Tag: earthworm

5 Attack Reports | 0 Vulnerabilities

Attack reports

Threat Brief: Exploitation of PAN-OS Captive Portal Zero-Day for Unauthenticated Remote Code Execution

A buffer overflow vulnerability in the User-ID Authentication Portal of PAN-OS software allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls. Limited exploitation has been observed starting April 9, 2026, by a likely state-sponsored th…
zero-day
earthworm
buffer overflow
pan-os
reversesocks5
2026-05-07
tunneling tools
Published: May 7, 2026
Linked vulnerabilities : CVE-2023-33538, CVE-2025-23304 (CVSS 7.8), CVE-2025-55182 (CVSS 10.0), CVE-2025-66478, CVE-2025-14847 (CVSS 8.7), CVE-2026-22584, CVE-2026-1281 (CVSS 9.8), CVE-2026-1340 (CVSS 9.8), CVE-2026-1731 (CVSS 9.9), CVE-2025-0921, CVE-2026-31431, CVE-2026-0300 (CVSS 9.3)
Downloadable IOCs: 4

Targets critical infrastructure sectors in North America

UAT-8837, assessed as a China-nexus advanced persistent threat actor, has been targeting critical infrastructure sectors in North America since 2025. The group exploits vulnerabilities, including zero-days, to gain initial access and deploys open-source tools for reconnaissance, credential harvesti…
apt
zero-day
credential harvesting
lateral movement
earthworm
impacket
sharphound
rubeus
critical infrastructure
china-nexus
active directory
CVE-2025-53690
dwagent
2026-01-16
certipy
goexec
gotokentheft
Published: January 16, 2026
Linked vulnerabilities : CVE-2025-53690
Downloadable IOCs: 29

ViewState Deserialization Zero-Day Vulnerability in Sitecore Products (CVE-2025-53690)

A critical ViewState deserialization vulnerability (CVE-2025-53690) was discovered in Sitecore products, affecting deployments using an exposed sample machine key. The attacker exploited this to achieve remote code execution, progressing from initial compromise to privilege escalation. Key events i…
viewstate
lateral movement
reconnaissance
privilege escalation
earthworm
remote code execution
sharphound
deserialization
2025-09-04
CVE-2025-53690
sitecore
dwagent
weepsteel
Published: September 4, 2025
Downloadable IOCs: 0

Analysis of CoinMiner Attacks Targeting Web Servers

The report details two separate attack cases targeting a Korean medical institution's web server, resulting in the installation of CoinMiners. The targeted server was a Windows IIS server, likely with PACS software installed. In both attacks, web shells were uploaded, and system information was col…
xmrig
coinminer
privilege escalation
earthworm
badpotato
godpotato
2024-06-24
webshell
netcat
cpolar
fscan
printnotifypotato
Published: June 24, 2024
Linked vulnerabilities : CVE-2021-1732
Downloadable IOCs: 59

China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence

python
plugx
lsass
trojan
2024-06-18
sygnia
c server
shadowpad
wmiexec
virustotal
earthworm
impacket
f5 bigip
command
f5 appliance
svchost
velvet ant
wireshark
guard
protect
Published: June 18, 2024
Downloadable IOCs: 5
Click here to see more Attack Reports