SecuriTricks - zero-day

Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | Google Cloud Blog

Google Threat Intelligence Group (GTIG) is tracking BRICKSTORM malware activity, which is being used to maintain persistent access to victim organizations in the United States. Since March 2025, Mandiant Consulting has responded to intrusions across a range of industry verticals, most notably legal…

linux

windows

Published: October 8, 2025

Downloadable IOCs: 12

Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors

Google Threat Intelligence Group (GTIG) is tracking BRICKSTORM malware activity, which is being used to maintain persistent access to victim organizations in the United States. Since March 2025, Mandiant Consulting has responded to intrusions across a range of industry verticals, most notably legal…

Published: October 8, 2025

Downloadable IOCs: 12

Three Lazarus RATs coming for your cheese

This report analyzes three remote access trojans (RATs) used by a Lazarus subgroup targeting financial and cryptocurrency organizations: PondRAT, ThemeForestRAT, and RemotePE. It details an incident response case from 2024 involving social engineering and possible zero-day exploitation. PondRAT is …

Published: September 3, 2025

Downloadable IOCs: 0

WinRAR Directory Traversal & NTFS ADS Vulnerabilities (CVE-2025-6218 & CVE-2025-8088)

Two high-severity vulnerabilities in WinRAR for Windows enable attackers to write files outside intended extraction directories. CVE-2025-6218 involves traditional path traversal, while CVE-2025-8088 extends the attack using NTFS Alternate Data Streams. Both flaws allow for reliable persistence and…

zero-day

remote code execution

Published: August 25, 2025

Linked vulnerabilities : CVE-2025-8088, CVE-2025-6218

Downloadable IOCs: 4

Paper Werewolf targets Russia with WinRAR zero-day vulnerability

A series of attacks by the Paper Werewolf (GOFFEE) cluster exploited vulnerabilities in WinRAR, including CVE-2025-6218 and a zero-day flaw. The threat actor used phishing emails impersonating Russian organizations, delivering malware through archive files. The attacks targeted Russian entities, ut…

Published: August 20, 2025

Downloadable IOCs: 0

Dissecting PipeMagic: Inside the architecture of a modular backdoor framework

PipeMagic is a sophisticated modular backdoor used by the Storm-2460 threat actor, disguised as a legitimate ChatGPT Desktop Application. It employs a highly flexible architecture with multiple linked list structures for payload management, execution, and networking. The malware communicates with i…

Published: August 18, 2025

Linked vulnerabilities : CVE-2025-29824 (CVSS 7.8)

Downloadable IOCs: 4

ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises

A zero-day exploit chain named 'ToolShell' is actively targeting on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cry…

zero-day

chinese threat actors

Published: August 14, 2025

Linked vulnerabilities : CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 8

ToolShell: An all-you-can-eat buffet for threat actors

A set of zero-day vulnerabilities in SharePoint Server, dubbed ToolShell, has been exploited in the wild since July 17, 2025. The vulnerabilities, CVE-2025-53770 and CVE-2025-53771, allow remote code execution and server spoofing, affecting on-premises SharePoint servers. Attackers have been chaini…

Published: August 12, 2025

Linked vulnerabilities : CVE-2025-49704

Downloadable IOCs: 20

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

A zero-day vulnerability in WinRAR, CVE-2025-8088, has been discovered being exploited in the wild by the Russia-aligned group RomCom. The vulnerability allows attackers to hide malicious files in archives, which are silently deployed when extracted. The exploit was used in spearphishing campaigns …

Published: August 11, 2025

Linked vulnerabilities : CVE-2023-36884, CVE-2025-8088

Downloadable IOCs: 9

Observed Malicious Driver Use Associated with Akira SonicWall Campaign

Akira affiliates have been observed exploiting two common drivers as part of a suspected AV/EDR evasion effort following initial access involving SonicWall abuse. The drivers, rwdrv.sys and hlpdrv.sys, are being used to facilitate AV/EDR evasion or disablement through a Bring Your Own Vulnerable Dr…

Published: August 8, 2025

Downloadable IOCs: 2

Active Exploitation of SonicWall VPNs

A potential zero-day vulnerability in SonicWall VPNs is being actively exploited to bypass MFA and deploy ransomware. The attack chain begins with a breach of the SonicWall appliance, followed by post-exploitation techniques including enumeration, detection evasion, lateral movement, and credential…

