Tag: supershell

4 Attack Reports | 0 Vulnerabilities

Attack reports

Inside China's Hosting Ecosystem: 18,000+ Malware C2 Servers Mapped Across Major ISPs

An analysis of Chinese hosting environments reveals over 18,000 active command-and-control (C2) servers distributed across 48 infrastructure providers. C2 infrastructure dominates malicious activity at 84%, followed by phishing at 13%. China Unicom hosts nearly half of all observed C2 servers, with…
malware
apt
xmrig
cobalt strike
china
asyncrat
cybercrime
mirai
nanocore
mgbot
infrastructure
supershell
command-and-control
mozi
vshell
rondodox
CVE-2025-8110
valley rat
2026-01-15
arl
cloud providers
isps
l3mon
Published: January 15, 2026
Linked vulnerabilities : CVE-2025-8110 (CVSS 8.7)
Downloadable IOCs: 12

Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited

A zero-day vulnerability in Gogs, a popular self-hosted Git service, has been discovered and is being actively exploited. The flaw, identified as CVE-2025-8110, is a symlink bypass of a previously patched RCE vulnerability. It allows authenticated users to overwrite files outside the repository, le…
vulnerability
zero-day
cloud security
supershell
rce
CVE-2024-55947
2025-12-10
CVE-2025-8110
git service
gogs
symlink bypass
Published: December 10, 2025
Linked vulnerabilities : CVE-2024-54148 (CVSS 9.8), CVE-2024-55947, CVE-2023-46747, CVE-2024-56731 (CVSS 10.0), CVE-2025-55182 (CVSS 10.0), CVE-2025-8110 (CVSS 8.7)
Downloadable IOCs: 0

Operation DRAGONCLONE: Chinese Telecom Targeted by Malware

A sophisticated campaign targeting China Mobile Tietong Co., Ltd., a subsidiary of China Mobile, has been uncovered. The attack employs VELETRIX, a new loader, and VShell, a known adversary simulation tool. The infection chain begins with a malicious ZIP file containing executable and DLL files. VE…
cobalt strike
CVE-2024-1709
dll sideloading
supershell
china-nexus
vshell
CVE-2025-31324
unc5174
2025-06-06
2025-06-07
veletrix
earth lamia
asset lighthouse system
ipfuscation
callback-execution
dll-sideloading
Published: June 7, 2025
Downloadable IOCs: 0

Supershell Malware Being Distributed to Linux SSH Servers

A Chinese-developed Go-based backdoor called Supershell is targeting poorly managed Linux SSH servers. The malware, which supports multiple platforms, primarily functions as a reverse shell for remote system control. Attackers use dictionary attacks from various IP addresses to gain access, then in…
xmrig
ssh
2024-09-20
cryptocurrency mining
supershell
Published: September 20, 2024
Downloadable IOCs: 5
Click here to see more Attack Reports