Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This report examines recent activities attributed to the XDSpy threat actor, focusing on an ongoing campaign targeting Eastern European and Russian governmental entities using the XDigo malware since March 2025. The investigation stemmed from analyzing a vulnerability in LNK files, leading to the discovery of a multi-stage infection chain. The report provides analysis of the XDigo implant and its connections to previous XDSpy activities. It also details the exploitation of LNK parsing issues and infrastructure used across different campaigns. The research uncovered additional, more recent XDSpy activity employing an alternative infection chain. Targets include government entities in Eastern Europe, with a confirmed victim in Belarus.

The threat known as SadFuture represents the latest evolution of the XDSpy threat actor's activities, focusing on a sophisticated multi-stage malware campaign targeting governmental entities primarily in Eastern Europe and Russia. The campaign has been active since at least March 2025 and centers around the deployment of the XDigo implant, a malware strain linked to previous XDSpy operations. The infection chain exploits a vulnerability in the parsing of LNK (Windows shortcut) files, enabling initial compromise without requiring user authentication but potentially involving user interaction to trigger the payload. This exploitation leverages Windows' handling of LNK files to execute malicious code, a technique that bypasses some traditional security controls. The campaign infrastructure and tactics have evolved, with recent activity showing an alternative infection chain, indicating adaptability and ongoing development by the threat actor. The attack techniques include a range of tactics and procedures such as etdownloader usage, living-off-the-land binaries (LOLBins) exploitation (e.g., T1218.011), credential dumping, data staging, and command and control communications, reflecting a comprehensive and persistent attack methodology. The confirmed targeting of government entities, including a victim in Belarus, underscores the geopolitical motivations behind the campaign. The threat actor's use of multiple techniques to maintain persistence, evade detection, and exfiltrate data highlights the advanced nature of this threat. No known public exploits are currently reported, but the exploitation of LNK parsing vulnerabilities remains a critical vector. The campaign's complexity and targeted nature suggest a well-resourced adversary with significant operational capabilities.

Detailed information about SadFuture: Mapping XDSpy latest evolution. Get real-time updates, technical details, and mitigation strategies.

SadFuture: Mapping XDSpy latest evolution - Live Threat Intelligence - Threat Radar | OffSeq.com

SadFuture: Mapping XDSpy latest evolution

An investigation into domains associated with the LummaC2 infostealing-malware campaign revealed a broader network of nearly 500 domains with highly malicious risk scores. These domains share similar registration patterns, including the use of Eastern European names and the inbox[.]eu email domain. The domains predominantly advertise technical education courses, but are likely lures for malware delivery. Four domains were identified as LummaC2 login panels. The campaign's infrastructure uses specific TLDs, naming conventions, and a Hong Kong address linked to OFAC-sanctioned entities. Security teams are advised to monitor for similar domain patterns, scrutinize suspicious training sites, and educate users about the risks.

The LummaC2 campaign represents a sophisticated infostealing malware operation that leverages an extensive and covert domain infrastructure to facilitate malware delivery and command-and-control (C2) activities. Investigations have uncovered nearly 500 domains linked to this campaign, characterized by highly malicious risk scores and consistent registration patterns. These domains predominantly use Eastern European personal names and the inbox[.]eu email domain for registration, suggesting a coordinated effort to mask the true operators. The domains primarily masquerade as providers of technical education courses, a tactic designed to lure victims into engaging with malicious content under the guise of legitimate training resources. Among these, four domains have been identified as actual LummaC2 login panels, serving as interfaces for threat actors to manage infected systems or distribute malware payloads. The infrastructure employs specific top-level domains (TLDs) and naming conventions, and intriguingly, includes a Hong Kong address linked to entities sanctioned by the Office of Foreign Assets Control (OFAC), indicating potential geopolitical or regulatory evasion strategies. The campaign aligns with several MITRE ATT&CK techniques, including spearphishing via service (T1566.002), establishing and using infrastructure (T1583.001), domain generation algorithms or domain fronting (T1589.002), and leveraging compromised or malicious domains (T1585, T1584.001). Although no known exploits are currently active in the wild, the campaign’s infrastructure and tactics pose a significant risk for credential theft, data exfiltration, and further malware dissemination. Security teams are advised to monitor for domain registration patterns similar to those identified, scrutinize suspicious technical education websites, and implement user awareness programs to mitigate the risk of social engineering attacks associated with this campaign.

Detailed information about Part 2: Tracking LummaC2 Infrastructure. Get real-time updates, technical details, and mitigation strategies.

Part 2: Tracking LummaC2 Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

Part 2: Tracking LummaC2 Infrastructure

Incorrect Authorization vulnerability in Drupal Commerce Alphabank Redirect allows Functionality Misuse.This issue affects Commerce Alphabank Redirect: from 0.0.0 before 1.0.3.

CVE-2025-48446 is an Incorrect Authorization vulnerability classified under CWE-863, affecting the Drupal Commerce Alphabank Redirect module versions prior to 1.0.3, specifically version 0.0.0. This vulnerability arises from improper authorization checks within the module's redirect functionality, which is designed to facilitate payment redirection to Alphabank services in e-commerce transactions. Due to the flawed authorization logic, an attacker with limited privileges or potentially unauthenticated users could misuse the redirect functionality to perform unauthorized actions or redirect users to unintended or malicious destinations. This could lead to functionality misuse, such as bypassing intended access controls, manipulating transaction flows, or redirecting customers to phishing or fraudulent payment pages. The vulnerability does not currently have any known exploits in the wild, and no official patches or updates have been linked yet, although the fixed version is indicated as 1.0.3. The lack of a CVSS score suggests that the vulnerability has been recently disclosed and is pending further assessment. The vulnerability affects a niche but critical component used in Drupal-based e-commerce sites that integrate with Alphabank payment systems, which are primarily relevant in regions where Alphabank operates or where Drupal Commerce is widely adopted. The core issue is the failure to properly verify user permissions before allowing redirect operations, which could compromise transaction integrity and user trust in the affected e-commerce platforms.

Detailed information about CVE-2025-48446: CWE-863 Incorrect Authorization in Drupal Commerce Alphabank Redirect affecting Drupal Commerce Alphabank Redirect. G

CVE-2025-48446: CWE-863 Incorrect Authorization in Drupal Commerce Alphabank Redirect - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-48446: CWE-863 Incorrect Authorization in Drupal Commerce Alphabank Redirect

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

Source: https://hackread.com/pathwiper-malware-hit-ukraines-critical-infrastructure/

The PathWiper malware is a newly identified malicious software campaign targeting Ukraine's critical infrastructure, as reported on June 9, 2025. Although detailed technical specifics such as infection vectors, payload mechanisms, or exploited vulnerabilities are not provided, the malware's designation as 'PathWiper' suggests destructive capabilities, likely involving the deletion or corruption of file system paths or critical data. This type of malware typically aims to disrupt operations by wiping essential files, rendering systems inoperable, or causing data loss. The attack on critical infrastructure indicates a strategic intent to impair essential services such as energy, water, transportation, or communication networks. Given the critical infrastructure context, the malware may employ sophisticated evasion techniques and possibly leverage zero-day exploits or social engineering to gain initial access. The absence of known exploits in the wild and minimal discussion levels imply that the malware is either newly discovered or under active investigation. The source of information is a Reddit InfoSecNews post linking to hackread.com, which, while newsworthy, lacks detailed technical disclosures or official advisories. The critical severity assigned reflects the potential for significant operational disruption and national security implications. Overall, PathWiper represents a high-impact threat with destructive intent against vital infrastructure systems in Ukraine, possibly serving as a geopolitical cyberweapon or sabotage tool.

Detailed information about New PathWiper Malware Strikes Ukraine's Critical Infrastructure. Get real-time updates, technical details, and mitigation strategies.

New PathWiper Malware Strikes Ukraine's Critical Infrastructure - Live Threat Intelligence - Threat Radar | OffSeq.com

New PathWiper Malware Strikes Ukraine's Critical Infrastructure

Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in Login Bypass.

CVE-2024-22773 is a high-severity vulnerability affecting Intelbras Action RF 1200 routers (version 1.2.2 and earlier) and Action RG 1200 routers (version 2.1.7 and earlier). The core issue involves the exposure of the router's administrative password within a cookie, which leads to a login bypass vulnerability. This means that an attacker can potentially gain unauthorized administrative access to the router's management interface without needing valid credentials or user interaction. The vulnerability is classified under CWE-922 (Improper Restriction of Operations within the Bounds of a Memory Buffer), indicating a flaw in how sensitive information is handled and protected. According to the CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack vector is network-based, requiring high attack complexity but no privileges or user interaction, and impacts confidentiality, integrity, and availability to a high degree. The absence of known exploits in the wild suggests that this vulnerability is newly disclosed and may not yet be actively exploited, but the potential for severe impact remains significant. The lack of vendor or product-specific patch information highlights a possible delay or absence of official remediation at the time of publication, increasing the urgency for affected organizations to implement compensating controls.

Detailed information about CVE-2024-22773: n/a in n/a affecting n/a n/a. Get real-time updates, technical details, and mitigation strategies.

CVE-2024-22773: n/a in n/a - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2024-22773: n/a in n/a

New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack

The PathWiper malware is a newly identified data wiper threat that emerged in 2025 and has been reported to disrupt critical infrastructure in Ukraine. As a data wiper, PathWiper is designed to irreversibly delete or corrupt data on infected systems, rendering them inoperable and causing significant operational disruption. Unlike ransomware, which typically encrypts data for extortion, data wipers aim solely to destroy data and system functionality, often as part of sabotage or cyberwarfare campaigns. The attack on Ukrainian critical infrastructure suggests a targeted campaign likely intended to impair essential services such as energy, transportation, or communications. Although detailed technical specifics of PathWiper are limited, the malware’s classification as a data wiper implies it operates at a low level, potentially leveraging administrative privileges to overwrite or delete critical system files and backups. The lack of known exploits in the wild and minimal public discussion indicates this threat is either newly discovered or tightly controlled by its operators. The critical severity rating reflects the high impact potential of such malware on system availability and operational continuity, especially within critical infrastructure sectors. Given the geopolitical context, this malware is likely part of a broader cyber conflict scenario. The absence of patch links or affected versions suggests that PathWiper may exploit zero-day vulnerabilities or rely on social engineering or supply chain vectors to gain initial access. Overall, PathWiper represents a sophisticated and destructive threat with the capability to cause widespread disruption in targeted environments.

Detailed information about New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack. Get real-time updates, technical details,

New PathWiper Data Wiper Malware Disrupts Ukrainian Critical Infrastructure in 2025 Attack - Live Threat Intelligence - Threat Radar | OffSeq.com

A destructive attack on Ukrainian critical infrastructure using a new wiper malware called 'PathWiper' has been observed. The attack, attributed to a Russia-nexus APT group, utilized a legitimate endpoint administration framework to deploy the wiper across connected endpoints. PathWiper overwrites file system artifacts with random data, targeting physical drives, volumes, and network shared drives. Its capabilities are similar to HermeticWiper, previously used against Ukrainian entities. The malware's sophisticated approach to identifying and corrupting connected drives and volumes distinguishes it from earlier wipers. This attack underscores the ongoing threat to Ukrainian infrastructure despite the prolonged conflict with Russia.

PathWiper is a newly identified wiper malware deployed in destructive attacks targeting critical infrastructure in Ukraine. Attributed to a Russia-nexus advanced persistent threat (APT) group, this malware leverages a legitimate endpoint administration framework to propagate across connected endpoints within a network. Unlike typical ransomware or data theft malware, PathWiper's primary objective is data destruction. It achieves this by overwriting file system artifacts with random data, effectively corrupting physical drives, logical volumes, and network shared drives. This approach renders affected systems unusable and data irrecoverable, causing significant operational disruption. PathWiper shares functional similarities with HermeticWiper, a previously observed destructive malware used against Ukrainian entities, but distinguishes itself through a more sophisticated mechanism for identifying and corrupting connected drives and volumes. The malware’s deployment via legitimate administrative tools indicates a high level of operational security and sophistication, complicating detection and response efforts. The attack techniques align with several MITRE ATT&CK tactics and techniques, including persistence (T1543), credential access (T1078), discovery (T1082, T1083), defense evasion (T1070), lateral movement (T1135), command and control (T1059.003, T1059.005), and impact (T1490). No known public exploits or patches are currently available, and the malware’s hash is provided for detection purposes. This attack underscores the persistent and evolving cyber threat landscape faced by Ukrainian critical infrastructure amid ongoing geopolitical conflict, highlighting the use of destructive malware as a strategic weapon to disrupt essential services and infrastructure.

Detailed information about Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine. Get real-time updates, technical details, and 

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine - Live Threat Intelligence - Threat Radar | OffSeq.com

Newly identified wiper malware 'PathWiper' targets critical infrastructure in Ukraine

In cplog service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed.

CVE-2025-31712 is a medium-severity buffer overflow vulnerability identified in the cplog service of several Unisoc (Shanghai) Technologies Co., Ltd. chipsets, including SC7731E, SC9832E, SC9863A, and multiple T-series models (T310, T606, T612, T616, T610, T618, T750, T765, T760, T770, T820, S8000, T8300, T9300). These chipsets are commonly embedded in Android devices running versions 13, 14, and 15. The vulnerability arises from a classic buffer overflow condition (CWE-120) due to a missing bounds check during a buffer copy operation within the cplog service. Specifically, the service performs a write operation without verifying that the input size fits within the allocated buffer, leading to an out-of-bounds write. This flaw can be exploited locally without requiring any privileges or user interaction, resulting in a denial of service (DoS) condition by crashing or destabilizing the affected service or device. The CVSS 3.1 base score is 5.1, reflecting a medium severity level, with an attack vector limited to local access (AV:L), low attack complexity (AC:L), no privileges required (PR:N), and no user interaction (UI:N). The impact affects integrity and availability but not confidentiality. No known exploits are currently reported in the wild, and no patches have been linked yet. The vulnerability is specific to the cplog service on Unisoc chipsets, which are widely used in budget and mid-range Android smartphones, particularly in emerging markets and some European device segments. The lack of privilege requirements and user interaction lowers the barrier for exploitation, but the local access requirement limits remote exploitation possibilities. The primary risk is local denial of service, which could disrupt device functionality or services relying on the affected chipsets.

Detailed information about CVE-2025-31712: cwe-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Unisoc (Shanghai) Technologies Co.,

CVE-2025-31712: cwe-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Unisoc (Shanghai) Technologies Co., Ltd. SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300 - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-31712: cwe-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Unisoc (Shanghai) Technologies Co., Ltd. SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T750/T765/T760/T770/T820/S8000/T8300/T9300

VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import feature.

FluBot is a well-known Android banking Trojan that primarily spreads via SMS phishing campaigns. It tricks users into installing a malicious app that masquerades as legitimate software, often delivered through deceptive SMS messages containing links. Once installed, FluBot gains extensive control over the infected device, including the ability to intercept SMS messages, manipulate data, control call functions, and remotely wipe data without authorization. The malware leverages these capabilities to steal sensitive information such as banking credentials, intercept two-factor authentication codes sent via SMS, and potentially disrupt device availability by wiping data. The provided information references a VT collection of FluBot threat intelligence encoded in a STIX 2.1 bundle, imported via MISP-STIX. The tags and MITRE ATT&CK patterns associated with this threat highlight its multifaceted attack techniques: delivering malicious apps through alternative means (T1476), unauthorized remote data wiping (T1469), call control (T1616), data manipulation (T1641), SMS control (T1582), and SMS message capture (T1412). The threat is categorized under data and SMS interception, payload delivery, and network activity. Although no specific affected versions or patches are noted, FluBot’s modus operandi relies on social engineering and exploitation of user trust rather than software vulnerabilities. The threat is marked with low severity and 50% certainty, indicating moderate confidence in the intelligence. No known exploits in the wild are reported in this specific collection, but FluBot remains a persistent threat in mobile malware landscapes.

Detailed information about VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import fea

VT collection - flubot via STIX 2.1 Bundle (bundle--931832a0-f7dc-4088-b0d0-9808ad05d585) and converted with the MISP-STIX import feature. - Live Threat Intelligence - Threat Radar | OffSeq.com

International law enforcement agencies have taken additional actions in Operation Endgame, targeting cybercriminal organizations, particularly those behind DanaBot. DanaBot is a powerful modular malware family written in Delphi, capable of keylogging, capturing screenshots, recording desktop videos, exfiltrating files, injecting content into web browsers, and deploying second-stage malware. It operates as a Malware-as-a-Service platform, enabling various attacks. DanaBot has been used in targeted attacks against government officials in the Middle East and Eastern Europe, and for DDoS attacks against Ukrainian servers. The malware implements a custom binary protocol encrypted with RSA and AES, and uses hardcoded C2 servers with Tor as a backup communication channel. Over 50 nicknames have been associated with DanaBot affiliates.

Operation Endgame 2.0 represents a coordinated international law enforcement effort targeting cybercriminal groups operating the DanaBot malware family. DanaBot is a sophisticated modular malware platform developed in Delphi, notable for its extensive capabilities including keylogging, screenshot capture, desktop video recording, file exfiltration, web browser content injection, and deployment of secondary malware payloads. Functioning as Malware-as-a-Service (MaaS), DanaBot enables affiliates to conduct a variety of cyberattacks without requiring deep technical expertise. The malware communicates with its command and control (C2) infrastructure using a custom binary protocol secured with RSA and AES encryption, enhancing its resilience against interception and analysis. It relies on hardcoded C2 servers and employs Tor as a fallback communication channel, complicating efforts to disrupt its operations. Historically, DanaBot has been leveraged in targeted espionage campaigns against government officials in the Middle East and Eastern Europe, as well as in distributed denial-of-service (DDoS) attacks targeting Ukrainian servers. The presence of over 50 known affiliate nicknames indicates a broad and decentralized operator base. The malware’s use of advanced techniques such as credential dumping (T1003), persistence mechanisms (T1543, T1547), lateral movement (T1090), and execution through user interaction (T1204) underscores its versatility and threat level. Despite the absence of known exploits in the wild for specific software vulnerabilities, DanaBot’s modularity and MaaS model make it a persistent and adaptable threat vector.

Detailed information about Operation Endgame 2.0. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Affecting Romania

Filter Threats

Threats Affecting Romania

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility