Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

AhnLab Security Intelligence Center analyzed attacks on Windows web servers during Q2 2025 using their Smart Defense infrastructure. The study focused on poorly managed servers, categorizing attack types and malware strains. It revealed that multiple threat actors often target vulnerable servers simultaneously, exploiting unpatched systems or misconfigurations. Attackers typically use file upload vulnerabilities to deploy web shells and execute commands, but may also exploit framework or Web Application Server weaknesses. The analysis provides detailed statistics on the number of affected systems and the frequency of attacks, offering insights into the current threat landscape for Windows-based web servers.

The reported threat concerns a campaign targeting Windows-based web servers during Q2 2025, as analyzed by the AhnLab Security Intelligence Center using their Smart Defense infrastructure. The analysis highlights that attackers focus primarily on poorly managed and unpatched Windows web servers, exploiting vulnerabilities such as file upload flaws to deploy web shells. These web shells enable remote command execution, allowing attackers to control compromised servers. Besides file upload vulnerabilities, attackers also exploit weaknesses in web application frameworks and web application servers, including Microsoft IIS and Apache Tomcat, to gain unauthorized access. Multiple threat actors often simultaneously target the same vulnerable servers, indicating a highly contested attack surface. The campaign involves various malware strains, including the Wograt web shell, and employs multiple tactics aligned with MITRE ATT&CK techniques such as T1190 (Exploit Public-Facing Application), T1505.003 (Server Software Component), and T1071 (Application Layer Protocol). Indicators of compromise include numerous file hashes and a suspicious domain (linuxwork.net). Although no specific CVEs or known exploits in the wild are cited, the campaign's medium severity rating reflects the ongoing risk posed by unpatched or misconfigured Windows web servers exposed to the internet. The report provides valuable statistical insights into attack frequency and affected systems, underscoring the persistent threat landscape for Windows web servers in 2025.

Detailed information about Statistics Report on Malware Targeting Windows Web Servers in Q2 2025. Get real-time updates, technical details, and mitigation strat

Statistics Report on Malware Targeting Windows Web Servers in Q2 2025 - Live Threat Intelligence - Threat Radar | OffSeq.com

Statistics Report on Malware Targeting Windows Web Servers in Q2 2025

Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management systems. The threat actors deploy various web shells, including AntSword and Chopper, and use custom Rust-based loaders called TetraLoader to deliver Cobalt Strike beacons and VSHell malware. The attackers conduct reconnaissance, enumerate directories, and stage files for exfiltration. Their tooling and tactics indicate a high level of proficiency in the Chinese language, suggesting a Chinese origin for the threat group.

The threat involves a remote code execution (RCE) zero-day vulnerability identified as CVE-2025-0994 in Cityworks, a widely used asset management system primarily deployed by local government entities for utilities and infrastructure management. Since January 2025, a Chinese-speaking threat actor group known as UAT-6382 has been actively exploiting this vulnerability. The exploitation chain begins with the attackers leveraging the RCE flaw to gain unauthorized access to Cityworks servers. Once inside, they deploy multiple web shells, including AntSword and China Chopper variants, to maintain persistent access and facilitate further operations. The attackers utilize a custom Rust-based loader named TetraLoader to deliver advanced payloads such as Cobalt Strike beacons and VSHell malware, which are commonly used for command and control, lateral movement, and data exfiltration. Their activities include reconnaissance of the compromised environment, directory enumeration, and staging of files for exfiltration, indicating a focus on intelligence gathering and potential disruption or espionage. The tooling and operational tactics demonstrate a high level of sophistication and fluency in Chinese, strongly suggesting the threat actor’s origin. Despite the absence of publicly available patches or CVSS scoring, the exploitation of a zero-day in critical infrastructure management software combined with advanced malware deployment underscores a significant threat to targeted organizations.

Detailed information about Exploits Cityworks zero-day vulnerability to deliver malware. Get real-time updates, technical details, and mitigation strategies.

Title	Severity	Type	Source	Date

Threats Tagged 'web shells'

Filter Threats

Threats Tagged 'web shells'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility