Cyberattack Campaign Targeted CISCO Products; Impacting Cisco AsyncOS Software; Security Updates Released
Cisco Patched Zero-Day RCE Exploited by China-Linked APT in Secure Email Gateways
Continue ReadingNetwork security
TP-Link Security Update, Omada Gateway Exploits Fixed in October Releaseย
Summary:ย TP-Linkโs October 2025 security updates fixes 4 vulnerabilities in its Omada Gateway devices, including multiple models commonly used in business networks.
| OEM | TP-Link |
| Severity | Critical |
| CVSS Score | 9.3 |
| CVEs | CVE-2025-6541, CVE-2025-6542, CVE-2025-7850, CVE-2025-7851 |
| Date of Announcement | 2025-10-21 |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview:
The vulnerabilities allow attackers to execute remote commands, even without authentication, potentially compromising systems. Some vulnerabilities also let authenticated users inject commands or gain root access, which could lead to traffic interception, configuration changes or malware installation. Security teams are advised to update firmware immediately, review network configurations and change passwords to reduce the risk of exploitation.ย
| Vulnerability Name | CVE ID | Product Affected | Severity | CVSS Score |
| OS Command Injection Vulnerability | CVE-2025-6542 | TP-Link Omada Gateways | Critical | 9.3 |
| Command Injection Vulnerability | CVE-2025-7850 | TP-Link Omada Gateways | Critical | 9.3 |
Technical Summary:
TP-Link Omada Gateways allows attackers to run arbitrary commands. The most critical one, CVE-2025-6542, a remote attacker can take full control of the device without logging in through the web interface. Another one allows logged-in users to inject commands and gain root access. The issues show the risks of exposed management portals. TP-Link recommends updating firmware, limiting network access and monitoring systems for any signs of attack.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-6542 | TP-Link Omada Gateways (ER605, ER7206, ER8411 & Others) | Unauthenticated remote attackers can execute arbitrary OS commands on the device | Remote Code Execution, System Compromise, Malware Deployment |
| CVE-2025-7850 | TP-Link Omada Gateways (ER7412-M2, ER7212PC, & Others) | Command injection exploitable after admin authentication on the web portal | System Compromise, Root-Level Control |
Additional Vulnerabilities:
The following high-severity vulnerabilities were also addressed in October 2025 TP-Link security updates for Omada Gateways –
| Vulnerability Name | CVE ID | Affected Component | Severity |
| Authenticated Arbitrary OS Command Execution in Omada Gateways | CVE-2025-6541 | TP-Link Omada Gateways | High |
| Root Shell Access Under Restricted Conditions in Omada Gateways | CVE-2025-7851 | TP-Link Omada Gateways | High |
Remediation:
Install the October 2025 firmware updates immediately via the TP-Link support portal to mitigate risks. Here is the below table with the updated version information for the models.
| Model | Affected Versions | Fixed Version |
| ER8411 | < 1.3.3 Build 20251013 Rel.44647 | >= 1.3.3 Build 20251013 Rel.44647 |
| ER7412-M2 | < 1.1.0 Build 20251015 Rel.63594 | >= 1.1.0 Build 20251015 Rel.63594 |
| ER707-M2 | < 1.3.1 Build 20251009 Rel.67687 | >= 1.3.1 Build 20251009 Rel.67687 |
| ER7206 | < 2.2.2 Build 20250724 Rel.11109 | >= 2.2.2 Build 20250724 Rel.11109 |
| ER605 | < 2.3.1 Build 20251015 Rel.78291 | >= 2.3.1 Build 20251015 Rel.78291 |
| ER706W | < 1.2.1 Build 20250821 Rel.80909 | >= 1.2.1 Build 20250821 Rel.80909 |
| ER706W-4G | < 1.2.1 Build 20250821 Rel.82492 | >= 1.2.1 Build 20250821 Rel.82492 |
| ER7212PC | < 2.1.3 Build 20251016 Rel.82571 | >= 2.1.3 Build 20251016 Rel.82571 |
| G36 | < 1.1.4 Build 20251015 Rel.84206 | >= 1.1.4 Build 20251015 Rel.84206 |
| G611 | < 1.2.2 Build 20251017 Rel.45512 | >= 1.2.2 Build 20251017 Rel.45512 |
| FR365 | < 1.1.10 Build 20250626 Rel.81746 | >= 1.1.10 Build 20250626 Rel.81746 |
| FR205 | < 1.0.3 Build 20251016 Rel.61376 | >= 1.0.3 Build 20251016 Rel.61376 |
| FR307-M2 | < 1.2.5 Build 20251015 Rel.76743 | >= 1.2.5 Build 20251015 Rel.76743 |
Here are some recommendations below
- Restrict network access to the management interface and enable trusted networks only.ย
- Apply least privilege principles and regular security audits for network devices.ย
- Disable remote management if not required and segment networks to limit lateral movement.ย
Conclusion:ย
There is no active exploitation noticed but organizations must prioritize firmware updates to prevent data breaches, malware and intrusions. Security teams should deploy updates immediately, enhance monitoring and implement mitigations to safeguard critical infrastructure.ย
References:
ย
Telecom Network in New Yorkย Area Dismantled after Network Threat Detected
The US Secret Service, the agency in charge of security for the United Nations General Assembly, discovered a threatening network of over 300 servers and 10,000 SIM cards across the New York tri-state area.
