Find what you’re looking for
Browse everything
6,867 results in Threat Reports
.NET SOAPwn Flaw (2025): Remote Code Execution via Rogue WSDL
In December 2025, security researchers at WatchTowr Labs revealed the 'SOAPwn' vulnerability (CVE-2025-34392 and CVE-2025-13659) impacting .NET Framework applications, including Barracuda Service Center RMM and Ivanti Endpoint Manager. Exploiting unsafe Web Services Description Language (WSDL) imports and HTTP client proxies, attackers could achieve remote code execution and arbitrary file writes on affected enterprise-grade systems. The flaw enabled threat actors to upload web shells, execute PowerShell scripts, or exfiltrate NTLM credentials via rogue SMB shares, potentially compromising entire application environments. Despite responsible disclosure, Microsoft stated the vulnerability is an application-level issue, leaving many unpatched systems at risk—especially those using components now at end-of-life such as Umbraco 8. This incident underscores the widespread risks associated with dynamic SOAP and WSDL usage in legacy frameworks and highlights attackers' growing focus on exploiting insecure software supply chains and overlooked application behaviors. The public disclosure has intensified scrutiny of web service integrations and spurred new urgency around secure coding practices in software built atop widely adopted frameworks.
How the Shai-Hulud Worm Exposed npm’s Supply-Chain Weaknesses in 2024
In May 2024, the Shai-Hulud worm re-emerged in a sophisticated supply-chain attack targeting the npm ecosystem. Attackers compromised popular npm packages to inject malicious code capable of propagating to developer environments globally. Once installed via npm, the worm enabled lateral movement, credential theft, and unauthorized access, significantly elevating the risk for organizations relying on open-source JavaScript components. Detection lag and incomplete remediation allowed the campaign to impact a broad swath of organizations and developers. This incident marks a resurgence of highly automated supply-chain malware targeting open source software, mirroring broader industry concerns around software dependencies and third-party risk. Increased attacker automation and stealthy propagation tactics underscore the critical need for vigilant dependency management and advanced detection.
01flip Ransomware Strikes APAC Critical Infrastructure—Rust-Based Attacks Escalate
In June 2025, a financially motivated cybercrime group tracked as CL-CRI-1036 launched targeted ransomware attacks using a new cross-platform strain called 01flip—written in Rust—against select organizations in the Asia-Pacific region. Initial access appears to have been gained by exploiting known vulnerabilities in internet-facing applications, including CVE-2019-11580, followed by lateral movement and mass deployment of ransomware payloads across Windows and Linux systems. The attackers demanded payment in Bitcoin and posted evidence of stolen data on dark web forums, impacting at least one critical infrastructure operator and resulting in operational disruption and data exposure. This incident highlights the rapid evolution of ransomware, with threat actors increasingly adopting modern development languages for advanced evasion. The emergence of 01flip demonstrates the ongoing risk posed by zero-day exploitation, inadequate segmentation, and cross-platform malware, underscoring the need for organizations to prioritize proactive threat detection and incident response capabilities.
Russian State-Backed Cyberattack Hits US Critical Infrastructure: Lessons from 2024
In 2024, U.S. authorities charged Ukrainian national Victoria Dubranova for her alleged involvement in Russian state-sponsored cyberattacks targeting critical infrastructure across the U.S. and allied nations. Dubranova is accused of collaborating with CyberArmyofRussia_Reborn (CARR) and NoName057(16), groups funded by Russian entities, to launch coordinated distributed denial of service (DDoS) and destructive intrusions. The attacks compromised water systems, food processing facilities, government bodies, and nuclear regulatory sites, resulting in water system sabotage, meat contamination, and emergency evacuations. Investigations revealed evolving tactics and recruitment methods, including custom malware (DDoSia) and incentivized hacktivist participation. This case underscores the escalating threat from state-backed cybercriminals targeting operational technology and essential services. As hacktivists innovate with new tools and social engineering, the risk to public utilities remains severe, prompting a regulatory and industry emphasis on network segmentation, reduced internet exposure, and proactive cyber defense.
Opportunistic Pro-Russia Hacktivist Attacks on Critical Infrastructure (2025)
In May and December 2025, joint advisories from CISA, FBI, NSA, Department of Energy, and international partners highlighted a surge in opportunistic attacks on US and global critical infrastructure mounted by pro-Russia hacktivist groups such as Cyber Army of Russia Reborn, Z-Pentest, NoName057(16), and Sector16. These actors leveraged poorly secured, internet-facing Virtual Network Computing (VNC) connections to infiltrate operational technology (OT) systems, targeting assets ranging from water treatment plants to energy and pipeline operators. The attacks, while generally less sophisticated than those carried out by advanced persistent threat (APT) groups, resulted in varying degrees of impact including service disruptions and, in some cases, physical damage to critical assets. This campaign reflects a growing trend of hacktivist groups exploiting low-hanging vulnerabilities in OT environments, often amplifying their impact through sensationalist or exaggerated public claims. The continued prevalence of exposed VNC devices and basic authentication weaknesses underscores the importance for asset owners and operators to harden access, enforce strong authentication, and monitor for anomalous activities to combat evolving hacktivist TTPs.
North Korean Threat Actors Weaponize React2Shell to Deploy Stealthy EtherRAT in 2025 Supply Chain Campaign
In late 2025, North Korea-linked threat actors exploited the critical React2Shell (CVE-2025-55182) vulnerability in React Server Components to deploy an advanced remote access trojan named EtherRAT. The campaign, tracked under 'Contagious Interview', targeted blockchain and Web3 developers through sophisticated social engineering on platforms such as LinkedIn, Upwork, and GitHub. Attackers leveraged a fake recruitment ruse, ultimately delivering EtherRAT via malicious scripts. The malware exhibits persistent mechanisms across Linux environments, utilizes Ethereum smart contracts for resilient C2, and aggressively evades detection with self-updating, obfuscated payloads. This attack demonstrates how advanced actors are increasingly adapting novel supply chain and social engineering tactics to target cloud-native developer ecosystems. The incident foreshadows a shift in the threat landscape, underlining the urgent need for robust east-west traffic controls, zero trust segmentation, and advanced anomaly detection for organizations exposed to modern DevOps and open-source risks.
Ransomware Reimagined: Attackers Deploy Their Own QEMU VM for Stealth and Persistence
In early 2025, a sophisticated ransomware incident was revealed by Red Canary Intelligence when an adversary launched a coordinated attack combining email bombing, social engineering, and abuse of legitimate remote access tools. Initially, victims endured email inundation designed to cause confusion and open the door to a convincing technical support ruse. Leveraging remote assistance software, attackers deployed a custom QEMU virtual machine (VM) into the compromised environment—a novel method for persistent access. Within this VM, tools such as Sliver C2, QDoor backdoor, and ScreenConnect enabled internal reconnaissance, lateral movement, and external command and control, all while evading conventional endpoint security controls. This incident is noteworthy for both its multi-layered attack chain and the adversary’s use of their own pre-configured VM for persistence, representing a shift toward virtualization-based evasion and resilience. The detection highlights a rise in blended attacks using social engineering, legitimate tools, and bespoke infrastructure, stressing the importance of defense-in-depth and advanced anomaly detection capabilities.
SAP’s December 2023 Patch: Three Critical Vulnerabilities Explained
In December 2023, SAP released security updates that addressed 14 vulnerabilities across several of its products, three of which were rated as critical. The most severe flaws affected fundamental SAP systems such as ABAP and NetWeaver, with CVSS scores as high as 9.9, potentially allowing attackers to execute unauthorized actions, access sensitive data, or disrupt business operations. The vulnerabilities could be exploited remotely, and patching delays threatened core business processes of organizations running SAP in enterprise and cloud environments. No active exploitation was publicly reported at disclosure, but SAP strongly urged immediate patching to mitigate risk. This incident highlights the persistent risks associated with complex enterprise application platforms widely used across industries. With attackers increasingly targeting software supply chains and critical business infrastructure, timely patch management and continuous vulnerability monitoring in environments like SAP remain essential to maintaining regulatory compliance and business continuity.
CISA Flags New High-Risk Vulnerabilities in 2025 KEV Catalog
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited vulnerabilities—CVE-2025-6218 (RARLAB WinRAR Path Traversal) and CVE-2025-62221 (Microsoft Windows Use After Free)—to its Known Exploited Vulnerabilities (KEV) Catalog. These critical flaws are utilized by cyber attackers to gain unauthorized access, facilitate lateral movement, and potentially execute arbitrary code within federal and enterprise environments. CISA’s directive mandates that all Federal Civilian Executive Branch (FCEB) agencies remediate these vulnerabilities by specified dates to mitigate significant risk, reinforcing the growing threat from rapid exploitation of newly discovered CVEs. This incident illustrates the ongoing challenges faced by organizations, as adversaries increasingly exploit widely used software at scale. The timely identification and remediation of KEV Catalog vulnerabilities are vital for maintaining strong security postures amid an uptick in exploitation and regulatory pressure to close known gaps.
US Treasury Highlights $4.5B in Ransomware Payments: 2024 Threat Landscape
In February 2024, the US Treasury’s Financial Crimes Enforcement Network (FinCEN) reported that ransomware attacks have resulted in over $4.5 billion in ransom payments since 2013, underscoring a dramatic surge in both scale and sophistication. Attackers typically infiltrated organizations through phishing campaigns, exploitation of unpatched vulnerabilities, and compromised remote desktop protocols, deploying ransomware variants to encrypt data and demand payment. These incidents disrupted critical business operations across sectors, forced enterprises to halt services, and left many struggling with reputational and financial damage. This report is especially relevant as ransomware strains evolve, facilitating large-scale attacks on enterprises, healthcare, and infrastructure. Heightened regulatory scrutiny, such as OFAC and FinCEN advisories, means organizations face intensified pressure to monitor, report, and prevent ransomware-related activities.
U-Boot Bootloader Flaw Threatens Global Manufacturing and Critical Infrastructure
In December 2025, a critical vulnerability (CVE-2025-24857) was disclosed in U-Boot, a widely-used bootloader for embedded systems, impacting all versions prior to 2017.11 and several Qualcomm chipsets. The flaw—improper access control for volatile memory containing boot code—allowed an attacker with local access to execute arbitrary code at boot, posing significant risk to devices across essential sectors including energy, communications, manufacturing, healthcare, and more. No active exploitation has been reported, but the vulnerability could undermine device integrity and operational security in globally deployed critical infrastructure systems. Mitigations include upgrading to the latest U-Boot version and implementing strict physical and network isolation measures. This incident underlines the persistent risk posed by supply chain and firmware vulnerabilities in critical infrastructure. With IoT and embedded device ubiquity rising, attackers are increasingly targeting low-level firmware to achieve persistence or bypass security, heightening regulatory scrutiny and emphasizing the need for proactive vulnerability management and secure device lifecycle practices.
React2Shell: Exploitation Surge Hits Businesses in 2025
In June 2025, attackers began widespread exploitation of CVE-2025-55182, a critical vulnerability known as React2Shell, shortly after it was publicly disclosed. Threat actors rapidly leveraged the unauthenticated remote code execution flaw to gain access to vulnerable web servers running the React2Shell component, allowing lateral movement, data exfiltration, and in some cases, ransomware deployment. The initial wave targeted a range of businesses, exploiting the window between disclosure and patch adoption, thus exposing organizations to operational disruption and compliance risks. The surge in React2Shell exploitation underscores an ongoing trend: cybercriminals are taking advantage of zero-day and recently publicized vulnerabilities with renewed speed and sophistication. Security teams must deal with shrinking patch windows, automated exploit tools, and increasing pressure from regulators to secure internet-facing applications.