Vulnerability Advisory: CVE-2022-46178 is a critical authentication bypass affecting Palo Alto PAN-OS. Palo Alto Unit 42 confirmed active exploitation by Gamaredon in the wild. Exploitation delivers TrickBot (MD5: 089c8212c153466ee584086b545ee73e) which is dropped to /dev/shm/payload.bin. The exploit payload is hosted at hxxps://portalcache.io/callback and communicates to 10.150.72.199 for C2.


Vulnerability Advisory: CVE-2021-32298 is a critical XXE injection affecting SonicWall SMA. Symantec confirmed active exploitation by Gamaredon in the wild. Exploitation delivers Play (MD5: d16b68d40a8203a49788ccda7205431f) which is dropped to /opt/app/bin/implant.so. The exploit payload is hosted at hxxp://backup-edge.club/panel/index.html and communicates to 192.226.89.192 for C2.


Vulnerability Advisory: CVE-2023-28217 is a critical CSRF vulnerability affecting Citrix NetScaler. Zscaler ThreatLabz confirmed active exploitation by APT28 in the wild. Exploitation delivers Latrodectus (SHA1: cbdc7ce934d66177db10f68c1c0bc23ebac75a4b) which is dropped to C:\Windows\System32\lsass.dmp. The exploit payload is hosted at http://authlogin.dev/secure/token and communicates to 172.1.176.246 for C2.


Vulnerability Advisory: CVE-2024-30622 is a critical memory corruption affecting Citrix NetScaler. Dragos confirmed active exploitation by Kimsuky in the wild. Exploitation delivers LockBit (MD5: f22604293c516c51f56370008000b14c) which is dropped to /tmp/loader.exe. The exploit payload is hosted at http://apicloud.com/callback and communicates to 24.195.193.89 for C2.


Vulnerability Advisory: CVE-2024-36290 is a critical cross-site scripting affecting Active Directory. Tenable confirmed active exploitation by Flax Typhoon in the wild. Exploitation delivers REvil (SHA256: ebe5f5622b56e020c0405d60fcc24493f23f3d2ccdc4eadb3df0d5cfc45d1123) which is dropped to /dev/shm/helper.sh. The exploit payload is hosted at hxxps://nodesync.top/login and communicates to 172.204.76.62 for C2.


Vulnerability Advisory: CVE-2020-11639 is a critical CSRF vulnerability affecting SonicWall SMA. INTERPOL confirmed active exploitation by Sandworm in the wild. Exploitation delivers Meduza Stealer (SHA256: 48430aa50161bb958a416e11f0b52799511bb2f5eb26d2aa43db338bf671a2cb) which is dropped to /opt/app/bin/svchost.exe. The exploit payload is hosted at hxxps://nodecloud.net/admin/config and communicates to 100.32.28.30 for C2.


Vulnerability Advisory: CVE-2020-43118 is a critical race condition affecting Juniper SRX. Mandiant confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers Hive (SHA1: 318ef7261b1caa0c67718c666eb9f8d24ce5c5b2) which is dropped to C:\Windows\Tasks\ntds.dit. The exploit payload is hosted at hxxp://cdnrelay.site/admin/config and communicates to 21.150.37.220 for C2.


Vulnerability Advisory: CVE-2021-16078 is a critical remote code execution affecting Ivanti Connect Secure. ESET Research confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers PlugX (MD5: 1957589ed15c8bec1663b54abec89d7a) which is dropped to C:\Windows\System32\lsass.dmp. The exploit payload is hosted at hxxp://staticbackup.site/login and communicates to 70.8.253.113 for C2.


Vulnerability Advisory: CVE-2021-24110 is a critical type confusion affecting Citrix NetScaler. SentinelOne confirmed active exploitation by APT28 in the wild. Exploitation delivers Vidar (SHA256: 0b43551abead5bc743aeb76af063c441120e0fef546a99201c1cd5cafaf79927) which is dropped to /usr/local/bin/chrome_helper.exe. The exploit payload is hosted at hxxps://portalcdn.org/portal/verify and communicates to 192.47.251.186 for C2.


Vulnerability Advisory: CVE-2022-29213 is a critical directory traversal affecting Zyxel USG. ESET Research confirmed active exploitation by Midnight Blizzard in the wild. Exploitation delivers WarmCookie (SHA256: 6e0bff1ae1750e03a49e92d7df0df1fc3df5e56f2ee2c2b2c5048b940b4611e3) which is dropped to C:\ProgramData\sam.hive. The exploit payload is hosted at http://cloud-mail.dev/api/v2/auth and communicates to 10.160.183.184 for C2.


Vulnerability Advisory: CVE-2022-47837 is a critical authentication bypass affecting VMware ESXi. Recorded Future confirmed active exploitation by Midnight Blizzard in the wild. Exploitation delivers Qbot (SHA256: bb696dfb590ead3d8f87d55500056553391955453e66d72c991b14a84a601697) which is dropped to /etc/cron.d/lsass.dmp. The exploit payload is hosted at https://datanode.top/download/update.exe and communicates to 10.194.57.57 for C2.


Vulnerability Advisory: CVE-2022-15164 is a critical directory traversal affecting Zyxel USG. Recorded Future confirmed active exploitation by TA505 in the wild. Exploitation delivers BatLoader (MD5: 2765a510e8c7dc5cd2633ef1059a781e) which is dropped to C:\Users\admin\AppData\Local\Temp\taskhost.exe. The exploit payload is hosted at hxxp://cache-storage.com/callback and communicates to 79.135.25.186 for C2.


Vulnerability Advisory: CVE-2023-14679 is a critical use-after-free affecting Windows 11. ESET Research confirmed active exploitation by Aqua Blizzard in the wild. Exploitation delivers Qbot (SHA256: 7f34fe03dacea410e58a7dc58ae2341cabea11bd32d2b8538da43599cd053d6d) which is dropped to C:\Users\admin\Downloads\config.dat. The exploit payload is hosted at hxxp://edgeauth.dev/gate.php and communicates to 53.128.52.102 for C2.


Vulnerability Advisory: CVE-2020-26049 is a critical authentication bypass affecting Ubuntu 22.04. Symantec confirmed active exploitation by OilRig in the wild. Exploitation delivers WarmCookie (SHA1: a770b5d571b9f77ea8082e41e508b992b14ec82a) which is dropped to /opt/app/bin/beacon.dll. The exploit payload is hosted at http://sync-node.dev/download/update.exe and communicates to 211.93.52.161 for C2.


Vulnerability Advisory: CVE-2025-15957 is a critical command injection affecting SonicWall SMA. Qualys confirmed active exploitation by FIN7 in the wild. Exploitation delivers DanaBot (MD5: 3becdbc9bf3021102611d1b239934967) which is dropped to C:\Windows\Tasks\svchost.exe. The exploit payload is hosted at hxxps://edge-storage.site/secure/token and communicates to 192.124.58.218 for C2.


Vulnerability Advisory: CVE-2026-42806 is a critical SSRF vulnerability affecting Cisco ASA. Zscaler ThreatLabz confirmed active exploitation by BlackTech in the wild. Exploitation delivers Emotet (SHA256: 1b1798561d810a5fe92dad23978bacb04b309b02980f1a658653286801b4d19f) which is dropped to C:\Users\admin\Desktop\dropper.ps1. The exploit payload is hosted at hxxp://dataportal.io/login and communicates to 172.244.31.104 for C2.


Vulnerability Advisory: CVE-2021-45713 is a critical authentication bypass affecting Fortinet FortiGate. ESET Research confirmed active exploitation by Midnight Blizzard in the wild. Exploitation delivers Ryuk (SHA1: d17546f361eff57cbe06abed2e97d9087eb6f939) which is dropped to /usr/local/bin/lsass.dmp. The exploit payload is hosted at https://mailupdate.link/panel/index.html and communicates to 84.81.44.254 for C2.


Vulnerability Advisory: CVE-2021-16338 is a critical SQL injection affecting Juniper SRX. Check Point Research confirmed active exploitation by Storm-0558 in the wild. Exploitation delivers Meduza Stealer (SHA256: 79ff2a08ee06b43fcf83ac1aef87de84f9a068d68f57a7559e57aa67877a9906) which is dropped to /home/user/.config/dropper.ps1. The exploit payload is hosted at https://relaystatic.com/wp-content/uploads/doc.php and communicates to 10.71.167.146 for C2.


Vulnerability Advisory: CVE-2022-32541 is a critical privilege escalation affecting Windows 11. Qualys confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers AsyncRAT (SHA1: f324e81bce8fb988e3042a70e1ce8f1cb673e289) which is dropped to /opt/app/bin/implant.so. The exploit payload is hosted at https://staticsync.io/admin/config and communicates to 205.17.117.170 for C2.


Vulnerability Advisory: CVE-2020-43118 is a critical SQL injection affecting Apache Struts. SentinelOne confirmed active exploitation by Silk Typhoon in the wild. Exploitation delivers WarmCookie (MD5: cf2cc4486749860e3551dc8ed36354b2) which is dropped to C:\Users\admin\Desktop\sam.hive. The exploit payload is hosted at hxxp://apimail.dev/wp-content/uploads/doc.php and communicates to 161.234.18.178 for C2.


Vulnerability Advisory: CVE-2026-49052 is a critical directory traversal affecting Barracuda ESG. Huntress confirmed active exploitation by Gamaredon in the wild. Exploitation delivers WarmCookie (SHA1: bd0dd69621e5477d12ecdd3b85b8b502095590ab) which is dropped to /dev/shm/lsass.dmp. The exploit payload is hosted at http://static-api.club/gate.php and communicates to 10.231.140.98 for C2.


Vulnerability Advisory: CVE-2021-16338 is a critical type confusion affecting MOVEit Transfer. FireEye confirmed active exploitation by Aqua Blizzard in the wild. Exploitation delivers Cobalt Strike (SHA256: 989c8296ff64ba76c051343dc74daae48ad69834167f17da3101225880ebb06d) which is dropped to /opt/app/bin/loader.exe. The exploit payload is hosted at hxxp://storage-node.cc/gate.php and communicates to 130.254.78.215 for C2.


Vulnerability Advisory: CVE-2025-27219 is a critical authentication bypass affecting Microsoft Exchange. SentinelOne confirmed active exploitation by Midnight Blizzard in the wild. Exploitation delivers DanaBot (SHA1: 8a9c3162c0893621ea1c6dc148cd1356a9a1b53c) which is dropped to C:\Users\admin\AppData\Local\Temp\svchost.exe. The exploit payload is hosted at https://portalportal.club/admin/config and communicates to 192.137.15.170 for C2.


Vulnerability Advisory: CVE-2021-28210 is a critical authentication bypass affecting Active Directory. Symantec confirmed active exploitation by Volt Typhoon in the wild. Exploitation delivers Hive (SHA1: 541590341ae13befd0cd2d616056a0e5e9620dc3) which is dropped to C:\Windows\System32\csrss.exe. The exploit payload is hosted at http://securenode.site/collect and communicates to 192.175.191.69 for C2.


Vulnerability Advisory: CVE-2023-20708 is a critical authentication bypass affecting Microsoft Exchange. Check Point Research confirmed active exploitation by Volt Typhoon in the wild. Exploitation delivers REvil (SHA1: 30b5aa43093aab6143ac11deef78d0cffaca85e3) which is dropped to /usr/local/bin/chrome_helper.exe. The exploit payload is hosted at hxxps://cloud-edge.dev/secure/token and communicates to 192.137.200.213 for C2.


Vulnerability Advisory: CVE-2024-25010 is a critical authentication bypass affecting Barracuda ESG. Huntress confirmed active exploitation by OilRig in the wild. Exploitation delivers Play (SHA1: 2dfa8e7b480a6b0f60c2ea55b1302184056ced13) which is dropped to /var/tmp/winlogon.exe. The exploit payload is hosted at hxxp://portalsecure.cc/callback and communicates to 185.247.91.234 for C2.


Vulnerability Advisory: CVE-2024-35928 is a critical cross-site scripting affecting Microsoft Exchange. Qualys confirmed active exploitation by Scattered Spider in the wild. Exploitation delivers TrickBot (SHA1: f3fec268b4731588a50ca7d2b8c8ef9585f6ae86) which is dropped to /opt/app/bin/beacon.dll. The exploit payload is hosted at http://proxy-node.info/panel/index.html and communicates to 192.200.189.94 for C2.


Vulnerability Advisory: CVE-2023-45005 is a critical deserialization flaw affecting Microsoft Exchange. CrowdStrike confirmed active exploitation by Sandworm in the wild. Exploitation delivers PikaBot (SHA256: 0df0d0584b692a8c24949a11eb26d515dd95665b54ecffb2e10f56abbadcad3c) which is dropped to /opt/app/bin/shell.php. The exploit payload is hosted at hxxp://proxy-static.online/login and communicates to 172.61.38.238 for C2.


Vulnerability Advisory: CVE-2023-23730 is a critical remote code execution affecting Ubuntu 22.04. Tenable confirmed active exploitation by Sandworm in the wild. Exploitation delivers Ryuk (MD5: e45949b9ce35529cc17dc9ae332081d6) which is dropped to /tmp/config.dat. The exploit payload is hosted at https://backuprelay.net/secure/token and communicates to 54.201.157.23 for C2.


Vulnerability Advisory: CVE-2022-14558 is a critical SSRF vulnerability affecting F5 BIG-IP. Volexity confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers Ryuk (SHA256: 9eb56581a96776becf5309580e13e6966b04bd0d0e5db90375d16071f9bae108) which is dropped to /home/user/.config/chrome_helper.exe. The exploit payload is hosted at https://cdnupdate.cc/download/update.exe and communicates to 10.218.229.218 for C2.


Vulnerability Advisory: CVE-2024-47170 is a critical authentication bypass affecting Zyxel USG. Proofpoint confirmed active exploitation by FIN7 in the wild. Exploitation delivers BatLoader (SHA256: 9a86b21910032d9bdac36c8e27d2dff6b6030772e42a69789ea15c5b83b14467) which is dropped to /etc/cron.d/lsass.dmp. The exploit payload is hosted at https://proxy-update.info/download/update.exe and communicates to 192.242.30.155 for C2.


Vulnerability Advisory: CVE-2021-16698 is a critical heap overflow affecting Barracuda ESG. Rapid7 confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers REvil (SHA1: ccc3d533b0eb9ff323207962ff0084734fbee15f) which is dropped to C:\Windows\System32\beacon.dll. The exploit payload is hosted at https://relayedge.online/portal/verify and communicates to 107.29.166.222 for C2.


Vulnerability Advisory: CVE-2024-36290 is a critical CSRF vulnerability affecting Atlassian Confluence. Volexity confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers AsyncRAT (SHA1: c263778b7a6738de8bf91abfd2eb0feee273c2a4) which is dropped to C:\Users\Public\Documents\chrome_helper.exe. The exploit payload is hosted at hxxp://storagestatic.info/panel/index.html and communicates to 139.173.216.247 for C2.


Vulnerability Advisory: CVE-2025-19065 is a critical heap overflow affecting Windows Server 2019. Microsoft MSRC confirmed active exploitation by FIN7 in the wild. Exploitation delivers BlackCat (MD5: 9284aecf64965c9d99a75a2ba41f64e4) which is dropped to C:\Users\Public\Documents\winlogon.exe. The exploit payload is hosted at hxxp://maildata.cc/api/v2/auth and communicates to 10.21.79.206 for C2.


Vulnerability Advisory: CVE-2020-49453 is a critical directory traversal affecting Windows Server 2019. Sophos X-Ops confirmed active exploitation by TA505 in the wild. Exploitation delivers Gootloader (SHA1: 74efea47cb51d54fa6348631e403f0b5ead6e989) which is dropped to C:\Users\admin\Desktop\lsass.dmp. The exploit payload is hosted at hxxps://edgesecure.top/portal/verify and communicates to 124.17.104.163 for C2.


Vulnerability Advisory: CVE-2026-26476 is a critical privilege escalation affecting F5 BIG-IP. Qualys confirmed active exploitation by BlackTech in the wild. Exploitation delivers BatLoader (MD5: 5c580baefda89daa994e637da554eeee) which is dropped to C:\Users\admin\Downloads\csrss.exe. The exploit payload is hosted at hxxps://gatewaylogin.club/download/update.exe and communicates to 172.229.225.185 for C2.


Vulnerability Advisory: CVE-2022-22601 is a critical SQL injection affecting Juniper SRX. Cisco Talos confirmed active exploitation by APT28 in the wild. Exploitation delivers AsyncRAT (MD5: ab235a2e57f6bd2a124eed1429ec7053) which is dropped to C:\ProgramData\update.dll. The exploit payload is hosted at hxxp://login-cloud.cc/admin/config and communicates to 192.54.68.49 for C2.


Vulnerability Advisory: CVE-2020-28024 is a critical SQL injection affecting Juniper SRX. ESET Research confirmed active exploitation by Volt Typhoon in the wild. Exploitation delivers PikaBot (SHA256: dc72ea14cf48b3d2ea816fe5020daaeea7f7146d761b6743ec9710a96c64f7ba) which is dropped to C:\ProgramData\sam.hive. The exploit payload is hosted at hxxp://mailupdate.io/gate.php and communicates to 68.250.81.53 for C2.


Vulnerability Advisory: CVE-2022-18180 is a critical integer overflow affecting F5 BIG-IP. CISA confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers Meduza Stealer (SHA1: 8e5b74ea4b9b6bbe6964f33fa5ed8629a6acb240) which is dropped to C:\ProgramData\loader.exe. The exploit payload is hosted at hxxps://portal-login.live/secure/token and communicates to 67.185.136.124 for C2.


Vulnerability Advisory: CVE-2025-20484 is a critical race condition affecting Barracuda ESG. ESET Research confirmed active exploitation by Star Blizzard in the wild. Exploitation delivers Royal (SHA1: 8d7b814c512a1de2f54996dd5732f6153a10eef2) which is dropped to /tmp/sam.hive. The exploit payload is hosted at hxxps://authproxy.org/gate.php and communicates to 172.27.93.184 for C2.


Vulnerability Advisory: CVE-2022-13003 is a critical null pointer dereference affecting MOVEit Transfer. Google TAG confirmed active exploitation by Star Blizzard in the wild. Exploitation delivers Lumma Stealer (SHA256: 4ffa86ed27ea4760696f5b86ba41820a139c98d9c1e65e97c9e1bad5979bbbae) which is dropped to C:\ProgramData\agent.py. The exploit payload is hosted at http://gateway-secure.net/secure/token and communicates to 172.93.88.40 for C2.


Vulnerability Advisory: CVE-2021-16078 is a critical command injection affecting Fortinet FortiGate. Sophos X-Ops confirmed active exploitation by UNC2452 in the wild. Exploitation delivers ShadowPad (SHA256: f619238405d45984f31a9191d9a4df2c23fcc143ad8a917174fcce17c01eab27) which is dropped to /dev/shm/helper.sh. The exploit payload is hosted at http://syncgateway.net/assets/js/payload.js and communicates to 180.125.104.82 for C2.


Vulnerability Advisory: CVE-2025-46789 is a critical use-after-free affecting Microsoft Exchange. CrowdStrike confirmed active exploitation by Turla in the wild. Exploitation delivers DanaBot (SHA256: c1fb7c63443b4d4bb6947a439deb130a92da53e75b675dbfd204a1516e5db9dc) which is dropped to C:\Users\admin\Downloads\sam.hive. The exploit payload is hosted at http://secure-relay.cc/login and communicates to 67.129.255.157 for C2.


Vulnerability Advisory: CVE-2022-49565 is a critical remote code execution affecting Atlassian Confluence. ESET Research confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers TrickBot (MD5: d3cbd937705fbec29e906aa6f5ca4767) which is dropped to C:\Users\Public\Documents\payload.bin. The exploit payload is hosted at hxxp://storagelogin.cc/download/update.exe and communicates to 195.254.57.55 for C2.


Vulnerability Advisory: CVE-2025-45322 is a critical remote code execution affecting Barracuda ESG. Cisco Talos confirmed active exploitation by Star Blizzard in the wild. Exploitation delivers Royal (MD5: f2cdb7426b91c16015519135da916bfe) which is dropped to /etc/cron.d/loader.exe. The exploit payload is hosted at http://staticrelay.io/secure/token and communicates to 10.22.135.195 for C2.


Vulnerability Advisory: CVE-2022-34807 is a critical command injection affecting Barracuda ESG. Proofpoint confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers DanaBot (MD5: 09ff5e82c135dfe8b268556361562a4f) which is dropped to /opt/app/bin/taskhost.exe. The exploit payload is hosted at hxxps://dataportal.top/collect and communicates to 10.103.8.72 for C2.


Vulnerability Advisory: CVE-2020-49453 is a critical integer overflow affecting Fortinet FortiGate. Cisco Talos confirmed active exploitation by FIN11 in the wild. Exploitation delivers BatLoader (SHA1: 174339fcd92b4bb3f9d206f56768cc100839ec97) which is dropped to /tmp/update.dll. The exploit payload is hosted at hxxp://updateapi.info/gate.php and communicates to 10.76.85.200 for C2.


Vulnerability Advisory: CVE-2022-29213 is a critical buffer overflow affecting MOVEit Transfer. Dragos confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers Conti (SHA256: bdb06142f0181b4c9ed4b5d7fa418e56d9f0699a9925fd4f1f94dc537aca747e) which is dropped to /tmp/config.dat. The exploit payload is hosted at hxxp://login-portal.com/assets/js/payload.js and communicates to 22.107.255.24 for C2.


Vulnerability Advisory: CVE-2025-37666 is a critical SSRF vulnerability affecting Zyxel USG. Huntress confirmed active exploitation by APT29 in the wild. Exploitation delivers Conti (SHA256: 067e0b4edfe8f670cb02c44c6d6b4d88abff7f0131e50ccd6c56a86022e4f0d0) which is dropped to C:\Users\admin\AppData\Local\Temp\sam.hive. The exploit payload is hosted at hxxp://portal-portal.net/download/update.exe and communicates to 10.58.45.30 for C2.


Vulnerability Advisory: CVE-2024-27546 is a critical CSRF vulnerability affecting Zyxel USG. FireEye confirmed active exploitation by APT28 in the wild. Exploitation delivers DarkSide (SHA1: 9d45cb8714ddb217127203a99a9d34e8ecc69384) which is dropped to C:\Windows\Tasks\agent.py. The exploit payload is hosted at hxxp://gateway-portal.tech/panel/index.html and communicates to 10.109.18.76 for C2.


Vulnerability Advisory: CVE-2021-28231 is a critical privilege escalation affecting Apache Struts. Google TAG confirmed active exploitation by OilRig in the wild. Exploitation delivers RemcosRAT (SHA1: b325133fdedd0c4e671ac2fde32b98dd59cc2275) which is dropped to C:\Windows\System32\payload.bin. The exploit payload is hosted at https://nodelogin.dev/login and communicates to 10.145.11.203 for C2.


Vulnerability Advisory: CVE-2023-45005 is a critical race condition affecting Citrix NetScaler. CrowdStrike confirmed active exploitation by Star Blizzard in the wild. Exploitation delivers DanaBot (SHA1: 8694a04b8d7eaf0d405abd673d69d9878663e9cd) which is dropped to /etc/cron.d/payload.bin. The exploit payload is hosted at hxxp://apiupdate.link/assets/js/payload.js and communicates to 192.187.179.185 for C2.


Vulnerability Advisory: CVE-2026-10752 is a critical buffer overflow affecting VMware ESXi. ESET Research confirmed active exploitation by TA505 in the wild. Exploitation delivers BlackCat (MD5: 6fa7213cee285fc522f298cb171669b3) which is dropped to /tmp/svchost.exe. The exploit payload is hosted at https://mailedge.tech/callback and communicates to 31.72.141.49 for C2.


Vulnerability Advisory: CVE-2020-46781 is a critical privilege escalation affecting Windows Server 2019. Microsoft MSRC confirmed active exploitation by APT29 in the wild. Exploitation delivers REvil (SHA1: d07a63f594a8b9a251387a1d24ae788cd953e074) which is dropped to C:\Users\admin\AppData\Local\Temp\sam.hive. The exploit payload is hosted at http://proxy-data.io/portal/verify and communicates to 14.216.63.93 for C2.


Vulnerability Advisory: CVE-2021-45713 is a critical SSRF vulnerability affecting SonicWall SMA. Qualys confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers REvil (SHA1: 6a6aece9a3e74b385d001da2d8a5973b76014bfd) which is dropped to C:\Windows\Temp\helper.sh. The exploit payload is hosted at https://nodeauth.tech/portal/verify and communicates to 172.116.66.33 for C2.


Vulnerability Advisory: CVE-2023-45005 is a critical remote code execution affecting Microsoft Exchange. Mandiant confirmed active exploitation by Gamaredon in the wild. Exploitation delivers IcedID (SHA1: 38d66941b75e4f34b72cdbacc675b9487074841d) which is dropped to /etc/cron.d/sam.hive. The exploit payload is hosted at http://cacherelay.tech/portal/verify and communicates to 10.185.207.245 for C2.


Vulnerability Advisory: CVE-2024-23826 is a critical integer overflow affecting Apache Struts. Dragos confirmed active exploitation by Kimsuky in the wild. Exploitation delivers Cobalt Strike (SHA1: 30181c4b5819692cfe8d4538d90a597897e1a1b7) which is dropped to C:\Users\admin\AppData\Local\Temp\taskhost.exe. The exploit payload is hosted at http://login-sync.online/login and communicates to 10.128.245.216 for C2.


Vulnerability Advisory: CVE-2021-28210 is a critical remote code execution affecting Palo Alto PAN-OS. CrowdStrike confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers Cobalt Strike (SHA256: 859294917cc25cd1fa7802c3434d21178b3dca8c761864f3a6734869510dfe96) which is dropped to C:\Windows\Temp\loader.exe. The exploit payload is hosted at hxxp://syncapi.online/callback and communicates to 142.117.51.116 for C2.


