Tag: 2025-10-31

10 Attack Reports | 111 Vulnerabilities

Attack reports

Operation SkyCloak: Tor Campaign targets Military of Russia & Belarus

A sophisticated campaign targeting Russian and Belarusian military personnel has been identified, using multi-stage infection chains and decoy documents. The attackers deploy OpenSSH and Tor bridges to establish covert remote access and lateral movement capabilities. The infection process involves …
obfuscation
espionage
powershell
russia
belarus
ssh
tor
military
2025-10-31
Published: October 31, 2025
Downloadable IOCs: 12

New wave of cyberattacks by APT group Cloud Atlas on Russia's government sector

The APT group Cloud Atlas has launched a new wave of cyberattacks targeting Russia's defense industry. They are using stolen document templates from previously infected organizations to create malicious Microsoft Office files. The group cleans metadata from these documents to avoid revealing compro…
apt
2025-10-31
powershower
bec attacks
Published: October 31, 2025
Downloadable IOCs: 20

From Brazil with Love: New Tactics from Lampion

This analysis details a long-running spam campaign by a Brazilian group known for using the Lampion banking trojan. The campaign, active since at least 2019, has evolved its infection chain and components. Key updates include the use of email attachments instead of links, cloud services for ephemer…
banking trojan
clickfix
lampion
2025-10-31
lampion stealer
Published: October 31, 2025
Downloadable IOCs: 20

Tracking an evolving Discord-based RAT family

ReversingLabs has identified four new remote access trojans (RATs) utilizing Discord for command and control. These RATs, operated by the STD Group, include Minecraft RAT, UwUdisRAT, STD RAT, and Propionanilide RAT. The malware, written in C++, uses a ROT23 cipher to encode Discord bot tokens for C…
discord
2025-10-31
std rat
propionanilide
uwudisrat
minecraft rat
propionanilide rat
Published: October 31, 2025
Downloadable IOCs: 0

LATAM baited into the delivery of PureHVNC

Between August and October 2025, a phishing campaign targeted Colombian users with emails impersonating the Attorney General's office. The emails contained links to download a malicious file, initiating an infection chain using Hijackloader to deliver PureHVNC Remote Access Trojan (RAT). The campai…
phishing
hijackloader
purehvnc
2025-10-31
Published: October 31, 2025
Downloadable IOCs: 30

New Loader Executing TorNet and PureHVNC

A new malware loader discovered in May 2025 executes two malware families: TorNet and PureHVNC. The loader uses API hashing with MurmurHash2 and implements persistence through registry modifications. It decrypts and decompresses payloads using AES-128-ECB and LZMA, then injects them into a suspende…
loader
purehvnc
code injection
tornet
2025-10-31
murmurhash2
Published: October 31, 2025
Downloadable IOCs: 0

Case of ActiveMQ Vulnerability Exploitation to Install Sharpire (Kinsing)

The Kinsing threat actor continues to distribute malware by exploiting known vulnerabilities, particularly CVE-2023-46604 in ActiveMQ. They target both Linux and Windows systems, using various malware types including XMRig, Stager, and Sharpire. The attack process involves exploiting the ActiveMQ v…
xmrig
meterpreter
cobaltstrike
vulnerability exploitation
CVE-2023-46604
cryptocurrency mining
2025-10-31
activemq
sharpire
h2miner
powershell empire
Published: October 31, 2025
Linked vulnerabilities : CVE-2021-44228, CVE-2023-46604
Downloadable IOCs: 4

Investigation Report: Android/BankBot-YNRK Mobile Banking Trojan

This report analyzes three Android APK samples identified as variants of the Android/BankBot-YNRK malware family. The malware exhibits sophisticated capabilities, including environment detection, persistence mechanisms, and extensive command-and-control functionalities. It abuses accessibility serv…
android
banking trojan
cryptocurrency theft
overlay attacks
2025-10-31
android/bankbot-ynrk
Published: October 31, 2025
Downloadable IOCs: 7

UNC6384 Weaponizes ZDI-CAN-25373 Vulnerability to Deploy PlugX Against Hungarian and Belgian Diplomatic Entities

Chinese-affiliated threat actor UNC6384 is conducting a cyber espionage campaign targeting European diplomatic entities, particularly in Hungary and Belgium. The group exploits the ZDI-CAN-25373 Windows vulnerability to deliver PlugX malware through spearphishing emails with malicious LNK files. Th…
spearphishing
plugx
dll side-loading
canonstager
2025-10-31
diplomatic targeting
zdi-can-25373
Published: October 31, 2025
Downloadable IOCs: 26

BRONZE BUTLER exploits Japanese asset management software vulnerability

In mid-2025, a sophisticated campaign by the Chinese state-sponsored threat group BRONZE BUTLER (also known as Tick) exploited a zero-day vulnerability in Motex LANSCOPE Endpoint Manager. The vulnerability, CVE-2025-61932, allowed remote attackers to execute arbitrary commands with SYSTEM privilege…
zero-day
havoc
CVE-2025-61932
2025-10-31
oaed loader
gokcpdoor
lanscope
Published: October 31, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-52665

10.0
    Unifi
  • Unifi Access
Published: October 31, 2025

CVE-2025-12553

10.0
    Blu
  • Blu Ic2
  • Blu Ic4
Published: October 31, 2025

CVE-2025-29270

10.0
    Deep Sea Electronics
  • Dse855
Published: October 31, 2025

CVE-2025-48983

9.9
    Veeam
  • Veeam Backup And Replication
Published: October 31, 2025

CVE-2025-5397

9.8
    Noo
  • Jobmonster
Published: October 31, 2025

CVE-2025-8489

9.8
    King
  • Addons For Elementor
Published: October 31, 2025

CVE-2025-6520

9.8
    Abis Technology
  • Bapsis
Published: October 31, 2025

CVE-2025-57108

9.8
    Kitware
  • Vtk
Published: October 31, 2025

CVE-2025-64348

9.3
    Elog
  • Elog
Published: October 31, 2025

CVE-2025-64385

9.2
    Manufacturer
  • Application
Published: October 31, 2025

CVE-2025-64388

9.2
    *
  • Web Server
Published: October 31, 2025

CVE-2025-48984

8.8
    *
  • Backup Server
Published: October 31, 2025

CVE-2025-52664

8.8
    Revive
  • Revive Adserver
Published: October 31, 2025

CVE-2025-7846

8.8
    Wordpress
  • User Extra Fields
Published: October 31, 2025

CVE-2025-11843

8.8
    Therefore
  • Therefore Online
  • Therefore On-Premises
  • Therefore Server
Published: October 31, 2025

CVE-2025-64353

8.8
    Chouby
  • Polylang
Published: October 31, 2025

CVE-2025-12507

8.8
    Bizerba
  • Communication Server
  • Bcs
Published: October 31, 2025

CVE-2025-64349

8.7
    Elog
  • Elog
Published: October 31, 2025

CVE-2025-54763

8.6
    Century Systems
  • Future Net Ma Ip-K
Published: October 31, 2025

CVE-2025-10897

8.6
    Woocommerce
  • Designer Pro
Published: October 31, 2025

CVE-2025-62618

8.6
    Elog
  • Elog
Published: October 31, 2025

CVE-2025-12508

8.4
    Brain2
  • Brain2 User
    Microsoft
Published: October 31, 2025

CVE-2025-12509

8.4
    Brain2
  • Global Shipping
Published: October 31, 2025

CVE-2025-64389

8.3
    Unknown
  • Device
Published: October 31, 2025

CVE-2025-33003

7.8
    Ibm
  • Infosphere Information Server
Published: October 31, 2025

CVE-2025-60749

7.8
    Trimble
  • Sketchup
Published: October 31, 2025

CVE-2025-64386

7.7
    *
  • *
Published: October 31, 2025

CVE-2025-64366

7.6
    Stylemix
  • Masterstudy Lms
Published: October 31, 2025

CVE-2025-10693

7.6
    Silicon Labs
  • Z-Wave Pir Sensor Reference Design
Published: October 31, 2025

CVE-2025-6176

7.5
    Scrapy
  • Scrapy
Published: October 31, 2025

CVE-2025-30188

7.5
    Open-Xchange
  • Component
Published: October 31, 2025

CVE-2025-62232

7.5
    Apache
  • Apisix
Published: October 31, 2025

CVE-2025-12115

7.5
    Wordpress
  • Woocommerce
Published: October 31, 2025

CVE-2025-58147

7.5
    Xen
  • Xen
Published: October 31, 2025

CVE-2025-58148

7.5
    Xen
  • Xen
Published: October 31, 2025

CVE-2025-58149

7.5
    Xen
  • Libxl
Published: October 31, 2025

CVE-2025-64359

7.5
    Stylemixthemes
  • Consulting
Published: October 31, 2025

CVE-2025-64360

7.5
    Stylemixthemes
  • Consulting Elementor Widgets
Published: October 31, 2025

CVE-2025-12501

7.5
    Opera
  • Gamemaker Ide
Published: October 31, 2025

CVE-2025-57106

7.5
    Kitware
  • Vtk
Published: October 31, 2025

CVE-2025-63468

7.5
    Totolink
  • Lr350
Published: October 31, 2025

CVE-2025-63469

7.5
    Totolink
  • Lr350
Published: October 31, 2025

CVE-2025-63464

7.5
    Totolink
  • Lr350
Published: October 31, 2025

CVE-2025-63465

7.5
    Totolink
  • Lr350
Published: October 31, 2025

CVE-2025-63561

7.5
    Summer Pearl Group
  • Vacation Rental Management Platform
Published: October 31, 2025

CVE-2025-30189

7.4
    Open-Xchange
  • *
Published: October 31, 2025

CVE-2025-48982

7.3
    Veeam
  • Agent For Microsoft Windows
Published: October 31, 2025

CVE-2025-12357

7.2
    Iso
  • 15118-2
    Electrical Vehicle
Published: October 31, 2025

CVE-2025-57107

7.1
    Kitware
  • Vtk
Published: October 31, 2025

CVE-2025-64168

7.1
    Agno
  • Framework
Published: October 31, 2025

CVE-2025-58152

6.9
    Century Systems
  • Future Net
Published: October 31, 2025

CVE-2025-63675

6.9
    *
  • Cryptidy
Published: October 31, 2025

CVE-2025-12552

6.9
    Blu
  • Blu-Ic2
  • Blu-Ic4
Published: October 31, 2025

CVE-2025-12554

6.9
    Blu
  • Blu-Ic2
  • Blu-Ic4
Published: October 31, 2025

CVE-2025-8385

6.8
    Wordpress
  • Zombify
Published: October 31, 2025

CVE-2025-4952

6.8
    Eset
  • Eset Security Products
Published: October 31, 2025

CVE-2025-48980

6.5
    Brave
  • Brave Browser
Published: October 31, 2025

CVE-2025-64354

6.5
    Matias Ventura
  • Gutenberg
Published: October 31, 2025

CVE-2025-64361

6.5
    Stylemixthemes
  • Consulting Elementor Widgets
Published: October 31, 2025

CVE-2025-64362

6.5
    Seventhqueen
  • K Elements
Published: October 31, 2025

CVE-2025-64367

6.5
    Adrian Tobey
  • Groundhogg
Published: October 31, 2025

CVE-2025-11806

6.4
    Wordpress
  • Qzzr Shortcode Plugin
Published: October 31, 2025

CVE-2025-27208

6.3
    Revive Adserver
  • Revive Adserver
Published: October 31, 2025

CVE-2025-11602

6.3
    Neo4j
  • Neo4j Enterprise
  • Neo4j Community
Published: October 31, 2025

CVE-2025-12547

6.3
    Logicaldoc
  • Logicaldoc Community Edition
Published: October 31, 2025

CVE-2025-60711

6.3
    Microsoft
  • Edge
Published: October 31, 2025

CVE-2025-63562

6.3
    Summer Pearl Group
  • Vacation Rental Management Platform
Published: October 31, 2025

CVE-2025-12464

6.2
    Qemu
  • E1000
  • Qemu
Published: October 31, 2025

CVE-2025-61427

6.1
    Beo Gmbh
  • Beo Atlas Einfuhr Ausfuhr
Published: October 31, 2025

CVE-2025-8849

5.4
    Librechat
  • Librechat
Published: October 31, 2025

CVE-2025-30191

5.4
    Open-Xchange
  • Open-Xchange