Published: August 4, 2025

Downloadable IOCs: 12

SharePoint Zero-Day Exploit (ToolShell) - Network Infrastructure Mapping

Chinese threat actors have been exploiting zero-day vulnerabilities in SharePoint servers, known as ToolShell, affecting nearly 150 organizations worldwide. The attacks, attributed to groups like Linen Typhoon and Violet Typhoon, began as early as July 17, 2025, targeting government agencies, criti…

zero-day

reconnaissance

webshell

chinese threat actors

telecommunication abuse

mapp

Published: August 2, 2025

Downloadable IOCs: 0

Inside The ToolShell Campaign

FortiGuard Labs has identified a new exploit chain called 'ToolShell' targeting on-premises Microsoft SharePoint servers. This attack combines two previously patched vulnerabilities (CVE-2025-49704 and CVE-2025-49706) with two zero-day variants (CVE-2025-53770 and CVE-2025-53771) to achieve remote …

zero-day

fileless

remote code execution

Published: July 25, 2025

Downloadable IOCs: 0

Defending Against ToolShell: SharePoint's Latest Critical Vulnerability

A critical zero-day vulnerability named ToolShell (CVE-2025-53770) has been discovered in on-premises SharePoint Server deployments. This vulnerability allows unauthenticated remote code execution, posing a significant threat to organizations worldwide. SentinelOne has detected active exploitation …

vulnerability

zero-day

cybersecurity

remote code execution

Published: July 23, 2025

Downloadable IOCs: 2

SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers

A zero-day vulnerability dubbed 'ToolShell' targeting on-premises Microsoft SharePoint Servers has been actively exploited. The flaw, identified as CVE-2025-53770 with an accompanying bypass CVE-2025-53771, allows unauthenticated remote code execution. Three distinct attack clusters have been obser…

vulnerability

zero-day

webshell

remote code execution

Published: July 22, 2025

Linked vulnerabilities : CVE-2025-53770 (CVSS 9.8), CVE-2025-49704

Downloadable IOCs: 3

SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know

Two critical zero-day vulnerabilities, CVE-2025-53770 and CVE-2025-53771, are actively exploited in on-premises Microsoft SharePoint servers. These flaws enable unauthenticated remote code execution through an exploit chain dubbed ToolShell. CVE-2025-53770 is a critical RCE vulnerability caused by …

authentication bypass

Published: July 21, 2025

Linked vulnerabilities : CVE-2025-23266 (CVSS 9.0), CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 3

Operation RoundPress targeting high-value webmail servers

ESET researchers have uncovered a Russia-aligned espionage operation named RoundPress, targeting high-value webmail servers through XSS vulnerabilities. The campaign, attributed to the Sednit group, aims to steal confidential data from specific email accounts. Initially focused on Roundcube in 2023…

Published: May 18, 2025

Linked vulnerabilities : CVE-2024-27443, CVE-2024-11182 (CVSS 6.1), CVE-2020-35730, CVE-2023-23397, CVE-2023-43770

Downloadable IOCs: 16

The Good, the Bad and the Ugly in Cybersecurity – Week 20

This intelligence update covers recent cybersecurity events. In positive developments, global authorities disrupted a major botnet, arrested a ransomware actor, and dismantled a dark web marketplace. On the negative side, a malicious NPM package was discovered hiding multi-stage malware using Unico…

Published: May 16, 2025

Linked vulnerabilities : CVE-2025-27920 (CVSS 9.8)

Downloadable IOCs: 1

CVE-2025-32756: FortiVoice Zero-Day Exploit Alert

A critical zero-day vulnerability (CVE-2025-32756) in multiple Fortinet products, including FortiVoice, has been actively exploited. The flaw is a stack-based buffer overflow that allows remote code execution without authentication. Attackers can gain full control of affected systems, access sensit…

remote-code-execution

Published: May 14, 2025

Linked vulnerabilities : CVE-2025-32756

Downloadable IOCs: 6

Marbled Dust leverages zero-day in Output Messenger for regional espionage

A Türkiye-affiliated espionage threat actor, Marbled Dust, has been exploiting a zero-day vulnerability in Output Messenger since April 2024. The attacks target Kurdish military entities in Iraq, allowing the actor to deliver malicious files and exfiltrate data. The exploit involves a directory tra…

Published: May 13, 2025

Linked vulnerabilities : CVE-2025-27920 (CVSS 9.8), CVE-2025-27921 (CVSS 6.1)

Downloadable IOCs: 3

DslogdRAT Malware Installed in Ivanti Connect Secure

The article discusses a malware called DslogdRAT, which was installed on Ivanti Connect Secure systems by exploiting CVE-2025-0282. The malware communicates with a C2 server during business hours to avoid detection. It uses a web shell for initial access and supports various commands for file opera…

ivanti connect secure

2025-04-28

spawnchimera

dslogdrat

Published: April 28, 2025

Downloadable IOCs: 0

Two sides of the same coin

This intelligence report analyzes the similarities between two previously separate APT groups, Team46 and TaxOff, concluding they are likely the same entity. The analysis covers their shared tactics, techniques, and procedures, including similar PowerShell commands, loader functionality, and infras…

Published: April 18, 2025

Downloadable IOCs: 0

Exploitation of CLFS zero-day leads to ransomware activity

A zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS) has been exploited against targets in IT, real estate, finance, software, and retail sectors across multiple countries. The exploit, deployed by PipeMagic malware and attributed to Storm-2460, enables privilege…

Published: April 9, 2025

Linked vulnerabilities : CVE-2025-24983 (CVSS 7.0), CVE-2025-29814 (CVSS 9.3), CVE-2025-29824 (CVSS 7.8)

Downloadable IOCs: 0

Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)

A critical security vulnerability, CVE-2025-22457, affecting Ivanti Connect Secure VPN appliances has been actively exploited since mid-March 2025. The vulnerability allows remote code execution through a buffer overflow. Two new malware families, TRAILBLAZE and BRUSHFIRE, have been deployed along …

espionage

zero-day

vpn

remote code execution

ivanti connect secure

spawnwave

Published: April 4, 2025

Downloadable IOCs: 0

A Deep Dive into Water Arsenal and Infrastructure

Water Gamayun, a suspected Russian threat actor, exploits the MSC EvilTwin zero-day vulnerability (CVE-2025-26633) to compromise systems and exfiltrate data. The group uses custom payloads like EncryptHub Stealer variants, SilentPrism and DarkWisp backdoors, as well as known malware like Stealc and…

Published: March 29, 2025

Downloadable IOCs: 0

Operation ForumTroll exploits zero-days in Google Chrome

In March 2025, a sophisticated malware campaign exploited a zero-day vulnerability in Google Chrome to infect targets. The attack, dubbed Operation ForumTroll, used personalized phishing emails with short-lived links to deliver malware. Kaspersky detected the exploit, reported it to Google, and an …

trojan.win64.convagent.gen

sandbox escape

trojan.win64.agent

CVE-2025-2783

Published: March 25, 2025

Downloadable IOCs: 0

CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin

Trend Research uncovered a campaign by the Russian threat actor Water Gamayun that exploits a zero-day vulnerability in the Microsoft Management Console framework to execute malicious code, named MSC EvilTwin (CVE-2025-26633).

Published: March 25, 2025

Linked vulnerabilities : CVE-2025-26633 (CVSS 7.0)

Downloadable IOCs: 58

Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns

A Windows .lnk file vulnerability, ZDI-CAN-25373, has been extensively exploited by state-sponsored and cybercriminal groups. The vulnerability allows hidden command execution through crafted shortcut files, exposing organizations to data theft and cyber espionage risks. Nearly 1,000 malicious .lnk…

Published: March 18, 2025

Downloadable IOCs: 851

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

A zero-day vulnerability in 7-Zip (CVE-2025-0411) was exploited by Russian cybercrime groups to target Ukrainian organizations. The vulnerability allows bypassing Windows Mark-of-the-Web protections through double archiving, enabling execution of malicious content. The campaign involved spear-phish…

mark-of-the-web bypass

Published: February 4, 2025

Downloadable IOCs: 0

From Credit Card Skimming to Exploiting Zero-Days

XE Group, a cybercriminal organization active since 2013, has evolved from credit card skimming to exploiting zero-day vulnerabilities. The group initially focused on web vulnerabilities and supply chain attacks but has now shifted to targeted information theft in manufacturing and distribution sec…

Published: February 3, 2025

Linked vulnerabilities : CVE-2024-57968 (CVSS 9.9), CVE-2025-25181 (CVSS 5.8), CVE-2019-18935, CVE-2017-9248

Downloadable IOCs: 17

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

A recent campaign targeting Fortinet FortiGate firewall devices with exposed management interfaces has been observed. The threat actors gained unauthorized access to the firewalls' administrative controls, created new accounts, established SSL VPN connections, and made various configuration changes…

zero-day

lateral movement

fortigate

vulnerability scanning

Published: January 11, 2025

Downloadable IOCs: 0

New Cleo zero-day RCE flaw exploited in data theft attacks

A critical zero-day vulnerability in Cleo's managed file transfer software is being actively exploited by hackers to breach corporate networks and steal data. The flaw affects Cleo LexiCom, VLTrader, and Harmony products, allowing unrestricted file upload and downloads leading to remote code execut…

Published: December 11, 2024

Downloadable IOCs: 0

Potential ZERO-DAY, Attackers Use Corrupted Files to Evade Detection

A sophisticated ongoing attack has been discovered that evades antivirus software, prevents sandbox uploads, and bypasses Outlook's spam filters. The attackers deliberately corrupt files to conceal their type, making detection difficult for security tools. These corrupted files, often identified as…

Published: December 4, 2024

Downloadable IOCs: 6

Chinese hackers exploit Fortinet VPN zero-day to steal credentials

Chinese threat actors, known as BrazenBamboo, are exploiting a zero-day vulnerability in Fortinet's FortiClient Windows VPN client to steal credentials. The hackers use a custom post-exploitation toolkit called DeepData, which includes a FortiClient plugin to extract usernames, passwords, and VPN s…

Published: November 18, 2024

Downloadable IOCs: 0

Weaponizing FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA

A Chinese state-affiliated threat actor, BrazenBamboo, has exploited a zero-day vulnerability in Fortinet's Windows VPN client to steal user credentials. The vulnerability allows extraction of login information from the FortiClient process memory. BrazenBamboo uses two malware families: DEEPDATA, a…

Published: November 16, 2024

Downloadable IOCs: 0

Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails

A newly discovered vulnerability in Windows NT LAN Manager (NTLM) has been exploited by suspected Russian hackers in cyber attacks against Ukraine. The flaw, identified as CVE-2024-43451, allows attackers to steal NTLMv2 hashes through minimal user interaction with malicious files. The exploit chai…

Published: November 14, 2024

Downloadable IOCs: 24

The Good, the Bad and the Ugly in Cybersecurity - Week 43

CISA proposes new security measures to protect sensitive data from adversary nations, following President Biden's Executive Order. A free file recovery tool for early Mallox ransomware victims is released. A novel macOS ransomware, macOS.NotLockBit, is discovered abusing AWS S3 for data exfiltratio…

Published: October 25, 2024

Downloadable IOCs: 0

Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575)

A new threat cluster, UNC5820, has been observed exploiting a zero-day vulnerability in FortiManager appliances across multiple industries. The vulnerability allows unauthorized execution of arbitrary code or commands on vulnerable devices. The attackers staged and exfiltrated configuration data fr…

configuration-exfiltration

network-security

Published: October 24, 2024

Linked vulnerabilities : CVE-2024-47575 (CVSS 9.8)

Downloadable IOCs: 4

Lazarus APT steals cryptocurrency and user data via a decoy MOBA game

Lazarus APT launched a sophisticated attack campaign using a decoy MOBA game website to exploit a zero-day vulnerability in Google Chrome. The exploit allowed remote code execution and bypassed the V8 sandbox. The attackers used social engineering tactics on social media to promote the fake game, w…

Published: October 23, 2024

Linked vulnerabilities : CVE-2024-4947

Downloadable IOCs: 2

Unmasking CVE-2024-38178: The Silent Threat of Windows Scripting Engine

CVE-2024-38178 is a type confusion vulnerability in JScript9.dll, patched by Microsoft in August 2024. It allows bypassing the CVE-2022-41128 patch through incorrect JIT engine optimizations. APT37, a North Korean threat group, exploited this vulnerability in June 2024 against South Korean targets.…

remote code execution

Published: October 17, 2024

Downloadable IOCs: 0

Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112)

Check Point Research discovered threat actors leveraging novel techniques to execute malicious code on Windows systems by exploiting Internet Explorer's vulnerabilities. The attackers utilized specially crafted .url files that, when opened, would launch IE and visit attacker-controlled URLs. Additi…

