Tag: vulnerability scanning

3 Attack Reports | 0 Vulnerabilities

Attack reports

New burrowing techniques

Webworm is a China-aligned APT group that has evolved its tactics since first being discovered in 2022, shifting focus from Asian targets to European governmental organizations. In 2025, the group deployed two new backdoors: EchoCreep, which uses Discord for command and control, and GraphWorm, whic…
apt
trochilus
mcrat
vulnerability scanning
cloud infrastructure
china-aligned
proxy tools
microsoft graph api
2026-05-20
chainworm
CVE-2017-7692
discord c&c
echocreep
github staging
graphworm
smuxproxy
wormfrp
wormsocket
Published: May 20, 2026
Linked vulnerabilities : CVE-2017-7692
Downloadable IOCs: 0

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

A recent campaign targeting Fortinet FortiGate firewall devices with exposed management interfaces has been observed. The threat actors gained unauthorized access to the firewalls' administrative controls, created new accounts, established SSL VPN connections, and made various configuration changes…
zero-day
lateral movement
fortigate
vulnerability scanning
fortinet
2025-01-11
ssl vpn
firewall
jsconsole
Published: January 11, 2025
Downloadable IOCs: 0

Detecting Vulnerability Scanning Traffic From Underground Tools Using Machine Learning

Researchers discovered an automated scanning tool called Swiss Army Suite (S.A.S) used for vulnerability scans on web services. The tool generates unusual SQL injection patterns that could potentially bypass web application firewalls. It offers features like Dork-based checker, generator, and SQL v…
sql injection
2024-10-01
2024-10-02
machine learning
vulnerability scanning
telemetry analysis
swiss army suite
underground tools
dork-based checker
s.a.s
web application security
Published: October 2, 2024
Downloadable IOCs: 8
Click here to see more Attack Reports