Tag: 2025-11-28

4 Attack Reports | 45 Vulnerabilities

Attack reports

Operation Hanoi Thief: Vietnam APT

A spear-phishing campaign dubbed 'Operation Hanoi Thief' is targeting Vietnamese IT professionals and recruitment teams. The attack uses a malicious ZIP file containing a fake resume and an LNK file. The LNK file executes a pseudo-polyglot payload, which deploys a C++ DLL implant called LOTUSHARVES…
vietnam
spear-phishing
information-stealer
dll-sideloading
2025-11-28
it-professionals
lotusharvest
browser-credentials
recruiters
Published: November 28, 2025
Downloadable IOCs: 6

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

Kaspersky researchers uncovered new malicious operations by the Tomiris threat actor targeting foreign ministries, intergovernmental organizations, and government entities. The attacks, which began in early 2025, show a shift in tactics with increased use of implants leveraging public services like…
apt
discord
telegram
havoc
government targets
adaptixc2
2025-11-28
jlorat
tomiris powershell telegram backdoor
multi-language malware
tomiris c# reverseshell
tomiris c/c++ reverseshell
tomiris python telegram reverseshell
reverse shells
tomiris python discord reverseshell
tomiris c# telegram reverseshell
tomiris rust downloader
tomiris python filegrabber
distopia backdoor
tomiris go reversesocks
tomiris go reverseshell
tomiris rust reverseshell
tomiris c++ reversesocks
Published: November 28, 2025
Downloadable IOCs: 66

Dragons in Thunder

This report details the activities of two hacker groups, QuietCrabs and Thor, targeting Russian companies. QuietCrabs exploited RCE vulnerabilities in Microsoft SharePoint and Ivanti Endpoint Manager Mobile, using KrustyLoader and Sliver malware. Thor employed more common tools and techniques, atta…
lockbit
ivanti
sliver
babuk
sharepoint
krustyloader
CVE-2025-4427
CVE-2025-4428
russian targets
CVE-2025-53770
2025-11-28
rce vulnerabilities
thor
cyberspionage
Published: November 28, 2025
Linked vulnerabilities : CVE-2021-27065, CVE-2025-4428, CVE-2025-4427, CVE-2025-53770 (CVSS 9.8)
Downloadable IOCs: 75

The Mystery OAST Host Behind a Regionally Focused Exploit Operation

A long-running, attacker-operated OAST service on Google Cloud has been observed driving a focused exploit operation. The actor combines stock Nuclei templates with custom payloads to expand their reach. All observed activity targeted canaries deployed in Brazil, indicating a deliberate regional fo…
exploit
brazil
google cloud
CVE-2025-4428
CVE-2025-2611
2025-11-28
oast
fastjson
regional targeting
nuclei
scanning infrastructure
Published: November 28, 2025
Linked vulnerabilities : CVE-2025-4428, CVE-2025-2611 (CVSS 9.3)
Downloadable IOCs: 9
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-66385

9.4
    Cerebrate
  • Cerebrate
Published: November 28, 2025

CVE-2025-64314

9.3
    Huawei
  • *
Published: November 28, 2025

CVE-2025-12183

8.8
    Org.Lz4
  • Lz4-Java
Published: November 28, 2025

CVE-2025-66359

8.5
    Logpoint
  • Logpoint
Published: November 28, 2025

CVE-2025-58303

8.4
    Huawei
  • Screen Recording Framework
Published: November 28, 2025

CVE-2025-58302

8.4
    Huawei
  • Settings Module
Published: November 28, 2025

CVE-2025-66384

8.2
    Misp
  • Misp
Published: November 28, 2025

CVE-2025-58310

8.0
    Huawei
  • Distributed Component
Published: November 28, 2025

CVE-2025-12638

8.0
    Keras
  • Keras
Published: November 28, 2025

CVE-2025-13768

7.7
    Uniong
  • Webitr
Published: November 28, 2025

CVE-2025-51735

7.5
    Hcl Technologies
  • Unica
Published: November 28, 2025

CVE-2025-58316

7.3
    Huawei
  • Video Related System Service
Published: November 28, 2025

CVE-2025-58308

7.3
    Huawei
  • Module
Published: November 28, 2025

CVE-2025-13769

7.1
    Uniong
  • Webitr
Published: November 28, 2025

CVE-2025-13770

7.1
    Uniong
  • Webitr
Published: November 28, 2025

CVE-2025-13771

7.1
    Uniong
  • Webitr
Published: November 28, 2025

CVE-2025-66360

6.9
    Logpoint
  • Logpoint
    Redis
Published: November 28, 2025

CVE-2025-66361

6.9
    Logpoint
  • Logpoint
Published: November 28, 2025

CVE-2025-12143

6.9
    Abb
  • Terra Ac Wallbox
Published: November 28, 2025

CVE-2025-58309

6.8
    Huawei
  • Startup Recovery Module
Published: November 28, 2025

CVE-2025-58314

6.6
    Huawei
  • Component Driver Module
Published: November 28, 2025

CVE-2025-13683

6.5
    Devolutions
  • Devolutions Server
  • Remote Desktop Manager
Published: November 28, 2025

CVE-2025-58307

6.4
    Huawei
  • Screen Recording Framework
Published: November 28, 2025

CVE-2025-51736

6.3
    Hcl Technologies
  • Unica
Published: November 28, 2025

CVE-2025-58294

6.2
    Huawei
  • Huawei Print Module
Published: November 28, 2025

CVE-2025-58305

6.2
    Huawei
  • Gallery
Published: November 28, 2025

CVE-2025-11156

5.9
    Netskope
  • Ns Client
Published: November 28, 2025

CVE-2025-58311

5.8
    Huawei
  • Usb Driver
Published: November 28, 2025

CVE-2025-58315

5.5
    Huawei
  • Wifi Module
Published: November 28, 2025

CVE-2025-51733

5.5
    Hcl Technologies
  • Unica
Published: November 28, 2025

CVE-2025-51734

5.4
    Hcl Technologies
  • Unica
Published: November 28, 2025

CVE-2025-59790

5.4
    Apache
  • Kvrocks
Published: November 28, 2025

CVE-2025-64313

5.3
    Huawei
  • Office Service
Published: November 28, 2025

CVE-2025-59792

5.3
    Apache
  • Kvrocks
Published: November 28, 2025

CVE-2025-58312

5.1
    Huawei
  • App Lock
Published: November 28, 2025

CVE-2025-64311

5.1
    Huawei
  • Notepad
Published: November 28, 2025

CVE-2025-66370

5.0
    Kivitendo
  • Kivitendo
Published: November 28, 2025

CVE-2025-66371

5.0
    Peppol
  • Peppol-Py
Published: November 28, 2025

CVE-2025-58304

4.9
    Huawei
  • File Management Module
Published: November 28, 2025

CVE-2025-64312

4.9
    Huawei
  • File Management Module
Published: November 28, 2025

CVE-2025-64315

4.4
    Huawei
  • File Management Module
Published: November 28, 2025

CVE-2025-13737

4.3
    Nextend
  • Nextend Social Login And Register
    Wordpress
Published: November 28, 2025

CVE-2025-66386

4.1
    Misp
  • Misp
Published: November 28, 2025

CVE-2025-66382

2.9
    Libexpat
  • Libexpat
Published: November 28, 2025

CVE-2025-66372

2.8
    Mustang
  • Mustang
Published: November 28, 2025
Click here to see more Vulnerabilities