The network could have โdisabled cell phone towers and potentially shut down the cellular network in New York City,โ Matt McCool, the special agent in charge of the Secret Serviceโs New York field office.
Key Points:
The network could also facilitate denial of service attacks and could send up to 30 million text messages per minute. All of the devices were found within 35 miles of the United Nations headquarters in Midtown Manhattan.
Analysis indicates cellular communications between nation-state threat actors and individuals that are known to federal law enforcement the report said.
The investigation into the devices is ongoing, the Secret Service said, but early forensic analysis indicates it was used for communications between โforeign actorsโ and people already known to federal law enforcement. No arrests have been announced, and investigators are still searching through the equivalent of 100,000 cell phones worth of data.
“This network had the potential to disable cell phone towers and essentially shut down the cellular network in New York City,” Matt McCool, special agent in charge of the Secret Service field office in New York, said in a video statement.
The telecommunications gear was recovered from so-called SIM farms housed in abandoned apartment buildings in at least five undisclosed sites. The devices discovered could be used to conduct a range of telecommunications attacks including disabling cell phone towers, enabling cybersecurity attacks and allowing encrypted communication between criminal groups and threat actors.
According to the Secret Service, the devices could facilitate a wide range of attacks on telecommunications systems, including disabling cell phone towers, enabling denial of service attacks.
This also allowed encrypted, anonymous communication between potential threat actors and criminal enterprises.
The forensic analysis indicates potential links between the network and overseas threat actors, as well as connections to individuals already known to federal law enforcement agencies.
According to Bloomberg, it is still unclear whether the network was connected to earlier incidents this year in which unknown individuals impersonated White House Chief of Staff Susie Wiles and Secretary of State Marco Rubio.
A full forensic review of the seized devices is ongoing as authorities continue to assess the scope and origins of the network.
Investigations started after threats to US officials
According to agents who spoke to the New York Times, the investigation began after anonymous telephonic threats were made against three US government officials earlier this year. One of the officials who was threatened worked with the Secret Service, while the other two were White House staffers.
State of crime
The agency first detected the New York-area SIM farm after it was linked to swatting incidents on Christmas Day in 2023. Those incidents involved Congresswoman Marjorie Taylor Greene and US Senator Rick Scott.
The cases were tied to two Romanian men, Thomasz Szabo and Nemanja Radovanovic, who were working with an American swatter, Alan Filion, also known as โTorswats.โ All three have since been convicted on swatting-related charges.
Ben Coon, head of intelligence at cybersecurity firm Unit 221b, believes there was little foreign state involvement, and the operation is based on financial crimes.
Images released by the Secret Service showed racks of neatly arranged telecom equipment, each component numbered and labeled. Cables were carefully laid out and secured, which could mean the operation was handled by well-resourced professionals.
The operation is linked to swatting incidents, organized crime groups, and nation-state actors, with equipment seized across New York and New Jersey.
Sources: https://www.telegraphindia.com/world/us-secret-service-dismantles-telecom-threat-network-in-new-york-ahead-of-un-general-assembly/cid/2124609
SEO Poisoning Campaign Targets IT Admins with Weaponized PuTTY & WinSCPย
SEO poisoning & malvertising campaign Summaryย
A sophisticated SEO poisoning and malvertising campaign has been active since early June 2025, targeting IT administrators with Trojanized installers of commonly used tools like PuTTY and WinSCP.
Attackers are manipulating search engine results and sponsored ads to lead users to fake websites, which deliver backdoored versions of these tools. Arctic Wolf security researchers have uncovered thia malvertising campaign that has been targeting IT professionals since early June 2025.
The malicious campaign leverages search engine manipulation to promote fake download sites that closely mimic legitimate software repositories.ย
Technical Summary
A threat campaign has been leveraging SEO poisoning and malicious advertisements to trick IT professionals into downloading Trojanized versions of PuTTY and WinSCP from fake websites. Once installed, a malware known as Oyster (aka Broomstick) creates persistent access within the victimโs environment, posing a severe risk to enterprise infrastructure.ย
This malware establishes persistence by creating a scheduled task that triggers every three minutes, invoking rundll32.exe to execute a malicious DLL named twain_96.dll using the DllRegisterServer export function, a technique commonly used to bypass traditional detection.ย ย
The attackers specifically target IT administrators and system operators due to their elevated privileges, which allows rapid lateral movement, access to sensitive systems such as domain controllers and the potential deployment of additional payloads like ransomware.
The campaignโs effectiveness stems from its exploitation of everyday workflows, especially IT adminsโ reliance on search engines to download tools making it both highly targeted and socially engineered for success.ย
| Element | Detail |
| Initial Access | SEO poisoning and fake sponsored ads redirect users to malicious download sites. |
| Malicious Tools | Trojanized installers of PuTTY and WinSCP. |
| Payload | Backdoor malware is known as Oyster/Broomstick. |
| Persistence | Scheduled Task every 3 minutes executing twain_96.dll using rundll32.exe via DllRegisterServer. |
| Target | IT admins with elevated privileges (Domain Admins, Server Admins). |
| Objective | Network penetration, domain controller access, data exfiltration, possible ransomware deployment. |
Malicious Sponsored PuTTY Ad on Bing. Source: Arcticwolf
Observed Malicious Domains
Organizations are urged to block the following domains immediately:
- updaterputty[.]comย
- zephyrhype[.]comย
- putty[.]runย
- putty[.]betย
- puttyy[.]orgย
These domains host fake versions of PuTTY and WinSCP and are actively used in the ongoing campaign.
Remediation:
1. Enforce Trusted Software Acquisition Policies
- Mandate the use of verified internal software repositories or direct access to official vendor websites.ย
- Where feasible, implement ad-blocking or web filtering to restrict access to software download categories known to be targeted by malvertising.ย
2. Strengthen Network and Endpoint Security Controls
- Block known malicious domains at firewall and DNS levels.ย
- Continuously monitor endpoints for suspicious behavior, including:ย
- The creation of unauthorized or high frequency scheduled tasks.ย
- DLL execution via rundll32.exe, especially involving non-standard DLLs such as twain_96.dll.ย
- Deploy or enhance EDR/XDR solutions to detect backdoor persistence methods.ย
3. User Awareness
- Educate IT staff on SEO poisoning and the risks of downloading tools via search results.ย
Conclusion:ย
By focusing on widely used administrative tools like PuTTY and WinSCP, threat actors are exploiting the trust and habits of IT professionals through convincing social engineering and poisoned search results.
This approach turns essential tools into delivery mechanisms for backdoors and persistent threats, compromising high-privilege users at the core of enterprise infrastructure.ย ย
Organizations must respond decisively by reinforcing endpoint monitoring, tightening software acquisition policies and implementing robust network-level defenses to mitigate the risks posed by this rapidly evolving threat landscape.
References:
RCE Risk in D-Link Routers due to Hardcoded Telnet Credentials
Summary A significant security flaw (CVE-2025-46176) has exposed thousands of D-Link routers to remote code execution attacks through hardcoded Telnet credentials embedded in firmware. This is affecting its DIR-605L and DIR-816L routers.
If successful exploitation happens this will enables attackers to modify router configurations, deploy malware, or pivot into internal networks.
| OEM | D-link |
| Severity | Medium |
| CVSS Score | 6.5 |
| CVEs | CVE-2025-46176 |
| Actively Exploited | No |
| Exploited in Wild | No |
| Advisory Version | 1.0 |
Overview
The flaw exposes devices to remote command execution (RCE) through hardcoded Telnet credentials.
The vulnerability has been rated medium in severity (CVSS 6.5), with no official firmware patch available as of May 2025.
| Vulnerability Name | CVE ID | Product Affected | Severity | Fixed Version |
| โHardcoded Telnet Credentials vulnerability | CVE-2025-46176 | D-Link Router | Medium | No official fix available |
Technical Summary
The vulnerability arises from hardcoded Telnet credentials in the router firmware, which allows unauthenticated remote attackers to execute arbitrary commands.
Firmware analysis revealed embedded credentials in configuration files used during Telnet service initialization.
Security experts recommended retiring these EOL devices due to absence of security support and the impossibility of removing hardcoded credentials through configuration changes.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-46176 | D-Link DIR-605L v2.13B01, DIR-816L v2.06B01 | Telnet service (/usr/sbin/telnetd -l /bin/sh -u Alphanetworks:$image_sign) uses hardcoded credentials from image_sign file, exposing plaintext passwords. | RCE |
Recommendations:
As of May 2025, no firmware updates are available to fix the vulnerability. Recommended temporary mitigations include :
- Disable Telnet access via the routerโs web interface.
- Block Telnet port (23) using firewall rules:
“iptables -A INPUT -p tcp –dport 23 -j DROP”
- Restrict WAN access to management interfaces.
- Monitor D-Linkโs official support page for firmware updates.
Conclusion:
Security researchers discovered the flaw through firmware analysis, revealing that both router models contain default Telnet credentials that cannot be changed by users.
While exploitation likelihood is currently assessed as low, vulnerability enables unauthenticated attackers to gain control of the routers, affecting confidentiality, integrity and availability.
Immediate mitigation is advised, especially for publicly exposed devices and Security experts strongly recommend retiring these EOL devices due to the absence of security support and the impossibility of removing hardcoded credentials through configuration changes.
Threat from Legacy Devices:
The vulnerability in Telnet revealed security risks that legacy networking equipment carry with them and is embedded hardcoded credentials in IoT devices.
Inadequate security, harboring multiple unpatched vulnerabilities and relying on inadequate security controls that fail to address underlying risks. This poses a threat not only to device itself, but also to the network and connected critical assets.
References:
Frequency & Sophistication of DDoS Attack rise to198% in 1stQ 2025
Ways to protect enterprise assets and infrastructure is not only a CISO’s responsibility but a cause of worry for CXO, CTO ‘s as a powerful DDoS attack can cause havoc on revenues, productivity and reputation.
Threat mitigation from any DDoS attack, requires services from secured and trusted partners who can offer expertise and scale whenever required to mitigate the threats that emerge from DDoS attack.
This is also important from cost point of view as large enterprise bear the burnout and it requires expertise to constantly monitor and clean the traffic that get routed to customer network.
It is important organization find service oriented partners who have skilled networking capacity and processing power so that in face of attack, they can automatically respond to DDoS attacks, detect and mitigate.
According to MazeBolt research, even the best DDoS protections leave enterprises highly exposed. Typically, large-scale, global organizations are only 60% protected – leaving the door wide open for cybercriminals to exploit the gaps.
Statistics show from past DDoS attacks have taken down large services like Spotify, GitHub, Microsoft services like Outlook and OneDrive.
According to new data released by Netscout, distributed denial of service (DDoS) attacks are on the rise. There were 17 million such attacks in 2024 โ up from 13 million the year before. Itโs an astonishing rise that has big implications for your business.
Defining DDoS attack
When a cyber criminal or malicious actor push for a service with additional requests than it can handle, making the resources unavailable and non-functional subsequently bringing it down.
In cases DDoS attack forcefully shuts a website, network, or computer offline by overloading it with requests. We often hear Black Friday sales out in big giant displays, these often drive a lot of internet traffic towards the brand or one destination at once.
A DDoS attack works when several different IP addresses target the same platform at same time that can overwhelm the server in question and bring it down.
Often, this attack is carried botnets which are a collection of devices when infected with malware, they can controlled remotely by cyber criminals. DDoS attack is executed by several different actors at the same time.
Increase in DDoS Attack in 2025
DDoS attacks increased by 198% compared to the last quarter of 2024 and by 358% compared to the same quarter last year.
On April 3 attack targeted an unnamed online betting organization, lasting around 90 minutes, starting at 11:15 with a surge of 67Gbps, before escalating sharply to 217Gbps by 11:23, and peaked just short of 1Tbps at 965Gbps by 11:36.
Research shows A total of 20.5 million DDoS attacks were stopped during the period, of which 6.6 million attacks were directly targeted at Cloudflareโs infrastructure. Gaming servers were the most popular target for DDoS attacks. Attack patterns remains spotted during the 2024 UEFA European Football Championship, held in Germany, where spikes in DDoS activity also targeted online betting sites.
In Geopolitics DDoS has emerged as a tool that is often and can be abused to target attacks.
According to research by NETSCOUT, the second half of 2024 saw almost 9 million DDoS attacks, a 12.75% increase from the first six months. Israel in particular saw a 2,844% increase in attacks, seeing a high of 519 in one day.
The above mentioned Russian hacking group, NoName057(16), focused primarily on government services in the UK, Belgium, and Spain. Georgia also saw a 1,489% increase in attacks in the lead up to the โRussia Billโ, highlighting its use as a political weapon.
Network-layer DDoS attacks were the primary driver of the overall surge. In Q1 2025, 16.8 million of these attacks were blocked, representing a 509% year-over-year rise and a 397% increase from the prior quarter.
Hyper-volumetric attacks, defined as those exceeding 1 terabit per second (Tbps) or one billion packets per second (Bpps), have become increasingly common. Cloudflare reported approximately 700 such attacks during the quarter, averaging about eight per day.
Major targets of DDoS attack
Globally, there have been notable changes in the most-targeted locations. Germany moved up four spots to become the most attacked country in Q1 2025.
Turkey made an 11-place jump to secure second position, while China dropped to third. Hong Kong, India, and Brazil also appeared among the top most-attacked countries, with movements seen across several regions in the rankings. Australia, for its part, remained outside the global top ten.
Industries facing the most pressure have shifted this quarter as well. The Gambling & Casinos sector moved to the top position as the most targeted industry, after climbing four places.
Telecommunications dropped to second, and Information Technology & Services followed in third.
Other industries experiencing notable increases in attacks included Cyber Security, which jumped 37 places, and Airlines, Aviation & Aerospace. In Australia, the industries facing the most attacks were Telecommunications, Information Technology and Services, Human Resources, and Consumer Services.
The report detailed attack vectors and trends, showing that the most common technique at the network layer remains SYN flood attacks, followed by DNS flood and Mirai-launched attacks.
Among HTTP DDoS attacks, more than 60% were identified and blocked as known botnets, with others attributed to suspicious attributes, browser impersonation, and cache busting techniques.
Cloudflare observed significant surges in two emerging attack methods. CLDAP reflection/amplification attacks grew by 3,488% quarter-over-quarter, exploiting the connectionless nature of the protocol to overwhelm victims with reflected traffic.
Similarly, ESP reflection/amplification attacks rose 2,301%, underscoring vulnerabilities in systems using the Encapsulating Security Payload protocol.
Despite the increase in the volume and size of attacks, the report noted that 99% of network-layer DDoS attacks in Q1 2025 were below 1 Gbps and one million packets per second.
Likewise, 94% of HTTP attacks fell below one million requests per second. Most attacks were short-lived, with 89% of network-layer and 75% of HTTP attacks ending within 10 minutes, but the impact can persist much longer due to the resulting service disruptions.
Addressing the rise of DDoS attack & Mitigation solution
DDoS attack intends to disrupt some or all of its targetโs services there are variety of DDoS attacks. They are all uniquely different. There are three common types of DDoS attacks:
- Volumetric (Gbps)
- Protocol (pps)
- Application layer (rps) attacks.
An effective DDoS attack is launched when near by network detects easily the cheap IoT devices like toys, small appliances, thermostats, security camera and Wi-Fi routers. These devices makes it easy to launch an effective attack that can have massive impact.
Threat Mitigation of DDoS attack
Application Layer attacks can be detected early with solutions by monitoring visitor behavior, blocking known bad bots and constant testing.
To do this more effectively Intrucept recently launched Cyber Analytics platform
Cyber Analytics platform ๐๐ฒ๐ฎ๐บ๐น๐ฒ๐๐๐น๐ ๐ฏ๐ฟ๐ถ๐ป๐ด๐ ๐๐ผ๐ด๐ฒ๐๐ต๐ฒ๐ฟ ๐๐ต๐ฒ ๐ฝ๐ถ๐น๐น๐ฎ๐ฟ๐ ๐ผ๐ณ ๐บ๐ผ๐ฑ๐ฒ๐ฟ๐ป ๐ฐ๐๐ฏ๐ฒ๐ฟ ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐ถ๐ป๐๐ผ ๐ผ๐ป๐ฒ ๐๐ป๐ถ๐ณ๐ถ๐ฒ๐ฑ ๐ฒ๐ฐ๐ผ๐๐๐๐๐ฒ๐บ ๐ถ.๐ฒ. ๐ฏ๐ฒ๐๐-๐ถ๐ป-๐ฐ๐น๐ฎ๐๐ ๐ฎ๐ ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐ฝ๐ฟ๐ผ๐ฑ๐๐ฐ๐๐.
โ
XDR (Extended Detection & Response)
โ
Next-Gen SIEM (Security Information & Event Management)
โ
SOAR (Security Orchestration, Automation & Response)
โ
Threat Intelligence
โ
AI-Powered Security Analytics
๐๐๐ฏ๐ฒ๐ฟ ๐๐ป๐ฎ๐น๐๐๐ถ๐ฐ๐ ๐ฑ๐ฒ๐น๐ถ๐๐ฒ๐ฟ๐:
Real-time threat detection across endpoints, cloud, networks, and apps
Automated incident response to reduce MTTR & human fatigue
AI-driven insights to power proactive, risk-based decision-making
Built for agility, scalability & actionable intelligence; our platform gives security teams the edge required to move from playing catch-up to staying ahead.
๐๐๐ฏ๐ฒ๐ฟ ๐๐ป๐ฎ๐น๐๐๐ถ๐ฐ๐ ๐ฟ๐ฒ๐ฝ๐ฟ๐ฒ๐๐ฒ๐ป๐๐ ๐ฎ ๐๐๐ฒ๐ฝ ๐ณ๐ผ๐ฟ๐๐ฎ๐ฟ๐ฑ ๐ถ๐ป ๐ฎ๐ฐ๐ต๐ถ๐ฒ๐๐ถ๐ป๐ด ๐ฏ๐ฒ๐๐๐ฒ๐ฟ ๐๐ฒ๐ฐ๐๐ฟ๐ถ๐๐ ๐ผ๐๐๐ฐ๐ผ๐บ๐ฒ๐.
DDoS attacks have skyrocketed 358% year-over-year, report says
Android Malware Crocodilus; Threat for cryptocurrency wallet Users
Crocodilus is a new banking malware that evades detection from Google’s play protect.
The Android malware has been specifically targeting to steal sensitive cryptocurrency wallet credentials through social engineering. Its convincing overlay screen warns users to back up their wallet key within 12 hours or risk losing access says security researchers.
Why threat researchers call this trojan ?
Crocodilus includes all the necessary features of modern banking malware: overlay attacks, keylogging, remote access, and โhiddenโ remote control capabilities. Also the malware is distributed via a proprietary dropper that bypasses Android 13 (and later) security protections as per researchers of Threat fabric.
Unlike any banking trojan which takes over devices, Crocodilus is similar in pattern and uses tactics to load a fake overlay on top of the real app to intercept the victimโs account credentials. These are targeted mostly for banking or cryptocurrency app users.
Another data theft feature of Crocodilus is a keylogger and the malware monitors all Accessibility events and captures all the elements displayed on the screen, i.e. it is an accessibility Logger.
Intricacies of Crocodilus Malware
The modus operandi of the malware makes it easier to preform task to gains access to accessibility service, to unlock access to screen content, perform navigation gestures, monitor for app launches.
The malware also offers remote access Trojan (RAT) functionality, which enables its operators to tap on the screen, navigate the user interface, perform swipe actions.
The malware is fitted with dedicated RAT command to take a screenshot of the Google Authenticator application and capture one-time password codes used for two-factor authentication account protection.
Android users are advised to avoid downloading APKs from outside Google Play and to ensure that Play Protect is always active on their devices.
Researchers discovered source code of malware revealing debug messages left by the developer(s), reveal Turkish speaking.
The Expanding Threat landscape with evolving Modern Malware’s
The Crocodilus malware designed to go after high valued assets that targets cryptocurrency wallets and Banks. These malware can make the defense line up of banking system weak and researchers advise to adopt a layered security approach that includes thorough device and behavior-based risk analysis on their customersโ devices.
Modern malware has the capability to break the security defenses of organization even if they are protected by cutting edge solutions to defend. As the threat landscape expand so are sophisticated attacks rising.
Modern malware can bypass most security solutions, including email filtering, anti-virus applications, sandboxing, and even IPS/IDS and sometime few file-less malware leaves no footprint on your computer and is executed exclusively in run-time memory.
In this sophisticated war against threat criminals enterprise security requires is taking services for active threat hunting and be diligent in scanning files meant for downloads.
To improve enterprise security the important aspects needs to be covered increase usage of multi-layer defenses. Protecting against modern malware is an ongoing effort, and rarely it is โset and forget.โ Utilize multiple layers of security, including anti-virus software, network layer protection, secure web gateways, and other tools for best results.
Keep improving your security posture against modern malware is an ongoing effort and includes multiple layers of security. With anti-virus software, advanced network layer protection, secure web gateways, and other tools the security posture at enterprise level increases.
Remember your best defenses can be in trouble, so continue monitoring, adapt and train employees, while using comprehensive multi-layer approach to security.
Source: https://www.threatfabric.com/blogs/exposing-crocodilus-new-device-takeover-malware-targeting-android-devices
Multiple High-Severity Vulnerabilities Patched in Zoomย ย
Summary
Multiple high-severity vulnerabilities have been identified in Zoom applications, including Zoom Workplace, Rooms Controller, Rooms Client, and Meeting SDK, causing exposure of Sensitive Data.
The most critical flaws, patched in Zoomโs March 11, 2025, security bulletin, include CVE-2025-27440 (heap-based buffer overflow), CVE-2025-27439 (buffer underflow), CVE-2025-0151 (use-after-free) CVE-2025-0150 (incorrect behavior order in iOS Workplace Apps).
All rated high severity with CVSS scores ranging from 7.1 to 8.5.
| OEM | Zoom |
| Severity | High |
| CVSS | 8.5 |
| CVEs | CVE-2025-27440, CVE-2025-27439, CVE-2025-0151, CVE-2025-0150, CVE-2025-0149 |
| Publicly POC Available | No |
| Patch/Remediation Available | Yes |
| Advisory Version | 1.0 |
Overview
These vulnerabilities could allow attackers to escalate privileges, execute arbitrary code, or cause denial-of-service (DoS) attacks. Zoom has released patches addressing these issues in version 6.3.0.
| Vulnerability Name | CVE ID | Product Affected | Severity | CVSS Score |
| Heap-Based Buffer Overflow Vulnerability | CVE-2025-27440 | ZOOM | High | 8.5 |
| Buffer Underflow Vulnerability | CVE-2025-27439 | ZOOM | High | 8.5 |
| Use-After-Free Vulnerability | CVE-2025-0151 | ZOOM | High | 8.5 |
| Incorrect Behavior Order Vulnerability | CVE-2025-0150 | ZOOM | High | 7.1 |
| Insufficient Data Verification Vulnerability | CVE-2025-0149 | ZOOM | Medium | 6.5 |
Technical Summary
These vulnerabilities could be exploited to gain unauthorized access, execute arbitrary code, or disrupt services through privilege escalation and memory corruption techniques. Exploitation requires authentication and network access, posing a risk to enterprise users.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-27440 | Zoom Workplace Apps (โฏWindows, macOS, and Linux, as well as mobile apps for iOS and Android.) | Heap-based buffer overflow, allowing attackers to inject malicious code | Privilege Escalation |
| CVE-2025-27439 | Zoom Workplace Apps | Buffer underflow, leading to unexpected crashes or data leakage | Denial of Service, Data Exposure |
| CVE-2025-0151 | Zoom Workplace Apps | Use-after-free issue leading to memory corruption and arbitrary code execution | Privilege Escalation |
| CVE-2025-0150 | Zoom Workplace Apps (iOS) | Incorrect behavior order allowing unauthorized access to authentication tokens | โฏInformation Disclosure |
| CVE-2025-0149 | Zoom Workplace Apps | Insufficient verification of data authenticity, allowing malformed network packets to bypass security checks | Denial of Service |
Remediation:
- Apply Patches Promptly: Ensure all Zoom applications are updated to version 6.3.0 or later, which includes fixes for 12 vulnerabilities disclosed in March 2025 alone.
Conclusion:
The recent vulnerabilities in Zoom highlight the ongoing challenges in securing widely used communication platforms. While Zoom has acted swiftly in providing patches, the recurrence of memory corruption and input validation flaws suggests architectural challenges.
Organizations should maintain a proactive security stance, ensuring timely updates and implementing stringent controls to safeguard sensitive data.
Organizations must treat Zoom not as a neutral utility but as a high-risk vector requiring stringent controls.
References:
High-Severity DoS Vulnerability in Cisco NX-OS Software
MPLS Encapsulated IPv6 Denial of Service Vulnerability
| OEM | CISCO |
| Severity | High |
| CVSS score | 7.4 |
| CVEs | CVE-2025-20111 |
| Exploited in Wild | No |
| Patch/Remediation Available | Yes |
| Advisory Version | 1.0 |
Overview
A high-severity vulnerability (CVE-2025-20111) in Cisco Nexus 3000 and 9000 Series Switches operating in standalone NX-OS mode could allow unauthenticated attackers to trigger a denial-of-service (DoS) condition by sending crafted ethernet frames, leading to unexpected device reloads.
| Vulnerability Name | CVE ID | Product Affected | Severity |
| Denial of service vulnerability | CVE-2025-20111 | Cisco Nexus | High |
Technical Summary
The vulnerability originates from improper handling of specific Ethernet frames within the health monitoring diagnostics of Cisco Nexus switches.
An unauthenticated, adjacent attacker can exploit this flaw by sending a sustained rate of crafted Ethernet frames to a vulnerable device. Successful exploitation results in repeated device reloads, disrupting network operations and potentially impacting high-availability environments.
| CVE ID | System Affected | Vulnerability Details | Impact |
| CVE-2025-20111 | Nexus 3000 Series: 3100, 3200, 3400, and 3600 models Nexus 9000 Series: 9200, 9300, and 9400 switches running standalone NX-OS | Improper handling of specific Ethernet frames in health monitoring diagnostics | Repeated device reboots, potential network downtime |
Remediation:
- Apply Software Updates: Cisco has released patched software versions to address the vulnerability. Network administrators should upgrade affected devices immediately.
- Use Cisco Software Checker: Organizations should verify their exposure using Ciscoโs Software Checker tool to identify the earliest fixed release.
- Implement Workarounds: If immediate patching is not feasible, organizations can mitigate risks using Access Control Lists (ACLs) to filter anomalous Ethernet frames targeting the health monitoring subsystem.
Conclusion:
CVE-2025-20111 presents a significant risk to enterprise and data center networks relying on Cisco Nexus switches. While there is no known active exploitation, organizations should prioritize patching and mitigation strategies to prevent service disruptions. Proactive monitoring and adherence to Ciscoโs security advisories will help ensure network resilience against potential exploitation.
References:
Convergence of IT & OT in Manufacturing witness Increased Cyber Attacks
Increasing cyberattacks on Industry 4.0
Continue Reading
Recent Comments