F5 Labs: SparkRAT C2 scanning from DigitalOcean and April 2025 CVE exploitation trends, including Fortinet SSL-VPN and SAP NetWeaver
F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…