Tag: china-aligned

2 Attack Reports | 0 Vulnerabilities

Attack reports

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

ESET researchers have identified a new threat actor named GhostRedirector that has compromised at least 65 Windows servers, primarily in Brazil, Thailand, and Vietnam. The actor utilizes two previously undocumented tools: a passive C++ backdoor called Rungan and a malicious Internet Information Ser…
backdoor
privilege escalation
iis module
windows servers
china-aligned
2025-09-04
zunput
comdai
seo fraud
rungan
gamshen
2025-09-08
Published: September 8, 2025
Downloadable IOCs: 24

ToolShell: An all-you-can-eat buffet for threat actors

A set of zero-day vulnerabilities in SharePoint Server, dubbed ToolShell, has been exploited in the wild since July 17, 2025. The vulnerabilities, CVE-2025-53770 and CVE-2025-53771, allow remote code execution and server spoofing, affecting on-premises SharePoint servers. Attackers have been chaini…
backdoor
apt
vulnerability
zero-day
exploitation
webshell
sharepoint
CVE-2025-53770
CVE-2025-53771
toolshell
CVE-2025-49704
CVE-2025-49706
2025-08-12
msil/webshell.js
china-aligned
Published: August 12, 2025
Linked vulnerabilities : CVE-2025-49704
Downloadable IOCs: 20
Click here to see more Attack Reports