Threats tagged 'mdifyloader'

Malware campaigns exploiting vulnerabilities in Ivanti Connect Secure devices, specifically CVE-2025-0282, have been active from December 2024 through July 2025. Attackers use MDifyLoader to side-load Cobalt Strike Beacon DLLs, along with vshell RAT and Fscan network scanner, to maintain persistent access. Initial access is gained via brute-force attacks, direct exploitation, and stolen credentials. The threat actors employ advanced lateral movement, persistence mechanisms such as domain account creation and malware service/task registration, and evasion techniques including use of legitimate files and ETW bypasses. European organizations using Ivanti Connect Secure devices are particularly targeted. The threat is assessed as medium severity due to moderate impact and exploitation complexity. No public exploits are currently available.

KEVEPSS 99%Report on CVE-2025-0282MalwareCWE-121#cobalt strikeGermany+9