Threats tagged 'deserialization'

Between May and September 2026, a Russian-speaking threat actor targeted Ukraine's state data-exchange infrastructure by exploiting Log4Shell vulnerabilities in Graylog servers. The attacker scanned millions of Ukrainian IP addresses to identify systems running UXP Verifier, a component of the national data-exchange platform. Using a two-stage CommonsBeanutils2 deserialization exploit delivered via Graylog's sessions API, the attacker gained access to at least two organizations, including a logging server containing millions of documents. The operation was exposed when the attacker accidentally served their working directory over HTTP, revealing tools and logs. Although the attacker queried transaction indices and showed knowledge of the system schema, no direct data exfiltration was observed. The campaign also involved failed exploitation attempts of other vulnerabilities.

Campaign#ukraine targeting#x-road platformUkraine

CVE-2025-55182, known as React2Shell, is a critical Remote Code Execution vulnerability affecting React Server Components (RSC) and related frameworks such as Next.js, Waku, and Vite. It arises from improper input deserialization in RSC payloads, enabling attackers to execute arbitrary code. Exploitation has been observed in cloud environments targeting containerized workloads, facilitating initial access, credential theft, cryptomining, and deployment of advanced backdoors. Public exploit code is available, and the vulnerability is actively exploited in the wild, including use in ransomware campaigns. No specific affected versions or patch information is provided. Detection templates exist to aid identification of exploitation attempts.