Do Son ASEC uncovers attacks on Linux servers installing legitimate proxy software (TinyProxy, Sing-box) to hijack resources for covert operations, bypassing traditional malware detection.
Remote Access
A critical flaw (CVE-2025-6561, CVSS 9.8) in Hunt Electronic DVRs allows unauthenticated remote attackers to access configuration files and obtain plaintext admin credentials.
Hackers are weaponizing legitimately signed ConnectWise ScreenConnect installers by using Authenticode stuffing to deploy malware and fake updates, leveraging social engineering.
NCSC reveals SHOE RACK, a stealthy post-exploitation malware using reverse SSH tunneling, DoH, and protocol abuse to maintain remote access on FortiGate 100D firewalls.
A critical path traversal flaw (CVE-2025-34022, CVSS 9.3) in Selea TARGA ANPR cameras allows unauthenticated remote access to sensitive files. PoC is public
A critical flaw (CVE-2025-24288, CVSS 9.8) in Versa Director exposes hardcoded default credentials for high-privilege accounts with sudo access. PoC released. Update now
Kimsuky APT is using HWP documents and stealthy AnyDesk backdoors in a new phishing campaign to infiltrate systems under the guise of academic collaboration.
Teleport disclosed a critical remote authentication bypass flaw (CVE-2025-49825) affecting self-hosted instances. Upgrade Proxies and agents immediately!
AutomationDirect's MB-Gateway has a critical (CVSS 10) flaw allowing unauthenticated remote access and RCE. Hardware limits prevent a software fix; replacement is recommended.
Cisco Talos warns of a Brazil-focused spam campaign abusing legitimate remote access tools (N-able, PDQ) to gain full system control. Stay vigilant!
FBI warns cybercriminals are exploiting outdated routers with TheMoon malware to build anonymous proxy networks for illicit activities.
ASUS routers have a critical vulnerability (CVE-2025-2492) allowing unauthorized access. Update firmware and strengthen security now.
SonicWall has patched three vulnerabilities (CVE-2025-23008, CVE-2025-23009, CVE-2025-23010) in its NetExtender VPN client. Update to version 10.3.2 or later to prevent privilege escalation and unauthorized access.