Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A spear phishing campaign targeting Polish entities has been observed, exploiting the CVE-2024-42009 vulnerability in Roundcube to steal user credentials. The campaign, attributed to UNC1151, involves sending emails with malicious JavaScript that installs a Service Worker in the victim's browser. This worker intercepts login attempts and sends credentials to the attackers. The exploit allows code execution when an email is opened. A new vulnerability, CVE-2025-49113, has also been discovered in Roundcube, potentially creating a more effective attack chain. The attackers use harvested credentials to analyze mailboxes, download address books, and spread further phishing messages. Organizations using Roundcube are advised to update their installations and review logs for indicators of compromise.

This threat involves a spearphishing campaign attributed to the threat actor UNC1151 targeting Polish entities by exploiting a critical vulnerability in the Roundcube webmail client, specifically CVE-2024-42009. Roundcube is a widely used open-source webmail solution deployed by many organizations for email access. The attack vector leverages malicious JavaScript embedded in spearphishing emails that, when opened, execute code allowing the installation of a Service Worker in the victim's browser. This Service Worker operates stealthily to intercept login attempts to Roundcube, capturing user credentials and transmitting them to attacker-controlled infrastructure. The exploit allows code execution simply upon opening the email, bypassing traditional security controls that rely on user interaction beyond opening the message. Additionally, a newly discovered vulnerability, CVE-2025-49113, in Roundcube may be chained with CVE-2024-42009 to create a more effective and persistent attack vector, potentially increasing the scope and impact of the campaign. After credential theft, UNC1151 uses the compromised accounts to analyze mailboxes, extract address books, and propagate further phishing emails internally, facilitating lateral movement and expanding their foothold within targeted organizations. The campaign employs advanced tactics such as service worker abuse (T1059.007), credential access (T1078), and spearphishing (T1566.001). Indicators of compromise include specific IP addresses, domains, URLs, and file hashes linked to the campaign. Organizations running Roundcube installations are urged to update their software promptly and conduct thorough log reviews for signs of compromise, such as unusual service worker registrations or unexpected login patterns.

Detailed information about UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign. Get real-time updates, technical details, and mit

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign - Live Threat Intelligence - Threat Radar | OffSeq.com

UNC1151 exploiting Roundcube to steal user credentials in a spearphishing campaign

Earth Lamia, an APT threat actor, has been targeting organizations in Brazil, India, and Southeast Asia since 2023. The group exploits web application vulnerabilities, particularly SQL injection, to gain access to targeted systems. They have developed custom tools like PULSEPACK backdoor and BypassBoss for privilege escalation. Earth Lamia's targets have shifted over time, initially focusing on financial services, then logistics and online retail, and recently IT companies, universities, and government organizations. The group employs various techniques including DLL sideloading, use of legitimate binaries, and development of modular backdoors. Earth Lamia's activities have been linked to other reported campaigns, suggesting a complex and evolving threat landscape.

Earth Lamia is an advanced persistent threat (APT) actor active since 2023, primarily targeting organizations across Brazil, India, and Southeast Asia. The group exploits web application vulnerabilities, with a notable emphasis on SQL injection attacks, to gain initial access to targeted systems. Their arsenal includes custom-developed malware such as the PULSEPACK backdoor and BypassBoss, which facilitate persistent access and privilege escalation respectively. Earth Lamia employs sophisticated techniques including DLL sideloading, leveraging legitimate binaries to evade detection, and modular backdoor architectures that allow flexible and adaptive operations. Their targeting has evolved over time, initially focusing on financial services, then expanding to logistics and online retail sectors, and more recently shifting towards IT companies, universities, and government organizations. The group’s tactics, techniques, and procedures (TTPs) align with multiple MITRE ATT&CK techniques such as T1053.005 (Scheduled Task/Job), T1592 (Gather Victim Host Information), T1587.001 (Develop Capabilities), T1140 (Deobfuscate/Decode Files or Information), and T1190 (Exploit Public-Facing Application), among others. Despite the lack of confirmed exploits in the wild for some referenced CVEs, the presence of multiple CVEs (including CVE-2017-9805 and several 2024-2025 vulnerabilities) suggests a broad exploitation scope. The group’s linkage to other campaigns and use of tools like Cobalt Strike and Brute Ratel further indicate a complex and evolving threat landscape with significant operational capabilities. The threat actor’s Chinese nexus and multi-industry targeting underscore a strategic intent to infiltrate diverse sectors for espionage or disruption purposes.

Detailed information about Custom Arsenal Developed to Target Multiple Industries. Get real-time updates, technical details, and mitigation strategies.

Custom Arsenal Developed to Target Multiple Industries - Live Threat Intelligence - Threat Radar | OffSeq.com

Custom Arsenal Developed to Target Multiple Industries

Salt Typhoon, a Chinese state-sponsored threat actor, has been targeting major telecommunications providers worldwide by exploiting vulnerabilities in network devices. This analysis tracks global exposures of internet-facing devices associated with Salt Typhoon activity over six months, including Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. Overall combined exposure decreased by 25%, with Sophos Firewall interfaces showing the largest reduction. Cisco IOS XE was the only platform with increased exposure. Geographically, most exposures remain concentrated in the United States, except for Sophos XG Firewall exposures in Germany. The persistence of exposed devices raises questions about remediation efforts and organizational responses to these threats.

Salt Typhoon is a Chinese state-sponsored threat actor that has been actively targeting major telecommunications providers globally by exploiting vulnerabilities in critical network infrastructure devices. The threat actor leverages multiple vulnerabilities, including CVE-2022-3236 and others linked to Sophos Firewalls, Cisco IOS XE WebUIs, Ivanti Connect Secure, and Fortinet FortiClient EMS systems. These devices are integral to network security and management, making their compromise highly impactful. Over a six-month tracking period, exposures of internet-facing devices vulnerable to Salt Typhoon activity have decreased by approximately 25%, with Sophos Firewall interfaces showing the most significant reduction. However, Cisco IOS XE WebUI exposures have increased, indicating a shifting attack surface. Geographically, while the majority of exposed devices remain in the United States, notable concentrations of Sophos XG Firewall exposures persist in Germany. The persistence of these exposures suggests incomplete remediation and potential gaps in organizational cybersecurity practices. The threat actor employs advanced tactics, techniques, and procedures (TTPs) such as remote code execution (T1203), credential access (T1078), lateral movement (T1021), and defense evasion (T1562), often deploying malware like ShadowPad and Masol RAT to maintain persistence and exfiltrate data. Despite no known exploits in the wild being reported at this time, the combination of exposed critical infrastructure devices and sophisticated adversary capabilities poses a substantial risk to targeted organizations. The lack of patch links and the presence of multiple CVEs indicate that vulnerabilities remain unpatched or partially mitigated in many environments, underscoring the need for urgent attention to these exposures.

Detailed information about The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices. Get real-time updates, technical details, 

The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices - Live Threat Intelligence - Threat Radar | OffSeq.com

The Persistent Threat of Salt Typhoon: Tracking Exposures of Potentially Targeted Devices

Trustwave SpiderLabs has identified ongoing malicious activities originating from Proton66 ASN, including vulnerability scanning, exploit attempts, and phishing campaigns. The investigation revealed connections between Proton66 and bulletproof hosting services advertised on underground forums. Mass scanning and exploit campaigns targeting multiple sectors were observed, with technology and financial organizations being the most common targets. A specific IP address linked to SuperBlack ransomware operators was found distributing critical exploits. The analysis also uncovered a potential rebranding of underground hosting services and shifts in IP addresses between different ASNs, suggesting relationships between providers.

The identified threat involves ongoing mass scanning and exploit campaigns orchestrated by the Proton66 ASN, a network associated with bulletproof hosting services frequently advertised on underground cybercrime forums. These campaigns encompass vulnerability scanning, exploit attempts, and phishing activities targeting multiple sectors, with a particular focus on technology and financial organizations. Proton66's infrastructure appears to be linked with the SuperBlack ransomware operators, as evidenced by a specific IP address distributing critical exploits. The campaigns leverage multiple critical vulnerabilities, including CVE-2024-10914, CVE-2024-55591, CVE-2024-41713, CVE-2025-24472, and CVE-2025-0108, indicating a broad and aggressive exploitation strategy. The threat actors demonstrate operational agility by rebranding underground hosting services and shifting IP addresses across different Autonomous System Numbers (ASNs), complicating detection and mitigation efforts. Although no confirmed exploits are currently observed in the wild, the presence of critical vulnerabilities and active scanning suggests a high risk of imminent exploitation. The use of bulletproof hosting ensures resilience against takedown attempts, enabling sustained malicious activity. The combination of mass scanning, exploitation attempts, and phishing campaigns indicates a multi-faceted approach aimed at compromising organizational networks, stealing credentials, deploying ransomware, and potentially disrupting services.

Detailed information about Mass Scanning and Exploit Campaigns. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'vulnerability exploitation'

Filter Threats

Threats Tagged 'vulnerability exploitation'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility