Tag: om.vbs

1 Attack Reports | 0 Vulnerabilities

Attack reports

Marbled Dust leverages zero-day in Output Messenger for regional espionage

A Türkiye-affiliated espionage threat actor, Marbled Dust, has been exploiting a zero-day vulnerability in Output Messenger since April 2024. The attacks target Kurdish military entities in Iraq, allowing the actor to deliver malicious files and exfiltrate data. The exploit involves a directory tra…
backdoor
espionage
zero-day
golang
data exfiltration
iraq
dns hijacking
CVE-2025-27920
CVE-2025-27921
2025-05-12
omserverservice.exe
omserverservice.vbs
omclientservice.exe
kurdistan
output messenger
2025-05-13
directory traversal
om.vbs
Published: May 13, 2025
Linked vulnerabilities : CVE-2025-27920 (CVSS 9.8), CVE-2025-27921 (CVSS 6.1)
Downloadable IOCs: 3
Click here to see more Attack Reports