Tag: 2025-11-05

9 Attack Reports | 108 Vulnerabilities

Attack reports

Crossed wires: a case study of Iranian espionage and attribution

This analysis examines a newly identified threat actor dubbed UNK_SmudgedSerpent that targeted academics and foreign policy experts between June and August 2025. The actor used domestic political lures related to Iran, benign conversation starters, health-themed infrastructure, and Remote Managemen…
espionage
phishing
credential harvesting
iranian threat actor
2025-11-05
rmm tools
attribution challenges
isl online
minibike
overlapping ttps
policy experts targeting
minijunk
pdqconnect
Published: November 5, 2025
Downloadable IOCs: 55

Operation Dragon Breath (APT-Q-27): Dimensional Reduction Attack Against the Gambling Industry

A threat group known as Golden Eye Dog (APT-Q-27) has been targeting individuals involved in gambling and related activities in Southeast Asia, as well as overseas Chinese communities. The group's operations include remote control, cryptocurrency mining, DDoS attacks, and traffic-related activities…
telegram
watering hole
southeast asia
2025-11-05
miuuti group
ghost
gambling industry
msi installer
golden eye dog
chinese communities
Published: November 5, 2025
Downloadable IOCs: 0

Weaponized Military Documents Deliver Advanced SSH-Tor Backdoor

A sophisticated cyber attack targeting the defense sector was identified in October 2025, utilizing a weaponized ZIP archive disguised as a military document. The multi-stage attack employs advanced evasion techniques and deploys a complex infrastructure combining OpenSSH for Windows with a customi…
openssh
defense sector
2025-11-05
tor hidden service
military lure
obfs4
uav operations
ssh-tor backdoor
belarusian air force
Published: November 5, 2025
Downloadable IOCs: 0

Operation Peek-a-Baku: Silent Lynx APT Targets Dushanbe with Espionage Campaign

The Silent Lynx APT group has been conducting espionage campaigns targeting Central Asian nations, Russia, China, and Azerbaijan. Two main campaigns were identified: one focusing on Russia-Azerbaijan relations and another on China-Central Asia relations. The group uses various malware including Pow…
apt
espionage
powershell
russia
china
.net
reverse shell
central asia
azerbaijan
silent loader
laplas
silentsweeper
ligolo-ng
2025-11-05
Published: November 5, 2025
Downloadable IOCs: 0

"Sneaky" new Android malware takes over your phone, hiding in fake news and ID apps

A sophisticated Android Trojan has been discovered that masquerades as trusted apps like news readers or digital ID applications. Once installed, it quietly operates in the background, stealing sensitive information such as login credentials and financial data. The malware exploits Android's Access…
android
cryptocurrency
trojan
banking malware
southeast asia
overlay attack
accessibility services
2025-11-05
android/trojan.spy.banker.aur9b9b491bc44
Published: November 5, 2025
Downloadable IOCs: 0

CLOP RANSOMWARE: DISSECTING NETWORK - THE RAVEN FILE

The report analyzes the network infrastructure used by the Clop ransomware group, focusing on their exploitation of CVE-2025-61882 in Oracle EBS. It identifies 96 IP addresses associated with a specific fingerprint, with Germany, Brazil, and Panama being prominent locations. The analysis reveals si…
ransomware
CVE-2023-0669
cyclops blink
infrastructure
CVE-2023-34362
CVE-2025-61882
2025-11-05
cryptomix
oracle ebs
fingerprints
ip addresses
network analysis
Published: November 5, 2025
Downloadable IOCs: 203

The DragonForce Cartel: Scattered Spider at the gate

DragonForce, a ransomware-as-a-service group active since 2023, has rebranded as a cartel and formed alliances with groups like Scattered Spider, LAPSUS$, and ShinyHunters. The group uses Conti-derived code and employs BYOVD attacks to terminate processes. DragonForce has expanded its affiliate pro…
social engineering
ransomware
encryption
conti
byovd
dragonforce
affiliate program
mamona
devman
2025-11-05
scattered spider
global
cartel
Published: November 5, 2025
Downloadable IOCs: 0

Evasion and Persistence via Hidden Hyper-V Virtual Machines

This investigation uncovered new tools and techniques used by the Curly COMrades threat actor to establish covert, long-term access to victim networks. The attackers exploited Hyper-V virtualization on compromised Windows 10 machines to create hidden remote operating environments. They deployed a m…
evasion
powershell
persistence
lateral movement
proxy
reverse shell
virtualization
2025-11-05
hyper-v
kerberos
alpine linux
curlcat
curlyshell
Published: November 5, 2025
Downloadable IOCs: 4

Update on Attacks by Threat Group APT-C-60

APT-C-60 continues to target Japan and East Asia with spear-phishing attacks impersonating job seekers. The attack flow has evolved, now directly attaching malicious VHDX files to emails. The malware, including Downloader1, Downloader2, and SpyGlace, has been updated with new features and communica…
rc4
github
spyglace
com hijacking
spear-phishing
recruitment
east asia
vhdx
2025-11-05
downloader1
downloader2
Published: November 5, 2025
Downloadable IOCs: 31
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-63601

9.9
    Snipe-It
  • Snipe-It
Published: November 5, 2025

CVE-2025-55343

9.9
    Quipux
  • Quipux
Published: November 5, 2025

CVE-2025-12735

9.8
    Expr-Eval
  • Expr-Eval
Published: November 5, 2025

CVE-2025-11749

9.8
    Wordpress
  • Ai Engine
Published: November 5, 2025

CVE-2025-12674

9.8
    Kiotviet
  • Kiotviet Sync
Published: November 5, 2025

CVE-2025-47151

9.8
    Entrouvert
  • Lasso
Published: November 5, 2025

CVE-2025-61304

9.8
    Dynatrace
  • Activegate
Published: November 5, 2025

CVE-2025-20354

9.8
    Cisco
  • Cisco Unified Ccx
Published: November 5, 2025

CVE-2025-63334

9.8
    Pocketvj
  • Pocketvj-Cp
Published: November 5, 2025

CVE-2025-55108

9.5
    Bmc
  • Control-M Agent
Published: November 5, 2025

CVE-2025-20358

9.4
    Cisco
  • Contact Center Express Editor
  • Unified Ccx
Published: November 5, 2025

CVE-2025-64459

9.1
    Djangoproject
  • Django
Published: November 5, 2025

CVE-2025-45378

9.1
    Dell
  • Cloudlink
Published: November 5, 2025

CVE-2025-46364

9.1
    Dell
  • Cloudlink
Published: November 5, 2025

CVE-2025-56231

9.1
    Tonec
  • Internet Download Manager
Published: November 5, 2025

CVE-2025-63416

9.1
    Selfbest
  • Selfbest
Published: November 5, 2025

CVE-2025-64109

8.8
    Cursor
  • Cursor
Published: November 5, 2025

CVE-2025-21078

8.8
    Samsung
  • Smart Switch
Published: November 5, 2025

CVE-2023-43000

8.8
    Apple
  • Macos
  • Ios
  • Ipad Os
  • Safari
Published: November 5, 2025

CVE-2025-12779

8.8
    Amazon
  • Workspaces
Published: November 5, 2025

CVE-2025-64110

8.7
    Cursor
  • Cursor
Published: November 5, 2025

CVE-2025-12384

8.6
    Wordpress
  • Document Embedder
Published: November 5, 2025

CVE-2025-20343

8.6
    Cisco
  • Cisco Identity Services Engine
Published: November 5, 2025

CVE-2025-62225

8.4
    Sony
  • Optical Disc Archive Software
Published: November 5, 2025

CVE-2025-64151

8.4
    Roboticsware
  • Roboticsware
Published: November 5, 2025

CVE-2025-30479

8.4
    Dell
  • Cloudlink
Published: November 5, 2025

CVE-2025-45379

8.4
    Dell
  • Cloudlink
Published: November 5, 2025

