Weekly Threat Landscape Digest – Week 16

1. High-Severity Vulnerabilities in F5 BIG-IP (CVE-2025-21091, CVE-2025-20058)

F5 has disclosed two high-severity vulnerabilities impacting BIG-IP systems, which could lead to system performance degradation and potential denial-of-service (DoS) conditions. These issues affect both the control and data planes under specific configurations, and successful exploitation may disrupt network traffic and require manual recovery.

Key Details:

• CVE-2025-21091 – SNMP Service Vulnerability
  → CVSS Score: 8.7 (High)
  → Triggered when SNMP v1/v2c is disabled and specific SNMP requests are received
  → Results in memory overutilization and system slowdown until snmpd is restarted
  → Affects control plane; may indirectly affect data plane performance
• CVE-2025-20058 – Message Routing Vulnerability
  → CVSS Score: 8.9 (High)
  → Caused by specific traffic patterns on virtual servers using message routing profiles
  → Results in memory exhaustion in the Traffic Management Microkernel (TMM)
  → Data plane issue only; leads to DoS

Impact:

• System performance degradation
• Denial-of-service conditions
• Manual intervention required to restore operations
• Disrupted availability of services

Affected Versions:

• 17.x: 17.1.0 – 17.1.1
• 16.x: 16.1.0 – 16.1.5
• 15.x: 15.1.0 – 15.1.10

Fixed Versions:

• 17.x: 17.1.2
• 16.x: 16.1.6 (Hotfix-BIGIP-16.1.5.2.0.7.5-ENG.iso)
• 15.x: Hotfix-BIGIP-15.1.10.6.0.11.6-ENG.iso

Recommendations:

• Upgrade to the fixed versions released by F5
• Apply mitigation steps if immediate patching is not feasible
• Monitor systems for signs of memory exhaustion or degraded traffic processing

Reference:

• https://my.f5.com/manage/s/article/K000140933
• https://my.f5.com/manage/s/article/K000140947

2. Fortinet Devices Exploited via Symbolic Link Vulnerability in SSL-VPN (Post-Exploitation Persistence)

Fortinet has disclosed a new post-exploitation technique used by threat actors to maintain persistent access to FortiGate devices through symbolic link abuse in the SSL-VPN component. Even after patching known vulnerabilities, attackers were able to bypass detection and retain access.

Key Details:

• Technique: Creation of a symbolic link in the SSL-VPN language directory linking to root filesystem
• Impact: Persistent unauthorized access to configuration files even after patching
• Exploited CVEs: FG-IR-22-398, FG-IR-23-097, FG-IR-24-015
• Affected Devices: Only FortiGate devices with SSL-VPN enabled
• Attack Vector: Post-compromise; leverages unpatched or previously compromised systems
• Detection: Avoided by placing links in a trusted path serving language files

Impact:

• Configuration file exposure
• Long-term unauthorized access
• High stealth due to evasion of standard detection methods

Mitigation and Recommendations:

1. Update FortiOS Immediately
   → Recommended versions: 7.6.2, 7.4.7, 7.2.11, 7.0.17, or 6.4.16
   → These include prevention against symbolic link creation and detection/removal mechanisms
2. Treat Affected Systems as Compromised
   → Review all configurations
   → Follow Fortinet’s recovery guidance
3. Enable and License AV/IPS
   → Automatically detects malicious symbolic links
   → Enables virtual patching until updates are applied
4. Harden Systems
   → Disable unused features like SSL-VPN
   → Conduct frequent audits and log reviews
5. Adopt Cyber Hygiene Practices
   → Maintain a rigorous patching schedule
   → Monitor Fortinet advisories and threat intelligence feeds
6. Use New Security Features
   → Compile-time hardening
   → BIOS-level firmware validation
   → Filesystem integrity monitoring via IMA

Reference:

• https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity

3. Apple Emergency Security Updates for Actively Exploited Zero-Day Vulnerabilities (CVE-2025-31200 & CVE-2025-31201)

Apple has released urgent security updates across all platforms—iOS, iPadOS, macOS, tvOS, and visionOS—to patch two zero-day vulnerabilities that have been actively exploited in targeted attacks. The flaws, discovered with Google TAG, impact high-profile individuals and allow remote code execution and PAC bypass on Apple Silicon.

Key Details:

• CVE-2025-31200 – Remote Code Execution in CoreAudio
  → Exploited via crafted audio streams in media files
  → No user interaction required
  → Platforms affected: iOS, macOS, iPadOS, tvOS, visionOS
  → Risk: Device takeover, espionage, surveillance
• CVE-2025-31201 – Pointer Authentication Code Bypass in RPAC
  → Enables privilege escalation on Apple Silicon (M1, M2, M3, A-series)
  → Used for stealthy persistence and advanced memory exploitation
  → Platforms affected: All Apple Silicon devices
  → Risk: Long-term compromise and undetectable attacks

Affected Products:

• iPhones/iPads: iPhone XS and later, iPad Pro 3rd gen+, iPad Air 3rd gen+, iPad 7th gen+, iPad mini 5th gen+
• macOS: Devices running macOS Sequoia
• tvOS: Apple TV HD, Apple TV 4K (all models)
• visionOS: Apple Vision Pro

Fixed Versions:

• iOS / iPadOS: 18.4.1
• macOS Sequoia: 15.4.1
• tvOS: 18.4.1
• visionOS: 2.4.1

Recommendations:

• Update immediately to the fixed versions across all Apple platforms
• Enforce patching via MDM systems in enterprise environments
• Review device behavior and access logs for signs of targeted compromise
• Educate high-risk users (e.g., executives, journalists) about this threat

References:

• https://support.apple.com/en-us/122282
• https://support.apple.com/en-us/122402
• https://support.apple.com/en-us/122401
• https://support.apple.com/en-us/122400

4. Oracle April 2025 Critical Patch Update Addresses 378 Vulnerabilities Across Multiple Products

Oracle has released its April 2025 Critical Patch Update (CPU) addressing 378 new vulnerabilities across a broad range of its products. Several of the vulnerabilities are rated critical (CVSS ≥ 9.8) and are remotely exploitable without authentication. Organizations using Oracle technologies are strongly advised to apply patches immediately to avoid exploitation, especially for unpatched legacy systems which continue to be a frequent target.

Key Details:

• Total Patches Released: 378
• Critical Vulnerabilities: Multiple (CVSS scores ≥ 9.8)
• Exploitability: Several issues exploitable remotely without authentication
• Attack Context: Oracle notes continued exploitation of older CVEs in unpatched systems

Notable Affected Product Categories:

• Oracle Database Server (19c, 21c, 23c)
• MySQL Server & Related Tools (MySQL Shell, Connectors, Workbench, Enterprise Backup)
• Oracle WebLogic Server, SOA Suite, WebCenter, HTTP Server
• Oracle Financial Services, E-Business Suite, JD Edwards, PeopleSoft, Fusion Middleware
• Oracle Communications Suite, including SBCs, BRMs, Policy Management, MetaSolv
• Primavera, Essbase, Java SE, GraalVM, GoldenGate, VirtualBox, and many others

Recommendations:

• Review Oracle’s April 2025 CPU in detail to identify impacted components in your environment
• Prioritize patching for internet-facing and business-critical applications
• Apply patches immediately using a phased and tested approach to minimize downtime
• Monitor system logs and alerts for unusual activity post-patching
• Retire or isolate legacy systems that cannot be updated

Reference:

• https://www.oracle.com/security-alerts/cpuapr2025.html

5. Critical Vulnerabilities in Unsupported Drupal Modules Pose Site Takeover Risk

Several Drupal contributed modules have been flagged as unsupported due to unresolved critical security vulnerabilities. Continued use of these modules places websites at significant risk of full compromise, data breaches, or service disruption.

Affected Modules and CVEs:

• Panelizer (obsolete)
  • CVE-2025-3735
  • This module has unresolved security issues and is no longer maintained.
  • Action: Uninstall immediately.
• Simple GTM
  • CVE-2025-3736
  • Contains known vulnerabilities and is marked unsupported.
  • Action: Uninstall immediately.
• Google Maps: Store Locator
  • CVE-2025-3737
  • Remains unpatched and poses a critical risk.
  • Action: Uninstall immediately.
• Google Optimize
  • CVE-2025-3738
  • Security flaws are unresolved; the project is unsupported.
  • Action: Uninstall immediately.
• Drupal 8 Google Optimize Hide Page
  • CVE-2025-3739
  • This module is unmaintained and vulnerable.
  • Action: Uninstall immediately.

Recommendations:

• Audit your Drupal websites for the presence of these unsupported modules.
• Uninstall any affected modules immediately.
• Replace deprecated modules with actively maintained alternatives.

References:

• https://www.drupal.org/sa-contrib-2025-036
• https://www.drupal.org/sa-contrib-2025-037
• https://www.drupal.org/sa-contrib-2025-038
• https://www.drupal.org/sa-contrib-2025-039
• https://www.drupal.org/sa-contrib-2025-040

6. Critical Google Chrome Security Update Fixes Heap Overflow and Use-After-Free Vulnerabilities

Google has released a critical security update for Chrome to address two high-severity vulnerabilities, one of which is rated Critical. These flaws could allow attackers to execute arbitrary code and potentially take full control of vulnerable systems.

Vulnerabilities Addressed:

CVE-2025-3619 – Heap Buffer Overflow in Codecs

• Severity: Critical
• Impact: Arbitrary code execution, potential system compromise
• Details: A heap buffer overflow in Chrome’s codecs component could allow memory to be overwritten, enabling remote code execution. This vulnerability poses a high risk and should be patched immediately.

CVE-2025-3620 – Use-After-Free in USB

• Severity: High
• Impact: Arbitrary code execution
• Details: This use-after-free vulnerability in the USB subsystem can be exploited after memory has been freed, potentially allowing execution of malicious code in the browser context.

Fixed Versions:

• Windows/Mac: Chrome 135.0.7049.95/.96
• Linux: Chrome 135.0.7049.95

Recommendations:

• Update Google Chrome to the latest stable version immediately.
• Ensure automatic updates are enabled to receive future security patches.
• Monitor browser versioning across managed devices and apply patch compliance policies.

Reference:

• https://chromereleases.googleblog.com/2025/04/stable-channel-update-fordesktop_15.html

7. Remote Code Execution Vulnerability in Cisco Webex App (CVE-2025-20236)

A high-severity Remote Code Execution (RCE) vulnerability has been disclosed in the Cisco Webex App, allowing unauthenticated attackers to execute arbitrary commands on user devices through specially crafted malicious meeting invite links. Although there is no confirmation of active exploitation in the wild, the vulnerability has a CVSS score of 8.8 and poses significant risk.

Vulnerability Overview:

• CVE ID: CVE-2025-20236
• Severity: High
• CVSS v4.0: 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
• Attack Vector: Remote
• Exploit Type: Client-side RCE via crafted URL
• Exploit Mechanism:
  Attackers craft a malicious Webex meeting invite URL. When a victim clicks the link, it initiates a file download and executes malicious content due to insufficient input validation in the Webex app’s custom URL parser (CWE-829).

Impact:

• Remote code execution under the user’s privileges
• Possibility of malware installation, data exfiltration, and lateral movement

Affected Versions:

• Not Vulnerable: Versions 44.5 and earlier, 44.8 and later
• Vulnerable: Versions 44.6 and 44.7
• Fixed Version: 44.6.2.30589 (for 44.6 series)

Recommendations:

• Update the Cisco Webex App to the latest fixed version immediately
• Avoid clicking unknown or suspicious Webex meeting links
• Train users to recognize phishing attempts that may leverage this vulnerability

Reference:

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-client-rce-ufyMMYLC 

8. Critical Privilege Escalation Vulnerability in Argo Events (CVE-2025-32445)

A critical vulnerability (CVSS 10.0) has been identified in Argo Events, a Kubernetes-native event-driven workflow automation framework. The flaw allows users with access to Argo custom resources (CRs) to escalate privileges, potentially leading to full cluster or host compromise.

Vulnerability Overview:

• CVE ID: CVE-2025-32445
• Severity: Critical
• CVSS Score: 10.0
• Component Affected: Argo Events – EventSource and Sensor Custom Resources
• Exploit Mechanism:
  Users with permissions to create or edit EventSource or Sensor CRs can manipulate the spec.template and spec.template.container fields to:
  • Enable privileged mode
  • Add dangerous Linux capabilities
  • Mount sensitive host file systems

Impact:

• Privilege escalation to host and cluster level
• Bypass of RBAC and Pod Security Policies
• Breach of tenant isolation in multi-tenant Kubernetes clusters
• Unauthorized access to data belonging to other tenants
• Full host compromise

Affected Versions:

• Argo Events versions prior to v1.9.6

Fixed Version:

• v1.9.6 and later

Recommendations:

• Upgrade Argo Events to v1.9.6 or newer immediately
• Review and restrict permissions to create or modify Argo CRs
• Implement strict RBAC policies to limit access to EventSource/Sensor resources
• Audit existing configurations for misuse of spec.template fields

Reference:

• https://github.com/argoproj/argo-events/security/advisories/GHSA-hmp7-x699-cvhq

9. Critical Session Management Vulnerability in Apache Roller (CVE-2025-24859)

A critical vulnerability has been discovered in Apache Roller, a widely used Java-based blogging platform. Tracked as CVE-2025-24859 with a CVSS v4 score of 10.0, this flaw arises from insufficient session expiration after a password change, allowing continued access to user accounts even after credentials have been updated.

Vulnerability Overview:

• CVE ID: CVE-2025-24859
• Severity: Critical
• CVSS Score: 10.0
• Affected Versions: Apache Roller 1.0.0 to 6.1.4
• Fixed Version: Apache Roller 6.1.5 and above

Impact:

• Active sessions remain valid even after a user or administrator changes the account password.
• Attackers with a valid session token can maintain access post-password change, undermining remediation efforts during incident response.
• Potential for persistent unauthorized access and continued compromise of user accounts.

Resolution:

• Apache addressed the issue in version 6.1.5 by implementing centralized session management that automatically invalidates all sessions when passwords are changed or accounts are disabled.

