Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

LameHug: first AI-Powered malware linked to Russia’s APT28

Source: https://securityaffairs.com/180092/apt/lamehug-first-ai-powered-malware-linked-to-russias-apt28.html

LameHug is reported as the first AI-powered malware attributed to the Russian advanced persistent threat (APT) group known as APT28. This malware represents a significant evolution in cyber threat capabilities by integrating artificial intelligence techniques into its operations. While specific technical details are limited, the association with APT28—a group historically known for sophisticated espionage and cyberattack campaigns targeting government, military, and critical infrastructure sectors—indicates that LameHug is likely designed for stealth, adaptability, and enhanced evasion of traditional detection mechanisms. The use of AI could enable the malware to dynamically adjust its behavior based on the environment, automate decision-making processes during attacks, and potentially improve its persistence and lateral movement within compromised networks. Although no known exploits in the wild have been confirmed yet, the emergence of AI-powered malware signals a new threat paradigm that could complicate incident response and attribution efforts. The minimal discussion and low Reddit score suggest that the threat is still emerging and not yet widely analyzed or observed in active campaigns. However, the newsworthiness and credible source imply that security communities should monitor developments closely.

Detailed information about LameHug: first AI-Powered malware linked to Russia’s APT28. Get real-time updates, technical details, and mitigation strategies.

LameHug: first AI-Powered malware linked to Russia’s APT28 - Live Threat Intelligence - Threat Radar | OffSeq.com

LameHug: first AI-Powered malware linked to Russia’s APT28

Reddit Discussion: LameHug: first AI-Powered malware linked to Russia’s APT28

A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0. This vulnerability affects the function sso of the file src/main/java/com/jeesite/modules/sys/web/SsoController.java. The manipulation of the argument redirect leads to open redirect. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 3d06b8d009d0267f0255acc87ea19d29d07cedc3. It is recommended to apply a patch to fix this issue.

CVE-2025-7785 is an open redirect vulnerability identified in thinkgem JeeSite versions up to 5.12.0. The vulnerability resides in the Single Sign-On (SSO) functionality, specifically within the sso method of the SsoController.java file. The issue arises from improper validation or sanitization of the 'redirect' parameter, which can be manipulated by an attacker to redirect users to arbitrary external URLs. This type of vulnerability is classified as an open redirect, where an attacker crafts a malicious URL that appears to be from a trusted domain but redirects victims to a malicious site. The vulnerability can be exploited remotely without requiring authentication or privileges, and user interaction is necessary as the victim must click on a crafted link. The disclosed CVSS 4.0 score is 5.3 (medium severity), reflecting the moderate risk posed by this vulnerability. The attack vector is network-based, with low attack complexity and no privileges or user authentication required. The impact on confidentiality is none, integrity is low, and availability is none. The vulnerability does not affect system components beyond the redirect functionality, but it can be leveraged in phishing campaigns or combined with other attacks to facilitate credential theft or malware delivery. A patch has been released (commit 3d06b8d009d0267f0255acc87ea19d29d07cedc3) to address this issue, and it is recommended to apply it promptly. No known exploits are currently observed in the wild, but public disclosure increases the risk of exploitation attempts.

Detailed information about CVE-2025-7785: Open Redirect in thinkgem JeeSite affecting thinkgem JeeSite. Get real-time updates, technical details, and mitigation

CVE-2025-7785: Open Redirect in thinkgem JeeSite - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-7785: Open Redirect in thinkgem JeeSite

Years Long Linux Cryptominer Spotted Using Legit Sites to Spread Malware

Source: https://hackread.com/linux-cryptominer-using-legit-sites-to-spread-malware/

The reported security threat involves a Linux-based cryptominer malware campaign that has persisted for several years. This malware leverages legitimate websites as vectors to distribute its payload, thereby increasing its chances of evading detection and spreading widely. The use of legitimate sites likely involves either compromising these sites or exploiting vulnerabilities in third-party content or advertising networks to deliver malicious scripts or binaries to unsuspecting users. Once executed on a Linux system, the malware installs a cryptominer that utilizes system resources to mine cryptocurrency without the user's consent. This unauthorized mining activity can degrade system performance, increase power consumption, and potentially cause hardware damage due to prolonged high resource usage. The campaign's longevity suggests a sophisticated and stealthy operation, possibly employing evasion techniques such as polymorphism, rootkit functionality, or exploiting zero-day vulnerabilities to maintain persistence. The lack of specific affected versions or detailed technical indicators limits precise identification, but the threat targets Linux environments, which are commonly used in servers, cloud infrastructure, and increasingly in enterprise desktops. The malware does not appear to have known exploits in the wild beyond its existing operation, and the discussion around it is minimal, indicating it might be underreported or detected primarily by specialized security researchers. The medium severity classification aligns with the typical impact of cryptomining malware, which, while not directly destructive like ransomware, can cause significant operational and financial damage over time.

Detailed information about Years Long Linux Cryptominer Spotted Using Legit Sites to Spread Malware. Get real-time updates, technical details, and mitigation st

Years Long Linux Cryptominer Spotted Using Legit Sites to Spread Malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Years Long Linux Cryptominer Spotted Using Legit Sites to Spread Malware

Reddit Discussion: Years Long Linux Cryptominer Spotted Using Legit Sites to Spread Malware

A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid' parameter in the employee application feature.

CVE-2025-49484 is a high-severity SQL injection vulnerability affecting the JS Jobs component versions 1.0.0 through 1.4.1 for the Joomla content management system. The vulnerability arises from improper neutralization of special elements used in SQL commands (CWE-89) within the 'cvid' parameter of the employee application feature. This flaw allows a low-privilege user to inject arbitrary SQL commands into the backend database without requiring authentication or user interaction. Exploitation could lead to unauthorized data disclosure, data modification, or even complete compromise of the underlying database. The vulnerability has a CVSS 4.0 base score of 8.7, reflecting its network attack vector, low attack complexity, no privileges required, and no user interaction needed, combined with high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the ease of exploitation and critical impact make this a significant threat to Joomla sites using the vulnerable JS Jobs plugin. The absence of available patches at the time of publication further increases risk for affected installations.

Detailed information about CVE-2025-49484: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomsky.com JS Jobs component for Jooml

CVE-2025-49484: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomsky.com JS Jobs component for Joomla - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-49484: CWE-89: Improper Neutralization of Special Elements used in an SQL Command in joomsky.com JS Jobs component for Joomla

A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web script or HTML via the jform[tags_text] parameter.

CVE-2025-50126 is a stored Cross-Site Scripting (XSS) vulnerability identified in the RSBlog! component versions 1.11.6 through 1.14.5 for the Joomla content management system. This vulnerability arises due to improper neutralization of input during web page generation, specifically within the jform[tags_text] parameter. Remote authenticated users can exploit this flaw by injecting arbitrary HTML or JavaScript code that is then stored and rendered in the context of the vulnerable Joomla site. Because the vulnerability is stored XSS, the malicious script persists on the server and is delivered to any user viewing the affected content, potentially leading to session hijacking, defacement, or redirection to malicious sites. The vulnerability requires the attacker to be authenticated with at least limited privileges (as indicated by the CVSS vector PR:L), but no user interaction is needed for exploitation once the malicious payload is stored. The CVSS 4.0 base score is 5.3, reflecting a medium severity level, with network attack vector, low attack complexity, and no user interaction required. The vulnerability does not affect confidentiality or availability directly but impacts integrity and can lead to further compromise through client-side attacks. No known exploits are currently reported in the wild, and no official patches have been linked yet. The vulnerability was reserved in June 2025 and published in July 2025, indicating recent disclosure and likely ongoing efforts to remediate.

Detailed information about CVE-2025-50126: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in rsjoomla.com RSBlog! c

CVE-2025-50126: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in rsjoomla.com RSBlog! component for Joomla - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-50126: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in rsjoomla.com RSBlog! component for Joomla

Geographic Threat Map

Global Threat Distribution

Threat Levels

Recent Threats

LameHug: first AI-Powered malware linked to Russia’s APT28

CVE-2025-7785: Open Redirect in thinkgem JeeSite

Years Long Linux Cryptominer Spotted Using Legit Sites to Sp...

CVE-2025-49484: CWE-89: Improper Neutralization of Special E...

Country Risk Levels

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility