Tag: auto-color

3 Attack Reports | 0 Vulnerabilities

Attack reports

CVE-2025-31324: Critical SAP Vulnerability & How to Protect Your Enterprise

A critical remote code execution vulnerability (CVE-2025-31324) affects SAP NetWeaver Development Server, allowing attackers to upload malicious files through the metadatauploader endpoint. This vulnerability enables unauthenticated remote code execution, potentially leading to enterprise network c…
exploit
vulnerability
remote code execution
auto-color
CVE-2025-31324
2025-09-10
netweaver
metadatauploader
sap
Published: September 10, 2025
Downloadable IOCs: 4

China-Nexus Threat Actor Actively Exploiting Ivanti Endpoint Manager Mobile (CVE-2025-4428) Vulnerability

A critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM) is being actively exploited by a China-nexus threat actor, UNC5221. The exploitation targets internet-facing EPMM deployments across various sectors including healthcare, telecommunications, and government. The attackers utilize unau…
ivanti
sliver
data exfiltration
china-nexus
auto-color
2025-05-21
krustyloader
frp
unauthenticated rce
epmm
CVE-2025-4427
CVE-2025-4428
Published: May 21, 2025
Linked vulnerabilities : CVE-2025-22457 (CVSS 9.0), CVE-2025-31324 (CVSS 10.0), CVE-2025-4428, CVE-2025-4427
Downloadable IOCs: 12

Auto-Color: An Emerging and Evasive Linux Backdoor

Auto-color is a newly discovered Linux malware that employs sophisticated evasion techniques. It renames itself to benign-looking filenames, hides remote C2 connections using advanced methods similar to Symbiote malware, and uses proprietary encryption for communication. The malware installs a mali…
linux
backdoor
evasion
encryption
government
c2
proxy
universities
reverse shell
2025-02-25
auto-color
library implant
symbiote
Published: February 25, 2025
Downloadable IOCs: 10
Click here to see more Attack Reports