Recommendations:

1. Upgrade Immediately:
   • Update all Apache Roller instances to version 6.1.5 or later.
   • Ensure previous versions are completely removed and replaced.
2. Audit Sessions:
   • Review current user sessions for anomalies or signs of misuse.
   • Log out all active sessions post-upgrade as a precautionary measure.

Reference:

• https://lists.apache.org/thread/4j906k16v21kdx8hk87gl7663sw7lg7f

10. Security Updates Released for Adobe Products – April 2025

Adobe has released security updates addressing multiple critical vulnerabilities in ColdFusion and other widely used products. These flaws could allow attackers to execute arbitrary code, perform unauthorized file reads, and bypass security features—posing a significant risk to affected systems.

ColdFusion Vulnerabilities:

The April 2025 ColdFusion update resolves 11 critical vulnerabilities, including:

• CVE-2025-24446 – Improper input validation → Arbitrary file system read (CVSS 9.1)
• CVE-2025-24447 – Deserialization of untrusted data → Arbitrary code execution (CVSS 9.1)
• CVE-2025-30281 – Improper access control → Arbitrary file system read (CVSS 9.1)
• CVE-2025-30282 – Improper authentication → Arbitrary code execution (CVSS 9.1)
• CVE-2025-30284 / 30285 – Deserialization of untrusted data → Code execution (CVSS 8.0)
• CVE-2025-30286 / 30289 – OS command injection → Code execution (CVSS 8.0 / 7.5)
• CVE-2025-30287 – Improper authentication → Code execution (CVSS 8.1)
• CVE-2025-30288 – Access control flaw → Security feature bypass (CVSS 7.8)
• CVE-2025-30290 – Path traversal → Security feature bypass (CVSS 8.7)

Patched Versions:

• ColdFusion 2021 Update 19
• ColdFusion 2023 Update 13
• ColdFusion 2025 Update 1

Other Adobe Product Vulnerabilities:

Additional security fixes have been released for various Adobe applications to resolve heap-based buffer overflows and out-of-bounds write issues that could lead to arbitrary code execution.

• After Effects: CVE-2025-27182, CVE-2025-27183
• Media Encoder: CVE-2025-27194, CVE-2025-27195
• Bridge: CVE-2025-27193
• Premiere Pro: CVE-2025-27196
• Photoshop: CVE-2025-27198
• Animate: CVE-2025-27199
• FrameMaker: CVE-2025-30304, CVE-2025-30297, CVE-2025-30295

Recommendations:

• Immediately apply all available Adobe security patches.
• Audit affected applications and verify successful update deployment.
• Monitor systems for signs of unauthorized access or unusual behavior.
• Limit network exposure for Adobe services where possible.

Reference:

• https://helpx.adobe.com/security/security-bulletin.html

11. Multiple Vulnerabilities in CrushFTP (CVE-2025-32102, CVE-2025-32103)

Two critical vulnerabilities have been disclosed in CrushFTP, a popular file transfer server. These flaws can be exploited to perform Server-Side Request Forgery (SSRF) and Directory Traversal attacks, which may result in unauthorized access to internal services and sensitive files.

CVE-2025-32102 – Server-Side Request Forgery (SSRF)

• Location: /WebInterface/function/ URI
• Vulnerable Parameter: command=telnetSocket with crafted host and port
• Impact: Allows attackers to make arbitrary requests from the CrushFTP server to internal or external systems.
• Consequence: Enables internal network scanning and access to services not normally exposed.

CVE-2025-32103 – Directory Traversal via UNC Paths

• Location: /WebInterface/function/ URI
• Vulnerable Parameter: command=getAdminXMLListing with unsanitized path input
• Impact: Allows injection of UNC paths (e.g., \\server\share)
• Consequence: Attackers can enumerate remote network shares and access file listings, bypassing SecurityManager protections.

Affected Versions:

• CrushFTP 9.x
• CrushFTP 10.x up to and including 10.8.4
• CrushFTP 11.x up to and including 11.3.1

Mitigation:

• Update CrushFTP to the latest patched version provided by the vendor.
• Audit logs for suspicious access attempts or abnormal internal requests.
• Restrict network access to CrushFTP servers to minimize exposure.

Reference:

• https://seclists.org/fulldisclosure/2025/Apr/17

12. Privilege Persistence Vulnerability in PyPI Organizations Feature

A security flaw has been addressed in the Python Package Index (PyPI) affecting its Organizations feature. The vulnerability allowed user privileges to persist even after being removed from an organization, posing a risk of unauthorized access to package management functions.

