Tag: 2025-11-19

8 Attack Reports | 134 Vulnerabilities

Attack reports

Network devices compromised for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …
apt
espionage
china
adversary-in-the-middle
dns hijacking
slowstepper
software update hijacking
2025-11-19
littledaemon
edgestepper
network implant
daemoniclogistics
Published: November 19, 2025
Downloadable IOCs: 4

PlushDaemon compromises network devices for adversary-in-the-middle attacks

China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper …
apt
espionage
china
adversary-in-the-middle
dns hijacking
slowstepper
software update hijacking
2025-11-19
littledaemon
edgestepper
network implant
daemoniclogistics
Published: November 19, 2025
Downloadable IOCs: 7

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

A malware campaign called WEBJACK is compromising Microsoft IIS servers to deploy BadIIS malware modules for SEO poisoning and fraud. The attackers hijack high-profile targets, including government and educational institutions, to redirect users to gambling websites. The campaign uses various tools…
seo poisoning
cobalt strike
chinese threat actor
latin america
southeast asia
badiis
iis modules
2025-11-19
xlanyloader
iis hijacking
m0yv
gambling redirection
Published: November 19, 2025
Downloadable IOCs: 34

GPT Trade: Fake Google Play Store drops BTMob Spyware and UASecurity Miner on Android Devices

A sophisticated Android dropper impersonating the Google Play Store was discovered, distributing an app called 'GPT Trade'. This malicious application, disguised as an AI trading assistant, actually deploys two dangerous payloads: BTMob spyware and UASecurity Miner. The dropper creates directories,…
social engineering
android
dropper
spyware
modular malware
btmob
2025-11-19
apk packer
uasecurity miner
fake app store
cryptocurrency miner
gpt trade
Published: November 19, 2025
Downloadable IOCs: 10

RONINGLOADER: DragonBreath's New Path to PPL Abuse

Elastic Security Labs uncovered a campaign by DragonBreath APT using a multi-stage loader named RONINGLOADER to deploy an updated gh0st RAT variant. The malware employs various evasion techniques targeting Chinese EDR tools, including signed driver abuse, thread-pool injection, and PPL exploitation…
apt
gh0st rat
driver abuse
2025-11-19
ppl abuse
wdac
thread-pool injection
chinese edr evasion
roningloader
Published: November 19, 2025
Downloadable IOCs: 14

Sophisticated Tuoni C2 Attack on U.S. Real Estate Firm Thwarted

In October 2025, a major U.S. real estate company was targeted by a highly advanced cyberattack using the emerging Tuoni C2 framework. The attack, which showed signs of AI assistance in code generation, was neutralized by Morphisec's Automated Moving Target Defense (AMTD) technology. The campaign l…
powershell
steganography
in-memory execution
ai-assisted
real estate
2025-11-19
tuoni c2
prevention
amtd
tuoni
Published: November 19, 2025
Downloadable IOCs: 4

License to Encrypt: Make Their Move

'The Gentlemen' ransomware group emerged in July 2025, employing advanced dual-extortion tactics. They encrypt data and exfiltrate sensitive information, threatening to release it unless a ransom is paid. The group developed their own Ransomware-as-a-Service (RaaS) platform after experimenting with…
linux
ransomware
windows
persistence
encryption
esxi
raas
2025-11-19
the gentlemen
dual-extortion
Published: November 19, 2025
Downloadable IOCs: 0

ShadowRay 2.0: Active Global Campaign Hijacks Ray AI Infrastructure Into Self-Propagating Botnet

A global hacking campaign dubbed ShadowRay 2.0 has been discovered, exploiting a vulnerability in the Ray AI framework to seize control of computing clusters and create a self-replicating botnet. The attackers use GitLab and GitHub for payload delivery, leveraging AI-generated code to adapt their m…
xmrig
ddos
botnet
cryptojacking
data exfiltration
self-propagation
devops
2025-11-19
CVE-2023-48022
ai infrastructure
sockstress
ray framework
Published: November 19, 2025
Downloadable IOCs: 0
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-63224

10.0
    Itel
  • Dab Encoder
Published: November 19, 2025

CVE-2025-12057

9.8
    Wordpress
  • Waveplayer
Published: November 19, 2025

CVE-2025-10437

9.8
    Eksagate
  • Webpack Management System
Published: November 19, 2025

CVE-2025-63218

9.8
    Axel Technology
  • Wolf1ms
  • Wolf2ms
Published: November 19, 2025

CVE-2025-63223

9.8
    Axel Technology
  • Streamermax Mk Ii
Published: November 19, 2025

CVE-2025-63206

9.8
    Dasankorea
  • Ds2924
  • Ds2924 Firmware
Published: November 19, 2025

CVE-2025-63207

9.8
    R.V.R.Elettronica
  • Tex
  • Web Gui
Published: November 19, 2025

CVE-2025-63210

9.8
    Newtec
  • Celox Uhd
Published: November 19, 2025

CVE-2025-65095

9.4
    Lookyloo
  • Lookyloo
Published: November 19, 2025

CVE-2025-13051

9.3
    Asustor
  • Abp
  • Aes
Published: November 19, 2025

CVE-2025-12592

9.3
    Vivotek
  • Device
Published: November 19, 2025

CVE-2025-34328

9.3
    Audiocodes
  • Fax Server And Auto-Attendant Ivr Appliances
Published: November 19, 2025

CVE-2025-34329

9.3
    Audiocodes
  • Fax Server
  • Auto-Attendant Ivr
Published: November 19, 2025

CVE-2025-13315

9.3
    Twonky
  • Twonky Server
Published: November 19, 2025

CVE-2025-65021

9.1
    Rallly
  • Rallly
Published: November 19, 2025

CVE-2025-65103

8.8
    Openstamanager
  • Openstamanager
Published: November 19, 2025

CVE-2025-34331

8.7
    Audiocodes
  • Fax Server
  • Auto-Attendant Ivr
Published: November 19, 2025

CVE-2025-34334

8.7
    Audiocodes
  • Fax Server
Published: November 19, 2025

CVE-2025-34335

8.7
    Audiocodes
  • Fax Server
Published: November 19, 2025

CVE-2025-34337

8.7
    Egovframework
  • Egovframe-Common-Components
Published: November 19, 2025

CVE-2025-65094

8.7
    Wbce
  • Wbce Cms
Published: November 19, 2025

CVE-2024-8527

8.6
    Automated Logic
  • Webctrl
    Carrier
Published: November 19, 2025

CVE-2025-10702

8.6
    Progress
  • Datadirect Connect For Jdbc
  • Openaccess Jdbc Driver
  • Hybrid Data Pipeline Jdbc Driver
Published: November 19, 2025

CVE-2025-10703

8.6
    Progress
  • Datadirect Connect For Jdbc
  • Datadirect Openaccess Jdbc Driver
  • Datadirect Hybrid Data Pipeline Jdbc Driver
Published: November 19, 2025

CVE-2025-34332

8.5
    Audiocodes
  • Fax Server
Published: November 19, 2025

CVE-2025-34333

8.5
    Audiocodes
  • Fax Server
  • Auto-Attendant Ivr
Published: November 19, 2025

CVE-2025-12852

8.4
    Nec
  • Rakurakumusen Start Ex
Published: November 19, 2025

CVE-2025-11243

8.3
    Nozomi Networks
  • Shelly Pro 4pm
Published: November 19, 2025

CVE-2025-12056

8.3
    Shelly
  • Shelly Pro 3em
Published: November 19, 2025

CVE-2025-13316

8.2
    Twonky
  • Twonky Server
Published: November 19, 2025

CVE-2025-65025

8.2
    Esm
  • Esm.Sh
Published: November 19, 2025

CVE-2025-65029

8.1
    Rallly
  • Rallly
Published: November 19, 2025

CVE-2025-65033

8.1
    Rallly
  • Rallly
Published: November 19, 2025

CVE-2025-65034

8.1
    Rallly
  • Rallly
Published: November 19, 2025

CVE-2025-64759

8.1
    Homarr
  • Homarr
Published: November 19, 2025

CVE-2025-13035

8.0
    Wordpress
  • Code Snippets
Published: November 19, 2025

CVE-2025-65099

7.7
    Claude
  • Claude Code
    Yarn
Published: November 19, 2025

CVE-2025-12646

7.5
    Wordpress
  • Community Events
Published: November 19, 2025

CVE-2025-11230

7.5
    Haproxy
  • Haproxy
Published: November 19, 2025

CVE-2025-63219

7.5
    Itel
  • Iso Fm Sfn Adapter
  • Webserver
Published: November 19, 2025

CVE-2025-63205

7.5
    Bridgetech
  • Vb220 Ip Network Probe
  • Vb120 Embedded Ip Rf Probe
  • Vb330 High-Capacity Probe
  • Vb440 St 2110 Production Analytics Probe
  • Nomad
Published: November 19, 2025

CVE-2025-63208

7.5
    Bridgetech
  • Vb288 Objective Qoe Content Extractor
Published: November 19, 2025

CVE-2025-63209

7.5
    Elca
  • Star Transmitter
Published: November 19, 2025

CVE-2025-51661

7.5
    Filecodebox
  • Filecodebox
Published: November 19, 2025

CVE-2025-63371

7.5
    Milos Paripovic
  • Onecommander
Published: November 19, 2025

CVE-2025-13400

7.4
    Tenda
  • Ch22 Firmware
  • Ch22
Published: November 19, 2025

CVE-2025-11446

7.3
    Upkeeper Solutions
  • Upkeeper Manager
Published: November 19, 2025

CVE-2025-63932

7.3
    D-Link
  • Router Dir-868l
Published: November 19, 2025

CVE-2025-63719

7.3
    Campcodes
  • Online Hospital Management System
Published: November 19, 2025

CVE-2025-13145

7.2
    Wordpress
  • Wp Import Ultimate Csv Xml Importer
Published: November 19, 2025

CVE-2025-12484

7.2
    Rafflepress
  • Giveaways And Contests
Published: November 19, 2025

CVE-2025-13206

7.2
    Givewp
  • Donation Plugin
Published: November 19, 2025

CVE-2025-63220

7.2
    Sound4
  • Sound4 First
Published: November 19, 2025

CVE-2025-65022

7.2
    Portabilis
  • I-Educar
Published: November 19, 2025

CVE-2025-65023

7.2
    Portabilis
  • I-Educar
Published: November 19, 2025

CVE-2025-65024

7.2
    Portabilis
  • I-Educar
Published: November 19, 2025

CVE-2025-12472

7.1
    Looker
  • Looker
Published: November 19, 2025

CVE-2025-64764

7.1
    Astro
  • Astro
Published: November 19, 2025

CVE-2025-65030

7.1
    Rallly
  • Rallly
Published: November 19, 2025

CVE-2025-11001

7.0
    7-Zip
  • 7-Zip
Published: November 19, 2025

CVE-2025-13395

6.9
    Codehub666
  • *
Published: November 19, 2025

CVE-2025-34330

6.9
    Audiocodes
  • Fax Server
  • Auto-Attendant Ivr
Published: November 19, 2025

CVE-2025-34336

6.9
    Egovframework
  • Egovframe-Common-Components
Published: November 19, 2025

CVE-2025-64765

6.9
    Astro
  • Astro
Published: November 19, 2025

CVE-2025-65100

6.9
    Isar
  • Isar
Published: November 19, 2025

CVE-2025-13410

6.9
    Campcodes
  • Retro Basketball Shoes Online Store
Published: November 19, 2025

CVE-2025-13420

6.9
    Itsourcecode
  • Human Resource Management System
Published: November 19, 2025

CVE-2025-13421

6.9
    Itsourcecode
  • Human Resource Management System
Published: November 19, 2025

CVE-2025-65089

6.8
    Xwiki
  • Xwiki Remote Macros
  • Xwiki
Published: November 19, 2025

CVE-2025-12174

6.5
    Directorist
  • Directorist
Published: November 19, 2025

CVE-2025-63878

6.5
    Github
  • Restaurant Website Restoran
Published: November 19, 2025

CVE-2025-65020

6.5
    Rallly
  • Rallly
Published: November 19, 2025

CVE-2025-65028

6.5
    Rallly
  • Rallly
Published: November 19, 2025

CVE-2025-65031

6.5
    Rallly
  • Rallly
    Github
Published: November 19, 2025

CVE-2025-65032

6.5
    Rallly
  • Rallly
Published: November 19, 2025

CVE-2025-36371

6.5
    Ibm
  • Ibm I
Published: November 19, 2025

CVE-2025-63212

6.5
    Gatesair
  • Flexiva-Lx
Published: November 19, 2025

CVE-2025-6251

6.4
    Royal
  • Elementor Addons And Templates
Published: November 19, 2025

CVE-2025-12710

6.4
    Wordpress
  • Pet-Manager
Published: November 19, 2025

CVE-2025-12878

6.4
    Funnelkit
  • Funnel Builder For Woocommerce Checkout
Published: November 19, 2025

CVE-2025-13054

6.4
    Wordpress
  • User Profile Builder
Published: November 19, 2025

CVE-2025-64408

6.3
    Apache
  • Causeway
Published: November 19, 2025

CVE-2025-63879

6.1
    E-Commerce Project
  • E-Commerce Project
Published: November 19, 2025

CVE-2025-65026

6.1
    Esm.Sh
  • Esm
Published: November 19, 2025

CVE-2025-12743

6.0
    Looker
  • Looker
Published: November 19, 2025

CVE-2025-64708

5.8
    Goauthentik
  • Authentik
Published: November 19, 2025

CVE-2025-13225

5.6
    Tanium
  • Tan Os
Published: November 19, 2025

CVE-2025-12359

5.4
    Wordpress
  • Responsive Lightbox Gallery
Published: November 19, 2025

CVE-2024-8528

5.4
    Automated Logic
  • Webctrl
    Carrier
Published: November 19, 2025

CVE-2025-11963

5.4
    Saysis Computer Systems Trade Ltd Co
  • Starcities
Published: November 19, 2025

CVE-2025-65019

5.4
    Astro
  • Astro
Published: November 19, 2025

CVE-2025-51662

5.4
    Filecodebox
  • Filecodebox
Published: November 19, 2025

CVE-2025-12427

5.3
    Yith
  • Woocommerce Wishlist
Published: November 19, 2025

CVE-2025-12770

5.3
    Wordpress
  • New User Approve
Published: November 19, 2025

CVE-2025-12777

5.3
    Yith
  • Woocommerce Wishlist
Published: November 19, 2025

CVE-2025-12349

5.3
    Icegram
  • Email Subscribers
Published: November 19, 2025

CVE-2025-12426

5.3
    Wordpress
  • Quiz Maker
Published: November 19, 2025

CVE-2025-12814

5.3
    Wordpress
  • Siteseo
Published: November 19, 2025

CVE-2025-12842

5.3
    Wordpress
  • Booking Plugin For Wordpress Appointments
Published: November 19, 2025

CVE-2025-12535

5.3
    Wordpress
  • Sureforms
Published: November 19, 2025

CVE-2025-13396

5.3
    Carmelogarcia
  • Courier Management System
Published: November 19, 2025

CVE-2025-13147

5.3
    Progress
  • Moveit Transfer
Published: November 19, 2025

CVE-2025-47914

5.3
    Golang
  • Ssh
Published: November 19, 2025

CVE-2025-58181

5.3
    Openssh
  • Openssh
Published: November 19, 2025

CVE-2025-13411

5.1
    Campcodes
  • Retro Basketball Shoes Online Store
Published: November 19, 2025

CVE-2025-13415

5.1
    Icret
  • Easyimages
Published: November 19, 2025

CVE-2025-12766

5.0
    Blackberry
  • Athoc
Published: November 19, 2025

CVE-2025-13397

4.8
    Mrubyc
  • Mrubyc
Published: November 19, 2025

CVE-2025-64521

4.8
    Goauthentik
  • Authentik
Published: November 19, 2025

CVE-2025-13412

4.8
    Campcodes
  • Retro Basketball Shoes Online Store
Published: November 19, 2025

CVE-2025-58412

4.7
    Fortinet
  • Fortiadc
Published: November 19, 2025

CVE-2025-0421

4.7
    Shopside Software Technologies Inc
  • Shopside
Published: November 19, 2025

CVE-2025-63243

4.6
    Pixeon
  • Weblaudos
Published: November 19, 2025

CVE-2025-12751

4.3
    Wordpress
  • Ws Chat
Published: November 19, 2025

CVE-2025-12822

4.3
    Wordpress
  • Wp Login And Register Using Jwt
Published: November 19, 2025

CVE-2025-13085

4.3
    Wordpress
  • Siteseo
Published: November 19, 2025

CVE-2025-64757

3.5
    Astro
  • Astro
Published: November 19, 2025

CVE-2025-11884

2.3
    Opentext
  • Ucmdb
Published: November 19, 2025

CVE-2025-65933

None
    Fortinet
  • Fortinet
Published: November 19, 2025

CVE-2025-65934

None
    Fortinet
  • *
Published: November 19, 2025

CVE-2025-65935

None
    Fortinet
  • Fortinet
Published: November 19, 2025

CVE-2025-65936

None
    Fortinet
  • Fortinet
Published: November 19, 2025

CVE-2025-65937

None
    Fortinet
  • Fortigate
Published: November 19, 2025

CVE-2025-65938

None
    Fortinet
  • Fortinet
Published: November 19, 2025

CVE-2025-65939

None
    Fortinet
  • Fortinet
Published: November 19, 2025

CVE-2025-65940

None
    Fortinet
  • *
Published: November 19, 2025

CVE-2025-65941

None
    Fortinet
  • Fortinet
Published: November 19, 2025

CVE-2025-0351

None
    Ubuntu
  • Ubuntu
Published: November 19, 2025

CVE-2025-63221

None
    Axel Technology
  • Puma
Published: November 19, 2025

CVE-2025-63211

None
    Bridgetech
  • Vbc Server
  • Element Manager
Published: November 19, 2025

CVE-2025-51663

None
    Filecodebox
  • Filecodebox
Published: November 19, 2025

CVE-2025-63213

None
    Qvidium
  • Opera11
Published: November 19, 2025

CVE-2025-63214

None
    Bridgetech
  • Vbc Server
  • Element Manager
Published: November 19, 2025

CVE-2025-4042

None
Published: November 19, 2025
Click here to see more Vulnerabilities