh
Published: October 29, 2025

CVE-2025-1549

6.3
    Watchguard
  • Mobile Vpn With Ssl Client
Published: October 29, 2025

CVE-2025-62788

6.3
    Wazuh
  • Wazuh
Published: October 29, 2025

CVE-2025-12450

6.1
    Litespeed
  • Litespeed Cache
Published: October 29, 2025

CVE-2025-64100

6.1
    Ckan
  • Ckan
Published: October 29, 2025

CVE-2025-12147

6.0
    Search-Guard
  • Search-Guard Flx
Published: October 29, 2025

CVE-2025-12148

6.0
    Search Guard
  • Search Guard
Published: October 29, 2025

CVE-2025-49042

5.9
    Automattic
  • Woocommerce
Published: October 29, 2025

CVE-2025-12058

5.9
    Keras
  • Keras
Published: October 29, 2025

CVE-2025-64200

5.9
    Villatheme
  • Email Template Customizer For Woocommerce
Published: October 29, 2025

CVE-2025-64289

5.9
    Premmerce
  • Premmerce Product Search
Published: October 29, 2025

CVE-2025-64291

5.9
    Premmerce
  • Premmerce User Roles
Published: October 29, 2025

CVE-2025-64135

5.9
    Jenkins
  • Eggplant Runner Plugin
Published: October 29, 2025

CVE-2025-60898

5.8
    Halo
  • Halo Cms
Published: October 29, 2025

CVE-2025-64199

5.4
    Wpestate
  • Wpresidence
Published: October 29, 2025

CVE-2025-64210

5.4
    Stylemixthemes
  • Masterstudy Elementor Widgets
Published: October 29, 2025

CVE-2025-64212

5.4
    Stylemixthemes
  • Masterstudy Lms
Published: October 29, 2025

CVE-2025-64285

5.4
    Premmerce
  • Woocommerce Wholesale Pricing
Published: October 29, 2025

CVE-2025-64132

5.4
    Jenkinsci
  • Mcp Server Plugin
Published: October 29, 2025

CVE-2025-64133

5.4
    Jenkins
  • Extensible Choice Parameter Plugin
Published: October 29, 2025

CVE-2025-64149

5.4
    Jenkins
  • Publish To Bitbucket Plugin
Published: October 29, 2025

CVE-2025-64150

5.4
    Jenkins
  • Publish To Bitbucket Plugin
Published: October 29, 2025

CVE-2025-57931

5.3
    Ays
  • Pro Popup Box
Published: October 29, 2025

CVE-2025-64296

5.3
    Facebook
  • Facebook For Woocommerce
Published: October 29, 2025

CVE-2023-7320

5.3
    Woocommerce
  • Woocommerce
Published: October 29, 2025

CVE-2025-58711

5.3
    Solwin
  • Blog Designer Pro
Published: October 29, 2025

CVE-2025-64211

5.3
    Stylemixthemes
  • Masterstudy Elementor Widgets
Published: October 29, 2025

CVE-2015-10146

4.9
    Wordpress
  • Thumbnail Slider With Lightbox
Published: October 29, 2025

CVE-2015-10147

4.9
    Wordpress
  • Easy Testimonial Slider And Form
Published: October 29, 2025

CVE-2025-11466

4.9
    Allegra
  • Databasebackupbl
Published: October 29, 2025

CVE-2024-45161

4.6
    Blu-Castle
  • Bcum221e
Published: October 29, 2025

CVE-2025-58939

4.3
    Highwarden
  • Super Store Finder
Published: October 29, 2025

CVE-2025-64201

4.3
    Blubrry
  • Powerpress
Published: October 29, 2025

CVE-2025-64219

4.3
    Strategy11
  • Business Directory
Published: October 29, 2025

CVE-2025-64226

4.3
    Colabrio
  • Stockie Extra
Published: October 29, 2025

CVE-2025-64228

4.3
    Fantasticplugins
  • Sumo Affiliates Pro
Published: October 29, 2025

CVE-2025-64229

4.3
    Sprout-Invoices
  • Client Invoicing
Published: October 29, 2025

CVE-2025-64234

4.3
    Evergreen Content Poster
  • Evergreen Content Poster
Published: October 29, 2025

CVE-2025-64286

4.3
    Wpestate
  • Wprentals
Published: October 29, 2025

CVE-2025-64288

4.3
    Premmerce
  • Premmerce
Published: October 29, 2025

CVE-2025-64290

4.3
    Premmerce
  • Premmerce Product Search
Published: October 29, 2025

CVE-2025-11587

4.3
    Wordpress
  • Call Now Button
Published: October 29, 2025

CVE-2025-11632

4.3
    Wordpress
  • Call Now Button
Published: October 29, 2025

CVE-2025-64136

4.3
    Jenkins
  • Themis Plugin
Published: October 29, 2025

CVE-2025-64137

4.3
    Jenkins
  • Themis Plugin
Published: October 29, 2025

CVE-2025-64138

4.3
    Jenkins
  • Jenkins Start Windocks Containers Plugin
Published: October 29, 2025

CVE-2025-64139

4.3
    Jenkins
  • Start Windocks Containers Plugin
Published: October 29, 2025

CVE-2025-64141

4.3
    Jenkins
  • Nexus Task Runner Plugin
Published: October 29, 2025

CVE-2025-64142

4.3
    Jenkins
  • Nexus Task Runner Plugin
Published: October 29, 2025

CVE-2025-64143

4.3
    Jenkins
  • Openshift Pipeline Plugin
Published: October 29, 2025

CVE-2025-64144

4.3
    Jenkins
  • Byteguard Build Actions Plugin
Published: October 29, 2025

CVE-2025-64145

4.3
    Jenkins
  • Byteguard Build Actions Plugin
Published: October 29, 2025

CVE-2025-64146

4.3
    Jenkins
  • Curseforge Publisher Plugin
Published: October 29, 2025

CVE-2025-64147

4.3
    Jenkins
  • Curseforge Publisher Plugin
Published: October 29, 2025

CVE-2025-64148

4.3
    Jenkins
  • Publish To Bitbucket Plugin
Published: October 29, 2025

CVE-2023-32199

4.3
    Suse
  • Rancher Manager
Published: October 29, 2025

CVE-2024-58269

4.3
    Rancher
  • Rancher Manager
Published: October 29, 2025

CVE-2025-11203

3.5
    Litellm
  • Litellm
Published: October 29, 2025

CVE-2025-62787

2.1
    Wazuh
  • Wazuh
Published: October 29, 2025

CVE-2025-64158

None
    Fortinet
  • *
Published: October 29, 2025

CVE-2025-64159

None
    Fortinet
  • Fortinet
Published: October 29, 2025

CVE-2025-64160

None
    Fortinet
  • Fortios
Published: October 29, 2025

CVE-2025-64161

None
    Fortinet
  • Fortigate
Published: October 29, 2025

CVE-2025-64162

None
    Fortinet
  • Fortinet
Published: October 29, 2025

CVE-2023-39177

None
    Unknown
  • Unknown
Published: October 29, 2025

CVE-2023-39178

None
    *
  • *
Published: October 29, 2025

CVE-2023-7324

None
    Linux
  • Linux Kernel
Published: October 29, 2025

CVE-2025-40083

None
    Linux
  • Linux
Published: October 29, 2025

CVE-2025-40084

None
    Linux
  • Linux Kernel
  • Ksmbd
Published: October 29, 2025

CVE-2025-40085

None
    Linux
  • Linux Kernel
Published: October 29, 2025

CVE-2025-61156

None
    Threatfire
  • Threatfire System Monitor
Published: October 29, 2025

CVE-2025-63622

None
    Code-Projects
  • Online Complaint Site
Published: October 29, 2025

CVE-2025-60542

None
    Typeorm
  • Typeorm
Published: October 29, 2025

CVE-2025-60595

None
    Sph Engineering
  • Ugcs
Published: October 29, 2025

CVE-2025-61234

None
    Dataphone
  • A920
Published: October 29, 2025

CVE-2025-35980

None
Published: October 29, 2025

CVE-2025-61876

None
    Inforcer
  • Inforcer Platform
Published: October 29, 2025

CVE-2025-60320

None
    Memoq
  • Memoq
Published: October 29, 2025
Click here to see more Vulnerabilities