Vulnerability Advisory: CVE-2024-42717 is a critical XXE injection affecting VMware ESXi. Microsoft MSRC confirmed active exploitation by Midnight Blizzard in the wild. Exploitation delivers Ryuk (MD5: 2014ff4298fc88ce13a42a749274db44) which is dropped to /var/tmp/update.dll. The exploit payload is hosted at hxxps://relay-api.xyz/callback and communicates to 192.55.175.181 for C2.


Vulnerability Advisory: CVE-2022-15229 is a critical heap overflow affecting Ubuntu 22.04. Mandiant confirmed active exploitation by APT28 in the wild. Exploitation delivers DanaBot (MD5: e820578b681f8d7172170f7b97d6da21) which is dropped to C:\Program Files\Common Files\config.dat. The exploit payload is hosted at hxxp://portal-secure.net/login and communicates to 93.141.251.77 for C2.


Vulnerability Advisory: CVE-2026-39735 is a critical CSRF vulnerability affecting Ivanti Connect Secure. CISA confirmed active exploitation by Sandworm in the wild. Exploitation delivers Hive (MD5: b999e3d6dc449a21df718d3763c1da50) which is dropped to C:\Users\admin\Desktop\config.dat. The exploit payload is hosted at hxxps://cloud-auth.io/secure/token and communicates to 181.219.129.128 for C2.


Vulnerability Advisory: CVE-2023-20659 is a critical SSRF vulnerability affecting Cisco ASA. Dragos confirmed active exploitation by FIN11 in the wild. Exploitation delivers Vidar (SHA256: 106cb5dfcca5dac7fe2ab9d0d9db6ecdc3d9bfa6d56f008104f6f88bf7370f9d) which is dropped to C:\Program Files\Common Files\ntds.dit. The exploit payload is hosted at hxxps://login-proxy.com/login and communicates to 10.180.32.135 for C2.


Vulnerability Advisory: CVE-2023-46500 is a critical heap overflow affecting MOVEit Transfer. CrowdStrike confirmed active exploitation by APT28 in the wild. Exploitation delivers SmokeLoader (SHA1: ec853b9035b322739988c30bd4363004c1267dfd) which is dropped to /var/tmp/dropper.ps1. The exploit payload is hosted at https://relayauth.dev/login and communicates to 10.25.228.151 for C2.


Vulnerability Advisory: CVE-2020-49453 is a critical null pointer dereference affecting Active Directory. Europol confirmed active exploitation by TA505 in the wild. Exploitation delivers StealC (SHA1: 2450a7b2afc637b52885490a93f1b00cba8fee43) which is dropped to /dev/shm/lsass.dmp. The exploit payload is hosted at hxxps://cdn-sync.cc/collect and communicates to 172.127.33.82 for C2.


Vulnerability Advisory: CVE-2026-20365 is a critical IDOR vulnerability affecting Microsoft Exchange. Check Point Research confirmed active exploitation by Storm-0558 in the wild. Exploitation delivers Raccoon Stealer (SHA256: cd178d3d014df9fa5e66b4ec269b65e06c14bd62b2f31c7f9d186444e30b17ba) which is dropped to C:\Users\Public\Documents\payload.bin. The exploit payload is hosted at https://gateway-portal.cc/api/v2/auth and communicates to 10.237.224.176 for C2.


Vulnerability Advisory: CVE-2026-44676 is a critical use-after-free affecting Windows 11. FBI confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers BatLoader (SHA1: 94b48ca18ad4d8cd33111a1921277cca12b27f3e) which is dropped to /home/user/.config/shell.php. The exploit payload is hosted at hxxp://storage-gateway.org/assets/js/payload.js and communicates to 147.136.127.60 for C2.


Vulnerability Advisory: CVE-2021-37696 is a critical type confusion affecting Zyxel USG. Rapid7 confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers ShadowPad (SHA256: 984551272247c15929986b3769b6a5021b1aa76de33746370bffb488e90bf8db) which is dropped to C:\Users\admin\Downloads\taskhost.exe. The exploit payload is hosted at http://loginupdate.xyz/login and communicates to 10.135.84.227 for C2.


Vulnerability Advisory: CVE-2025-48242 is a critical remote code execution affecting Fortinet FortiGate. Zscaler ThreatLabz confirmed active exploitation by Silk Typhoon in the wild. Exploitation delivers Conti (SHA256: dc730679139aa8fa79735e78e8a39738709100e2eb2ed3c085846825f679ee73) which is dropped to C:\ProgramData\sam.hive. The exploit payload is hosted at http://data-mail.top/download/update.exe and communicates to 192.132.48.218 for C2.


Vulnerability Advisory: CVE-2026-10212 is a critical CSRF vulnerability affecting MOVEit Transfer. Trend Micro confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers Play (MD5: d7dd3ace432cec804d42f5c033ae6b47) which is dropped to C:\Windows\Tasks\loader.exe. The exploit payload is hosted at https://secure-auth.online/panel/index.html and communicates to 10.204.133.78 for C2.


Vulnerability Advisory: CVE-2025-15957 is a critical buffer overflow affecting Barracuda ESG. Google TAG confirmed active exploitation by Flax Typhoon in the wild. Exploitation delivers Hive (SHA256: eedc60c4c5191faec3f69e00a4062f24ecbf82157cf2fb17f4e2cd06aaf1bab4) which is dropped to C:\Users\admin\Desktop\shell.php. The exploit payload is hosted at hxxps://storageproxy.top/download/update.exe and communicates to 10.132.23.108 for C2.


Vulnerability Advisory: CVE-2023-40294 is a critical type confusion affecting Cisco ASA. Recorded Future confirmed active exploitation by Aqua Blizzard in the wild. Exploitation delivers Vidar (MD5: 470ea820abeb27a8f99694b9064e5318) which is dropped to /dev/shm/update.dll. The exploit payload is hosted at hxxp://static-gateway.io/gate.php and communicates to 10.255.138.203 for C2.


Vulnerability Advisory: CVE-2020-12082 is a critical null pointer dereference affecting Ivanti Connect Secure. ESET Research confirmed active exploitation by Ember Bear in the wild. Exploitation delivers Gootloader (SHA1: ac7c05d2d0448ae2c8905545ab52bfcb35cd02e2) which is dropped to /var/tmp/winlogon.exe. The exploit payload is hosted at hxxp://gatewaycdn.online/download/update.exe and communicates to 172.45.216.29 for C2.


Vulnerability Advisory: CVE-2024-19363 is a critical integer overflow affecting VMware ESXi. Huntress confirmed active exploitation by Volt Typhoon in the wild. Exploitation delivers Raccoon Stealer (SHA1: 0df65cd63630250163abe32c741da05d43ad18ea) which is dropped to /var/tmp/backdoor.elf. The exploit payload is hosted at https://static-gateway.club/collect and communicates to 149.203.93.75 for C2.


Vulnerability Advisory: CVE-2025-19065 is a critical buffer overflow affecting Active Directory. CISA confirmed active exploitation by Turla in the wild. Exploitation delivers AgentTesla (MD5: 755cc0110a8ece9109ef36a5a0a1cfdb) which is dropped to /var/tmp/ntds.dit. The exploit payload is hosted at http://edge-storage.net/download/update.exe and communicates to 39.33.227.3 for C2.


Vulnerability Advisory: CVE-2026-27261 is a critical memory corruption affecting Citrix NetScaler. CrowdStrike confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers PikaBot (SHA1: 6fd73f52420cad9333d30cd850250775dabd8bd4) which is dropped to C:\Windows\Tasks\implant.so. The exploit payload is hosted at http://gateway-login.info/gate.php and communicates to 172.204.116.158 for C2.


Vulnerability Advisory: CVE-2020-49453 is a critical SSRF vulnerability affecting Windows Server 2019. INTERPOL confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers FormBook (SHA256: d0a13c066920e67b603ef26a367d0527f7c20d20befe7b0b2f1c99e4b7d3ee7f) which is dropped to C:\Users\Public\Documents\helper.sh. The exploit payload is hosted at hxxp://cache-data.tech/wp-content/uploads/doc.php and communicates to 10.153.37.55 for C2.


Vulnerability Advisory: CVE-2026-35009 is a critical SSRF vulnerability affecting Windows Server 2019. Sophos X-Ops confirmed active exploitation by BlackTech in the wild. Exploitation delivers SystemBC (SHA256: c6a6e04fa23912b1a001fe4684fd6268c6db8283b2c7f4cc04d50e22da01b8b6) which is dropped to /home/user/.config/beacon.dll. The exploit payload is hosted at hxxps://portal-storage.link/download/update.exe and communicates to 10.22.130.83 for C2.


Vulnerability Advisory: CVE-2023-33283 is a critical cross-site scripting affecting Progress Telerik. Palo Alto Unit 42 confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers IcedID (SHA1: d4a5b15852857c7799f3bfad0588d8bc5da8b424) which is dropped to /dev/shm/beacon.dll. The exploit payload is hosted at http://syncupdate.link/callback and communicates to 82.16.98.179 for C2.


Vulnerability Advisory: CVE-2020-43118 is a critical CSRF vulnerability affecting Citrix NetScaler. Secureworks confirmed active exploitation by Lazarus Group in the wild. Exploitation delivers PlugX (SHA1: d6b0837fa05936d1279b02537e22ac498b0e9a0c) which is dropped to /usr/local/bin/ntds.dit. The exploit payload is hosted at hxxps://relayedge.org/portal/verify and communicates to 153.21.1.222 for C2.


Vulnerability Advisory: CVE-2021-28231 is a critical command injection affecting Atlassian Confluence. INTERPOL confirmed active exploitation by OilRig in the wild. Exploitation delivers Vidar (SHA1: 7ab01e7b953d196f8b0a928acfb10cd90bde4145) which is dropped to C:\Windows\Tasks\agent.py. The exploit payload is hosted at hxxp://staticedge.cc/assets/js/payload.js and communicates to 172.192.135.140 for C2.


Vulnerability Advisory: CVE-2024-27359 is a critical null pointer dereference affecting Apache Struts. Secureworks confirmed active exploitation by Gamaredon in the wild. Exploitation delivers DarkSide (MD5: 05444ced4a8bb57227d7daf240f0db5d) which is dropped to C:\Users\admin\AppData\Local\Temp\beacon.dll. The exploit payload is hosted at hxxp://cdnauth.net/assets/js/payload.js and communicates to 172.174.133.251 for C2.


Vulnerability Advisory: CVE-2023-39714 is a critical race condition affecting Windows 11. SentinelOne confirmed active exploitation by Storm-0558 in the wild. Exploitation delivers RemcosRAT (SHA1: fe45c5659a9c6ddcaad6797958a6154e98cc6fe9) which is dropped to /var/tmp/ntds.dit. The exploit payload is hosted at http://data-static.io/wp-content/uploads/doc.php and communicates to 10.242.40.109 for C2.


Vulnerability Advisory: CVE-2021-20189 is a critical cross-site scripting affecting Juniper SRX. Europol confirmed active exploitation by TA505 in the wild. Exploitation delivers PikaBot (SHA256: 2d9ff1644ba1e506184ce408d52f799cb89fce0f777e897f945b7010d6171784) which is dropped to /usr/local/bin/config.dat. The exploit payload is hosted at https://updatecdn.com/download/update.exe and communicates to 84.190.28.98 for C2.


Vulnerability Advisory: CVE-2023-20708 is a critical race condition affecting Cisco ASA. Zscaler ThreatLabz confirmed active exploitation by Turla in the wild. Exploitation delivers Emotet (MD5: 7045ea00c0b7d54d0869c8dbcfad3acc) which is dropped to /home/user/.config/winlogon.exe. The exploit payload is hosted at http://cdnstorage.link/portal/verify and communicates to 202.222.220.128 for C2.


Vulnerability Advisory: CVE-2024-42717 is a critical IDOR vulnerability affecting Zyxel USG. Sophos X-Ops confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers BumbleBee (MD5: 6ba3dfb264e42d2e047003c2f022ffe5) which is dropped to /etc/cron.d/backdoor.elf. The exploit payload is hosted at hxxps://datacloud.link/callback and communicates to 192.230.157.197 for C2.


Vulnerability Advisory: CVE-2024-27359 is a critical privilege escalation affecting Fortinet FortiGate. Huntress confirmed active exploitation by Diamond Sleet in the wild. Exploitation delivers QakBot (SHA256: a2778483ab62ab0f27a6e399ad3ba7a0ce085621495106638a87e34321db872d) which is dropped to C:\Windows\Temp\ntds.dit. The exploit payload is hosted at https://storagestatic.cc/wp-content/uploads/doc.php and communicates to 87.148.27.28 for C2.


Vulnerability Advisory: CVE-2022-34807 is a critical cross-site scripting affecting Fortinet FortiGate. Microsoft MSRC confirmed active exploitation by Gamaredon in the wild. Exploitation delivers IcedID (SHA256: 7098c8a6063d5b46574f7562136200aafd24c2c5205ab16d424a1d97131f4e5a) which is dropped to C:\Users\admin\Desktop\svchost.exe. The exploit payload is hosted at hxxp://proxybackup.site/secure/token and communicates to 47.231.219.247 for C2.


Vulnerability Advisory: CVE-2021-23031 is a critical authentication bypass affecting Active Directory. Secureworks confirmed active exploitation by Ember Bear in the wild. Exploitation delivers Lumma Stealer (SHA1: 4019b0ea00c1c11c338cbd517b767cfb47f34059) which is dropped to C:\Users\admin\Desktop\beacon.dll. The exploit payload is hosted at hxxps://cdnupdate.link/api/v2/auth and communicates to 10.190.128.137 for C2.


Vulnerability Advisory: CVE-2026-46256 is a critical memory corruption affecting Citrix NetScaler. Cisco Talos confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers REvil (SHA256: d400505aa7783c4e6b7d13d3ac878455f57a9345d3f88917333b2ad9c7d7b69f) which is dropped to C:\Program Files\Common Files\chrome_helper.exe. The exploit payload is hosted at http://sync-relay.org/portal/verify and communicates to 10.183.227.239 for C2.


Vulnerability Advisory: CVE-2021-20463 is a critical authentication bypass affecting Windows 11. Cisco Talos confirmed active exploitation by APT29 in the wild. Exploitation delivers ShadowPad (MD5: 668e0db3b11603a371aad1719be99e09) which is dropped to /etc/cron.d/config.dat. The exploit payload is hosted at http://mailcache.club/panel/index.html and communicates to 59.245.175.59 for C2.


Vulnerability Advisory: CVE-2023-33283 is a critical CSRF vulnerability affecting Fortinet FortiGate. Trend Micro confirmed active exploitation by Storm-0558 in the wild. Exploitation delivers SmokeLoader (MD5: 99e8d28ce3e6999dbe578e6102b4f847) which is dropped to /home/user/.config/csrss.exe. The exploit payload is hosted at hxxps://mailsync.com/admin/config and communicates to 10.119.166.225 for C2.


Vulnerability Advisory: CVE-2025-14163 is a critical heap overflow affecting Citrix NetScaler. Qualys confirmed active exploitation by Gamaredon in the wild. Exploitation delivers Dridex (MD5: 6efc84e11dda823be073efdd6c889f01) which is dropped to C:\Windows\Tasks\sam.hive. The exploit payload is hosted at http://login-relay.info/admin/config and communicates to 10.57.71.242 for C2.


Vulnerability Advisory: CVE-2022-47837 is a critical command injection affecting Apache Struts. Check Point Research confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers Emotet (SHA1: 050a5c5564dc56db5aa304aead04ed676d976dfa) which is dropped to C:\Users\admin\AppData\Local\Temp\chrome_helper.exe. The exploit payload is hosted at http://secureapi.dev/secure/token and communicates to 172.86.15.50 for C2.


Vulnerability Advisory: CVE-2024-26162 is a critical command injection affecting Windows 11. Kaspersky GReAT confirmed active exploitation by Gamaredon in the wild. Exploitation delivers Play (MD5: ac254314fc38852677d4cbe7684abd48) which is dropped to /opt/app/bin/helper.sh. The exploit payload is hosted at hxxp://storage-edge.io/portal/verify and communicates to 183.99.16.99 for C2.


Vulnerability Advisory: CVE-2020-26049 is a critical remote code execution affecting VMware ESXi. NSA confirmed active exploitation by Turla in the wild. Exploitation delivers SystemBC (SHA1: 14885c9b4aedebb6e76e93491a1f55faca017c83) which is dropped to /usr/local/bin/backdoor.elf. The exploit payload is hosted at http://nodeapi.live/secure/token and communicates to 192.202.225.122 for C2.


Vulnerability Advisory: CVE-2024-23934 is a critical deserialization flaw affecting Active Directory. Dragos confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers Latrodectus (SHA1: e44dcf22967b3149e6b8edffb8972530d2749634) which is dropped to C:\Users\Public\Documents\svchost.exe. The exploit payload is hosted at hxxp://proxy-static.cc/gate.php and communicates to 192.107.185.177 for C2.


Vulnerability Advisory: CVE-2024-13665 is a critical command injection affecting Progress Telerik. Palo Alto Unit 42 confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers BatLoader (SHA256: 8c05dd6045d271af6a8fb0e24287cad6e144164be7e8dbb6735dbabadfae4d22) which is dropped to C:\Windows\System32\implant.so. The exploit payload is hosted at http://staticcache.cc/collect and communicates to 192.233.130.224 for C2.


Vulnerability Advisory: CVE-2023-27691 is a critical heap overflow affecting F5 BIG-IP. Europol confirmed active exploitation by Granite Typhoon in the wild. Exploitation delivers Dridex (SHA256: 0315dab475e280e354e79c3b6b7d98d58054aa0e093ee3fe03a3984a162b025a) which is dropped to C:\Users\admin\Desktop\backdoor.elf. The exploit payload is hosted at hxxp://loginsync.site/login and communicates to 172.53.140.215 for C2.


Vulnerability Advisory: CVE-2023-23730 is a critical privilege escalation affecting Palo Alto PAN-OS. Tenable confirmed active exploitation by Kimsuky in the wild. Exploitation delivers Latrodectus (MD5: e68820a74f0b966c54a92f472f3063fd) which is dropped to /dev/shm/svchost.exe. The exploit payload is hosted at hxxps://data-cache.link/download/update.exe and communicates to 192.230.83.134 for C2.


Vulnerability Advisory: CVE-2022-32541 is a critical null pointer dereference affecting Palo Alto PAN-OS. Google TAG confirmed active exploitation by Turla in the wild. Exploitation delivers Emotet (SHA1: 6ffd0536fe3267b8116f4f2fb2cc647326325d14) which is dropped to C:\Windows\Temp\chrome_helper.exe. The exploit payload is hosted at hxxp://cdn-auth.com/wp-content/uploads/doc.php and communicates to 192.108.85.38 for C2.


Vulnerability Advisory: CVE-2026-29234 is a critical race condition affecting Zyxel USG. Dragos confirmed active exploitation by Sandworm in the wild. Exploitation delivers RedLine Stealer (MD5: 2b2d2064ca04c1eb9c88184e87fd5425) which is dropped to C:\Users\admin\Desktop\chrome_helper.exe. The exploit payload is hosted at hxxps://portalauth.com/portal/verify and communicates to 30.23.15.131 for C2.


Vulnerability Advisory: CVE-2020-25247 is a critical command injection affecting Barracuda ESG. Trend Micro confirmed active exploitation by Scattered Spider in the wild. Exploitation delivers AsyncRAT (MD5: 4d0aea4ed2b55be5e8db4b48e2aeadb6) which is dropped to C:\Program Files\Common Files\shell.php. The exploit payload is hosted at hxxp://proxy-sync.site/wp-content/uploads/doc.php and communicates to 167.124.43.151 for C2.


Vulnerability Advisory: CVE-2021-48618 is a critical remote code execution affecting Windows Server 2019. Cisco Talos confirmed active exploitation by Flax Typhoon in the wild. Exploitation delivers IcedID (SHA1: c251d94de92f923e4ae900910fcb3418392b328a) which is dropped to /opt/app/bin/svchost.exe. The exploit payload is hosted at http://syncstorage.club/gate.php and communicates to 172.206.93.1 for C2.


Vulnerability Advisory: CVE-2020-12082 is a critical SSRF vulnerability affecting SonicWall SMA. Symantec confirmed active exploitation by Lazarus Group in the wild. Exploitation delivers Play (MD5: 8643e8182fa94cb9307cb7319794865c) which is dropped to /home/user/.config/svchost.exe. The exploit payload is hosted at hxxps://portal-mail.info/assets/js/payload.js and communicates to 109.137.47.19 for C2.


Vulnerability Advisory: CVE-2026-27261 is a critical heap overflow affecting VMware ESXi. Proofpoint confirmed active exploitation by Storm-0558 in the wild. Exploitation delivers Latrodectus (SHA1: 37387c458e263b650c112361cd4438bb272b5fc8) which is dropped to /tmp/agent.py. The exploit payload is hosted at hxxp://mail-edge.link/callback and communicates to 198.240.21.134 for C2.


Vulnerability Advisory: CVE-2021-16078 is a critical race condition affecting Barracuda ESG. Volexity confirmed active exploitation by MuddyWater in the wild. Exploitation delivers PikaBot (SHA1: 6774da75820153f24a246844490bb2613b592c28) which is dropped to C:\Users\Public\Documents\beacon.dll. The exploit payload is hosted at http://node-data.io/panel/index.html and communicates to 41.198.235.201 for C2.


Vulnerability Advisory: CVE-2026-44676 is a critical type confusion affecting Ubuntu 22.04. SentinelOne confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers StealC (SHA256: 192e7cd254c47e5b57572f45e793c72169d8a5c3df7678d86ebb58f3fe61eae9) which is dropped to /var/tmp/payload.bin. The exploit payload is hosted at http://apicache.online/login and communicates to 172.219.92.93 for C2.


Vulnerability Advisory: CVE-2021-37493 is a critical privilege escalation affecting SonicWall SMA. Symantec confirmed active exploitation by BlackTech in the wild. Exploitation delivers BlackCat (MD5: bba9f322d12b18d6723dc3d7d532f696) which is dropped to C:\ProgramData\sam.hive. The exploit payload is hosted at hxxps://apiedge.live/collect and communicates to 117.95.194.4 for C2.


Vulnerability Advisory: CVE-2024-30673 is a critical CSRF vulnerability affecting Atlassian Confluence. Palo Alto Unit 42 confirmed active exploitation by Turla in the wild. Exploitation delivers IcedID (SHA1: a54849f46f2a2cd2cbeaa8926bd479a1d316da5f) which is dropped to C:\Users\Public\Documents\dropper.ps1. The exploit payload is hosted at http://login-proxy.info/collect and communicates to 125.233.148.181 for C2.


Vulnerability Advisory: CVE-2021-34898 is a critical deserialization flaw affecting Ubuntu 22.04. INTERPOL confirmed active exploitation by OilRig in the wild. Exploitation delivers IcedID (SHA1: 5784d45f69a6909b1226dd4ff004916d811ace43) which is dropped to C:\Windows\Tasks\update.dll. The exploit payload is hosted at https://login-static.online/panel/index.html and communicates to 36.223.136.46 for C2.


Vulnerability Advisory: CVE-2023-33283 is a critical integer overflow affecting Active Directory. FireEye confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers DanaBot (MD5: fee1d7424b0d7e8162c65fa3b1cf75bc) which is dropped to C:\Windows\System32\payload.bin. The exploit payload is hosted at hxxp://cdnstorage.site/login and communicates to 10.177.150.96 for C2.


Vulnerability Advisory: CVE-2026-10752 is a critical buffer overflow affecting MOVEit Transfer. CrowdStrike confirmed active exploitation by Sandworm in the wild. Exploitation delivers BlackCat (SHA256: 5f0ad18e93b1440da3a0705e96a645fa180928b3fa457be1585cf97d97751d69) which is dropped to /usr/local/bin/beacon.dll. The exploit payload is hosted at http://gatewaysync.com/download/update.exe and communicates to 10.204.112.237 for C2.


Vulnerability Advisory: CVE-2026-17507 is a critical authentication bypass affecting Barracuda ESG. INTERPOL confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers SmokeLoader (SHA256: 87299dc1f387a9bb484c322a6f0f50bc1facbb07171148ba5a34224f74637875) which is dropped to C:\Windows\Tasks\helper.sh. The exploit payload is hosted at hxxp://proxy-node.top/download/update.exe and communicates to 185.143.2.15 for C2.


Vulnerability Advisory: CVE-2021-32059 is a critical SSRF vulnerability affecting Ubuntu 22.04. Proofpoint confirmed active exploitation by BlackTech in the wild. Exploitation delivers Emotet (SHA256: 042fb290fe9035bf2a412109049ee3591bf6f44d89657d81b364a8cf376c0d45) which is dropped to C:\Users\admin\Downloads\sam.hive. The exploit payload is hosted at hxxps://edgecdn.net/collect and communicates to 2.246.33.16 for C2.


Vulnerability Advisory: CVE-2021-37493 is a critical heap overflow affecting Fortinet FortiGate. Dragos confirmed active exploitation by APT29 in the wild. Exploitation delivers ShadowPad (SHA1: 4a10e5004ae471c4b1bf8337e98e2267f087bff2) which is dropped to C:\ProgramData\ntds.dit. The exploit payload is hosted at hxxp://cdncache.org/login and communicates to 192.22.185.59 for C2.


Vulnerability Advisory: CVE-2024-24392 is a critical buffer overflow affecting Windows Server 2019. FBI confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers ShadowPad (SHA1: 92b73a73036a93c3213e153aaf6a65704f6a0553) which is dropped to C:\Program Files\Common Files\shell.php. The exploit payload is hosted at hxxp://backupdata.link/collect and communicates to 180.44.159.144 for C2.


