Threats tagged 'misp:automation-level="unsupervised"'

KRVTZ-NET IDS alerts for 2026-05-14

The KRVTZ-NET IDS alerts for 2026-05-13 report network reconnaissance activity primarily involving scanning by Exabot webcrawler user agents. Some IP addresses are associated with attempts to probe known vulnerabilities, including CVE-2023-27997 targeting Fortigate VPN's /remote/logincheck endpoint and CVE-2025-55182 related to unsafe property access in React Server Components (React2Shell). There is no evidence of confirmed exploitation or active attacks in this data. The activity is informational and categorized as low severity.

KRVTZ-NET IDS alerts for 2026-05-12

KRVTZ-NET IDS alerts for 2026-05-11

KRVTZ-NET IDS alerts for 2026-05-10

Maltrail IOC for 2026-05-10

KRVTZ-NET IDS alerts for 2026-05-09

Maltrail IOC for 2026-05-09

The KRVTZ-NET IDS alerts for May 8, 2026, report network reconnaissance and scanning activities, including exploit attempts targeting Fortigate VPN devices via repeated GET requests to the /remote/logincheck endpoint. These attempts are linked to CVE-2023-27997. The alert does not specify affected product versions or confirm successful exploitation. Known exploits in the wild exist, and the vulnerability is associated with CWE-122. Patch availability is not confirmed in this alert, and the severity is assessed as low.

KRVTZ-NET IDS alerts for 2026-05-07

Maltrail IOC for 2026-05-08

Maltrail IOC for 2026-05-07

Maltrail IOC for 2026-05-06

The KRVTZ-NET IDS alerts for 2026-05-05 report low-severity network reconnaissance activity involving multiple IP addresses linked to scanning and exploitation attempts. The alert includes indicators related to known vulnerabilities such as CVE-2025-55182 affecting React Server Components and CVE-2023-27997 targeting Fortigate VPN. No affected product versions or active exploitation in the wild are confirmed. Patch availability is not indicated, and no vendor advisories or specific mitigation instructions are provided. The activity primarily represents reconnaissance rather than confirmed successful exploitation.

This entry reports a Maltrail Indicator of Compromise (IOC) dated 2026-05-05, sourced from the CIRCL OSINT Feed. It is categorized as malware-related network activity with a medium severity rating. No specific affected versions or technical exploit details are provided. There is no patch available, and no known exploits in the wild have been identified. The information is based on open-source intelligence and manual collection methods.

KRVTZ-NET IDS alerts for 2026-05-04

Maltrail IOC for 2026-05-04

KRVTZ-NET IDS alerts for 2026-05-03

Maltrail IOC for 2026-05-03

KRVTZ-NET IDS alerts for 2026-05-02