# StopRansomware: Ghost (Cring) Ransomware | CISA

Cybersecurity Advisory

Release Date

February 19, 2025

Alert Code

AA25-050A

#### Actions for Organizations to Take Today to Mitigate Cyber Threats Related to Ghost (Cring) Ransomware Activity

1.  Maintain regular system backups stored separately from the source systems which cannot be altered or encrypted by potentially compromised network devices \[CPG 2.R\].
2.  Patch known vulnerabilities by applying timely security updates to operating systems, software, and firmware within a risk-informed timeframe \[CPG 2.F\].
3.  Common Vulnerabilities and Exposures (CVE): CVE-2018-13379, CVE-2010-2861, CVE-2009-3960, CVE-2021-34473, CVE-2021-34523, CVE-2021-31207.
4.  Segment networks to restrict lateral movement from initial infected devices and other devices in the same organization \[CPG 2.F\].
5.  Require Phishing-Resistant MFA for access to all privileged accounts and email services accounts.

**Summary**
-----------

_**Note:** This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit_ [_stopransomware.gov_](https://www.cisa.gov/stopransomware "#StopRansomware") _to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources._

The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) are releasing this joint advisory to disseminate known Ghost (Cring)—(“Ghost”)—ransomware IOCs and TTPs identified through FBI investigation as recently as January 2025.

Beginning early 2021, Ghost actors began attacking victims whose internet facing services ran outdated versions of software and firmware. This indiscriminate targeting of networks containing vulnerabilities has led to the compromise of organizations across more than 70 countries, including organizations in China. Ghost actors, located in China, conduct these widespread attacks for financial gain. Affected victims include critical infrastructure, schools and universities, healthcare, government networks, religious institutions, technology and manufacturing companies, and numerous small- and medium-sized businesses.

Ghost actors rotate their ransomware executable payloads, switch file extensions for encrypted files, modify ransom note text, and use numerous ransom email addresses, which has led to variable attribution of this group over time. Names associated with this group include Ghost, Cring, Crypt3r, Phantom, Strike, Hello, Wickrme, HsHarada, and Rapture. Samples of ransomware files Ghost used during attacks are: Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe.

Ghost actors use publicly available code to exploit Common Vulnerabilities and Exposures (CVEs) and gain access to internet facing servers. Ghost actors exploit well known vulnerabilities and target networks where available patches have not been applied.

The FBI, CISA, and MS-ISAC encourage organizations to implement the recommendations in the **Mitigations** section of this advisory to reduce the likelihood and impact of Ghost ransomware incidents.

**Technical Details**
---------------------

**Note:** This advisory uses the [MITRE ATT&CK® Matrix for Enterprise](https://attack.mitre.org/versions/v16/ "MITRE ATT&CK® Matrix for Enterprise") framework, version 16.1. See the **MITRE ATT&CK Tactics and Techniques** section of this advisory for a table of the threat actors’ activity mapped to MITRE ATT&CK tactics and techniques.

### Initial Access

The FBI has observed Ghost actors obtaining initial access to networks by exploiting public facing applications that are associated with multiple CVEs \[[T1190](https://attack.mitre.org/versions/v16/techniques/T1190/ "Exploit Public-Facing Application")\]. Their methodology includes leveraging vulnerabilities in Fortinet FortiOS appliances ([CVE-2018-13379](https://nvd.nist.gov/vuln/detail/CVE-2018-13379 "CVE-2018-13379")), servers running Adobe ColdFusion ([CVE-2010-2861](https://nvd.nist.gov/vuln/detail/CVE-2010-2861 "CVE-2010-2861") and [CVE-2009-3960](https://nvd.nist.gov/vuln/detail/CVE-2009-3960 "CVE-2009-3960")), Microsoft SharePoint ([CVE-2019-0604](https://nvd.nist.gov/vuln/detail/CVE-2019-0604 "CVE-2019-0604")), and Microsoft Exchange ([CVE-2021-34473](https://nvd.nist.gov/vuln/detail/CVE-2021-34473 "CVE-2021-34473"), [CVE-2021-34523](https://nvd.nist.gov/vuln/detail/CVE-2021-34523 "CVE-2021-34523"), and [CVE-2021-31207](https://nvd.nist.gov/vuln/detail/CVE-2021-31207 "CVE-2021-31207")— commonly referred to as the ProxyShell attack chain).

### Execution

Ghost actors have been observed uploading a web shell \[[T1505.003](https://attack.mitre.org/versions/v16/techniques/T1505/003/ "Server Software Component: Web Shell")\] to a compromised server and leveraging Windows Command Prompt \[[T1059.003](https://attack.mitre.org/versions/v16/techniques/T1059/003/ "Command and Scripting Interpreter: Windows Command Shell")\] and/or PowerShell \[[T1059.001](https://attack.mitre.org/versions/v16/techniques/T1059/001/ "Command and Scripting Interpreter: PowerShell")\] to download and execute [Cobalt Strike](https://attack.mitre.org/software/S0154/ "Cobalt Strike") Beacon malware \[[T1105](https://attack.mitre.org/versions/v16/techniques/T1105/ "Ingress Tool Transfer")\] that is then implanted on victim systems. Despite Ghost actors’ malicious implementation, Cobalt Strike is a commercially available adversary simulation tool often used for the purposes of testing an organization’s security controls.

### Persistence

Persistence is not a major focus for Ghost actors, as they typically only spend a few days on victim networks. In multiple instances, they have been observed proceeding from initial compromise to the deployment of ransomware within the same day. However, Ghost actors sporadically create new local \[[T1136.001](https://attack.mitre.org/versions/v16/techniques/T1136/001/ "Create Account: Local Account")\] and domain accounts \[[T1136.002](https://attack.mitre.org/versions/v16/techniques/T1136/002/ "Create Account: Domain Account")\] and change passwords for existing accounts \[[T1098](https://attack.mitre.org/versions/v16/techniques/T1098/ "Account Manipulation")\]. In 2024, Ghost actors were observed deploying web shells \[[T1505.003](https://attack.mitre.org/versions/v16/techniques/T1505/003/ "Server Software Component: Web Shell")\] on victim web servers.

### Privilege Escalation

Ghost actors often rely on built in Cobalt Strike functions to steal process tokens running under the SYSTEM user context to impersonate the SYSTEM user, often for the purpose of running Beacon a second time with elevated privileges \[[T1134.001](https://attack.mitre.org/versions/v16/techniques/T1134/001/ "Access Token Manipulation: Token Impersonation/Theft")\].

Ghost actors have been observed using multiple open-source tools in an attempt at privilege escalation through exploitation \[[T1068](https://attack.mitre.org/versions/v16/techniques/T1068/ "Exploitation for Privilege Escalation")\] such as “[SharpZeroLogon](https://github.com/leitosama/SharpZeroLogon "SharpZeroLogon"),” “SharpGPPPass,” “[BadPotato](https://github.com/BeichenDream/BadPotato "BadPotato"),” and “[GodPotato](https://github.com/BeichenDream/GodPotato "GodPotato").” These privilege escalation tools would not generally be used by individuals with legitimate access and credentials.

See **Table 1** for a descriptive listing of tools.

### Credential Access

Ghost actors use the built in Cobalt Strike function “hashdump” or [Mimikatz](https://attack.mitre.org/versions/v16/software/S0002/ "Mimikatz") \[[T1003](https://attack.mitre.org/versions/v16/techniques/T1003/ "OS Credential Dumping")\] to collect passwords and/or password hashes to aid them with unauthorized logins and privilege escalation or to pivot to other victim devices.

### Defense Evasion

Ghost actors used their access through Cobalt Strike to display a list of running processes \[[T1057](https://attack.mitre.org/versions/v16/techniques/T1057/ "Process Discovery")\] to determine which antivirus software \[[T1518.001](https://attack.mitre.org/versions/v16/techniques/T1518/001/ "Software Discovery: Security Software Discovery")\] is running so that it can be disabled \[[T1562.001](https://attack.mitre.org/versions/v16/techniques/T1562/001/ "Impair Defenses: Disable or Modify Tools")\]. Ghost frequently runs a command to disable Windows Defender on network connected devices. Options used in this command are: Set-MpPreference -DisableRealtimeMonitoring 1 -DisableIntrusionPreventionSystem 1 -DisableBehaviorMonitoring 1 -DisableScriptScanning 1 -DisableIOAVProtection 1 -EnableControlledFolderAccess Disabled -MAPSReporting Disabled -SubmitSamplesConsent NeverSend.

### Discovery

Ghost actors have been observed using other built-in Cobalt Strike commands for domain account discovery \[[T1087.002](https://attack.mitre.org/versions/v16/techniques/T1087/002/ "Account Discovery: Domain Account")\], open-source tools such as “[SharpShares](https://github.com/mitchmoser/SharpShares "SharpShares")” for network share discovery \[[T1135](https://attack.mitre.org/versions/v16/techniques/T1135/ "Network Share Discovery")\], and “[Ladon 911](https://github.com/k8gege/Ladon)” and “[SharpNBTScan](https://github.com/BronzeTicket/SharpNBTScan "SharpNBTScan")” for remote systems discovery \[[T1018](https://attack.mitre.org/versions/v16/techniques/T1018/ "Remote System Discovery")\]. Network administrators would be unlikely to use these tools for network share or remote systems discovery.

### Lateral Movement

Ghost actors used elevated access and Windows Management Instrumentation Command-Line (WMIC) \[[T1047](https://attack.mitre.org/versions/v16/techniques/T1047/ "Windows Management Instrumentation")\] to run PowerShell commands on additional systems on the victim network— often for the purpose of initiating additional Cobalt Strike Beacon infections. The associated encoded string is a base 64 PowerShell command that always begins with: powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACIA… \[[T1132.001](https://attack.mitre.org/versions/v16/techniques/T1132/001/ "Data Encoding: Standard Encoding")\]\[[T1564.003](https://attack.mitre.org/versions/v16/techniques/T1564/003/ "Hide Artifacts: Hidden Window")\].

This string decodes to “$s=New-Object IO.MemoryStream(,\[Convert\]::FromBase64String(“” and is involved with the execution of Cobalt Strike in memory on the target machine.

**In cases where lateral movement attempts are unsuccessful, Ghost actors have been observed abandoning an attack on a victim.**

### Exfiltration

Ghost ransom notes often claim exfiltrated data will be sold if a ransom is not paid. However, Ghost actors do not frequently exfiltrate a significant amount of information or files, such as intellectual property or personally identifiable information (PII), that would cause significant harm to victims if leaked. The FBI has observed limited downloading of data to Cobalt Strike Team Servers \[[T1041](https://attack.mitre.org/versions/v16/techniques/T1041/ "Exfiltration Over C2 Channel")\]. Victims and other trusted third parties have reported limited uses of Mega.nz \[[T1567.002](https://attack.mitre.org/versions/v16/techniques/T1567/002/ "Exfiltration Over Web Service: Exfiltration to Cloud Storage")\] and installed web shells for similar limited data exfiltration. **Note:** The typical data exfiltration is less than hundreds of gigabytes of data.

### Command and Control

Ghost actors rely heavily on Cobalt Strike Beacon malware and Cobalt Strike Team Servers for command and control (C2) operations, which function using hypertext transfer protocol (HTTP) and hypertext transfer protocol secure (HTTPS) \[[T1071.001](https://attack.mitre.org/versions/v16/techniques/T1071/001/ "Application Layer Protocol: Web Protocols")\]. Ghost rarely registers domains associated with their C2 servers. Instead, connections made to a uniform resource identifier (URI) of a C2 server, for the purpose of downloading and executing Beacon malware, directly reference the C2 server’s IP address. For example, http://xxx.xxx.xxx.xxx:80/Google.com where xxx.xxx.xxx.xxx represents the C2 server’s IP address.

For email communication with victims, Ghost actors use legitimate email services that include traffic encryption features. \[[T1573](https://attack.mitre.org/versions/v16/techniques/T1573/ "Encrypted Channel")\] Some examples of emails services that Ghost actors have been observed using are Tutanota, Skiff, ProtonMail, Onionmail, and Mailfence.

**Note:** **Table 2** contains a list of Ghost ransom email addresses.

### Impact and Encryption

Ghost actors use Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe, which are all ransomware executables that share similar functionality. Ghost variants can be used to encrypt specific directories or the entire system’s storage \[[T1486](https://attack.mitre.org/versions/v16/techniques/T1486/ "Data Encrypted for Impact")\]. The nature of executables’ operability is based on command line arguments used when executing the ransomware file. Various file extensions and system folders are excluded during the encryption process to avoid encrypting files that would render targeted devices inoperable.

These ransomware payloads clear Windows Event Logs \[[T1070.001](https://attack.mitre.org/versions/v16/techniques/T1070/001/ "Indicator Removal: Clear Windows Event Logs")\], disable the Volume Shadow Copy Service, and delete shadow copies to inhibit system recovery attempts \[[T1490](https://attack.mitre.org/versions/v16/techniques/T1490/ "Inhibit System Recovery")\]. Data encrypted with Ghost ransomware variants cannot be recovered without the decryption key. Ghost actors hold the encrypted data for ransom and typically demand anywhere from tens to hundreds of thousands of dollars in cryptocurrency in exchange for decryption software \[[T1486](https://attack.mitre.org/versions/v16/techniques/T1486/ "Data Encrypted for Impact")\].

The impact of Ghost ransomware activity varies widely on a victim-to-victim basis. Ghost actors tend to move to other targets when confronted with hardened systems, such as those where proper network segmentation prevents lateral moment to other devices.

**Indicators of Compromise (IOC)**
----------------------------------

**Table 1** lists several tools and applications Ghost actors have used for their operations. The use of these tools and applications on a network should be investigated further.

**Note:** Authors of these tools generally state that they should not be used in illegal activity.

_Table 1: Tools Leveraged by Ghost Actors_

Name

Description

Source

Cobalt Strike

Cobalt Strike is penetration testing software. Ghost actors  use an unauthorized version of Cobalt Strike.

N/A

IOX

Open-source proxy, used to establish a reverse proxy to a Ghost C2 server from an internal victim device.

github\[.\]com/EddieIvan01/iox

SharpShares.exe

SharpShares.exe is used to enumerate accessible network shares in a domain. Ghost actors use this primarily for host discovery.

github\[.\]com/mitchmoser/SharpShares

SharpZeroLogon.exe

SharpZeroLogon.exe attempts to exploit [CVE-2020-1472](https://nvd.nist.gov/vuln/detail/CVE-2020-1472 "CVE-2020-1472") and is run against a target Domain Controller.

github\[.\]com/leitosama/SharpZeroLogon

SharpGPPPass.exe

SharpGPPPass.exe attempts to exploit [CVE-2014-1812](https://nvd.nist.gov/vuln/detail/CVE-2014-1812 "CVE-2014-1812") and targets XML files created through Group Policy Preferences that may contain passwords.

N/A

SpnDump.exe

SpnDump.exe is used to list service principal name identifiers, which Ghost actors use for service and hostname enumeration.

N/A

NBT.exe

A compiled version of SharpNBTScan, a NetBIOS scanner. Ghost actors use this tool for hostname and IP address enumeration.

github\[.\]com/BronzeTicket/SharpNBTScan

BadPotato.exe

BadPotato.exe is an exploitation tool used for privilege escalation.

github\[.\]com/BeichenDream/BadPotato

God.exe

God.exe is a compiled version of GodPotato and is used for privilege escalation.

github\[.\]com/BeichenDream/GodPotato

HFS (HTTP File Server)

A portable web server program that Ghost actors use to host files for remote access and exfiltration.

rejitto\[.\]com/hfs

Ladon 911

A multifunctional scanning and exploitation tool, often used by Ghost actors with the MS17010 option to scan for SMB vulnerabilities associated with [CVE-2017-0143](https://nvd.nist.gov/vuln/detail/CVE-2017-0143 "CVE-2017-0143") and [CVE-2017-0144](https://nvd.nist.gov/vuln/detail/CVE-2017-0144 "CVE-2017-0144").

github\[.\]com/k8gege/Ladon

Web Shell

A backdoor installed on a web server that allows for the execution of commands and facilitates persistent access.

Slight variation of github\[.\]com/BeichenDream/Chunk-Proxy/blob/main/proxy.aspx

_Table 2: MD5 File Hashes Associated with Ghost Ransomware Activity_

File name

MD5 File Hash

Cring.exe

c5d712f82d5d37bb284acd4468ab3533

Ghost.exe

34b3009590ec2d361f07cac320671410

d9c019182d88290e5489cdf3b607f982

ElysiumO.exe

29e44e8994197bdb0c2be6fc5dfc15c2

c9e35b5c1dc8856da25965b385a26ec4

d1c5e7b8e937625891707f8b4b594314

Locker.exe

ef6a213f59f3fbee2894bd6734bbaed2

iex.txt, pro.txt (IOX)

ac58a214ce7deb3a578c10b97f93d9c3

x86.log (IOX)

c3b8f6d102393b4542e9f951c9435255

0a5c4ad3ec240fbfd00bdc1d36bd54eb

sp.txt (IOX)

ff52fdf84448277b1bc121f592f753c5

main.txt (IOX)

a2fd181f57548c215ac6891d000ec6b9

isx.txt (IOX)

625bd7275e1892eac50a22f8b4a6355d

sock.txt (IOX)

db38ef2e3d4d8cb785df48f458b35090

### Ransom Email Addresses

**Table 3** is a subset of ransom email addresses that have been included in Ghost ransom notes.

_Table 3: Ransom Email Addresses_

Email Addresses

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

[\[email protected\]](/cdn-cgi/l/email-protection)

### Ransom Notes

Starting approximately in August 2024, Ghost actors began using TOX IDs in ransom notes as an alternative method for communicating with victims. For example: EFE31926F41889DBF6588F27A2EC3A2D7DEF7D2E9E0A1DEFD39B976A49C11F0E19E03998DBDA and E83CD54EAAB0F31040D855E1ED993E2AC92652FF8E8742D3901580339D135C6EBCD71002885B.

**MITRE ATT&CK Tactics and Techniques**
---------------------------------------

See **Table 4 to Table 13** for all referenced threat actor tactics and techniques in this advisory. For assistance with mapping malicious cyber activity to the MITRE ATT&CK framework, version 16.1, see CISA and MITRE ATT&CK’s [Best Practices for MITRE ATT&CK Mapping](https://www.cisa.gov/news-events/news/best-practices-mitre-attckr-mapping "Best Practices for MITRE ATT&CK Mapping") and CISA’s [Decider Tool](https://github.com/cisagov/Decider/ "Decider Tool").

_Table 4: Initial Access_

Technique Title

ID

Use

Exploit Public-Facing Application

[T1190](https://attack.mitre.org/versions/v16/techniques/T1190/ "Exploit Public-Facing Application")

Ghost actors exploit multiple vulnerabilities in public-facing systems to gain initial access to servers.