Vulnerability Details

• Type: Improper Access Control / Privilege Persistence
• CVE ID: Not assigned
• Discovery Date: April 14, 2025
• Root Cause: Incomplete revocation of team-level permissions during user removal operations
• Introduced On: April 20, 2023 (with the launch of the Organizations feature)
• Impact: Potential unauthorized access to actions such as:
  • Uploading/deleting packages
  • Modifying team memberships

Exposure and Response

• Real-World Instances: Two instances identified
• Exploitation: No evidence of malicious activity or abuse
• Mitigation Actions:
  • Hotfix deployed immediately
  • Public patch issued with transparent PR
  • Comprehensive audit completed
  • All affected users notified

Recommendations

• Audit Privileges Regularly: Ensure that user roles and access rights are updated immediately after removal.
• Automate Revocation: Use automated workflows to enforce complete privilege cleanup.
• Monitor Access Logs: Set alerts for unusual permission usage or role escalation.
• Stay Updated: Subscribe to PyPI and open-source ecosystem advisories to respond to future issues proactively.

Reference

• https://blog.pypi.org/posts/2025-04-14-incident-report-organization-team-privileges/

13. Critical Vulnerabilities in ABB Arctic Wireless Gateways

Multiple critical vulnerabilities have been identified in ABB’s Arctic Wireless Gateways, particularly within the embedded Telit PLS62-W wireless modem. These flaws may allow remote attackers to execute code, escalate privileges, disclose sensitive information, or cause denial-of-service (DoS) conditions.

These systems are commonly deployed in critical infrastructure sectors, including Energy, increasing the urgency of patching and mitigation.

Key Vulnerabilities:

CVE-2024-6387 – OpenSSH Signal Handler Race Condition

• Severity: Critical (CVSS v4 Score: 9.2)
• Impact: Remote root code execution
• Attack Vector: Remote unauthenticated SSH
• Details: Exploits a race condition in OpenSSH’s signal handler on glibc-based systems to gain full system access.

CVE-2023-47610 – Buffer Overflow via SMS

• Severity: Critical (CVSS v4 Score: 9.2)
• Impact: Arbitrary code execution with elevated privileges
• Attack Vector: Remote via specially crafted binary SMS
• Details: A classic buffer overflow (CWE-120) vulnerability triggered by SMS messages.

Additional related CVEs include:
CVE-2023-47611, CVE-2023-47612, CVE-2023-47613, CVE-2023-47614, CVE-2023-47615, CVE-2023-47616

Affected Models:

• ARP600, ARC600, ARR600: Firmware versions 3.4.10 – 3.4.13
• ARG600, ARC600, ARR600: All versions with Telit PLS62-W module

Recommended Mitigation Measures:

1. For Modem Module Vulnerabilities (Binary SMS Exploits):

• Contact the mobile network provider to disable binary SMS on affected subscriptions.
• If SMS functionality is not required, disable SMS entirely.

2. For SSH Vulnerability:

• Use OpenVPN tunnels for remote access instead of exposing SSH.
• If SSH is necessary, restrict access only through VPN and keep the SSH port closed to the public internet.

3. Additional Best Practices:

• Use private cellular access points to limit exposure.
• Implement physical security for devices.
• Isolate these devices behind network firewalls and separate from general-purpose networks.
• Never connect programming devices to untrusted networks.
• Scan all imported data/media for malware.
• Apply all firmware, OS, and security patches.
• Ensure VPN solutions are up to date with the latest versions.
• Use up-to-date antivirus and firewall tools.

Reference:

https://search.abb.com/library/Download.aspx?DocumentID=2NGA002427&LanguageCode=en&DocumentPartId=pdf&Action=Launch 

14. Critical Vulnerability in Everest Forms WordPress Plugin

A critical vulnerability has been identified in the Everest Forms plugin for WordPress that could allow unauthenticated attackers to perform malicious actions, including file deletion or code execution under certain conditions.

Vulnerability Details

• CVE ID: CVE-2025-3439
• Severity: Critical (CVSS Score: 9.8)
• Type: PHP Object Injection
• Affected Versions: Everest Forms prior to v3.1.2
• Fixed Version: v3.1.2 and later

The flaw exists in how the plugin processes the field_value parameter, allowing attackers to inject PHP objects via unauthenticated requests. While Everest Forms does not include a known POP (PHP Object Payload) chain, exploitation becomes possible if other plugins or themes present on the site include such a chain.

Potential Impact

• Deletion of arbitrary files
• Disclosure of sensitive information
• Execution of arbitrary code (if a POP chain exists from other installed components)

Recommendations

• Update Immediately: Upgrade Everest Forms to version 3.1.2 or later.
• Audit WordPress Environment: Check for the presence of other vulnerable plugins or themes.
• Enhance Security: Apply a Web Application Firewall (WAF) and harden WordPress configurations.
• Monitor Logs: Review access logs for suspicious activity related to the field_value parameter.

Reference

• https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/everestforms/everest-forms-contact-form-quiz-survey-newsletter-payment-form-builder-forwordpress-311-unauthenticated-php-object-injection

15. Vulnerability in Apache SeaTunnel

A critical vulnerability has been disclosed in Apache SeaTunnel, a widely adopted distributed data integration platform, potentially allowing attackers to gain unauthorized access and execute remote code on affected systems.

