Vulnerabilities - Cybersec Sentinel

Vulnerabilities

A collection of 16 posts

CVE-2025-53770 and CVE-2025-53771 Abused in Active Attacks on On-Prem SharePoint

Vulnerabilities

CVE-2025-53770 and CVE-2025-53771 Abused in Active Attacks on On-Prem SharePoint

Threat Group: Linen Typhoon, Violet Typhoon, Storm-2603 Threat Type: Remote Code Execution & Spoofing Exploited Vulnerabilities: CVE-2025-53770 (RCE), CVE-2025-53771 (Spoofing) Malware Used: ToolShell (spinstall0.aspx) Threat Score: 🔴 High (8.0/10) – Active exploitation by nation-state actors, persistent access via cryptographic theft, and potential lateral movement across enterprise networks. Last Threat

Fortinet Vulnerabilities Targeted as APT41 Deploys KEYPLUG

Fortinet Vulnerabilities Targeted as APT41 Deploys KEYPLUG

Threat Group: APT41 (RedGolf, BrazenBamboo, Grayfly, Wicked Panda) Threat Type: APT, Malware, Backdoor Exploited Vulnerabilities: CVE-2023-48788 (FortiClient EMS), CVE-2022-40684 (FortiOS/FortiProxy/FortiSwitchManager) Malware Used: KEYPLUG (Windows and Linux variants), DEEPDATA (distinct APT41 toolset) Threat Score: 🔥 Critical (8.8/10) – Due to threat actor sophistication, vulnerability severity, and cross-platform malware capabilities.

Active Exploitation of NTLM Hash Theft in Windows via CVE-2025-24054

Vulnerabilities

Active Exploitation of NTLM Hash Theft in Windows via CVE-2025-24054

Threat Group: Unattributed (suspected infrastructure overlap with APT28); prior similar CVE exploited by UAC-0194 and Blind Eagle (APT-C-36) Threat Type: NTLM Hash Theft, Relay Attack Vector Exploited Vulnerabilities: CVE-2025-24054 (NTLM Hash Disclosure via .library-ms), variant of CVE-2024-43451 Malware Used: None directly tied; secondary payloads possible (RATs, e.g., SparkRAT in

UEFI Secure Boot Vulnerability Highlighted in CVE 2024 7344

Vulnerabilities

UEFI Secure Boot Vulnerability Highlighted in CVE 2024 7344

Threat Group: N/A Threat Type: Vulnerability Exploitation Exploited Vulnerabilities: CVE-2024-7344 Malware Used: Custom PE Loader with Encrypted Payload Threat Score: High (9.2/10) – Due to its ability to bypass foundational security mechanisms like UEFI Secure Boot, enabling undetectable and persistent compromises. Overview CVE-2024-7344 is a critical vulnerability found

DoubleClickjacking Exploit Turns Your Clicks into Chaos

DoubleClickjacking Exploit Turns Your Clicks into Chaos

Threat Group: Unattributed Threat Type: Clickjacking Variant Exploited Vulnerabilities: User Interface (UI) Redressing Vulnerabilities Malware Used: None Threat Score: High (8.0/10) – Due to its ability to bypass existing clickjacking defenses and exploit common user interactions. Last Threat Observation: January 3, 2025 Overview DoubleClickjacking is an advanced form of

Evolving Techniques in Cloud Atlas Cyber Attacks

Evolving Techniques in Cloud Atlas Cyber Attacks

Threat Group: Cloud Atlas (also known as Inception) Threat Type: Advanced Persistent Threat (APT) Exploited Vulnerabilities: * CVE-2017-11882: Memory corruption in Microsoft Office. * CVE-2018-0802: Formula editor vulnerability in Microsoft Office exploited via malicious RTF files. Malware Used: * VBShower: Polymorphic VBS-based backdoor. * PowerShower: PowerShell-based malware for reconnaissance and lateral movement. * VBCloud: New

FortiWLM Security Alert Critical Remote Code Execution Flaw Discovered

Vulnerabilities

FortiWLM Security Alert Critical Remote Code Execution Flaw Discovered

Threat Group: Unknown Threat Actor(s) Threat Type: Remote Code Execution (RCE) Exploited Vulnerabilities: CVE-2023-34990 (Critical) Malware Used: None identified Threat Score: High (9.8/10) – Due to remote code execution potential, unauthenticated access, and widespread use in enterprise environments. Last Threat Observation: December 2024 Overview CVE-2023-34990 is a critical

APT-K-47 Deploys Enhanced Asyncshell to Exploit Vulnerabilities

APT-K-47 Deploys Enhanced Asyncshell to Exploit Vulnerabilities

Threat Group: Mysterious Elephant (APT-K-47) Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: WinRAR Vulnerability (CVE-2023-38831) Malware Used: Asyncshell (versions 1 through 4), ORPCBackdoor, MSMQSPY Threat Score: High (8.5/10) — Due to its targeted approach, advanced obfuscation techniques, and evolving attack vectors. Last Threat Observation: November 27, Overview APT-K-47,

GNU Wget Exposed by Malicious URI Handling in CVE-2024-38428

GNU Wget Exposed by Malicious URI Handling in CVE-2024-38428

Threat Group: N/A Threat Type: Software Vulnerability Exploited Vulnerabilities: CVE-2024-38428 Malware Used: N/A Threat Score: High (9.1/10) — Critical vulnerability due to potential for sensitive data exposure, phishing, and man-in-the-middle (MiTM) attacks. Last Threat Observation: June 2, 2024, fix commit pushed; vulnerability classified in August 2024. Overview

Palo Alto Confirms Ongoing Exploits Against PAN OS Management Interfaces

Palo Alto Confirms Ongoing Exploits Against PAN OS Management Interfaces

Threat Group: Unknown Threat Type: Remote Code Execution (RCE) Vulnerability Exploited Vulnerabilities: PAN-OS Firewall Management Interface Malware Used: Web Shells Threat Score: High (9.3/10) — Due to the critical nature of the vulnerability allowing unauthenticated remote command execution. Last Threat Observation: November 16, 2024. Overview Palo Alto Networks has