Published: July 10, 2024

Linked vulnerabilities : CVE-2024-38112 (CVSS 7.5), CVE-2021-40444, CVE-2023-36025

Downloadable IOCs: 7

Uncovering Espionage Operations

This comprehensive analysis delves into the intricate tactics employed by a suspected China-nexus cyber espionage actor, UNC3886. The report unveils the group's sophisticated exploitation of zero-day vulnerabilities and their deployment of rootkits like REPTILE and MEDUSA for persistent system acce…

Published: June 24, 2024

Linked vulnerabilities : CVE-2023-20867, CVE-2022-41328, CVE-2022-22948, CVE-2023-34048, CVE-2022-42475

Downloadable IOCs: 39

Uncorking Old Wine: Zero-Day from 2017 + Loader in Unholy Alliance

An analysis uncovered a suspected malicious campaign targeting entities in Ukraine. The attack employed an old vulnerability from 2017, CVE-2017-8570, as the initial entry vector. The operation utilized a customized loader to deliver the Cobalt Strike Beacon payload. While the specific threat actor…

Published: April 29, 2024

Downloadable IOCs: 6

Tag: zero-day

Attack reports

Prolific Zero-Day Exploits Continue

Water APT Multi-Stage Attack Uncovered

New Commercial-Grade Android Spyware in Exploit Chain Targeting Samsung Devices

BRONZE BUTLER exploits Japanese asset management software vulnerability

How ForumTroll APT was linked to Dante spyware

Mem3nt0 mori – The Hacking Team is back!

Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors | Google Cloud Blog

Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors

Three Lazarus RATs coming for your cheese

WinRAR Directory Traversal & NTFS ADS Vulnerabilities (CVE-2025-6218 & CVE-2025-8088)

Paper Werewolf targets Russia with WinRAR zero-day vulnerability

Dissecting PipeMagic: Inside the architecture of a modular backdoor framework

ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises

ToolShell: An all-you-can-eat buffet for threat actors

Update WinRAR tools now: RomCom and others exploiting zero-day vulnerability

Observed Malicious Driver Use Associated with Akira SonicWall Campaign

Active Exploitation of SonicWall VPNs

SharePoint Zero-Day Exploit (ToolShell) - Network Infrastructure Mapping

Inside The ToolShell Campaign

Defending Against ToolShell: SharePoint's Latest Critical Vulnerability

SharePoint ToolShell | Zero-Day Exploited in-the-Wild Targets Enterprise Servers

SharePoint Vulnerabilities (CVE-2025-53770 & CVE-2025-53771): Everything You Need to Know

Operation RoundPress targeting high-value webmail servers

The Good, the Bad and the Ugly in Cybersecurity – Week 20

CVE-2025-32756: FortiVoice Zero-Day Exploit Alert

Marbled Dust leverages zero-day in Output Messenger for regional espionage

DslogdRAT Malware Installed in Ivanti Connect Secure

Two sides of the same coin

Exploitation of CLFS zero-day leads to ransomware activity

Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)

A Deep Dive into Water Arsenal and Infrastructure

Operation ForumTroll exploits zero-days in Google Chrome

CVE-2025-26633: How Water Gamayun Weaponizes MUIPath using MSC EvilTwin

Windows Shortcut Exploit Abused as Zero-Day in Widespread APT Campaigns

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

From Credit Card Skimming to Exploiting Zero-Days

Console Chaos: A Campaign Targeting Publicly Exposed Management Interfaces on Fortinet FortiGate Firewalls

New Cleo zero-day RCE flaw exploited in data theft attacks

Potential ZERO-DAY, Attackers Use Corrupted Files to Evade Detection

Chinese hackers exploit Fortinet VPN zero-day to steal credentials

Weaponizing FortiClient Vulnerability to Steal VPN Credentials via DEEPDATA

Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails

The Good, the Bad and the Ugly in Cybersecurity - Week 43

Investigating FortiManager Zero-Day Exploitation (CVE-2024-47575)

Lazarus APT steals cryptocurrency and user data via a decoy MOBA game

Unmasking CVE-2024-38178: The Silent Threat of Windows Scripting Engine

Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112)

Uncovering Espionage Operations

Uncorking Old Wine: Zero-Day from 2017 + Loader in Unholy Alliance