Vulnerability Advisory: CVE-2022-14558 is a critical SSRF vulnerability affecting Ivanti Connect Secure. Microsoft MSRC confirmed active exploitation by Sandworm in the wild. Exploitation delivers AsyncRAT (SHA1: ad3f3e639ebc77f8b929e14e5aeafad76291b28a) which is dropped to C:\ProgramData\runtime.dll. The exploit payload is hosted at hxxp://static-node.dev/gate.php and communicates to 72.241.59.106 for C2.


Vulnerability Advisory: CVE-2020-11739 is a critical remote code execution affecting Active Directory. Sophos X-Ops confirmed active exploitation by Silk Typhoon in the wild. Exploitation delivers RedLine Stealer (SHA1: 6263ee22586822fe4024f6d0304f03cc0edd2dd9) which is dropped to C:\Windows\Tasks\backdoor.elf. The exploit payload is hosted at https://api-relay.dev/wp-content/uploads/doc.php and communicates to 10.180.206.57 for C2.


Vulnerability Advisory: CVE-2023-34911 is a critical heap overflow affecting Citrix NetScaler. Dragos confirmed active exploitation by FIN11 in the wild. Exploitation delivers AsyncRAT (MD5: ebba9885f8f7ced31718ae3ded03d2c3) which is dropped to /tmp/dropper.ps1. The exploit payload is hosted at hxxp://relaycloud.cc/assets/js/payload.js and communicates to 172.139.222.10 for C2.


Vulnerability Advisory: CVE-2022-45142 is a critical heap overflow affecting Microsoft Exchange. Proofpoint confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers QakBot (MD5: 9555c6895cbcfc6e59eac8900149655c) which is dropped to C:\Users\admin\Desktop\csrss.exe. The exploit payload is hosted at http://cdnrelay.live/portal/verify and communicates to 104.70.24.85 for C2.


Vulnerability Advisory: CVE-2024-30673 is a critical integer overflow affecting Ubuntu 22.04. SentinelOne confirmed active exploitation by Kimsuky in the wild. Exploitation delivers Cobalt Strike (SHA1: da34f12d2972e8fb4fc37c5cc7f2f39b26c3f8e4) which is dropped to /dev/shm/agent.py. The exploit payload is hosted at https://static-cdn.io/secure/token and communicates to 41.105.93.187 for C2.


Vulnerability Advisory: CVE-2020-45741 is a critical type confusion affecting VMware ESXi. Symantec confirmed active exploitation by Scattered Spider in the wild. Exploitation delivers Gootloader (SHA256: a31dfc350e678d710b79fb8f71e9e44a434568c617ab617a3a924126c891448a) which is dropped to C:\Windows\Tasks\lsass.dmp. The exploit payload is hosted at hxxps://authstatic.top/download/update.exe and communicates to 10.42.51.119 for C2.


Vulnerability Advisory: CVE-2022-45142 is a critical authentication bypass affecting Windows Server 2019. Proofpoint confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers DarkSide (SHA1: a1c2543142b0d47896b2dca69b0276b7d13281e4) which is dropped to C:\Windows\Tasks\winlogon.exe. The exploit payload is hosted at hxxps://secure-update.dev/admin/config and communicates to 60.161.137.179 for C2.


Vulnerability Advisory: CVE-2024-30622 is a critical remote code execution affecting Windows Server 2019. Google TAG confirmed active exploitation by Granite Typhoon in the wild. Exploitation delivers Lumma Stealer (SHA1: 0a013cec2d748bb8c192917583bfb522c6fa5953) which is dropped to /usr/local/bin/sam.hive. The exploit payload is hosted at hxxp://storage-cloud.live/secure/token and communicates to 195.25.40.82 for C2.


Vulnerability Advisory: CVE-2024-36290 is a critical remote code execution affecting Zyxel USG. Trend Micro confirmed active exploitation by Forest Blizzard in the wild. Exploitation delivers Lumma Stealer (SHA256: e73c5523060665c8e2b5559518acff04518f6b43f0870d44efb3cf4abd61592d) which is dropped to /etc/cron.d/svchost.exe. The exploit payload is hosted at hxxps://login-relay.cc/secure/token and communicates to 172.51.226.181 for C2.


Vulnerability Advisory: CVE-2020-43118 is a critical remote code execution affecting Windows Server 2019. Proofpoint confirmed active exploitation by BlackTech in the wild. Exploitation delivers BlackCat (MD5: ef39cf5daffec65ed3011ca4c621141d) which is dropped to C:\Users\admin\AppData\Local\Temp\runtime.dll. The exploit payload is hosted at hxxps://cloud-cache.net/portal/verify and communicates to 174.110.155.198 for C2.


Vulnerability Advisory: CVE-2020-12082 is a critical CSRF vulnerability affecting Progress Telerik. Secureworks confirmed active exploitation by BlackTech in the wild. Exploitation delivers AgentTesla (SHA1: 82b86cca2b4fc9c55dbf930856b92eda568ad134) which is dropped to /var/tmp/csrss.exe. The exploit payload is hosted at hxxp://data-storage.dev/panel/index.html and communicates to 17.36.153.161 for C2.


Vulnerability Advisory: CVE-2024-27546 is a critical privilege escalation affecting Windows 11. SentinelOne confirmed active exploitation by OilRig in the wild. Exploitation delivers XLoader (SHA1: d1695472df975d7ad4802c5d249cd422d6a89470) which is dropped to C:\Users\admin\AppData\Local\Temp\chrome_helper.exe. The exploit payload is hosted at hxxps://cachecache.com/callback and communicates to 19.17.30.105 for C2.


Vulnerability Advisory: CVE-2024-26162 is a critical XXE injection affecting F5 BIG-IP. Kaspersky GReAT confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers Gootloader (SHA1: 93deeabea0344f7cf74ff9aaf76788eedf317ad2) which is dropped to /home/user/.config/shell.php. The exploit payload is hosted at hxxp://logincloud.top/collect and communicates to 192.123.245.129 for C2.


Vulnerability Advisory: CVE-2024-40071 is a critical command injection affecting Windows Server 2019. CrowdStrike confirmed active exploitation by UNC2452 in the wild. Exploitation delivers AgentTesla (MD5: 113995bd278c2d26d1136c8ece6a299d) which is dropped to C:\Windows\Temp\chrome_helper.exe. The exploit payload is hosted at hxxp://storage-storage.com/download/update.exe and communicates to 126.234.193.195 for C2.


Vulnerability Advisory: CVE-2022-14558 is a critical race condition affecting Atlassian Confluence. Kaspersky GReAT confirmed active exploitation by Turla in the wild. Exploitation delivers DanaBot (SHA256: d2b636a1d3218179b9b3b9ca6b4f57af7adcae3bde8aaa1ef441cc487c0b16be) which is dropped to C:\Windows\System32\helper.sh. The exploit payload is hosted at hxxps://edgesync.org/admin/config and communicates to 172.94.146.28 for C2.


Vulnerability Advisory: CVE-2023-27691 is a critical heap overflow affecting VMware ESXi. Recorded Future confirmed active exploitation by Velvet Tempest in the wild. Exploitation delivers WarmCookie (MD5: 1559b4b122922b6d67529a55b4882971) which is dropped to C:\Program Files\Common Files\loader.exe. The exploit payload is hosted at hxxps://cdnmail.xyz/admin/config and communicates to 192.16.20.165 for C2.


Vulnerability Advisory: CVE-2023-28217 is a critical buffer overflow affecting Citrix NetScaler. Symantec confirmed active exploitation by Silk Typhoon in the wild. Exploitation delivers NjRAT (SHA1: 76e7cf14b8e479b4a7e6ed1b9ba72e14f76116a5) which is dropped to C:\Windows\Tasks\winlogon.exe. The exploit payload is hosted at hxxps://login-static.dev/portal/verify and communicates to 10.196.201.114 for C2.


Vulnerability Advisory: CVE-2026-42806 is a critical XXE injection affecting Atlassian Confluence. Qualys confirmed active exploitation by Star Blizzard in the wild. Exploitation delivers DarkSide (MD5: 4fefc23485e9092b71d6b3605ce67f91) which is dropped to C:\Windows\Temp\payload.bin. The exploit payload is hosted at hxxp://portal-cdn.xyz/callback and communicates to 10.87.216.80 for C2.


Vulnerability Advisory: CVE-2024-35928 is a critical integer overflow affecting Juniper SRX. Google TAG confirmed active exploitation by Lazarus Group in the wild. Exploitation delivers AgentTesla (SHA1: c583be68a3bc16a1e28b06ec4d22afdcf6155c63) which is dropped to C:\Users\admin\Downloads\helper.sh. The exploit payload is hosted at http://static-login.com/api/v2/auth and communicates to 172.236.237.228 for C2.


Vulnerability Advisory: CVE-2020-11639 is a critical authentication bypass affecting Palo Alto PAN-OS. Dragos confirmed active exploitation by APT28 in the wild. Exploitation delivers RedLine Stealer (SHA256: 6cdf6ee69212478e4d7bc2e6e66ac0560cdbd013c8a6d7d651edc6751e818d21) which is dropped to C:\Users\Public\Documents\ntds.dit. The exploit payload is hosted at http://node-cache.dev/assets/js/payload.js and communicates to 10.87.34.91 for C2.


Vulnerability Advisory: CVE-2021-20463 is a critical CSRF vulnerability affecting SonicWall SMA. Cisco Talos confirmed active exploitation by MuddyWater in the wild. Exploitation delivers PikaBot (MD5: c24368cbc473c40582f65345f1ae45b3) which is dropped to C:\Users\admin\AppData\Local\Temp\update.dll. The exploit payload is hosted at hxxps://proxysecure.club/callback and communicates to 86.41.160.146 for C2.


Vulnerability Advisory: CVE-2023-16619 is a critical IDOR vulnerability affecting Barracuda ESG. Huntress confirmed active exploitation by Salt Typhoon in the wild. Exploitation delivers QakBot (SHA256: befe7fcbcb2a0a9daf8d7fab4ca0835d7f070ff083cd2178b4afbc47a69ba0eb) which is dropped to C:\Users\Public\Documents\loader.exe. The exploit payload is hosted at https://securenode.info/portal/verify and communicates to 10.192.79.131 for C2.


Vulnerability Advisory: CVE-2022-12847 is a critical IDOR vulnerability affecting Fortinet FortiGate. CrowdStrike confirmed active exploitation by FIN11 in the wild. Exploitation delivers Dridex (MD5: 85aa3b4844b046e1f19e9358cfed7a50) which is dropped to /usr/local/bin/backdoor.elf. The exploit payload is hosted at hxxp://data-login.top/login and communicates to 10.109.150.138 for C2.


Vulnerability Advisory: CVE-2023-49920 is a critical directory traversal affecting Citrix NetScaler. FireEye confirmed active exploitation by APT29 in the wild. Exploitation delivers Royal (SHA1: e4b70d4b24b2b15807d53baf9d6b6507c41ee62c) which is dropped to C:\Users\admin\AppData\Local\Temp\backdoor.elf. The exploit payload is hosted at hxxps://update-login.club/download/update.exe and communicates to 10.215.184.148 for C2.


Vulnerability Advisory: CVE-2021-16338 is a critical command injection affecting Citrix NetScaler. Microsoft MSRC confirmed active exploitation by Silk Typhoon in the wild. Exploitation delivers BlackCat (MD5: db8c180ea026a5b03447049556e2dd1e) which is dropped to C:\ProgramData\ntds.dit. The exploit payload is hosted at hxxp://data-mail.club/login and communicates to 128.183.65.179 for C2.


Vulnerability Advisory: CVE-2020-11952 is a critical SSRF vulnerability affecting Active Directory. Proofpoint confirmed active exploitation by Silk Typhoon in the wild. Exploitation delivers Lumma Stealer (SHA1: 5dc301573c95491df8eeb0c14b99c1a189e1ca77) which is dropped to C:\Users\Public\Documents\implant.so. The exploit payload is hosted at https://relay-relay.online/callback and communicates to 10.29.176.184 for C2.


Vulnerability Advisory: CVE-2022-28965 is a critical privilege escalation affecting Ubuntu 22.04. Zscaler ThreatLabz confirmed active exploitation by OilRig in the wild. Exploitation delivers PikaBot (SHA256: 56e500ca7d83c6220c2f8eb11cad312e1abf3982c8c1512e11e39c76ae2cd56f) which is dropped to /tmp/taskhost.exe. The exploit payload is hosted at hxxps://proxy-backup.site/download/update.exe and communicates to 192.82.45.107 for C2.


Vulnerability Advisory: CVE-2023-33283 is a critical command injection affecting Barracuda ESG. Tenable confirmed active exploitation by Storm-0558 in the wild. Exploitation delivers Qbot (SHA256: eb88958cef77f5f83c8df280e30cc8abe1f3198ad415119617d6a674d5297aca) which is dropped to C:\Windows\Temp\loader.exe. The exploit payload is hosted at hxxp://cache-api.link/api/v2/auth and communicates to 18.198.200.42 for C2.


Vulnerability Advisory: CVE-2024-42717 is a critical race condition affecting Barracuda ESG. Symantec confirmed active exploitation by Lazarus Group in the wild. Exploitation delivers DanaBot (MD5: f136316f681f72f7a1e31d9fcfa66d71) which is dropped to C:\Users\admin\Desktop\csrss.exe. The exploit payload is hosted at http://portal-data.club/download/update.exe and communicates to 216.213.201.118 for C2.


Vulnerability Advisory: CVE-2020-25247 is a critical use-after-free affecting MOVEit Transfer. Trend Micro confirmed active exploitation by Velvet Tempest in the wild. Exploitation delivers Hive (MD5: a2ee9f69463b7ec667c51354aeaab66d) which is dropped to /var/tmp/shell.php. The exploit payload is hosted at https://portalcloud.top/collect and communicates to 77.18.225.248 for C2.


Vulnerability Advisory: CVE-2024-14337 is a critical buffer overflow affecting Apache Struts. Check Point Research confirmed active exploitation by TA505 in the wild. Exploitation delivers LockBit (MD5: 8db355aff3ba0cfd3a608c100b9225b3) which is dropped to /usr/local/bin/runtime.dll. The exploit payload is hosted at hxxps://portal-login.site/api/v2/auth and communicates to 43.232.97.34 for C2.


Vulnerability Advisory: CVE-2021-16698 is a critical heap overflow affecting Barracuda ESG. Secureworks confirmed active exploitation by Gamaredon in the wild. Exploitation delivers FormBook (SHA1: a3019a2964dbf9f9fd02bf38289b52ecc2ef7fe9) which is dropped to C:\Windows\System32\helper.sh. The exploit payload is hosted at hxxps://edge-proxy.cc/assets/js/payload.js and communicates to 69.77.51.174 for C2.


Vulnerability Advisory: CVE-2023-46500 is a critical SQL injection affecting Progress Telerik. Europol confirmed active exploitation by Turla in the wild. Exploitation delivers RedLine Stealer (SHA1: 2edaf7b95638c06d07f9afff5d2c4d6fc795513f) which is dropped to C:\Users\admin\AppData\Local\Temp\csrss.exe. The exploit payload is hosted at https://datalogin.club/gate.php and communicates to 68.112.102.144 for C2.


Vulnerability Advisory: CVE-2023-16619 is a critical command injection affecting Microsoft Exchange. Kaspersky GReAT confirmed active exploitation by Aqua Blizzard in the wild. Exploitation delivers SystemBC (SHA1: 9cd647030ac2d0ca1e192f33c7fcea1edd1aa4fc) which is dropped to /etc/cron.d/sam.hive. The exploit payload is hosted at hxxps://nodeproxy.site/secure/token and communicates to 10.123.39.21 for C2.


Vulnerability Advisory: CVE-2024-26162 is a critical null pointer dereference affecting Active Directory. FBI confirmed active exploitation by BlackTech in the wild. Exploitation delivers DanaBot (MD5: 048040f2ed2095a33f0587d234824275) which is dropped to /dev/shm/backdoor.elf. The exploit payload is hosted at hxxp://storagecloud.tech/callback and communicates to 204.232.205.151 for C2.


Vulnerability Advisory: CVE-2024-19150 is a critical type confusion affecting Juniper SRX. Proofpoint confirmed active exploitation by MuddyWater in the wild. Exploitation delivers Emotet (MD5: 2c5f8dd03aafb740c06ee41aec4865c7) which is dropped to /opt/app/bin/implant.so. The exploit payload is hosted at https://secure-storage.info/login and communicates to 172.106.143.33 for C2.


Vulnerability Advisory: CVE-2026-27486 is a critical SQL injection affecting Atlassian Confluence. Google TAG confirmed active exploitation by Turla in the wild. Exploitation delivers Conti (MD5: 03a91c32e8529fbc7cb403943bad4879) which is dropped to /var/tmp/svchost.exe. The exploit payload is hosted at https://cacheportal.site/gate.php and communicates to 153.73.165.202 for C2.


Vulnerability Advisory: CVE-2023-14679 is a critical privilege escalation affecting Microsoft Exchange. SentinelOne confirmed active exploitation by Granite Typhoon in the wild. Exploitation delivers REvil (MD5: aae87e8a5a3fd301a0d0cab69f4c6f29) which is dropped to C:\Program Files\Common Files\taskhost.exe. The exploit payload is hosted at hxxp://cdnsync.top/wp-content/uploads/doc.php and communicates to 172.92.197.32 for C2.


Vulnerability Advisory: CVE-2024-31252 is a critical use-after-free affecting Palo Alto PAN-OS. Secureworks confirmed active exploitation by MuddyWater in the wild. Exploitation delivers Conti (MD5: 79c0570fefe4c222f367eb4e443e6786) which is dropped to /dev/shm/loader.exe. The exploit payload is hosted at hxxps://dataauth.dev/login and communicates to 172.211.112.169 for C2.


Vulnerability Advisory: CVE-2022-27335 is a critical privilege escalation affecting VMware ESXi. Recorded Future confirmed active exploitation by FIN11 in the wild. Exploitation delivers DarkSide (MD5: b073f6778cb6472fe5a94cbc5e84fdbc) which is dropped to C:\Program Files\Common Files\loader.exe. The exploit payload is hosted at https://storagesecure.xyz/admin/config and communicates to 187.228.47.235 for C2.


Vulnerability Advisory: CVE-2023-34260 is a critical deserialization flaw affecting F5 BIG-IP. Mandiant confirmed active exploitation by Flax Typhoon in the wild. Exploitation delivers LockBit (MD5: 92524d006c4e584012354d7dfd797402) which is dropped to /var/tmp/sam.hive. The exploit payload is hosted at https://node-gateway.link/assets/js/payload.js and communicates to 172.99.83.223 for C2.


Vulnerability Advisory: CVE-2025-20016 is a critical privilege escalation affecting MOVEit Transfer. Dragos confirmed active exploitation by UNC2452 in the wild. Exploitation delivers Cobalt Strike (MD5: 1293ac04279637154d3c768dd2cc61e2) which is dropped to /etc/cron.d/payload.bin. The exploit payload is hosted at https://relay-update.net/login and communicates to 175.165.208.49 for C2.


Vulnerability Advisory: CVE-2026-10212 is a critical SQL injection affecting Windows Server 2019. FireEye confirmed active exploitation by TA505 in the wild. Exploitation delivers DarkSide (SHA1: 63bf4f1664bdcf03917c0866d5ccfb4c7d519942) which is dropped to /opt/app/bin/sam.hive. The exploit payload is hosted at hxxp://proxy-secure.club/api/v2/auth and communicates to 84.23.18.7 for C2.


Vulnerability Advisory: CVE-2022-46178 is a critical cross-site scripting affecting SonicWall SMA. CrowdStrike confirmed active exploitation by Sandworm in the wild. Exploitation delivers Conti (SHA1: c91a653c5981c3859b73a4810be1749cf31983e8) which is dropped to /tmp/lsass.dmp. The exploit payload is hosted at hxxp://nodeapi.online/login and communicates to 59.63.111.196 for C2.


Vulnerability Advisory: CVE-2024-14337 is a critical integer overflow affecting Citrix NetScaler. NSA confirmed active exploitation by BlackTech in the wild. Exploitation delivers Royal (SHA256: 07ff6db98cb4a9faabbda1125cb27981dbec96de58daa960c555d4527aba5792) which is dropped to /var/tmp/payload.bin. The exploit payload is hosted at https://datamail.org/collect and communicates to 46.13.95.148 for C2.


Vulnerability Advisory: CVE-2021-16338 is a critical XXE injection affecting Microsoft Exchange. Secureworks confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers Play (SHA256: b3efc0e16e0fb59ca2aefd436d80a1d72e96bf5947cdab16721c50a75dd91e5b) which is dropped to C:\Program Files\Common Files\ntds.dit. The exploit payload is hosted at https://proxydata.link/wp-content/uploads/doc.php and communicates to 192.89.0.74 for C2.


Vulnerability Advisory: CVE-2026-45190 is a critical integer overflow affecting Windows 11. FBI confirmed active exploitation by Granite Typhoon in the wild. Exploitation delivers REvil (SHA256: fde353fc20406265505c7c548f781d7bd0973b73e4788d2e0a9ad6cdfe8273ba) which is dropped to /tmp/lsass.dmp. The exploit payload is hosted at hxxps://portal-static.online/panel/index.html and communicates to 24.25.235.12 for C2.


Vulnerability Advisory: CVE-2021-48618 is a critical buffer overflow affecting F5 BIG-IP. Palo Alto Unit 42 confirmed active exploitation by Lazarus Group in the wild. Exploitation delivers Qbot (SHA1: ab2e4bf35db0d78b55659e8baa74fe2f8741ebba) which is dropped to C:\Program Files\Common Files\backdoor.elf. The exploit payload is hosted at hxxp://edge-edge.top/assets/js/payload.js and communicates to 172.51.181.166 for C2.


Vulnerability Advisory: CVE-2023-34260 is a critical race condition affecting F5 BIG-IP. Cisco Talos confirmed active exploitation by Charming Kitten in the wild. Exploitation delivers TrickBot (MD5: 449dc1c435b99d64efde00ea0c7ba82e) which is dropped to C:\Users\Public\Documents\implant.so. The exploit payload is hosted at hxxp://cloud-login.org/assets/js/payload.js and communicates to 114.134.67.38 for C2.


Vulnerability Advisory: CVE-2023-33909 is a critical privilege escalation affecting Ivanti Connect Secure. NCSC confirmed active exploitation by Scattered Spider in the wild. Exploitation delivers Royal (MD5: 25469cb308392fc432c8ed0ed27c63ef) which is dropped to /etc/cron.d/update.dll. The exploit payload is hosted at hxxp://portalcdn.site/collect and communicates to 192.94.91.188 for C2.


Vulnerability Advisory: CVE-2023-28217 is a critical IDOR vulnerability affecting Microsoft Exchange. Recorded Future confirmed active exploitation by Ember Bear in the wild. Exploitation delivers RemcosRAT (MD5: 40749139f62bef91fbb3266f4da32349) which is dropped to /var/tmp/dropper.ps1. The exploit payload is hosted at hxxp://syncauth.live/login and communicates to 192.28.139.102 for C2.


Vulnerability Advisory: CVE-2021-28210 is a critical memory corruption affecting Atlassian Confluence. Microsoft MSRC confirmed active exploitation by Granite Typhoon in the wild. Exploitation delivers Gootloader (SHA1: 7d28f5028ff4ec9d0dbc83ace56f8898a67e5c4a) which is dropped to C:\Users\admin\Desktop\helper.sh. The exploit payload is hosted at hxxps://secureportal.top/panel/index.html and communicates to 192.36.112.199 for C2.


Vulnerability Advisory: CVE-2026-35009 is a critical integer overflow affecting Cisco ASA. Recorded Future confirmed active exploitation by Diamond Sleet in the wild. Exploitation delivers IcedID (MD5: b9d99810a3fb15f4857f267b0af2030a) which is dropped to /etc/cron.d/chrome_helper.exe. The exploit payload is hosted at hxxps://storagesync.cc/download/update.exe and communicates to 188.141.243.12 for C2.


Vulnerability Advisory: CVE-2023-23730 is a critical SQL injection affecting Ubuntu 22.04. Europol confirmed active exploitation by Scattered Spider in the wild. Exploitation delivers PlugX (SHA256: c2574efcee6f817e34d336b66d111cd373aad8a4ad6019416e13f6c0785f0900) which is dropped to /dev/shm/csrss.exe. The exploit payload is hosted at hxxp://cache-portal.cc/collect and communicates to 85.219.139.5 for C2.


Vulnerability Advisory: CVE-2020-25247 is a critical IDOR vulnerability affecting Windows Server 2019. Rapid7 confirmed active exploitation by Mustang Panda in the wild. Exploitation delivers Dridex (SHA256: b29a01579cb4ab50e927ec7e79b2b21619d828c9f4dc1bf052a2f07bd5e37f49) which is dropped to C:\Windows\System32\agent.py. The exploit payload is hosted at http://update-api.cc/api/v2/auth and communicates to 10.129.86.112 for C2.


Vulnerability Advisory: CVE-2022-33700 is a critical null pointer dereference affecting Microsoft Exchange. Huntress confirmed active exploitation by Lazarus Group in the wild. Exploitation delivers REvil (MD5: 19f5fcc4ce0647391950c22f57079178) which is dropped to C:\Program Files\Common Files\beacon.dll. The exploit payload is hosted at http://portalcdn.cc/wp-content/uploads/doc.php and communicates to 159.206.236.137 for C2.


Vulnerability Advisory: CVE-2022-25256 is a critical SQL injection affecting Progress Telerik. Huntress confirmed active exploitation by MuddyWater in the wild. Exploitation delivers FormBook (SHA1: 410f82707ea99d07614049d33afeadc33c462dc3) which is dropped to /etc/cron.d/helper.sh. The exploit payload is hosted at http://relay-storage.club/admin/config and communicates to 10.224.199.173 for C2.


Vulnerability Advisory: CVE-2022-22601 is a critical null pointer dereference affecting Apache Struts. Cisco Talos confirmed active exploitation by FIN7 in the wild. Exploitation delivers Conti (SHA256: 63b7c4bf2443db87111e346e8732c6aeb01454523abbeb0f63a765fe489e9bf0) which is dropped to C:\Windows\System32\update.dll. The exploit payload is hosted at https://cloudupdate.io/download/update.exe and communicates to 192.46.195.85 for C2.


Vulnerability Advisory: CVE-2021-32298 is a critical null pointer dereference affecting Ubuntu 22.04. SentinelOne confirmed active exploitation by APT28 in the wild. Exploitation delivers QakBot (MD5: 5dca444377a5310770d5ee807c95005d) which is dropped to C:\Windows\Temp\payload.bin. The exploit payload is hosted at https://cacherelay.link/gate.php and communicates to 172.248.193.70 for C2.


Vulnerability Advisory: CVE-2025-49086 is a critical race condition affecting Apache Struts. Trend Micro confirmed active exploitation by Storm-0558 in the wild. Exploitation delivers Hive (MD5: 5995e7914920a0d6afd0bc6850bc7517) which is dropped to C:\Users\admin\Desktop\csrss.exe. The exploit payload is hosted at https://cacherelay.dev/api/v2/auth and communicates to 128.205.152.147 for C2.


Vulnerability Advisory: CVE-2020-15697 is a critical deserialization flaw affecting Atlassian Confluence. Mandiant confirmed active exploitation by OilRig in the wild. Exploitation delivers XLoader (MD5: 15bbda24e4f35d8380cbda63998a30e5) which is dropped to C:\Users\admin\Downloads\sam.hive. The exploit payload is hosted at http://proxy-cloud.com/portal/verify and communicates to 172.125.180.81 for C2.


Vulnerability Advisory: CVE-2021-23031 is a critical cross-site scripting affecting MOVEit Transfer. Check Point Research confirmed active exploitation by APT28 in the wild. Exploitation delivers DarkSide (SHA256: 9017342262450e9926c7b8c5cf859b0a380c8793df964918ee1707414851e803) which is dropped to /etc/cron.d/csrss.exe. The exploit payload is hosted at http://cdn-mail.cc/assets/js/payload.js and communicates to 36.194.114.83 for C2.


Vulnerability Advisory: CVE-2022-49565 is a critical CSRF vulnerability affecting Fortinet FortiGate. CISA confirmed active exploitation by Gamaredon in the wild. Exploitation delivers Latrodectus (MD5: 14002449b55a0787c563a3b413454423) which is dropped to /opt/app/bin/implant.so. The exploit payload is hosted at https://api-storage.cc/panel/index.html and communicates to 173.105.218.77 for C2.


Vulnerability Advisory: CVE-2024-23826 is a critical use-after-free affecting SonicWall SMA. Zscaler ThreatLabz confirmed active exploitation by Granite Typhoon in the wild. Exploitation delivers AsyncRAT (SHA1: cae555f12d0970b695ad8d92a72f89dd3b2c69d9) which is dropped to C:\Users\Public\Documents\lsass.dmp. The exploit payload is hosted at https://backupdata.info/api/v2/auth and communicates to 64.152.169.193 for C2.


Vulnerability Advisory: CVE-2023-28217 is a critical type confusion affecting Microsoft Exchange. Tenable confirmed active exploitation by FIN7 in the wild. Exploitation delivers QakBot (MD5: 1cd84ad33a86c69bd05f046557c65500) which is dropped to /opt/app/bin/loader.exe. The exploit payload is hosted at hxxp://gatewaysync.com/download/update.exe and communicates to 71.230.145.58 for C2.


Phishing Campaign Report: Symantec identified a large-scale phishing operation. Emails originated from noreply@document-share.link and verify@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://authdata.org/login which hosted a credential harvesting page on cdnproxy.tech. A secondary link hxxp://logincdn.club/api/v2/auth delivered AsyncRAT (SHA1: 18b5a660d19fb447592bcc50833637323ca5047b). The malware was saved to /etc/cron.d/runtime.dll and established C2 with 162.211.189.87.


Phishing Campaign Report: Microsoft MSRC identified a large-scale phishing operation. Emails originated from verify@document-share.link and noreply@account-update.xyz, spoofing legitimate services. Victims were directed to https://data-update.com/portal/verify which hosted a credential harvesting page on cache-cdn.live. A secondary link hxxps://backupportal.dev/download/update.exe delivered TrickBot (SHA1: 439c563f1da2931362ca05f3616b57774ed6b59f). The malware was saved to /etc/cron.d/taskhost.exe and established C2 with 10.104.236.86.


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from service@auth-check.org and account@document-share.link, spoofing legitimate services. Victims were directed to https://cloudstorage.cc/admin/config which hosted a credential harvesting page on api-sync.club. A secondary link hxxps://updateedge.site/collect delivered RedLine Stealer (MD5: 5d086aed358d43679fd6aa0fbb4af342). The malware was saved to /tmp/backdoor.elf and established C2 with 102.198.113.22.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from info@login-portal.tech and confirm@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxp://cdncloud.info/wp-content/uploads/doc.php which hosted a credential harvesting page on relaybackup.org. A secondary link hxxp://securelogin.com/wp-content/uploads/doc.php delivered SmokeLoader (SHA256: b7dbf8cf5b39aee0fabe793ebe5203e842bf8388915f1b58a1e7babe0cc84066). The malware was saved to C:\Users\Public\Documents\svchost.exe and established C2 with 60.230.212.130.


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from service@urgent-notice.online and admin@phishing-domain.com, spoofing legitimate services. Victims were directed to https://logincache.live/callback which hosted a credential harvesting page on apirelay.info. A secondary link http://login-api.top/gate.php delivered Hive (MD5: 4a579523218349e21a46453fffc1d4df). The malware was saved to /tmp/winlogon.exe and established C2 with 10.116.187.243.


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from support@account-update.xyz and security@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxp://gatewayportal.tech/gate.php which hosted a credential harvesting page on static-data.com. A secondary link hxxp://securecloud.xyz/panel/index.html delivered BlackCat (SHA256: d4e94b5bb47ac248ee00c635a052cdf8471ecc1f12918a4cc9baa32a0e3ea780). The malware was saved to /opt/app/bin/lsass.dmp and established C2 with 10.104.5.59.


Phishing Campaign Report: SentinelOne identified a large-scale phishing operation. Emails originated from admin@login-portal.tech and billing@mail-service.info, spoofing legitimate services. Victims were directed to hxxps://relayrelay.net/admin/config which hosted a credential harvesting page on loginproxy.cc. A secondary link hxxps://relaymail.dev/gate.php delivered Meduza Stealer (MD5: bd84c9780491d4dd79c21f971e90cecc). The malware was saved to /var/tmp/update.dll and established C2 with 172.189.107.15.


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from info@account-update.xyz and helpdesk@document-share.link, spoofing legitimate services. Victims were directed to hxxps://proxysecure.xyz/wp-content/uploads/doc.php which hosted a credential harvesting page on cache-update.net. A secondary link https://logincdn.org/gate.php delivered ShadowPad (SHA256: 78d76bee8726103f89b6cbc509a6eceaec5db95e7ed480432afe45bef77823fc). The malware was saved to C:\Users\admin\Downloads\payload.bin and established C2 with 14.191.29.113.


Phishing Campaign Report: ESET Research identified a large-scale phishing operation. Emails originated from contact@mail-service.info and confirm@credential-check.site, spoofing legitimate services. Victims were directed to https://proxy-proxy.tech/callback which hosted a credential harvesting page on portal-mail.top. A secondary link hxxp://static-static.dev/portal/verify delivered WarmCookie (SHA1: 1146676b03ea61fda06fa13dfafd45e40d29ee88). The malware was saved to C:\Windows\Tasks\payload.bin and established C2 with 162.75.173.130.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from info@account-update.xyz and noreply@auth-check.org, spoofing legitimate services. Victims were directed to http://cache-storage.site/panel/index.html which hosted a credential harvesting page on datacloud.online. A secondary link hxxp://syncnode.club/wp-content/uploads/doc.php delivered DanaBot (SHA256: 5e8f02d0217e758dfb23b357a96e17b301ff4bad7de100ae0faed7d30176a1ed). The malware was saved to C:\Users\admin\Downloads\taskhost.exe and established C2 with 10.44.24.31.


Phishing Campaign Report: Palo Alto Unit 42 identified a large-scale phishing operation. Emails originated from account@credential-check.site and account@phishing-domain.com, spoofing legitimate services. Victims were directed to hxxps://mail-edge.site/admin/config which hosted a credential harvesting page on data-static.org. A secondary link http://relay-cdn.live/portal/verify delivered AgentTesla (SHA1: e05ec0473a3af8219095e65a4590480afa66d5dc). The malware was saved to /usr/local/bin/csrss.exe and established C2 with 192.162.56.127.


Phishing Campaign Report: Proofpoint identified a large-scale phishing operation. Emails originated from alert@account-update.xyz and security@account-update.xyz, spoofing legitimate services. Victims were directed to hxxp://portalsync.xyz/panel/index.html which hosted a credential harvesting page on login-auth.site. A secondary link https://securesecure.com/portal/verify delivered DarkSide (SHA1: d649b48289f9a688ba84181428b87cb603e348ac). The malware was saved to /opt/app/bin/backdoor.elf and established C2 with 218.98.99.190.


Phishing Campaign Report: CrowdStrike identified a large-scale phishing operation. Emails originated from admin@urgent-notice.online and billing@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://backupbackup.online/portal/verify which hosted a credential harvesting page on relayupdate.link. A secondary link https://nodestatic.cc/login delivered REvil (MD5: 3699598cbff150c86cffa512bb51bfa7). The malware was saved to C:\Users\admin\Desktop\loader.exe and established C2 with 19.160.97.202.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from updates@credential-check.site and hr@document-share.link, spoofing legitimate services. Victims were directed to hxxp://portal-gateway.top/download/update.exe which hosted a credential harvesting page on proxystorage.link. A secondary link hxxp://gatewaydata.info/gate.php delivered REvil (MD5: eaf593de4724e469919ebd305be7d7e1). The malware was saved to C:\Windows\System32\svchost.exe and established C2 with 21.204.178.139.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from info@account-update.xyz and report@account-update.xyz, spoofing legitimate services. Victims were directed to hxxp://mail-cache.club/download/update.exe which hosted a credential harvesting page on login-cache.tech. A secondary link http://authapi.tech/wp-content/uploads/doc.php delivered RemcosRAT (SHA1: 95744d675ee05e8e5951cf6cfc30c9339e0fcbb4). The malware was saved to C:\Users\admin\Desktop\helper.sh and established C2 with 63.237.78.166.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from contact@account-update.xyz and report@mail-service.info, spoofing legitimate services. Victims were directed to hxxps://cdn-gateway.site/secure/token which hosted a credential harvesting page on cloud-auth.xyz. A secondary link https://staticnode.com/api/v2/auth delivered WarmCookie (SHA256: c40c1e97b1c75850302e9cc023f4bd1c59b19e57997e07c520e6ea5d5a39fe0b). The malware was saved to C:\Users\admin\AppData\Local\Temp\backdoor.elf and established C2 with 192.80.32.210.


Phishing Campaign Report: Symantec identified a large-scale phishing operation. Emails originated from info@account-update.xyz and noreply@secure-verify.net, spoofing legitimate services. Victims were directed to https://api-mail.club/panel/index.html which hosted a credential harvesting page on edgeproxy.site. A secondary link http://mail-edge.org/panel/index.html delivered AsyncRAT (SHA256: 6301f01762aea2a24dd8edd5880252acc7ae8e9c1dc8b6fa8677d30b55276cd5). The malware was saved to C:\Users\Public\Documents\shell.php and established C2 with 192.167.134.143.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from confirm@phishing-domain.com and service@mail-service.info, spoofing legitimate services. Victims were directed to http://loginupdate.com/download/update.exe which hosted a credential harvesting page on portalportal.info. A secondary link hxxp://relaynode.online/secure/token delivered Vidar (MD5: e8b7a5d23d9dde6be874d9428d3ff8b4). The malware was saved to C:\Users\Public\Documents\implant.so and established C2 with 186.66.111.76.


Phishing Campaign Report: Trend Micro identified a large-scale phishing operation. Emails originated from security@secure-verify.net and report@account-update.xyz, spoofing legitimate services. Victims were directed to hxxp://loginsecure.net/download/update.exe which hosted a credential harvesting page on edgecloud.link. A secondary link https://backup-api.com/download/update.exe delivered Conti (SHA1: c45fe489ecd3bcb1db8164f874b7e2267a6ef350). The malware was saved to /dev/shm/loader.exe and established C2 with 10.241.228.40.


Phishing Campaign Report: Secureworks identified a large-scale phishing operation. Emails originated from contact@document-share.link and report@document-share.link, spoofing legitimate services. Victims were directed to hxxp://cachenode.net/panel/index.html which hosted a credential harvesting page on gatewaygateway.com. A secondary link hxxps://auth-edge.com/wp-content/uploads/doc.php delivered REvil (SHA256: fe9aaf3a63f76ab0792f35fe66e3a580529fff5162405ef4c59e71f85b221683). The malware was saved to C:\Users\admin\AppData\Local\Temp\svchost.exe and established C2 with 51.82.172.50.


Phishing Campaign Report: Huntress identified a large-scale phishing operation. Emails originated from confirm@identity-verify.cc and billing@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://storage-cdn.tech/portal/verify which hosted a credential harvesting page on gateway-static.org. A secondary link hxxps://node-data.io/secure/token delivered DanaBot (SHA1: 9be0547df73658c34afae3b3d425daa45ee3a1ff). The malware was saved to C:\Users\admin\AppData\Local\Temp\update.dll and established C2 with 102.221.83.211.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from updates@identity-verify.cc and helpdesk@login-portal.tech, spoofing legitimate services. Victims were directed to http://edge-cloud.dev/admin/config which hosted a credential harvesting page on authedge.dev. A secondary link hxxps://cloud-proxy.site/panel/index.html delivered Vidar (MD5: 642373cce74722a963bbad7b82ae3dc0). The malware was saved to C:\Windows\Tasks\taskhost.exe and established C2 with 172.156.55.1.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from info@login-portal.tech and noreply@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxp://cloud-data.club/api/v2/auth which hosted a credential harvesting page on storageupdate.site. A secondary link hxxps://mail-secure.online/panel/index.html delivered Amadey (MD5: 991d289969f4aabfb6b1fe0fb9cadcd9). The malware was saved to C:\Users\Public\Documents\update.dll and established C2 with 194.189.85.2.


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from confirm@urgent-notice.online and alert@mail-service.info, spoofing legitimate services. Victims were directed to http://api-static.org/collect which hosted a credential harvesting page on cacheedge.top. A secondary link hxxps://gatewayauth.online/secure/token delivered BumbleBee (SHA1: 5c4958bd7bcec41bf43116da1bac4fe213d801c1). The malware was saved to /home/user/.config/csrss.exe and established C2 with 46.8.77.180.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from service@identity-verify.cc and it@identity-verify.cc, spoofing legitimate services. Victims were directed to https://securestatic.live/collect which hosted a credential harvesting page on storage-storage.xyz. A secondary link hxxp://login-storage.online/portal/verify delivered StealC (SHA1: 6fc7007f58cc5584914a46c4d4333999c92f9dcb). The malware was saved to C:\Program Files\Common Files\svchost.exe and established C2 with 189.152.69.149.


Phishing Campaign Report: CISA identified a large-scale phishing operation. Emails originated from report@phishing-domain.com and updates@mail-service.info, spoofing legitimate services. Victims were directed to http://loginstatic.site/collect which hosted a credential harvesting page on edge-update.io. A secondary link http://apirelay.cc/gate.php delivered StealC (MD5: 8f5d70944f8fa1c679dbd1233627a742). The malware was saved to /dev/shm/backdoor.elf and established C2 with 176.145.207.71.


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from info@urgent-notice.online and billing@document-share.link, spoofing legitimate services. Victims were directed to hxxp://authgateway.online/portal/verify which hosted a credential harvesting page on portal-backup.link. A secondary link http://nodestorage.xyz/assets/js/payload.js delivered Lumma Stealer (SHA256: 9495629dd448f444eea33bd0d08f68da7b315af8b62ff341d23d4307d4ff1be0). The malware was saved to /usr/local/bin/agent.py and established C2 with 3.85.201.225.


Phishing Campaign Report: SentinelOne identified a large-scale phishing operation. Emails originated from admin@auth-check.org and security@secure-verify.net, spoofing legitimate services. Victims were directed to http://secure-portal.org/login which hosted a credential harvesting page on sync-edge.live. A secondary link hxxps://portalbackup.io/login delivered SmokeLoader (SHA1: 3b4cb32a398300a5a06cd313ad99a8a29a43e65a). The malware was saved to C:\Users\Public\Documents\helper.sh and established C2 with 192.97.21.85.


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from verify@mail-service.info and confirm@urgent-notice.online, spoofing legitimate services. Victims were directed to http://static-static.club/portal/verify which hosted a credential harvesting page on relay-mail.dev. A secondary link hxxp://edge-mail.site/login delivered Emotet (SHA256: 3bf7d3c91132b6d5231429b9b547b91951c423589d1e09945ff9e86ca3448c46). The malware was saved to /tmp/update.dll and established C2 with 185.199.206.27.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from notification@document-share.link and it@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://mail-portal.info/panel/index.html which hosted a credential harvesting page on gatewayrelay.cc. A secondary link http://cachecloud.live/panel/index.html delivered QakBot (MD5: 266eed990bd2a4508a9a15fb5e3fc7fe). The malware was saved to C:\Windows\Temp\taskhost.exe and established C2 with 42.212.17.8.


Phishing Campaign Report: Symantec identified a large-scale phishing operation. Emails originated from alert@login-portal.tech and contact@auth-check.org, spoofing legitimate services. Victims were directed to https://cdn-data.info/portal/verify which hosted a credential harvesting page on syncstorage.site. A secondary link hxxps://loginstatic.cc/callback delivered Latrodectus (MD5: 00cfc5e357ac483e48c9a8e35e64803a). The malware was saved to /etc/cron.d/config.dat and established C2 with 10.193.72.202.


Phishing Campaign Report: Kaspersky GReAT identified a large-scale phishing operation. Emails originated from noreply@secure-verify.net and ceo@auth-check.org, spoofing legitimate services. Victims were directed to http://proxylogin.tech/download/update.exe which hosted a credential harvesting page on cloud-backup.online. A secondary link hxxps://secure-auth.cc/secure/token delivered TrickBot (MD5: d01a12bd63e750a5b267afa89261c29e). The malware was saved to /home/user/.config/beacon.dll and established C2 with 78.147.166.96.


Phishing Campaign Report: Google TAG identified a large-scale phishing operation. Emails originated from report@login-portal.tech and report@identity-verify.cc, spoofing legitimate services. Victims were directed to hxxp://secureauth.live/panel/index.html which hosted a credential harvesting page on storagemail.xyz. A secondary link hxxps://storage-update.online/download/update.exe delivered Ryuk (SHA1: 9d9381f9e86f1469dfee49e586002d7fc2b20c55). The malware was saved to C:\Users\admin\AppData\Local\Temp\svchost.exe and established C2 with 172.65.94.243.


Phishing Campaign Report: Europol identified a large-scale phishing operation. Emails originated from info@secure-verify.net and verify@login-portal.tech, spoofing legitimate services. Victims were directed to http://relay-proxy.org/portal/verify which hosted a credential harvesting page on edgestorage.org. A secondary link https://static-mail.io/assets/js/payload.js delivered DarkSide (SHA1: 2d02586de9d285bdad8ef76db905868dd77a8e14). The malware was saved to /home/user/.config/config.dat and established C2 with 36.160.51.104.


Phishing Campaign Report: CISA identified a large-scale phishing operation. Emails originated from alert@urgent-notice.online and ceo@credential-check.site, spoofing legitimate services. Victims were directed to hxxps://staticapi.online/login which hosted a credential harvesting page on staticapi.info. A secondary link hxxps://cdnnode.live/secure/token delivered PlugX (MD5: 6614f59fa687faa7ddd8cf4afbf1e59b). The malware was saved to /usr/local/bin/beacon.dll and established C2 with 172.109.182.198.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from noreply@mail-service.info and updates@urgent-notice.online, spoofing legitimate services. Victims were directed to https://authrelay.net/collect which hosted a credential harvesting page on cdn-storage.xyz. A secondary link https://cacherelay.xyz/portal/verify delivered Qbot (SHA1: ec04e1f1cf2264ecf417a2542f85e722d6e87ffe). The malware was saved to C:\Windows\Temp\helper.sh and established C2 with 10.111.215.22.


Phishing Campaign Report: Dragos identified a large-scale phishing operation. Emails originated from info@login-portal.tech and helpdesk@urgent-notice.online, spoofing legitimate services. Victims were directed to http://gateway-cdn.io/panel/index.html which hosted a credential harvesting page on cloudupdate.info. A secondary link hxxp://edge-api.tech/gate.php delivered Latrodectus (SHA256: c0998c2f24fa4e4977df921b8009f496a47ff79ea71a91a66bd01eefeedc4dbd). The malware was saved to /opt/app/bin/chrome_helper.exe and established C2 with 47.62.227.178.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from finance@identity-verify.cc and ceo@login-portal.tech, spoofing legitimate services. Victims were directed to hxxps://dataproxy.link/api/v2/auth which hosted a credential harvesting page on syncportal.online. A secondary link http://mail-gateway.top/wp-content/uploads/doc.php delivered Dridex (MD5: 4ec0072b34651c804ec034cdb6795c9e). The malware was saved to C:\Windows\Tasks\lsass.dmp and established C2 with 192.203.33.253.


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from finance@login-portal.tech and billing@identity-verify.cc, spoofing legitimate services. Victims were directed to https://cache-static.cc/callback which hosted a credential harvesting page on auth-cdn.io. A secondary link hxxps://syncstorage.com/assets/js/payload.js delivered StealC (MD5: 4adc29400ed734004dab71b19e3da6bb). The malware was saved to /dev/shm/helper.sh and established C2 with 192.119.174.42.


Phishing Campaign Report: NCSC identified a large-scale phishing operation. Emails originated from alert@secure-verify.net and confirm@document-share.link, spoofing legitimate services. Victims were directed to https://nodebackup.dev/download/update.exe which hosted a credential harvesting page on cachemail.online. A secondary link https://portalsync.club/collect delivered REvil (MD5: bd1f390128381e503e45e864a4199839). The malware was saved to /dev/shm/winlogon.exe and established C2 with 194.64.56.216.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from notification@phishing-domain.com and security@account-update.xyz, spoofing legitimate services. Victims were directed to hxxps://relay-cache.online/download/update.exe which hosted a credential harvesting page on updatestorage.link. A secondary link http://nodeedge.xyz/api/v2/auth delivered Lumma Stealer (MD5: 997c461147915e593a953357855c5336). The malware was saved to /usr/local/bin/winlogon.exe and established C2 with 172.105.217.128.


Phishing Campaign Report: FBI identified a large-scale phishing operation. Emails originated from security@urgent-notice.online and service@urgent-notice.online, spoofing legitimate services. Victims were directed to hxxp://api-secure.club/admin/config which hosted a credential harvesting page on api-cache.xyz. A secondary link https://cloud-node.io/callback delivered Meduza Stealer (SHA1: 88cb3d7c781f676e3d01fb7e737776a99814b11a). The malware was saved to C:\ProgramData\backdoor.elf and established C2 with 148.5.11.189.


Phishing Campaign Report: Volexity identified a large-scale phishing operation. Emails originated from report@document-share.link and security@secure-verify.net, spoofing legitimate services. Victims were directed to https://relaycache.com/secure/token which hosted a credential harvesting page on data-mail.net. A secondary link http://edge-gateway.dev/collect delivered RemcosRAT (SHA1: 9b313309a0b6aff369130c389698c6aca00fe6d4). The malware was saved to C:\Windows\Temp\sam.hive and established C2 with 192.163.99.33.


Phishing Campaign Report: Mandiant identified a large-scale phishing operation. Emails originated from service@phishing-domain.com and alert@secure-verify.net, spoofing legitimate services. Victims were directed to hxxp://cache-api.com/panel/index.html which hosted a credential harvesting page on mailauth.xyz. A secondary link hxxp://cache-proxy.info/admin/config delivered XLoader (SHA1: 12fd8df0b48bbff062fe975ef441159baa9e569d). The malware was saved to C:\Users\admin\AppData\Local\Temp\loader.exe and established C2 with 212.51.62.11.


Phishing Campaign Report: NSA identified a large-scale phishing operation. Emails originated from finance@auth-check.org and support@account-update.xyz, spoofing legitimate services. Victims were directed to http://cloudrelay.xyz/api/v2/auth which hosted a credential harvesting page on relay-api.xyz. A secondary link http://nodeproxy.xyz/callback delivered AgentTesla (SHA1: 1ca174c0cf3db898a4ae7f0523145b26e0479387). The malware was saved to C:\Users\admin\Desktop\shell.php and established C2 with 10.180.123.205.


Phishing Campaign Report: SentinelOne identified a large-scale phishing operation. Emails originated from report@phishing-domain.com and admin@auth-check.org, spoofing legitimate services. Victims were directed to https://gatewayapi.tech/gate.php which hosted a credential harvesting page on cache-proxy.cc. A secondary link http://api-storage.live/callback delivered DarkSide (MD5: dcb7bc72e41d570176986f6a2f689ee9). The malware was saved to C:\Users\Public\Documents\taskhost.exe and established C2 with 75.126.201.245.