Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A routine monitoring by researchers uncovered an exploitation attempt on a honeypot server running TeamCity, a CI/CD tool. The attack exploited an exposed Java Debug Wire Protocol (JDWP) interface, leading to remote code execution, deployment of cryptomining payload, and establishment of multiple persistence mechanisms. The attack was notable for its rapid exploitation, use of a customized XMRig payload, and stealthy crypto-mining techniques. JDWP, designed for debugging Java applications, becomes a high-risk entry point when exposed to the Internet without proper authentication. The attackers used a structured sequence to achieve remote code execution, likely using a variant of jdwp-shellifier. They deployed a dropper script that installed an XMRig miner and set up various persistence mechanisms including boot scripts, systemd services, cron jobs, and shell configuration files.

The threat involves exploitation of exposed Java Debug Wire Protocol (JDWP) interfaces on publicly accessible servers, specifically targeting a TeamCity continuous integration/continuous deployment (CI/CD) tool instance. JDWP is a protocol used for debugging Java applications, which by design allows remote control and inspection of Java processes. When JDWP ports are left open and accessible from the internet without authentication or proper network restrictions, attackers can leverage this to gain remote code execution (RCE) capabilities. In the observed attack, threat actors used a variant of the jdwp-shellifier tool to execute arbitrary commands on the compromised host. The attack chain began with reconnaissance and rapid exploitation of the exposed JDWP port, followed by deployment of a dropper script that installed a customized version of the XMRig cryptocurrency miner. To maintain persistence, the attackers employed multiple mechanisms including boot scripts, systemd service units, cron jobs, and modifications to shell configuration files. The mining operation was conducted stealthily to avoid detection and maximize resource usage. This attack highlights the critical risk of exposing debugging interfaces like JDWP to untrusted networks, as it effectively bypasses authentication and allows full control over the Java process and underlying system. The use of TeamCity as a target is significant given its role in software development pipelines, potentially enabling further lateral movement or supply chain compromise. The attack also demonstrates a typical post-exploitation pattern of cryptojacking, which while not immediately destructive, can degrade system performance and increase operational costs. The lack of authentication on JDWP and the absence of network segmentation or firewall rules are key enablers for this threat. No specific affected versions or patches are noted, emphasizing that the vulnerability is a misconfiguration rather than a software flaw. The attack does not require user interaction once the JDWP port is exposed, and exploitation can be automated and rapid.

Detailed information about Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open. Get real-time updates, technical details, and mitiga

Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open - Live Threat Intelligence - Threat Radar | OffSeq.com

Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

AhnLab Security Intelligence Center analyzed attacks on Windows web servers during Q2 2025 using their Smart Defense infrastructure. The study focused on poorly managed servers, categorizing attack types and malware strains. It revealed that multiple threat actors often target vulnerable servers simultaneously, exploiting unpatched systems or misconfigurations. Attackers typically use file upload vulnerabilities to deploy web shells and execute commands, but may also exploit framework or Web Application Server weaknesses. The analysis provides detailed statistics on the number of affected systems and the frequency of attacks, offering insights into the current threat landscape for Windows-based web servers.

The reported threat concerns a campaign targeting Windows-based web servers during Q2 2025, as analyzed by the AhnLab Security Intelligence Center using their Smart Defense infrastructure. The analysis highlights that attackers focus primarily on poorly managed and unpatched Windows web servers, exploiting vulnerabilities such as file upload flaws to deploy web shells. These web shells enable remote command execution, allowing attackers to control compromised servers. Besides file upload vulnerabilities, attackers also exploit weaknesses in web application frameworks and web application servers, including Microsoft IIS and Apache Tomcat, to gain unauthorized access. Multiple threat actors often simultaneously target the same vulnerable servers, indicating a highly contested attack surface. The campaign involves various malware strains, including the Wograt web shell, and employs multiple tactics aligned with MITRE ATT&CK techniques such as T1190 (Exploit Public-Facing Application), T1505.003 (Server Software Component), and T1071 (Application Layer Protocol). Indicators of compromise include numerous file hashes and a suspicious domain (linuxwork.net). Although no specific CVEs or known exploits in the wild are cited, the campaign's medium severity rating reflects the ongoing risk posed by unpatched or misconfigured Windows web servers exposed to the internet. The report provides valuable statistical insights into attack frequency and affected systems, underscoring the persistent threat landscape for Windows web servers in 2025.

Detailed information about Statistics Report on Malware Targeting Windows Web Servers in Q2 2025. Get real-time updates, technical details, and mitigation strat

Statistics Report on Malware Targeting Windows Web Servers in Q2 2025 - Live Threat Intelligence - Threat Radar | OffSeq.com

Statistics Report on Malware Targeting Windows Web Servers in Q2 2025

A critical vulnerability (CVE-2025-30406) in Gladinet CentreStack and Triofox software has been discovered and is being actively exploited. The flaw involves hardcoded cryptographic keys in configuration files, allowing attackers to abuse ASPX ViewState for remote code execution. Affected versions include CentreStack below 16.4.10315.56368 and Triofox below 16.4.10317.56372. Exploitation leads to immediate compromise with potential for privilege escalation. Mitigation involves patching or changing machineKey values. Post-exploitation activities include downloading malicious DLLs, lateral movement, and installation of remote access tools like MeshCentral. Immediate action is recommended for vulnerable servers exposed to the internet.

CVE-2025-30406 is a critical security vulnerability affecting Gladinet CentreStack and Triofox software versions below 16.4.10315.56368 and 16.4.10317.56372 respectively. The root cause of the vulnerability is the presence of hardcoded cryptographic keys within configuration files that protect the ASP.NET ViewState data. ViewState is a mechanism used in ASP.NET applications to preserve page and control state between HTTP requests, relying on cryptographic keys to ensure the integrity and confidentiality of the data. Because the keys are hardcoded and thus predictable, attackers can craft malicious ViewState payloads that the server accepts as valid, bypassing protections. This flaw enables remote code execution (RCE) on vulnerable servers without requiring authentication or user interaction, leading to immediate system compromise. Furthermore, attackers can escalate privileges, gaining elevated access rights on the compromised system.

Post-exploitation activities observed include downloading malicious DLL files, lateral movement within internal networks, and installation of remote access tools such as MeshCentral, which provide persistent access and further control over the environment. The vulnerability primarily targets internet-facing servers running vulnerable versions of CentreStack or Triofox, which are enterprise file sharing and synchronization platforms widely used in corporate environments. Exploitation leverages the ASP.NET ViewState mechanism by abusing weak cryptographic protections due to hardcoded keys, undermining the confidentiality and integrity of the ViewState data and enabling arbitrary code injection.

Mitigation requires immediate patching by applying vendor updates or upgrading to fixed versions. If patches are unavailable, changing the machineKey values to unique, strong cryptographic keys invalidates the hardcoded keys and prevents exploitation. Additional defensive measures include network segmentation, restricting internet exposure, monitoring for specific indicators of compromise such as known malicious file hashes and suspicious domains (e.g., rtb.mftadsrvr.com), and hardening ASP.NET configurations by disabling ViewState if not required or enabling strong MAC validation. Given the active exploitation in the wild and the severity of the impact, organizations using these products must prioritize remediation and monitoring to prevent compromise and lateral movement within their networks.

Detailed information about CVE-2025-30406 - Critical Gladinet CentreStack & Triofox Vulnerability Exploited In The Wild. Get real-time updates, technical detail

Title	Severity	Type	Source	Date

Threats Tagged 'remote code execution'

Filter Threats

Threats Tagged 'remote code execution'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility