Tag: cisa

5 Attack Reports | 0 Vulnerabilities

Attack reports

Microsoft WSUS Remote Code Execution (CVE-2025-59287) Actively Exploited in the Wild (Updated November 3)

A critical vulnerability in Microsoft's Windows Server Update Services (WSUS) allows unauthenticated remote code execution with system privileges. Initially patched on October 14, 2025, the flaw required an emergency update on October 23 due to incomplete mitigation. Active exploitation was observe…
cisa
rce
patch management
CVE-2025-59287
2025-12-07
active exploitation
kev catalog
windows server
wsus
Published: December 7, 2025
Linked vulnerabilities : CVE-2024-36401, CVE-2025-32433 (CVSS 10.0), CVE-2025-52905 (CVSS 7.0), CVE-2025-52906 (CVSS 9.3), CVE-2025-52907 (CVSS 7.3), CVE-2025-59287 (CVSS 9.8), CVE-2025-53868 (CVSS 8.5), CVE-2025-61955 (CVSS 8.5), CVE-2025-57780 (CVSS 8.5), CVE-2025-55182 (CVSS 10.0), CVE-2025-66478, CVE-2025-21042
Downloadable IOCs: 1

Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications

The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) are releasing this joint Cybersecurity Advisory in response to exploitation in September 2024 of vulnerabilities in Ivanti Cloud Service Appliances (CSA): CVE-2024-8963, an administrative bypass vu…
ivanti
cisa
2025-01-24
Published: January 24, 2025
Linked vulnerabilities : CVE-2024-8190 (CVSS 7.2), CVE-2024-8963 (CVSS 9.1), CVE-2024-9379 (CVSS 7.2), CVE-2024-9380 (CVSS 7.2), CVE-2024-9381 (CVSS 7.2), CVE-2025-0282 (CVSS 9.0), CVE-2025-0283 (CVSS 7.0)
Downloadable IOCs: 28

The Good, the Bad and the Ugly in Cybersecurity - Week 43

CISA proposes new security measures to protect sensitive data from adversary nations, following President Biden's Executive Order. A free file recovery tool for early Mallox ransomware victims is released. A novel macOS ransomware, macOS.NotLockBit, is discovered abusing AWS S3 for data exfiltratio…
ransomware
zero-day
mallox
cisa
CVE-2024-47575
2024-10-25
fortinet
aws s3
macos.notlockbit
Published: October 25, 2024
Downloadable IOCs: 0

FASTCash for Linux

A newly identified variant of FASTCash "payment switch" malware specifically targets the Linux operating system, as well as Microsoft Windows, according to CISA and the Department of Homeland Security (DHS).
malware
linux
windows
code
cisa
2024-10-15
bluenoroff
fastcash
linux variant
ubuntu linux
atms
lira
linux sample
atmpos
triton
format
aix
Published: October 15, 2024
Downloadable IOCs: 12

North Korea Cyber Group Conducts Global Espionage Campaign to Advance Regime's Military and Nuclear Programs

The U.S. Federal Bureau of Investigation (FBI) and several partner agencies are releasing this advisory to highlight a North Korean state-sponsored cyber group known as Andariel, operating under the Reconnaissance General Bureau (RGB) 3rd Bureau. This group primarily targets defense, aerospace, nuc…
2024-07-25
cisa
Published: July 25, 2024
Downloadable IOCs: 60
Click here to see more Attack Reports