/
threat_actors:Patchwork × latest_source_host:f5.com × limpar

Resultados

2 casos · pág. 1/1

f5.com · exploit público high

F5 Labs: SparkRAT C2 scanning from DigitalOcean and April 2025 CVE exploitation trends, including Fortinet SSL-VPN and SAP NetWeaver

F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…

CVE-2017-9841 CVE-2019-9082 CVE-2022-24847 Patchwork BianLian
f5.com · medium

F5 Labs analyzes SparkRAT open-source RAT architectural weaknesses, exploits an in-the-wild C2, and releases YARA rules

F5 Labs published research on SparkRAT, a freely available, Go-based open-source Remote Access Trojan with a C2 server and builds for Windows, Linux and macOS. Public reporting since January 2023 shows use by a widening set of actors: Chinese-speaking groups, Winnti (APT41), Patchwork, TAG-100, suspected UAC-0194 against Ukraine, and Cybe…

Winnti APT41