3 casos · pág. 1/1
F5 Labs, using Efflux sensor telemetry, reports on the most exploited CVEs of April 2025 and on internet-wide scanning for SparkRAT command-and-control servers. A single actor, using three IPs in DigitalOcean ASN 14061, sent identical HTTP POST requests to the SparkRAT in-place update endpoint, each IP scanning for about 13 hours and reac…
F5 Labs, using Efflux sensor telemetry, reports a campaign that began on 2025-06-08. One actor is exploiting TP-Link AX21 routers (CVE-2023-1389, command injection in the country query parameter) and Raisecom web interfaces (CVE-2024-7120) to deliver a new malware family named NoBooze1. Four source IPs and three stage-one hosts were rotat…
Unit 42 reports a campaign, tracked as CL-UNK-1211, that targeted government entities and state-affiliated infrastructure between October 2025 and April 2026. The cluster has not been attributed to a nation-state or to cybercrime. The attackers focused on Linux servers for reconnaissance, persistence and intelligence collection, including…
