cyberthreat.zip

Cyber Threat intelligence Alert Contact: [email protected]

[cyberthreat.zip @cyberthreatzip]

C2: boatdealers[.]su, gokart[.]su, cecilioc2[.]xyz, sendtuna[.]com, ipmoyu[.]xyz, rebirth[.]st

ENS C2: m3rnbvs5d[.]eth

Full report: https://t.co/JmRsfdNuwX

[cyberthreat.zip @cyberthreatzip]

⚠️ JACKSKID: BEYOND A MIRAI FORK

Nokia Deepfield & Comcast exposed an advanced botnet with 80K+ samples & 13 releases in 5 months.

• Dual infection: Telnet + Android TV ADB
• 3-layer encryption: RC4+ChaCha20+TEA
• Fast-flux: 40-50 IPs/domain
• 17 DDoS attacks

[cyberthreat.zip @cyberthreatzip]

APT31's Arsenal:

SharpADUserIP (Recon)
SharpChrome (Password theft)
StickyNotesExtract (Data theft)
Tailscale VPN (Tunneling)
CloudSorcerer/OneDriveDoor (Cloud C2)
VtChatter (VirusTotal C2)
LocalPlugX (Lateral movement)
Various backdoors (Linux/Windows)

[cyberthreat.zip @cyberthreatzip]

APT31 (China) targeted Russian gov't IT contractors in 2025 & earlier. The group operated undetected for extended periods, gathering intelligence through sophisticated cyber espionage campaigns.

[cyberthreat.zip @cyberthreatzip]

APT31 (China) targeted Russian gov't IT contractors in 2025 & earlier. The group operated undetected for extended periods, gathering intelligence through sophisticated cyber espionage campaigns.

[cyberthreat.zip @cyberthreatzip]

⚠️ 7-Zip RCE Vulnerability

CVE-2025-11001: Critical vulnerability in 7-Zip! A malicious ZIP file can allow remote code execution on your computer. Simply opening the file is enough.

❕ Users are advised to update to 7-Zip version 25.00 or later.

[cyberthreat.zip @cyberthreatzip]

⚠️ OpenVPN RCE Vulnerability

CVE-2025-10680: High-severity flaw enabling authenticated VPN servers to execute OS commands on clients.

Scope: OpenVPN Client (Linux, macOS)
Requirement: --dns-updown enabled

[cyberthreat.zip @cyberthreatzip]

❕ Affected Versions:
FortiOS: 7.0.0 through 7.0.16 (upgrade to 7.0.17 or later).
FortiProxy: 7.0.0 through 7.0.19 (upgrade to 7.0.20 or later), and 7.2.0 through 7.2.12 (upgrade to 7.2.13 or later).

[cyberthreat.zip @cyberthreatzip]

⚠️ Fortinet FortiOS/FortiProxy Zero Day Vulnerability

CVE-2024-55591: (CVSS score: 9.6) is an authentication bypass vulnerability in FortiOS and FortiProxy. It allows attackers to gain super admin privileges through specially crafted Node.js websocket requests.

[cyberthreat.zip @cyberthreatzip]

✨🎉 A new year brings new opportunities and new goals!
At https://t.co/CGSRasEfw6, we’re here to ensure your growth and security in 2025. 🛡️💻

Wishing everyone a happy, healthy, and safe New Year! 🎄🎆
#CyberThreatZip #HappyNewYear2025

[cyberthreat.zip @cyberthreatzip]

⚠️ 7-Zip RCE Vulnerability

CVE-2024-11477: CVE-2024-11477: An integer underflow vulnerability in 7-Zip’s Zstandard decompression function (CVSS 7.8) allows attackers to execute malicious code.

❕ Users are advised to update to 7-Zip version 24.07 or later.

[cyberthreat.zip @cyberthreatzip]

⚠️ Palo Alto Networks Privilege escalation vulnerability

CVE-2024-9474: A privilege escalation vulnerability affecting authorized users.

[cyberthreat.zip @cyberthreatzip]

⚠️ Palo Alto Networks Authentication bypass vulnerability

CVE-2024-0012: An authentication bypass vulnerability in PAN-OS allows attackers to gain administrator privileges.

[cyberthreat.zip @cyberthreatzip]

Cumhuriyet, bağımsızlık ateşiyle yanan milletin en büyük zaferidir. 29 Ekim Cumhuriyet Bayramımız kutlu olsun!🇹🇷

[cyberthreat.zip @cyberthreatzip]

⚠️ DragonRank Hits IIS Servers in Asia, Europe

Over 35 IIS servers compromised using BadIIS malware and ASPXspy, exploiting web app vulnerabilities for SEO fraud.

[cyberthreat.zip @cyberthreatzip]

⚠️ Cisco Command Injection Flaw

CVE-2024-20469: Cisco Identity Services Engine (ISE) has a command injection vulnerability allowing local attackers with admin access to escalate privileges to root. Patch the system to mitigate the threat.

[cyberthreat.zip @cyberthreatzip]

❕Systems are not affected if IPv6 is disabled on the target machine.

[cyberthreat.zip @cyberthreatzip]

⚠️ Windows TCP/IP 0-Click RCE Vulnerability

CVE-2024-38063: Microsoft released an urgent update for a critical vulnerability. It allows remote code execution via specially crafted IPv6 packets. All Windows and Windows Server versions are affected.

[cyberthreat.zip @cyberthreatzip]

⚠️ Windows TCP/IP 0-Click RCE Vulnerability

CVE-2024-38063: Microsoft released an urgent update for a critical vulnerability. It allows remote code execution via specially crafted IPv6 packets. All Windows and Windows Server versions are affected.

[cyberthreat.zip @cyberthreatzip]

Our Telegram Channel is Opened

Our Telegram channel, where we make all announcements about cyber threats and security vulnerabilities, has been opened.

https://t.co/BZtiNeRkOw

[cyberthreat.zip @cyberthreatzip]

⚠️ Critical GeoServer RCE Flaw

CVE-2024-36401: GeoServer versions before 2.24.4, 2.25.2, and 2.23.6 have a critical RCE vulnerability (CVSS 9.8). Users should upgrade to the latest versions to mitigate the threat.

[cyberthreat.zip @cyberthreatzip]

This vulnerability allows authentication bypass in Active Directory, granting full admin access on ESXi hypervisors. Attackers can escalate privileges by creating or renaming an 'ESX Admins' group. Used on systems with prior access.

[cyberthreat.zip @cyberthreatzip]

⚠️VMware ESXi Authentication Bypass Vulnerability

CVE-2024-37085: VMware ESXi Vulnerability

On July 29, Microsoft announced that ransomware groups were exploiting a vulnerability identified as CVE-2024-37085.