CVE-2025-10907

8.4
    Wso2
  • Wso2
Published: November 5, 2025

CVE-2025-11093

8.4
    Wso2
  • Wso2 Micro Integrator
  • Wso2 Enterprise Integrator
  • Wso2 Api Manager
Published: November 5, 2025

CVE-2025-57130

8.3
    Zwii
  • Zwii Cms
Published: November 5, 2025

CVE-2025-12497

8.1
    Phlox
  • Phlox Theme
Published: November 5, 2025

CVE-2025-55278

8.1
    Hcl
  • Devops Loop
Published: November 5, 2025

CVE-2025-10622

8.0
    Redhat
  • Satellite
Published: November 5, 2025

CVE-2025-12197

7.5
    Wordpress
  • Events Calendar
Published: November 5, 2025

CVE-2025-12139

7.5
    Wordpress
  • File Manager For Google Drive
Published: November 5, 2025

CVE-2025-46404

7.5
    Entr'ouvert
  • Lasso
Published: November 5, 2025

CVE-2025-46705

7.5
    Entr'ouvert
  • Lasso
Published: November 5, 2025

CVE-2025-46784

7.5
    Entrouvert
  • Lasso
Published: November 5, 2025

CVE-2025-64458

7.5
    Django
  • Django
Published: November 5, 2025

CVE-2025-63248

7.5
    Dwsurvey
  • Dwsurvey
Published: November 5, 2025

CVE-2025-43990

7.3
    Dell
  • Dell Command Monitor
Published: November 5, 2025

CVE-2025-63417

7.2
    Selfbest
  • Selfbest Platform
Published: November 5, 2025

CVE-2025-21079

7.1
    Samsung
  • Members
Published: November 5, 2025

CVE-2025-61084

7.1
    Mdamon
  • Mdamon Mail Server
Published: November 5, 2025

CVE-2025-21073

6.8
    Samsung
  • Usb Connection Mode
Published: November 5, 2025

CVE-2025-56232

6.8
    Gog
  • Galaxy
Published: November 5, 2025

CVE-2025-3125

6.7
    Wso2
  • Wso2
Published: November 5, 2025

CVE-2025-46366

6.7
    Dell
  • Cloudlink
Published: November 5, 2025

CVE-2025-46424

6.7
    Dell
  • Cloudlink
Published: November 5, 2025

CVE-2025-20375

6.5
    Cisco
  • Unified Ccx
Published: November 5, 2025

CVE-2025-20376

6.5
    Cisco
  • Cisco Unified Ccx
Published: November 5, 2025

CVE-2025-10713

6.5
    Wso2
  • Wso2
Published: November 5, 2025

CVE-2025-55341

6.5
    Quipux
  • Quipux
Published: November 5, 2025

CVE-2025-60784

6.5
    Zhangbang
  • Xiaozhangbang Voluntary Like System
Published: November 5, 2025

CVE-2025-63585

6.5
    Ossn
  • Open Source Social Network
Published: November 5, 2025

CVE-2025-11162

6.4
    Spectra
  • Spectra Gutenberg Blocks
Published: November 5, 2025

CVE-2025-11917

6.4
    Wordpress
  • Wpematico
Published: November 5, 2025

CVE-2025-12388

6.4
    Wordpress
  • B Carousel Block
Published: November 5, 2025

CVE-2025-11820

6.4
    Graphina
  • Elementor Charts And Graphs
Published: November 5, 2025

CVE-2025-11987

6.4
    Wordpress
  • Visual Link Preview
Published: November 5, 2025

CVE-2025-11745

6.4
    Wordpress
  • Ad Inserter
Published: November 5, 2025

CVE-2025-10567

6.3
    Funnelkit
  • Funnelkit
Published: November 5, 2025

CVE-2025-6027

6.3
    Wordpress
  • Ace User Management
Published: November 5, 2025

CVE-2025-12580

6.1
    Wordpress
  • Sms Plugin
Published: November 5, 2025

CVE-2025-5770

6.1
    Wso2
  • *
Published: November 5, 2025

CVE-2025-63418

6.1
    Selfbest
  • Selfbest
Published: November 5, 2025

CVE-2025-21071

5.7
    Samsung
  • Fingerprint Trustlet
Published: November 5, 2025

CVE-2025-8871

5.6
    Everest Forms
  • Everest Forms
