Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit BlueTeam

Reddit ThreatIntel

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions.

CVE-2025-6250 is a high-severity vulnerability affecting BeyondTrust Privilege Management for Windows versions prior to 25.4.270.0. The vulnerability arises from improper handling of elevated processes, specifically when the Windows Management Instrumentation Command-line (wmic.exe) is executed with a full administrative token. Under these conditions, a user with elevated privileges can stop the Defendpoint service, which is protected by anti-tamper mechanisms designed to prevent unauthorized modifications. By stopping this service, the attacker effectively bypasses these protections. Once the Defendpoint service is disabled, the attacker can escalate privileges by adding themselves to the local Administrators group, thereby gaining the ability to run any process with elevated permissions. This vulnerability is classified under CWE-424 (Improper Protection of Privileges), indicating a failure to adequately protect privileged operations. The CVSS v4.0 score of 7.1 reflects a high severity, with the vector indicating that the attack requires local access (AV:L), low attack complexity (AC:L), privileges required are high (PR:H), no user interaction (UI:N), and results in high impact on confidentiality, integrity, and availability (VC:H/VI:H/VA:H). There are no known exploits in the wild at the time of publication, and no patches have been linked yet. The vulnerability affects the core functionality of privilege management, potentially allowing malicious insiders or compromised accounts with elevated privileges to gain full administrative control over affected systems.

Detailed information about CVE-2025-6250: CWE-424 in BeyondTrust Privilege Management for Windows affecting BeyondTrust Privilege Management for Windows. Get re

CVE-2025-6250: CWE-424 in BeyondTrust Privilege Management for Windows - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-6250: CWE-424 in BeyondTrust Privilege Management for Windows

Threats Tagged 'cve-2025-6250'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-6250'

Lead Pen Test Professional