Published: October 31, 2025

CVE-2025-64368

5.4
    Mikado-Themes
  • Bard
Published: October 31, 2025

CVE-2025-11191

5.3
    Realpress
  • Realpress
Published: October 31, 2025

CVE-2025-12094

5.3
    Oopspam
  • Anti-Spam
Published: October 31, 2025

CVE-2025-12041

5.3
    Wordpress
  • Eri File Library
Published: October 31, 2025

CVE-2025-12460

5.3
    Afterlogic
  • Aurora Webmail
Published: October 31, 2025

CVE-2025-12521

5.3
    Analytify
  • Analytify Pro
Published: October 31, 2025

CVE-2024-13992

5.1
    Nagios
  • Nagios Xi
Published: October 31, 2025

CVE-2025-64387

5.1
    *
  • *
Published: October 31, 2025

CVE-2025-62264

5.1
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: October 31, 2025

CVE-2025-12546

5.1
    Logicaldoc
  • Logicaldoc Community Edition
Published: October 31, 2025

CVE-2025-59501

4.8
    Microsoft
  • Configuration Manager
Published: October 31, 2025

CVE-2025-62267

4.6
    Liferay
  • Liferay Portal
  • Liferay Dxp
Published: October 31, 2025

CVE-2025-40603

4.5
    Sonicwall
  • Sma100
Published: October 31, 2025

CVE-2025-11975

4.3
    Fusewp
  • Fusewp
Published: October 31, 2025

CVE-2025-12175

4.3
    Wordpress
  • The Events Calendar
Published: October 31, 2025

CVE-2025-8383

4.3
    Wordpress
  • Depicter
Published: October 31, 2025

CVE-2025-64351

4.3
    Rank Math
  • Rank Math Seo
Published: October 31, 2025

CVE-2025-64356

4.3
    F1logic
  • Insert Php Code Snippet
Published: October 31, 2025

CVE-2025-64357

4.3
    Younesjfr
  • Advanced Database Cleaner
Published: October 31, 2025

CVE-2025-64358

4.3
    Webtoffee
  • Smart Coupons For Woocommerce
Published: October 31, 2025

CVE-2025-64350

3.8
    Rank Math
  • Rank Math Seo
Published: October 31, 2025

CVE-2025-36249

3.7
    Ibm
  • Jazz For Service Management
Published: October 31, 2025

CVE-2025-23050

3.1
    Qt
  • Qt
Published: October 31, 2025

CVE-2025-64352

2.7
    Wpdeveloper
  • Essential Addons For Elementor
Published: October 31, 2025

CVE-2025-6075

1.8
    Python
  • Python
Published: October 31, 2025

CVE-2025-52663

None
    Ubiquiti
  • Unifi Talk Touch
  • Unifi Talk Touch Max
  • Unifi Talk G3 Phones
Published: October 31, 2025

CVE-2025-40106

None
    Linux
  • Kernel
Published: October 31, 2025

CVE-2025-64363

None
    Seventhqueen
  • Kleo
Published: October 31, 2025

CVE-2025-64364

None
    Stylemixthemes
  • Masterstudy
Published: October 31, 2025

CVE-2025-64365

None
    Colabrio
  • Ohio Extra
Published: October 31, 2025

CVE-2025-63466

None
    Totolink
  • Lr350
Published: October 31, 2025

CVE-2025-63467

None
    Totolink
  • Lr350
Published: October 31, 2025

CVE-2025-63460

None
    Totolink
  • A7000r
Published: October 31, 2025

CVE-2025-63461

None
    Totolink
  • A7000r
Published: October 31, 2025

CVE-2025-63462

None
    Totolink
  • A7000r
Published: October 31, 2025

CVE-2025-63463

None
    Totolink
  • Lr350
Published: October 31, 2025

CVE-2025-63459

None
    Totolink
  • A7000r
Published: October 31, 2025

CVE-2025-63454

None
    Tenda
  • Ax-3
Published: October 31, 2025

CVE-2025-63458

None
    Tenda
  • Ax-1803
Published: October 31, 2025

CVE-2025-63563

None
    Summer Pearl Group
  • Vacation Rental Management Platform
Published: October 31, 2025
Click here to see more Vulnerabilities