Published: November 5, 2025

CVE-2025-21076

5.5
    Samsung
  • Samsung Account
Published: November 5, 2025

CVE-2025-60753

5.5
    Libarchive
  • Bsdtar
Published: November 5, 2025

CVE-2025-58337

5.4
    Apache
  • Doris
Published: November 5, 2025

CVE-2025-20303

5.4
    Cisco
  • Ise
  • Ise-Pic
Published: November 5, 2025

CVE-2025-20304

5.4
    Cisco
  • Ise
  • Ise-Pic
Published: November 5, 2025

CVE-2025-57244

5.4
    Openkm
  • Community Edition
Published: November 5, 2025

CVE-2025-31954

5.4
    Hcl
  • Iautomate
Published: November 5, 2025

CVE-2025-11835

5.3
    Wordpress
  • Paid Membership Subscriptions
Published: November 5, 2025

CVE-2025-10873

5.3
    Elementinvader
  • Elementinvader Addons For Elementor
Published: November 5, 2025

CVE-2025-11072

5.3
    Melabu
  • Wp Download Counter Button
Published: November 5, 2025

CVE-2025-12676

5.3
    Kiotviet
  • Kiotviet Sync
Published: November 5, 2025

CVE-2025-12677

5.3
    Wordpress
  • Kiotviet Sync
Published: November 5, 2025

CVE-2025-12192

5.3
    Wordpress
  • The Events Calendar
Published: November 5, 2025

CVE-2025-12468

5.3
    Wordfence
  • Funnelkit Automations
    Woocommerce
Published: November 5, 2025

CVE-2025-46365

5.3
    Dell
  • Cloudlink
Published: November 5, 2025

CVE-2025-59716

5.3
    Owncloud
  • Guests
Published: November 5, 2025

CVE-2025-55342

5.3
    Quipux
  • Quipux
Published: November 5, 2025

CVE-2025-10853

5.2
    Wso2
  • Wso2
Published: November 5, 2025

CVE-2025-20374

4.9
    Cisco
  • Unified Ccx
Published: November 5, 2025

CVE-2025-20289

4.8
    Cisco
  • Ise
  • Ise-Pic
Published: November 5, 2025

CVE-2025-12745

4.8
    Quickjs
  • Quickjs
Published: November 5, 2025

CVE-2025-43418

4.6
    Apple
  • Ios
  • Ipados
Published: November 5, 2025

CVE-2025-12582

4.3
    Wordpress
  • Features Plugin
Published: November 5, 2025

CVE-2025-21074

4.3
    Samsung
  • Libimagecodec
Published: November 5, 2025

CVE-2025-21075

4.3
    Samsung
  • Libimagecodec
Published: November 5, 2025

CVE-2025-11373

4.3
    Depicter
  • Popup And Slider Builder
Published: November 5, 2025

CVE-2025-12675

4.3
    Kiotviet
  • Kiotviet Sync
Published: November 5, 2025

CVE-2025-12469

4.3
    Funnelkit
  • Automations
Published: November 5, 2025

CVE-2025-20305

4.3
    Cisco
  • Ise
Published: November 5, 2025

CVE-2025-20377

4.3
    Cisco
  • Cisco Unified Intelligence Center
Published: November 5, 2025

CVE-2025-52602

4.2
    Hcl
  • Hcl Bigfix
Published: November 5, 2025

CVE-2025-21077

3.3
    Samsung
  • Samsung Email
Published: November 5, 2025

CVE-2025-64448

None
    Fortinet
  • Fortinet
Published: November 5, 2025

CVE-2025-64449

None
    Fortinet
  • Fortinet
Published: November 5, 2025

CVE-2025-64450

None
    Fortinet
  • Fortinet
Published: November 5, 2025

CVE-2025-64451

None
    Fortinet
  • *
Published: November 5, 2025

CVE-2025-64452

None
    Fortinet
  • Fortinet
Published: November 5, 2025

CVE-2025-64453

None
    Fortinet
  • Fortinet
Published: November 5, 2025

CVE-2025-64454

None
    Fortinet
  • Fortigate
Published: November 5, 2025

CVE-2025-64455

None
    Fortinet
  • Fortinet
Published: November 5, 2025
Click here to see more Vulnerabilities