U.S. CISA adds TP-Link Archer C7(EU) and TL-WR841N flaws to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/181886/hacking/u-s-cisa-adds-tp-link-archer-c7eu-and-tl-wr841n-flaws-to-its-known-exploited-vulnerabilities-catalog.html
An Iranian-aligned spear-phishing campaign masquerading as Omani Ministry of Foreign Affairs communications targeted global government entities. The operation used compromised mailboxes to distribute malicious Word documents containing VBA macros. When executed, these macros decoded and deployed a payload named sysProcUpdate, which gathered system metadata and attempted to beacon to a command and control server. The campaign showed sophisticated techniques including anti-analysis measures, persistence mechanisms, and regional targeting across multiple countries. Evidence suggests this was part of a broader espionage effort by the Homeland Justice group associated with Iran's Ministry of Intelligence and Security, coinciding with heightened geopolitical tensions.
An Iran-nexus spear-phishing campaign masquerading as the Omani Ministry of Foreign Affairs targeted global governments in August 2025. Attributed to Iranian-aligned operators linked to the Homeland Justice group and MOIS, the campaign used compromised mailboxes to send emails with malicious Microsoft Word attachments. The documents contained VBA macros that decoded and deployed malware payloads. The multi-wave operation targeted diplomatic and governmental entities across multiple regions, including the Middle East, Africa, Europe, Asia, and the Americas. The campaign utilized social engineering lures, anti-analysis techniques, and a reconnaissance-focused malware called sysProcUpdate. The attackers aimed to gain initial access, map internal networks, and prepare for further exploitation in diplomatic and industrial organizations.
ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners
Source: https://thehackernews.com/2025/08/shadowcaptcha-exploits-wordpress-sites.html
CVE-2025-25733 is a vulnerability in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units (RSUs) across multiple firmware versions. It allows attackers with physical proximity to modify SPI flash memory regions due to incorrect access control. This can degrade the security posture of the affected devices by potentially enabling unauthorized firmware or configuration changes. The vulnerability has a CVSS score of 3.5, indicating low severity, primarily impacting confidentiality and integrity without affecting availability. Exploitation requires physical access and no user interaction or authentication is needed. No known exploits are currently reported in the wild. European organizations relying on these RSUs for traffic management and infrastructure security could face risks of tampering or sabotage if physical security is insufficient. Mitigation involves enhancing physical security controls, monitoring for unauthorized access, and applying vendor patches once available. Countries with extensive smart traffic infrastructure deployments and Kapsch TrafficCom presence, such as Germany, Austria, and the Netherlands, are most likely to be affected.
CVE-2025-25732 is a medium severity vulnerability affecting Kapsch TrafficCom RIS-9160 and RIS-9260 Roadside Units (RSUs) in specific firmware versions. The flaw stems from incorrect access control in the EEPROM component, allowing attackers to overwrite stored password hashes with their own. This enables privilege escalation to root without requiring authentication or user interaction. The vulnerability impacts confidentiality, integrity, and availability of the affected RSUs. Although no known exploits are currently reported in the wild, the potential for attackers to gain full control over critical traffic infrastructure devices is significant. European organizations operating these RSUs, especially in countries with extensive intelligent transportation systems, face increased risk. Mitigation requires strict physical and network access controls, firmware updates when available, and monitoring for anomalous device behavior. Countries with widespread deployment of Kapsch RSUs, such as Germany, Austria, and the Netherlands, are most likely to be affected given their advanced traffic management deployments. The vulnerability’s CVSS score of 6.8 reflects its medium severity, balancing the high impact with the requirement for physical or network proximity to exploit.
Hacked Law Enforcement and Government Email Accounts Sold on Dark Web
Source: https://www.infosecurity-magazine.com/news/law-enforcement-government-emails/
Over 29,000 Unpatched Microsoft Exchange Servers Leaving Networks at Risk
Source: https://hackread.com/29k-microsoft-exchange-servers-unpatched-networks-risk/
Over 29,000 Exchange servers unpatched against high-severity flaw
Source: https://www.bleepingcomputer.com/news/security/over-29-000-exchange-servers-unpatched-against-high-severity-flaw/
These indicators of compromise (IOCs) were identified through LevelBlue Labs' proprietary collection and threat hunting processes, leveraging AI-driven heuristics to detect anomalous patterns, behavioral analysis of malicious activity, and cross-referenced intelligence from endpoint telemetry and external sources. The IOCs included in this pulse are associated with command and control (C2) infrastructure, facilitating malware communication, data exfiltration, and persistent threat actor operations. Use this data to enhance detection rules, block malicious infrastructure, or correlate with existing incident investigations.
ReVault flaws let hackers bypass Windows login on Dell laptops
Source: https://www.bleepingcomputer.com/news/security/revault-flaws-let-hackers-bypass-windows-login-on-dell-laptops/
U.S. CISA adds D-Link cameras and Network Video Recorder flaws to its Known Exploited Vulnerabilities catalog
Source: https://securityaffairs.com/180833/security/u-s-cisa-adds-d-link-cameras-and-network-video-recorder-flaws-to-its-known-exploited-vulnerabilities-catalog.html
SentinelLABS and Beazley Security uncovered a series of infostealer campaigns delivering the Python-based PXA Stealer. The malware, which first appeared in late 2024, has evolved to incorporate sophisticated anti-analysis techniques and a hardened command-and-control infrastructure. Over 4,000 unique victim IP addresses from 62 countries were identified, with South Korea, the United States, and the Netherlands being the most targeted. The stolen data includes passwords, credit card records, and browser cookies. The threat actors, linked to Vietnamese-speaking cybercriminal circles, monetize the stolen data through a subscription-based underground ecosystem that automates resale via Telegram's API. The campaign showcases the growing trend of weaponizing legitimate infrastructure for large-scale information theft and monetization.
Critical Dahua Camera Flaws Enable Remote Hijack via ONVIF and File Upload Exploits
Source: https://thehackernews.com/2025/07/critical-dahua-camera-flaws-enable.html
Critical SAP flaw exploited to launch Auto-Color Malware attack on U.S.company
Source: https://securityaffairs.com/180562/malware/critical-sap-flaw-exploited-to-launch-auto-color-malware-attack-on-u-s-company.html
