SecuriTricks - zero-day

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

A zero-day vulnerability in 7-Zip (CVE-2025-0411) was exploited by Russian cybercrime groups to target Ukrainian organizations. The vulnerability allows bypassing Windows Mark-of-the-Web protections through double archiving, enabling execution of malicious content. The campaign involved spear-phish…

zero-day

cyberespionage

mark-of-the-web bypass

Published: February 4, 2025

Downloadable IOCs: 0

From Credit Card Skimming to Exploiting Zero-Days

XE Group, a cybercriminal organization active since 2013, has evolved from credit card skimming to exploiting zero-day vulnerabilities. The group initially focused on web vulnerabilities and supply chain attacks but has now shifted to targeted information theft in manufacturing and distribution sec…

Published: February 3, 2025

Downloadable IOCs: 17

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

A recent campaign targeting Fortinet FortiGate firewall devices with exposed management interfaces has been observed. The threat actors gained unauthorized access to the firewalls' administrative controls, created new accounts, established SSL VPN connections, and made various configuration changes…

zero-day

lateral movement

fortigate

vulnerability scanning

Published: January 11, 2025

Downloadable IOCs: 0

Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112)

Check Point Research discovered threat actors leveraging novel techniques to execute malicious code on Windows systems by exploiting Internet Explorer's vulnerabilities. The attackers utilized specially crafted .url files that, when opened, would launch IE and visit attacker-controlled URLs. Additi…

Published: July 10, 2024

Downloadable IOCs: 7

Uncovering Espionage Operations

This comprehensive analysis delves into the intricate tactics employed by a suspected China-nexus cyber espionage actor, UNC3886. The report unveils the group's sophisticated exploitation of zero-day vulnerabilities and their deployment of rootkits like REPTILE and MEDUSA for persistent system acce…

Published: June 24, 2024

Downloadable IOCs: 39

Uncorking Old Wine: Zero-Day from 2017 + Loader in Unholy Alliance

An analysis uncovered a suspected malicious campaign targeting entities in Ukraine. The attack employed an old vulnerability from 2017, CVE-2017-8570, as the initial entry vector. The operation utilized a customized loader to deliver the Cobalt Strike Beacon payload. While the specific threat actor…

Published: April 29, 2024

Downloadable IOCs: 6

Tag: zero-day

Attack reports

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

From Credit Card Skimming to Exploiting Zero-Days

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

New Cleo zero-day RCE flaw exploited in data theft attacks

Potential ZERO-DAY, Attackers Use Corrupted Files to Evade Detection

Chinese hackers exploit Fortinet VPN zero-day to steal credentials

Weaponizing FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA

Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails

The Good, the Bad and the Ugly in Cybersecurity - Week 43

Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575)

Lazarus APT steals cryptocurrency and user data via a decoy MOBA game

Unmasking CVE-2024-38178: The Silent Threat of Windows Scripting Engine

Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112)

Uncovering Espionage Operations

Uncorking Old Wine: Zero-Day from 2017 + Loader in Unholy Alliance