Vulnerability Details

• CVE ID: CVE-2025-32896
• Severity: High
• Affected Versions: Apache SeaTunnel versions 2.3.1 through 2.3.10
• Fixed Version: 2.3.11

The flaw resides in a legacy REST API endpoint /hazelcast/rest/maps/submit-job. Attackers can exploit this endpoint by submitting malicious job configurations, injecting parameters into a MySQL connection URL to:

• Read arbitrary files from the server filesystem (e.g., credentials, configuration)
• Execute remote code via unsafe Java object deserialization

Potential Impact

• Unauthorized Data Access – Sensitive files can be read remotely
• Remote Code Execution – Full server control through Java deserialization
• Operational Disruption – Possible service outage, data corruption, or malware deployment

Recommendations

• Upgrade Immediately: Update to Apache SeaTunnel v2.3.11
• Disable Legacy API: Use restful api-v2 instead of v1
• Enforce Mutual TLS: Enable HTTPS two-way authentication to prevent unauthorized API access
• Audit Logs: Review logs for unauthorized access or suspicious job submissions

Reference

• https://lists.apache.org/thread/s2dw28t4p0q6t3k0qoqnm18t6pt04pyt

16. Heap Buffer Overflow Vulnerability in Perl

A heap buffer overflow vulnerability has been identified in multiple versions of the Perl programming language, potentially leading to denial-of-service (DoS) or, in less secure environments, arbitrary code execution.

Vulnerability Details

• CVE ID: CVE-2024-56406
• Severity: High (CVSS pending)
• Vulnerability Type: Heap Buffer Overflow
• Affected Versions: Perl 5.34, 5.36, 5.38, 5.40
• Fixed Versions: Perl 5.38.4, 5.40.2

The vulnerability arises from improper handling of non-ASCII characters within the tr/// transliteration operator. When processing crafted input, Perl may experience a segmentation fault.

Potential Impact

• Denial of Service (DoS): A segmentation fault can crash the application or system using Perl.
• Arbitrary Code Execution: In legacy or unprotected environments, the buffer overflow could be exploited for code execution.

Recommendations

• Upgrade Perl Immediately: Apply updates to Perl v5.38.4, v5.40.2, or the latest available secure release.
• Audit Usage: Review and test critical scripts or applications relying on Perl, especially if using transliteration operations.
• Harden Execution Environments: Apply memory protection mechanisms such as ASLR, DEP, or container isolation to reduce risk.

Reference

• https://nvd.nist.gov/vuln/detail/CVE-2024-56406

17. Vulnerabilities in Jenkins Docker Images

Two medium-severity vulnerabilities have been identified in Jenkins Docker images that could allow attackers to impersonate build agents, compromise pipeline integrity, and access sensitive build data.

Vulnerability Details

• CVE IDs: CVE-2025-32754 (jenkins/ssh-agent), CVE-2025-32755 (jenkins/ssh-slave)
• Severity: Medium
• Vulnerability Type: SSH Host Key Reuse
• Affected Images:
  • jenkins/ssh-agent up to and including 6.11.1
  • jenkins/ssh-slave all versions

The vulnerabilities arise from SSH host keys being generated during image build for Debian-based variants. This results in identical host keys across multiple containers, creating a critical weakness in secure communication.

Potential Impact

• Man-in-the-Middle Attacks: Intercept traffic between Jenkins controller and agent
• Agent Impersonation: Compromise CI/CD integrity by masquerading as a legitimate build agent
• Credential Theft and Code Injection: Steal secrets or inject malicious code into builds
• Unauthorized Access: Read or modify sensitive pipeline data

Recommendations

• Upgrade Immediately:
  • Use jenkins/ssh-agent version 6.11.2 or later
  • Replace jenkins/ssh-slave with supported alternatives
• Regenerate SSH Host Keys: For existing builds, manually regenerate SSH keys post-deployment
• Audit Pipelines and Access Logs: Investigate unusual agent behaviors or traffic
• Network Hardening: Use secure channels and mutual authentication between controller and agents

Reference

• https://www.jenkins.io/security/advisory/2025-04-10/

18. Stealthy Fileless VShell RAT Campaign by UNC5174 Targeting Linux Systems

A new cyber-espionage campaign attributed to Chinese state-sponsored threat group UNC5174 is actively targeting Linux systems using a fileless variant of the VShell Remote Access Trojan (RAT). This campaign demonstrates advanced evasion techniques and a tightly integrated, memory-resident malware architecture.

Key Threat Details

• Threat Actor: UNC5174 (Chinese state-affiliated)
• Malware Tools:
  • VShell RAT: Executes entirely in memory (fileless), mimics kernel threads (e.g., [kworker/0:2])
  • Snowlight Malware: Acts as the dropper, loads VShell using memfd_create
  • Sliver Toolkit: Used for post-exploitation
• Technique:
  • Payload never touches disk, avoiding detection by traditional endpoint security
  • C2 communication over WebSockets using HTTPS – encrypted and blends into normal traffic
• Initial Vector: Malicious bash scripts targeting Linux environments

Infrastructure

• C2 Domain Squatting Examples:
  • vs.gooogleasia[.]com
  • apib.googlespays[.]com
• Infrastructure hosted on: Google Compute Engine

Attack Goals

• Primary: Intelligence gathering on governments, think tanks, critical infrastructure
• Secondary: Selling access to compromised environments on dark web

Impact

• Stealthy persistence through memory-only execution
• Difficult attribution and replication due to heavy customization
• High evasion against endpoint detection tools

Detection & Mitigation

• Monitor Linux systems for:
  • Usage of memfd_create, fexecve
  • Abnormal large anonymous memory mappings
  • Hidden processes mimicking kernel threads
• Use behavioral detection rules (e.g., Sysdig Falco) to catch memory-based malware behaviors
• Inspect WebSocket traffic over HTTPS for unusual activity
• Block known spoofed domains and apply network-level detection for domain-squatting C2 patterns

Reference

• https://www.govinfosecurity.com/chinese-hackers-deploy-stealthy-fileless-vshell-rat-a-28012

19. Smishing Triad: Chinese Scam Syndicate Driving Global Phishing Surge

A Chinese-speaking cybercriminal syndicate, often referred to as the Smishing Triad, has emerged as a leading global operator of large-scale SMS-based phishing (smishing) campaigns. These highly coordinated operations involve impersonating postal services, financial institutions, and telecom providers to steal personal and financial information from unsuspecting victims.

Key Threat Details

• Threat Group: Smishing Triad (linked to multiple Chinese-speaking phishing-as-a-service operators)
• Tactics:
  • Use of SMS, iMessage, and RCS for fake delivery notifications or toll fee scams
  • Victims are lured into phishing websites to enter personal and financial information
  • Use of fraudulent Apple iCloud accounts and digital wallets to clone stolen card data

Attack Infrastructure

• Domains: ~200,000 domains registered, including:
  • Top-level domains like .top, .vip, .world
  • Impersonation of Apple, USPS, and tax authorities
• Software Tools:
  • Lighthouse platform used for managing stolen card and identity data
  • Constantly updated phishing kits, sold to other actors

Techniques

• Credential Harvesting: Victims are prompted to submit OTPs, which are used to add cards to Apple Pay or Google Wallet
• Card Aging Strategy: Initially waited up to 90 days before misuse, now cards are often used within a few days
• Telegram Channels: Used to showcase added cards and manage operations
• Fake websites mimic legitimate portals and trick users into real-time credential submission

Operational Scale

• Active in 121+ countries
• 1M+ hits on phishing pages over a 20-day period (Silent Push report)
• Targets include PayPal, Visa, Mastercard, Stripe, and Australian banks

Risks

• Identity theft and financial fraud
• Bypassing traditional fraud detection with encrypted, fast transactions through digital wallets
• Scalable phishing-as-a-service model enables rapid global expansion

Detection & Mitigation

• Monitor and block known phishing domains used by Smishing Triad
• Educate users about SMS-based scams and how to identify suspicious links
• Enable real-time fraud detection for OTP misuse and digital wallet pairing attempts
• Law enforcement and telecom providers urged to disrupt bulk SMS infrastructure and domain registration abuse

Reference

• https://www.wired.com/story/smishing-triad-scam-group/

20. Server-Side Phishing Campaign Targets Employee and Healthcare Portals

An ongoing phishing campaign has adopted server-side credential validation techniques to evade traditional detection mechanisms. The campaign primarily targets employee and member login portals of major U.S. organizations, including Aramark, Highmark, and state unemployment systems.

Key Threat Details

• Technique: Server-side phishing with PHP-based kits
• Initial Targets: Employee portals (e.g., Aramark’s MyAccess, Oregon Employment Department, Highmark)
• Observed Behavior:
  • Credentials sent to xxx.php, processed via check.php
  • Mimics legitimate SSO flow to appear authentic
  • Redirection occurs only after OTP is validated (in advanced variants)

Notable Features

• Credential theft via cloned login pages under /online paths
• Use of Cloudflare for DNS protection and obfuscated IP hosting
• Server-side logic reduces visibility to analysts and detection tools
• Some phishing kits simulate 2FA workflows with fake OTP validation
• Collected credentials likely reused or sold via underground channels

Advanced Indicators

• Use of localStorage to hold usernames across phishing sessions
• JavaScript polling behavior (check.php) to validate credentials without user redirection
• POST data using type=3 parameter to collect 2FA OTPs
• Redirects only if msg == “success2″—a sign of successful phishing

Impact

• Credential theft with server-side exfiltration
• Bypass of 2FA protections via simulated OTP flows
• Targeting of multiple industries including healthcare, HR, telecom, and state services

Recommendations

• Monitor for POST requests to xxx.php, check.php, and /online directories
• Detect type=3 in payloads as indicators of OTP harvesting
• Flag traffic from/to known malicious infrastructure (80.64.30[.]100/101)
• Investigate TLS certificates with anomalies (issuer XX, CN with IP)
• Review login activity for spoofed portals and fake redirects

Reference

• https://hunt.io/blog/server-side-phishing-evasion-employee-portals

21. Rogue .RDP File Exploits in Espionage Campaign Targeting Europe

A sophisticated cyber-espionage campaign, attributed to Russian-aligned threat group UNC5837, has been observed abusing Windows Remote Desktop Protocol (.RDP) files to gain stealthy access to government and military networks across Europe.

Key Threat Details

• Threat Group: UNC5837 (attributed by Google Threat Intelligence Group)
• Attack Type: Spear-phishing with malicious .rdp file attachments
• First Observed: October 2024
• Targets: European government and defense institutions
• Attribution Link: Suspected Russian state-backed actors

Attack Vectors

1. Drive and Clipboard Redirection
   • .rdp files configure RDP sessions to redirect drives and clipboard, allowing attackers to:
     • Access the file system
     • Read/write local drives
     • Capture clipboard content (passwords, sensitive text)
   • Risk magnified in virtualized environments due to shared clipboard with host
2. Deceptive RemoteApps
   • Victims are presented with a fake RemoteApp (e.g., “AWS Secure Storage Connection Stability Test”) instead of a full desktop session
   • App runs from attacker’s server, leveraging:
     • Windows environment variables like %USERPROFILE%, %COMPUTERNAME% for passive reconnaissance
     • Signed .rdp files with valid SSL certificates to bypass warnings
3. Fileless Intrusion
   • Attack is stealthy and does not require malware to be installed
   • Likely use of PyRDP or similar tool for:
     • Clipboard theft
     • File exfiltration
     • Session control

Detection Challenges

• Minimal endpoint artifacts; relies on Windows-native RDP behavior
• Difficult for traditional antivirus and EDR solutions to detect due to:
  • Legitimate RDP use
  • No dropped payloads

Recommendations

• Policy Hardening:
  • Block execution of .rdp files from untrusted publishers
  • Enforce Network Level Authentication (NLA)
  • Disable drive and clipboard redirection
• Monitoring:
  • Log and alert on .rdp execution from email downloads or unknown sources
  • Enable detailed event logging for RDP sessions
• User Awareness:
  • Train users to never open .rdp file attachments
  • Flag external emails that include .rdp attachments

Reference

• https://cybersecuritynews.com/hackers-exploiting-windows-rdp-files-for-rogue-remote-desktop-connections

22. SideCopy APT Hackers Mimic Government Staff to Deliver XenoRAT in Targeted Indian Espionage Campaign

A newly observed campaign by the Pakistan-linked APT group SideCopy has targeted Indian government sectors since late December 2024, significantly expanding its scope to include ministries of railways, oil & gas, and external affairs. The campaign employs deceptive spear-phishing emails, fake government domains, and open-source malware like XenoRAT, SparkRAT, and a new CurlBack RAT.

Key Threat Details

• Threat Group: SideCopy APT (Pakistan-linked)
• First Observed: December 2024
• Target Sectors: Indian government ministries, municipal corporations
• Delivery Method: Spear-phishing emails with .pdf.lnk shortcuts → MSI payloads
• Infection Chain:
  • .lnk file → Obfuscated command → Downloads .msi payload
  • MSI uses PowerShell to decrypt embedded XenoRAT DLLs directly in memory

Notable Techniques

• Phishing Domains: Fake domains and email addresses (e.g., [email protected]) mimicking NIC and NDC portals
• Deception Tactics: Login portals impersonating City Municipal Corporation services in Maharashtra
• Malware Used:
  • XenoRAT: In-memory execution using AES decryption via PowerShell
  • CurlBack RAT: Undocumented RAT that registers victim systems via unique C2 beaconing
  • SparkRAT: Cross-platform support (Windows, Linux)
• Persistence Mechanism: Scheduled tasks camouflaged as legitimate Windows services

Recommendations

• Block .lnk, .hta, and .msi attachments in email gateways
• Monitor for:
  • Scheduled tasks with suspicious names
  • PowerShell use of [System.Security.Cryptography.Aes]
  • Connections to known C2 domains listed above
• Implement URL filtering and threat intelligence feeds to block spoofed domains
• Train users to recognize targeted phishing emails mimicking government communication

Reference

• https://cybersecuritynews.com/sidecopy-apt-hackers-mimic-as-government-personnel