Rhadamanthys is a sophisticated, multi-modular malware family sold on underground markets since September 2022, developed by experienced threat actors. It builds upon previous malware projects by the same authors, indicating continuous evolution and refinement. Although no known exploits are currently observed in the wild, its high complexity and modularity suggest it can be adapted for various attack scenarios, including espionage, data theft, or sabotage. The malware's design allows it to evade detection and maintain persistence, posing a significant risk to targeted organizations. European entities, especially those in critical infrastructure, finance, and government sectors, could be prime targets given the malware's capabilities and the strategic value of these sectors. Mitigation requires proactive threat hunting, network segmentation, and monitoring for indicators of compromise linked to Rhadamanthys. Countries with advanced digital economies and strategic geopolitical importance, such as Germany, France, the UK, and the Netherlands, are likely to be most affected. Given the malware's high potential impact on confidentiality, integrity, and availability, combined with its ease of adaptation by skilled actors, the suggested severity is high. Defenders should prioritize awareness of this threat, implement advanced detection mechanisms, and maintain updated incident response plans.
GhostSocks is a Malware-as-a-Service (MAAS) that converts compromised devices into residential proxies, enabling threat actors to bypass anti-fraud mechanisms. Introduced in October 2023, it gained popularity after partnering with LummaStealer in February 2024. The malware, coded in Golang, uses obfuscation techniques and can be built as a 32-bit DLL or executable. It doesn't implement persistence mechanisms but focuses on SOCKS5 functionality. GhostSocks uses a configuration file or hardcoded config to connect to C2 servers, randomly generates credentials, and establishes a SOCKS5 connection using open-source libraries. Despite law enforcement actions against related platforms, GhostSocks continues to operate, posing ongoing risks of double victimization and long-term network access for cybercriminals.
A recent attack on a poorly managed MS-SQL server involved the use of XiebroC2, an open-source C2 framework similar to CobaltStrike. The attackers exploited vulnerable credentials, installed JuicyPotato for privilege escalation, and then deployed XiebroC2 using PowerShell. XiebroC2 supports various features including remote control, information collection, and defense evasion across multiple platforms. The malware collects system information and connects to a C&C server for command execution. To protect against such attacks, administrators are advised to use complex passwords, regularly update them, keep security software current, and implement firewalls to restrict external access to publicly accessible database servers.
When Audits Fail: Four Critical Pre-Auth Vulnerabilities in TRUfusion Enterprise
Source: https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/
Phantom Taurus, a newly identified Chinese state-sponsored threat actor, has been conducting espionage operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The group's primary focus includes ministries of foreign affairs, embassies, and military operations, with the objective of gathering sensitive information. Phantom Taurus employs distinctive tactics, techniques, and procedures, including a new malware suite called NET-STAR. This suite consists of three web-based backdoors designed to target Internet Information Services (IIS) web servers. The group has recently shifted from targeting emails to directly accessing databases, demonstrating their ability to adapt and evolve their methods. Phantom Taurus' activities align with Chinese strategic interests, and their infrastructure overlaps with other known Chinese APT groups.
Hacker Breaches US Surveillance Firm RemoteCOM, Accesses Court Supervision Records and Criminal Data
Source: https://hackread.com/us-surveillance-remotecom-hack-court-data/
One of the common infosec jokes is that sometimes, you do not need to "break" an application, but you have to log in. This is often the case for weak default passwords, which are common in IoT devices. However, an even easier method is to tell the application who you are. This does not even require a password&#;x26;#;x21; One of the sad recurring vulnerabilities is an HTTP cookie that contains the user&#;x26;#;39;s username or userid.
CVE-2025-8122 is a high-severity SQL Injection vulnerability affecting the Polska Akademia Dostępności PAD CMS, specifically in the article positioning functionality across all three templates (www, bip, ww+bip). The flaw arises from improper neutralization of input provided by authorized users, enabling blind SQL injection attacks without requiring user interaction or elevated privileges beyond authorized user access. The product is end-of-life, and no patches will be issued, increasing risk for organizations still using this CMS. Exploitation could lead to significant confidentiality and integrity breaches, including unauthorized data access or manipulation. European organizations using PAD CMS, particularly in Poland and neighboring countries with higher adoption, are at greatest risk. Mitigation requires immediate migration to alternative CMS platforms or implementing strict input validation and database query parameterization at the application or network level. Due to the lack of vendor support and the critical nature of the vulnerability, proactive compensating controls and monitoring are essential to reduce exposure.
CVE-2025-8121 is a high-severity SQL Injection vulnerability affecting the Polska Akademia Dostępności PAD CMS, specifically in its article positioning functionality across all three templates (www, bip, ww+bip). The flaw arises from improper neutralization of input from authorized users, enabling blind SQL injection attacks without requiring user interaction. The product is end-of-life, and no patches will be issued, increasing the risk for organizations still using it. Exploitation can lead to significant confidentiality and integrity breaches, including unauthorized data access and manipulation. European organizations using PAD CMS, especially in Poland and neighboring countries, are at heightened risk. Mitigation requires immediate migration to alternative CMS platforms or implementing strict input validation and web application firewalls. Given the CVSS 8.7 score and no known exploits in the wild yet, proactive defense is critical to prevent potential exploitation.
CVE-2025-8120 is a critical vulnerability in the Polska Akademia Dostępności PAD CMS that allows unauthenticated remote attackers to upload and execute arbitrary files due to improper validation of upload permissions. This unrestricted file upload flaw affects all three templates of PAD CMS (www, bip, ww+bip) and can lead to remote code execution without any authentication or user interaction. The product is end-of-life, and no patches will be issued, increasing the risk for organizations still using it. The vulnerability has a maximum CVSS score of 10, reflecting its severe impact on confidentiality, integrity, and availability. Although no exploits are currently known in the wild, the ease of exploitation and critical impact make this a significant threat. European organizations using PAD CMS, especially in Poland and neighboring countries, are at highest risk. Immediate mitigation involves discontinuing use of PAD CMS or isolating affected systems, implementing strict network segmentation, and monitoring for suspicious file uploads or execution attempts.
CVE-2025-8117 is a high-severity vulnerability in the Polska Akademia Dostępności PAD CMS affecting all three templates (www, bip, www+bip). The vulnerability arises from improper initialization of a parameter used in the password recovery process, enabling attackers to change passwords for any user who has not previously used the reset password functionality. Exploitation requires no authentication or user interaction and can be performed remotely over the network. The product is end-of-life, and no patches will be issued, increasing the risk for organizations still using this CMS. This vulnerability can lead to unauthorized account takeover, compromising confidentiality and integrity of user accounts and potentially the entire CMS. European organizations using PAD CMS, especially in Poland and neighboring countries, are at heightened risk. Mitigation requires immediate migration to alternative CMS platforms or implementing compensating controls such as network segmentation and strict access controls. Given the lack of available patches and ease of exploitation, this vulnerability demands urgent attention from defenders.
CVE-2025-8116 is a reflected Cross-site Scripting (XSS) vulnerability in the Polska Akademia Dostępności (PAD) CMS affecting its printing and save-to-PDF functionality across all three templates (www, bip, www+bip). An attacker can craft a malicious URL that, when visited by a user, executes arbitrary JavaScript in the victim's browser. The product is End-Of-Life, and no patches will be issued, leaving systems exposed. The vulnerability has a CVSS 4.0 base score of 5.1 (medium severity), requiring no privileges but some user interaction. While no known exploits are reported in the wild, the risk remains due to the lack of vendor support. European organizations using PAD CMS should be aware of the risk of session hijacking, data theft, or defacement through this XSS flaw. Mitigation requires compensating controls such as input validation, web application firewalls, or migration to supported platforms. Poland is the most affected country given the product origin and usage, with other European countries potentially impacted if they use PAD CMS.
CVE-2025-7065 is a critical vulnerability in the Polska Akademia Dostępności (PAD) CMS affecting all three templates (www, bip, ww+bip). It allows unauthenticated remote attackers to upload files of any type without restriction due to a client-controlled permission check parameter in the photo upload functionality. This unrestricted file upload can lead to remote code execution (RCE) on the affected server. The product is end-of-life, and no patches will be issued. The vulnerability has a CVSS 4.0 base score of 10.0, indicating maximum severity with no authentication or user interaction required. Although no known exploits are currently in the wild, the risk is extremely high due to the ease of exploitation and potential impact. European organizations using PAD CMS are at significant risk, especially those in Poland and countries with public sector deployments of this CMS. Immediate mitigation involves disabling the vulnerable upload functionality, isolating affected systems, and migrating to alternative supported platforms.
CVE-2025-7063 is a critical vulnerability in the Polska Akademia Dostępności (PAD) CMS that allows unauthenticated remote attackers to upload files of any type due to a client-controlled permission check parameter. This unrestricted file upload can lead to remote code execution (RCE) on affected systems. The vulnerability affects all three PAD CMS templates (www, bip, ww+bip) and the product is end-of-life with no patches forthcoming. The CVSS 4.0 base score is 10.0, indicating a critical severity with network attack vector, no authentication or user interaction required, and high impact on confidentiality, integrity, and availability. Although no known exploits are currently reported in the wild, the risk is significant given the ease of exploitation and potential for full system compromise. European organizations using PAD CMS should urgently consider mitigation strategies including isolating affected systems, disabling file upload functionality, or migrating to alternative CMS platforms. Poland is the most likely affected country due to the product’s origin and usage, but other European countries using PAD CMS may also be at risk. Immediate action is recommended given the lack of vendor support and critical nature of this vulnerability.
Asahi halts ordering, shipping, and customer service after cyberattack
Source: https://securityaffairs.com/182791/security/asahi-halts-ordering-shipping-and-customer-service-after-cyberattack.html
CISA Sounds Alarm on Critical Sudo Flaw Actively Exploited in Linux and Unix Systems
Source: https://thehackernews.com/2025/09/cisa-sounds-alarm-on-critical-sudo-flaw.html
Conti, a notorious ransomware operation identified in 2019, quickly gained infamy for its advanced encryption, rapid lateral movement, and double extortion tactics. Operated by the Russia-based Wizard Spider group, Conti evolved from Ryuk ransomware and maintained suspected ties to Russian state interests. Between 2019 and 2022, Conti targeted healthcare providers, governments, educational institutions, critical infrastructure, and private businesses, earning an estimated $180 million in 2021. Their aggressive tactics highlighted the urgent need for strong cybersecurity defenses. In 2022, internal divisions arose following leaked private chats. Conti's operations mimicked legitimate businesses, showcasing the industrialization of cybercrime and its devastating impact on critical sectors.
