A persistent nine-month RondoDoX botnet campaign has been targeting IoT devices and web applications. The threat actors have recently shifted to weaponizing a critical Next.js vulnerability, deploying malicious payloads like 'React2Shell' and cryptominers. The campaign, spanning from March to December 2025, shows quick adaptation to latest attack trends. The activity is divided into three phases: initial reconnaissance, web application exploitation, and IoT botnet deployment. The attackers have been using multiple command and control servers and deploying various malware variants. The campaign has intensified in December 2025 with a focus on Next.js exploitation. The impact includes widespread IoT device compromise, Next.js application risks, credential harvesting, and persistent multi-architecture threats.
A critical remote code execution vulnerability (CVE-2025-6389) in the Sneeit Framework WordPress plugin is actively exploited in the wild, allowing unauthenticated attackers to execute code on affected servers. This can lead to the creation of malicious admin accounts or backdoors. Simultaneously, an ICTBroadcast vulnerability (CVE-2025-2611) is being exploited to spread the Frost DDoS botnet, which incorporates exploits for multiple CVEs. The attacks are part of a small, targeted campaign against a limited number of vulnerable internet-exposed systems.
The UNC1151 threat actor is conducting a spearphishing campaign exploiting a critical vulnerability (CVE-2024-42009) in the Roundcube webmail client. Malicious JavaScript embedded in phishing emails installs a stealthy Service Worker in victims' browsers upon opening the email, intercepting login credentials and exfiltrating them without further user interaction. A second vulnerability (CVE-2025-49113) may be chained to increase persistence and impact. Stolen credentials enable attackers to access mailboxes, harvest address books, and propagate phishing internally, facilitating lateral movement. The campaign primarily targets Polish organizations but also threatens neighboring Central European countries with significant Roundcube deployments. Organizations are urged to patch vulnerabilities, monitor for unusual Service Worker activity, enforce multi-factor authentication, and enhance email filtering to mitigate risks.
Earth Lamia is an advanced persistent threat (APT) actor active since 2023, targeting organizations primarily in Brazil, India, and Southeast Asia. The group exploits web application vulnerabilities, notably SQL injection, to gain initial access. They have developed custom malware tools such as the PULSEPACK backdoor and BypassBoss for privilege escalation. Their targeting has evolved from financial services to logistics, online retail, IT companies, universities, and government organizations. Techniques used include DLL sideloading, leveraging legitimate binaries, and modular backdoor deployment. The group's campaigns are linked to other reported activities, indicating a sophisticated and evolving threat actor.
Salt Typhoon is a Chinese state-sponsored threat actor targeting major telecommunications providers globally by exploiting vulnerabilities in various network devices. This analysis monitors exposures of internet-facing devices linked to Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction, while Cisco IOS XE exposure increased. Most exposures are concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices suggests ongoing challenges in remediation and organizational response.