_Table 5: Execution_

Technique Title

ID

Use

Windows Management Instrumentation

[T1047](https://attack.mitre.org/versions/v16/techniques/T1047/ "Windows Management Instrumentation")

Ghost actors abuse WMI to run PowerShell scripts on other devices, resulting in their infection with Cobalt Strike Beacon malware.

PowerShell

[T1059.001](https://attack.mitre.org/versions/v16/techniques/T1059/001/ "Command and Scripting Interpreter: PowerShell")

Ghost actors use PowerShell for various functions including to deploy Cobalt Strike.

Windows Command Shell

[T1059.003](https://attack.mitre.org/techniques/T1059/003/ "Command and Scripting Interpreter: Windows Command Shell")

Ghost actors use the Windows Command Shell to download malicious content on to victim servers.

_Table 6: Persistence_

Technique Title

ID

Use

Account Manipulation

[T1098](https://attack.mitre.org/versions/v16/techniques/T1098/ "Account Manipulation")

Ghost actors change passwords for already established accounts.

Local Account

[T1136.001](https://attack.mitre.org/versions/v16/techniques/T1136/001/ "Create Account: Local Account")

Ghost actors create new accounts or makes modifications to local accounts.

Domain Account

[T1136.002](https://attack.mitre.org/versions/v16/techniques/T1136/002/ "Create Account: Domain Account")

Ghost actors create new accounts or makes modifications to domain accounts.

Web Shell

[T1505.003](https://attack.mitre.org/versions/v16/techniques/T1505/003/ "Server Software Component: Web Shell")

Ghost actors upload web shells to victim servers to gain access and for persistence.

_Table 7: Privilege Escalation_

Technique Title

ID

Use

Exploitation for Privilege Escalation

[T1068](https://attack.mitre.org/versions/v16/techniques/T1068/ "Exploitation for Privilege Escalation")

Ghost actors use a suite of open source tools in an attempt to gain elevated privileges through exploitation of vulnerabilities.

Token Impersonation/Theft

[T1134.001](https://attack.mitre.org/versions/v16/techniques/T1134/001/ "Access Token Manipulation: Token Impersonation/Theft")

Ghost actors use Cobalt Strike to steal process tokens of processes running at a higher privilege.

_Table 8: Defense Evasion_

Technique Title

ID

Use

Application Layer Protocol: Web Protocols

[T1071.001](https://attack.mitre.org/versions/v16/techniques/T1071/001/ "Application Layer Protocol: Web Protocols")

Ghost actors use HTTP and HTTPS protocols while conducting C2 operations.

Impair Defenses: Disable or Modify Tools

[T1562.001](https://attack.mitre.org/versions/v16/techniques/T1562/001/ "Impair Defenses: Disable or Modify Tools")

Ghost actors disable antivirus products.

Hidden Window

[T1564.003](https://attack.mitre.org/versions/v16/techniques/T1564/003/ "Hide Artifacts: Hidden Window")

Ghost actors use PowerShell to conceal malicious content within legitimate appearing command windows.

_Table 9: Credential Access_

Technique Title

ID

Use

OS Credential Dumping

[T1003](https://attack.mitre.org/versions/v16/techniques/T1003/ "OS Credential Dumping")

Ghost actors use Mimikatz and the Cobalt Strike “hashdump” command to collect passwords and password hashes.

_Table 10: Discovery_

Technique Title

ID

Use

Remote System Discovery

[T1018](https://attack.mitre.org/versions/v16/techniques/T1018/ "Remote System Discovery")

Ghost actors use tools like Ladon 911 and ShapNBTScan for remote systems discovery.

Process Discovery

[T1057](https://attack.mitre.org/versions/v16/techniques/T1057/ "Process Discovery")

Ghost actors run a ps command to list running processes on an infected device.

Domain Account Discovery

[T1087.002](https://attack.mitre.org/techniques/T1087/002 "Account Discovery: Domain Account")

Ghost actors run commands such as net group “Domain Admins” /domain to discover a list of domain administrator accounts.

Network Share Discovery

[T1135](https://attack.mitre.org/versions/v16/techniques/T1135/ "Network Share Discovery")

Ghost actors use various tools for network share discovery for the purpose of host enumeration.

Software Discovery

[T1518](https://attack.mitre.org/versions/v16/techniques/T1518/ "Software Discovery")

Ghost actors use their access to determine which antivirus software is running.

Security Software Discovery

[T1518.001](https://attack.mitre.org/versions/v16/techniques/T1518/001/ "Software Discovery: Security Software Discovery")

Ghost actors run Cobalt Strike to enumerate running antivirus software.

_Table 11: Exfiltration_

Technique Title

ID

Use

Exfiltration Over C2 Channel

[T1041](https://attack.mitre.org/versions/v16/techniques/T1041/ "Exfiltration Over C2 Channel")

Ghost actors use both web shells and Cobalt Strike to exfiltrate limited data.

Exfiltration to Cloud Storage

[T1567.002](https://attack.mitre.org/versions/v16/techniques/T1567/002/ "Exfiltration Over Web Service: Exfiltration to Cloud Storage")

Ghost actors sometimes use legitimate cloud storage providers such as Mega.nz for malicious exfiltration operations.

_Table 12: Command and Control_

Technique Title

ID

Use

Web Protocols

[T1071.001](https://attack.mitre.org/versions/v16/techniques/T1071/001/ "Application Layer Protocol: Web Protocols")

Ghost actors use Cobalt Strike Beacon malware and Cobalt Strike Team Servers which communicate over HTTP and HTTPS.

Ingress Tool Transfer

[T1105](https://attack.mitre.org/versions/v16/techniques/T1105/ "Ingress Tool Transfer")

Ghost actors use Cobalt Strike Beacon malware to deliver ransomware payloads to victim servers.

Standard Encoding

[T1132.001](https://attack.mitre.org/versions/v16/techniques/T1132/001/ "Data Encoding: Standard Encoding")

Ghost actors use PowerShell commands to encode network traffic which reduces their likelihood of being detected during lateral movement.

Encrypted Channel

[T1573](https://attack.mitre.org/versions/v16/techniques/T1573/ "Encrypted Channel")

Ghost actors use encrypted email platforms to facilitate communications.

_Table 13: Impact_

Technique Title

ID

Use

Data Encrypted for Impact

[T1486](https://attack.mitre.org/techniques/T1486 "Data Encrypted for Impact")

Ghost actors use ransomware variants Cring.exe, Ghost.exe, ElysiumO.exe, and Locker.exe to encrypt victim files for ransom.

Inhibit System Recovery

[T1490](https://attack.mitre.org/versions/v16/techniques/T1490/ "Inhibit System Recovery")

Ghost actors delete volume shadow copies.

**Mitigations**
---------------

The FBI, CISA, and MS-ISAC recommend organizations reference their [#StopRansomware Guide](https://www.cisa.gov/stopransomware/ransomware-guide "#StopRansomware Guide") and implement the mitigations below to improve cybersecurity posture on the basis of the Ghost ransomware activity. These mitigations align with the [Cross-Sector Cybersecurity Performance Goals (CPGs)](https://www.cisa.gov/cross-sector-cybersecurity-performance-goals "Cross-Sector Cybersecurity Performance Goals (CPGs)") developed by CISA and the National Institute of Standards and Technology (NIST). The CPGs provide a minimum set of practices and protections that CISA and NIST recommend all organizations implement. CISA and NIST based the CPGs on existing cybersecurity frameworks and guidance to protect against the most common and impactful threats, tactics, techniques, and procedures. Visit CISA’s [CPGs webpage](https://www.cisa.gov/cpg "CPGs webpage") for more information on the CPGs, including additional recommended baseline protections.

*   **Maintain regular system backups** that are known-good and stored offline or are segmented from source systems \[[CPG 2.R](https://www.cisa.gov/cybersecurity-performance-goals-cpgs#SystemBackups2R "System Backups (2.R)")\]. Ghost ransomware victims whose backups were unaffected by the ransomware attack were often able to restore operations without needing to contact Ghost actors or pay a ransom.
*   **Patch known vulnerabilities by** applying timely security updates to operating systems, software, and firmware within a risk-informed timeframe \[[CPG 1.E](https://www.cisa.gov/cybersecurity-performance-goals-cpgs#MitigatingKnownVulnerabilities1E "Mitigating Known Vulnerabilities (1.E)")\].
*   **Segment networks to restrict lateral movement from initial infected devices and other devices in the same organization \[**[CPG 2.F](https://www.cisa.gov/cybersecurity-performance-goals-cpgs#NetworkSegmentation2F "Network Segmentation (2.F)")**\].**
*   **Require** [**Phishing-Resistant MFA**](https://www.cisa.gov/MFA "Phishing-Resistant MFA") **for access to all privileged accounts and email services accounts.**
*   **Train users to recognize phishing attempts.**
*   **Monitor for unauthorized use of PowerShell. Ghost actors leverage PowerShell for malicious purposes, although it is often a helpful tool that is used by administrators and defenders to manage system resources. For more information, visit NSA and CISA’s** [joint guidance](https://media.defense.gov/2022/Jun/22/2003021689/-1/-1/1/CSI_KEEPING_POWERSHELL_SECURITY_MEASURES_TO_USE_AND_EMBRACE_20220622.PDF "joint guidance") **on PowerShell best practices.**
    *   Implement the principle of least privilege when granting permissions so that employees who require access to PowerShell are aligned with organizational business requirements.
*   **Implement allowlisting** for applications, scripts, and network traffic to prevent unauthorized execution and access \[[CPG 3.A](https://www.cisa.gov/cybersecurity-performance-goals-cpgs#DetectingRelevantThreatsandTTPs3A "Detecting Relevant Threats and TTPs (3.A)")\].
*   **Identify, alert on, and investigate abnormal network activity. Ransomware activity generates unusual network traffic across all phases of the attack chain. This includes running scans to discover other network connected devices, running commands to list, add, or alter administrator accounts, using PowerShell to download and execute remote programs, and running scripts not usually seen on a network. Organizations that can successfully identify and investigate this activity are better able to interrupt malicious activity before ransomware is executed \[**[CPG 3.A](https://www.cisa.gov/cybersecurity-performance-goals-cpgs#DetectingRelevantThreatsandTTPs3A "Detecting Relevant Threats and TTPs (3.A)")**\].**
    *   Ghost actors run a significant number of commands, scripts, and programs that IT administrators would have no legitimate reason for running. Victims who have identified and responded to this unusual behavior have successfully prevented Ghost ransomware attacks.
*   **Limit exposure of services by disabling unused ports** such as, RDP 3398, FTP 21, and SMB 445, and restricting access to essential services through securely configured VPNs or firewalls.
*   **Enhance email security** by implementing advanced filtering, blocking malicious attachments, and enabling DMARC, DKIM, and SPF to prevent spoofing \[[CPG 2.M](https://www.cisa.gov/cybersecurity-performance-goals-cpgs#EmailSecurity2M "Email Security (2.M)")\].

**Validate Security Controls**
------------------------------

In addition to applying mitigations, the FBI, CISA, and MS-ISAC recommend exercising, testing, and validating your organization’s security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.

To get started:

1.  Select an ATT&CK technique described in this advisory (see **Table 3** to **Table 13**).
2.  Align your security technologies against the technique.
3.  Test your technologies against the technique.
4.  Analyze your detection and prevention technologies’ performance.
5.  Repeat the process for all security technologies to obtain a set of comprehensive performance data.
6.  Tune your security program, including people, processes, and technologies, based on the data generated by this process.

**Reporting**
-------------

Your organization has no obligation to respond or provide information back to the FBI in response to this joint advisory. If, after reviewing the information provided, your organization decides to provide information to the FBI, reporting must be consistent with applicable state and federal laws.

The FBI is interested in any information that can be shared, to include logs showing communication to and from foreign IP addresses, a sample ransom note, communications with threat actors, Bitcoin wallet information, and/or decryptor files.

Additional details of interest include a targeted company point of contact, status and scope of infection, estimated loss, operational impact, date of infection, date detected, initial attack vector, and host and network-based indicators.

The FBI, CISA, and MS-ISAC do not encourage paying ransom as payment does not guarantee victim files will be recovered. Furthermore, payment may also embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities. Regardless of whether you or your organization have decided to pay the ransom, the FBI and CISA urge you to promptly report ransomware incidents to FBI’s [Internet Crime Complain Center (IC3)](https://www.ic3.gov/Home/ComplaintChoice "Internet Crime Complain Center (IC3)"), a [local FBI Field Office](https://www.fbi.gov/contact-us/field-offices "local FBI Field Office"), or CISA via the agency’s [Incident Reporting System](https://www.cisa.gov/report "Incident Reporting System") or its 24/7 Operations Center ([\[email protected\]](/cdn-cgi/l/email-protection#ea988f9a85989eaa8983998bc48d859cc38598 "Report to CISA")) or by calling 1-844-Say-CISA (1-844-729-2472).

**Disclaimer**
--------------

The information in this report is being provided “as is” for informational purposes only. The FBI, CISA, and MS-ISAC do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the FBI, CISA, and the MS-ISAC.

**Version History**
-------------------

**February 19, 2025:** Initial version.

This product is provided subject to this [Notification](/notification "Follow link") and this [Privacy & Use](/privacy-policy "Follow link") policy.

### Tags

**Advisory CVE**: [CVE-2009-3960](https://nvd.nist.gov/vuln/detail/CVE-2009-3960), [CVE-2010-2861](https://nvd.nist.gov/vuln/detail/CVE-2010-2861), [CVE-2018-13379](https://nvd.nist.gov/vuln/detail/CVE-2018-13379), [CVE-2019-0604](https://nvd.nist.gov/vuln/detail/CVE-2019-0604), [CVE-2021-31207](https://nvd.nist.gov/vuln/detail/CVE-2021-31207), [CVE-2021-34473](https://nvd.nist.gov/vuln/detail/CVE-2021-34473), [CVE-2021-34523](https://nvd.nist.gov/vuln/detail/CVE-2021-34523)

**Audience**: Educational Institutions, Faith-Based Community, Industry, Small and Medium Businesses

**Co-Sealers and Partners**: Federal Bureau of Investigation, Multi-State Information Sharing and Analysis Center

**MITRE ATT&CK TTP**: Command and Control (TA0011), Credential Access (TA0006), Defense Evasion (TA0005), Discovery (TA0007), Execution (TA0002), Exfiltration (TA0010), Impact (TA0040), Initial Access (TA0001), Lateral Movement (TA0008), Persistence (TA0003), Privilege Escalation (TA0004)


Black Basta’s Leaked Chat Logs

Leaked ransomware chat logs reveal Black Basta’s targeted CVEs.

On February 11, 2025, a major leak exposed BLACKBASTA's internal Matrix chat logs. The leaker claimed they released the data because the group was targeting Russian banks. This leak closely resembles the previous Conti leaks.

Cybercrime group focused on Microsoft vulnerabilities as well as flaws in network edge devices and communications software.

We have sightings from MISP and The Shadowserver fundation related to the rejected CVE:

* CVE-2024-21683
* ghsa-vr88-2hv2-5jvf


VMSA-2025-0004: VMware ESXi, Workstation, and Fusion updates address multiple vulnerabilities (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226)

Ref: [https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/25390)

# Impacted Products

    VMware ESXi
    VMware Workstation Pro / Player (Workstation)
    VMware Fusion
    VMware Cloud Foundation
    VMware Telco Cloud Platform

## Introduction

Multiple vulnerabilities in VMware ESXi, Workstation, and Fusion were privately reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products.
3a. VMCI heap-overflow vulnerability (CVE-2025-22224)

Description:
VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.3.

Known Attack Vectors:
A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host.

Resolution:
To remediate CVE-2025-22224 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds:
None.

Additional Documentation:
A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0004

Acknowledgements:
VMware would like to thank Microsoft Threat Intelligence Center for reporting this issue to us.

Notes:
VMware by Broadcom has information to suggest that exploitation of CVE-2025-22224 has occurred in the wild.
3b. VMware ESXi arbitrary write vulnerability (CVE-2025-22225)

Description:
VMware ESXi contains an arbitrary write vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.2.

Known Attack Vectors:
A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the sandbox.

Resolution:
To remediate CVE-2025-22225 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds:
None.

Additional Documentation:
A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0004

Acknowledgements:
VMware would like to thank Microsoft Threat Intelligence Center for reporting this issue to us.

Notes:
VMware by Broadcom has information to suggest that exploitation of CVE-2025-22225 has occurred in the wild.
3c. HGFS information-disclosure vulnerability (CVE-2025-22226)

Description:
VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.1.

Known Attack Vectors:
A malicious actor with administrative privileges to a virtual machine may be able to exploit this issue to leak memory from the vmx process.

Resolution:
To remediate CVE-2025-22226 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds:
None.

Additional Documentation:
A supplemental FAQ was created for clarification. Please see: https://brcm.tech/vmsa-2025-0004

Acknowledgements:
VMware would like to thank Microsoft Threat Intelligence Center for reporting this issue to us.

Notes:
VMware by Broadcom has information to suggest that exploitation of CVE-2025-22226 has occurred in the wild.


Cyber Threat Overview 2024 from CERT-FR

> In this fourth edition of the Cyber Threat Overview, The French Cybersecurity Agency (ANSSI) addresses prevalent cybersecurity threats and the pivotal incidents which occurred in 2024. In line with the previous years, ANSSI estimates that attackers associated with the cybercriminal ecosystem and reputedly linked to China and Russia are three of the main threats facing both critical information systems and the national ecosystem as a whole.
>
> This past year was also marked by the hosting of the Paris Olympic and Paralympic Games and by the number and the impact of vulnerabilities affecting information systems’ security edge devices.

| CVE              | SCORE CVSS3.x | ÉDITEUR       | RISQUE                                               | RÉFÉRENCE CERT-FR                          |
|-----------------|--------------|--------------|------------------------------------------------------|--------------------------------------------|
| CVE-2024-21887 | 9.1          | IVANTI  | Remote execution of arbitrary code, security policy and authentication bypass, access to restricted resources on different security and VPN gateways | CERTFR-2024-ALE-001, CERTFR-2024-AVI-0109, CERTFR-2024-AVI-0085 |
| CVE-2023-46805 | 8.2          | IVANTI       | Remote execution of arbitrary code, security policy and authentication bypass on different security and VPN gateways | CERTFR-2024-ALE-0097 |
| CVE-2024-21893 | 8.2          |IVANTI  |                                                      |                                            |
| CVE-2024-3400  | 10.0         | PALO ALTO NETWORKS | Remote execution of arbitrary code on different security devices | CERTFR-2024-ALE-006, CERTFR-2024-AVI-0307 |
| CVE-2022-42475 | 9.8          | FORTINET     | Remote execution of arbitrary code on different SSL VPN gateways | CERTFR-2022-ALE-012, CERTFR-2022-AVI-1090 |
| CVE-2024-8963  | 9.4          | IVANTI       | Remote execution of arbitrary code and security policy bypass on different security and VPN gateways | CERTFR-2024-ALE-013, CERTFR-2024-AVI-0796, CERTFR-2024-AVI-0917 |
| CVE-2024-8190  | 7.2          | IVANTI |                                                      | CERTFR-2024-ALE-014, CERTFR-2024-AVI-0917 |
| CVE-2024-47575 | 9.8          | FORTINET     | Remote execution of arbitrary code on different security devices | CERTFR-2024-ALE-014, CERTFR-2024-AVI-0917 |
| CVE-2024-21762 | 9.8          | FORTINET     | Remote execution of arbitrary code on different security devices | CERTFR-2024-ALE-004, CERTFR-2024-AVI-0108 |
| CVE-2021-44228 | 10.0         | APACHE       | Remote execution of arbitrary code                  | CERTFR-2021-ALE-022                        |
| CVE-2024-24919 | 8.6          | CHECK POINT  | Breach of data confidentiality                      | CERTFR-2024-ALE-008, CERTFR-2024-AVI-0449  |


Critical authentication bypass vulnerabilities (CVE-2025-25291 + CVE-2025-25292) were discovered in ruby-saml up to version 1.17.0.
More information: https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials/


Pre-authentication SQL injection to RCE in GLPI (CVE-2025-24799/CVE-2025-24801)

Ref: [https://blog.lexfo.fr/glpi-sql-to-rce.html](https://blog.lexfo.fr/glpi-sql-to-rce.html)

Several GLPI instances have been identified during Red Team engagements. The software is popular with French-speaking companies, some of those even expose their instances directly on the Internet. GLPI has been historically known to harbor multiple easy-to-find vulnerabilities, and because it is often connected to an Active Directory, finding a vulnerability on this application for Red Team engagements or internal infrastructure audits could lead to initial access to the internal network and the recovery of an active directory account.

- 2024-12-25 - Discovery of the vulnerability
-  2025-01-28 - Report of the vulnerability through Github Advisories
- 2025-01-28 - GLPI validates the report and assigns CVE-2025-24801 (exécution de code à distance)
- 2025-01-28 - GLPI validates the report and assigns CVE-2025-24799 (injection SQL)
-  2025-02-12 - Release patched version 10.0.18
-  2025-03-12 - Article released


Ingress NGINX Controller for Kubernetes  - Vulnerabilities fixed in controller-v1.12.1

[This release fixes](https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1) the following CVEs:

-    CVE-2025-1097
-    CVE-2025-1098
-    CVE-2025-1974
-    CVE-2025-24513
-    CVE-2025-24514

Unfortunately, to fix CVE-2025-1974 it was necessary to disable the validation of the generated NGINX configuration during the validation of Ingress resources.

The resulting NGINX configuration is still checked before the actual loading, so that there are no failures of the underlying NGINX. However, invalid Ingress resources can lead to the NGINX configuration no longer being able to be updated.

To reduce such situations as far as possible, we therefore recommend enabling annotation validation and disabling snippet annotations. In case of doubt, such states can be determined from the logs of the Ingress NGINX Controller. Watch out for a line of dashes followed by "Error:" telling you what went wrong.


Kaspersky - Operation ForumTroll: APT attack with Google Chrome zero-day exploit chain

# Operation ForumTroll exploits zero-days in Google Chrome | Securelist
![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/03/25125858/SL-operation-ForumTroll-featured-800x450.jpg)

[Incidents](https://securelist.com/category/incidents/)

[Incidents](https://securelist.com/category/incidents/)

25 Mar 2025

minute read

![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/03/25125858/SL-operation-ForumTroll-featured-1200x600.jpg)

In mid-March 2025, Kaspersky technologies detected a wave of infections by previously unknown and highly sophisticated malware. In all cases, infection occurred immediately after the victim clicked on a link in a phishing email, and the attackers’ website was opened using the Google Chrome web browser. No further action was required to become infected.

All malicious links were personalized and had a very short lifespan. However, Kaspersky’s exploit detection and protection technologies successfully identified the zero-day exploit that was used to escape Google Chrome’s sandbox. We quickly analyzed the exploit code, reverse-engineered its logic, and confirmed that it was based on a zero-day vulnerability affecting the latest version of Google Chrome. We then reported the vulnerability to the Google security team. Our detailed report enabled the developers to quickly address the issue, and on March 25, 2025, Google released an update fixing the vulnerability and [thanked us](https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html) for discovering this attack.

[![Acknowledgement for finding CVE-2025-2783 (excerpt from security fixes included into Chrome 134.0.6998.177/.178)](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/03/25212201/operation-forumtroll-01.png)](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/03/25212201/operation-forumtroll-01.png)

Acknowledgement for finding CVE-2025-2783 (excerpt from security fixes included into Chrome 134.0.6998.177/.178)

We have discovered and reported dozens of zero-day exploits actively used in attacks, but this particular exploit is certainly one of the most interesting we’ve encountered. The vulnerability CVE-2025-2783 really left us scratching our heads, as, without doing anything obviously malicious or forbidden, it allowed the attackers to bypass Google Chrome’s sandbox protection as if it didn’t even exist. The cause of this was a logical error at the intersection of Google Chrome’s sandbox and the Windows operating system. We plan to publish the technical details of this vulnerability once the majority of users have installed the updated version of the browser that fixes it.

Our research is still ongoing, but judging by the functionality of the sophisticated malware used in the attack, it seems the attackers’ goal was espionage. The malicious emails contained invitations supposedly from the organizers of a scientific and expert forum, “Primakov Readings”, targeting media outlets and educational institutions in Russia. Based on the content of the emails, we dubbed the campaign Operation ForumTroll.

[![Example of a malicious email used in this campaign (translated from Russian)](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/03/25212153/operation-forumtroll-02-1.png)](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2025/03/25212153/operation-forumtroll-02-1.png)

Example of a malicious email used in this campaign (translated from Russian)

At the time of writing, there’s no exploit active at the malicious link – it just redirects visitors to the official [website](https://primakovreadings.ru/) of “Primakov Readings”. However, we strongly advise against clicking on any potentially malicious links.

The exploit we discovered was designed to run in conjunction with an additional exploit that enables remote code execution. Unfortunately, we were unable to obtain this second exploit, as in this particular case it would have required waiting for a new wave of attacks and exposing users to the risk of infection. Fortunately, patching the vulnerability used to escape the sandbox effectively blocks the entire attack chain.

All the attack artifacts analyzed so far indicate high sophistication of the attackers, allowing us to confidently conclude that a state-sponsored APT group is behind this attack.

We plan to publish a detailed report with technical details about the zero-day exploit, the sophisticated malware, and the attackers’ techniques.

Kaspersky products detect the exploits and malware used in this attack with the following verdicts:

*   Exploit.Win32.Generic
*   Trojan.Win64.Agent
*   Trojan.Win64.Convagent.gen
*   PDM:Exploit.Win32.Generic
*   PDM:Trojan.Win32.Generic
*   UDS:DangerousObject.Multi.Generic

Indicators of Compromise
------------------------

[primakovreadings\[.\]info](https://opentip.kaspersky.com/primakovreadings.info/icid=gl_OpenTIP_acq_ona_smm__onl_b2b_securelist_lnk_sm-team_______05122bf6e284c4c0&utm_source=SL&utm_medium=SL&utm_campaign=SL)

*   [![](https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2024/04/10092503/NEXT_310x420_EN_1.jpg)](https://www.kaspersky.com/next?icid=gl_KNext_acq_ona_smm__onl_b2b_securelist_ban_sm-team___knext___)

##### Latest Posts

##### Latest Webinars

##### Reports

In this article, we discuss the tools and TTPs used in the SideWinder APT’s attacks in H2 2024, as well as shifts in its targets, such as an increase in attacks against the maritime and logistics sectors.

Kaspersky researchers analyze EAGERBEE backdoor modules, revealing a possible connection to the CoughingDown APT actor.

While investigating an incident involving the BellaCiao .NET malware, Kaspersky researchers discovered a C++ version they dubbed “BellaCPP”.

Lazarus targets employees of a nuclear-related organization with a bunch of malware, such as MISTPEN, LPEClient, RollMid, CookieTime and a new modular backdoor CookiePlus.


Microsoft Patch Tuesday for April 2025 — Snort rules and prominent vulnerabilities

Microsoft has released its monthly security update for April of 2025 which includes 126 vulnerabilities affecting a range of products, including 11 that Microsoft marked as “critical”.

In this month's release, none of the included vulnerabilities have been observed by Microsoft to be exploited in the wild. The eleven "critical” entries are all remote code execution (RCE) vulnerabilities, four of which have been marked as "Exploitation more likely".

Two of the “critical” vulnerabilities listed affect components of the Windows Remote Desktop Services.

CVE-2025-27480 and CVE-2025-27482 are RCE vulnerabilities in components of the Remote Desktop Gateway Service. Both vulnerabilities were given a CVSS 3.1 score of 8.1. To successfully exploit these an attacker could connect to a system with the Remote Desktop Gateway role and trigger a race condition to create a use-after-free scenario, potentially allowing arbitrary code to be executed. Microsoft has assessed that the attack complexity is “high”, and exploitation is “More likely”.

CVE-2025-26663 is an RCE vulnerability in the Windows Lightweight Directory Access Protocol (LDAP) and has been given a CVSS 3.1 score of 8.1. This could be exploited by an attacker by sending a specially crafted LDAP call to trigger a use-after-free vulnerability, allowing arbitrary code to be executed in the context of the LDAP service. An attacker could initiate this by sending a victim an email or message containing a malicious link. Microsoft has assessed that exploitation is “more likely” and that the attack complexity is “high”.

CVE-2025-26670 is a RCE vulnerability in the Lightweight Directory Access Protocol (LDAP) Client and has been given a CVSS 3.1 base score of 8.1. An attacker could exploit this vulnerability by sending sequential specially crafted LDAP requests to a vulnerable LDAP server. Successful exploitation would require an attacker to win a race condition, which could result in a use-after-free that would allow for arbitrary code execution. Microsoft states that exploitation of this vulnerability is “More likely” and that the attack complexity is “high”.

CVE-2025-26686 is an RCE vulnerability in Windows TCP/IP and has been given a CVSS 3.1 base score of 7.5. Due to improperly locked memory in Windows TCP/IP, this vulnerability could allow an attacker to execute arbitrary code over a network. To exploit this an attacker must wait for a user to initiate a connection and send a DHCPv6, to which the attacker would reply with a DHCPv6 response containing a fake IPv6 address. Successful exploitation requires the attacker to win a race condition and make several preparations in the target environment beforehand. Due to this complexity Microsoft has determined that exploitation is "Less likely".

CVE-2025-27491 is an RCE vulnerability in Windows Hyper-V and has a CVSS 3.1 base score of 7.1. An attacker with guest privileges on a network could exploit this by convincing a victim to click a link to a malicious site.  Microsoft has determined that exploitation of this vulnerability is “Less likely” and that the attack complexity is “high”.

CVE-2025-29791 is an RCE vulnerability in Microsoft Excel and has a CVSS 3.1 base score of 7.8. An attacker could exploit this by sending a specially crafted document to a victim that triggers a type confusion when opened. Once triggered, the type confusion could lead to arbitrary code execution. Microsoft has assessed that exploitation of this vulnerability is "Less likely".

CVE-2025-27752 is another RCE vulnerability in Microsoft Excel and has a CVSS 3.1 score of 7.8. This is a heap overflow vulnerability and can be exploited by an attacker to locally execute arbitrary code. It has been assessed that exploitation of this vulnerability is considered "Less likely".

CVE-2025-27745, CVE-2025-27748 and CVE-2025-27749 are RCE vulnerabilities in Microsoft Office and all have a CVSS 3.1 base score of 7.8. These could be exploited by an attacker by triggering a use-after-free scenario, allowing for the execution of arbitrary code. Microsoft has determined that exploitation for each is considered "Less likely".

Talos would also like to highlight the following "important" vulnerabilities as Microsoft has determined that exploitation is "More likely":

    CVE-2025-27472 - Windows Mark of the Web Security Feature Bypass Vulnerability
    CVE-2025-27727 - Windows Installer Elevation of Privilege Vulnerability
    CVE-2025-29792 - Microsoft Office Elevation of Privilege Vulnerability
    CVE-2025-29793 - Microsoft SharePoint Remote Code Execution Vulnerability
    CVE-2025-29794 - Microsoft SharePoint Remote Code Execution Vulnerability
    CVE-2025-29809 - Windows Kerberos Security Feature Bypass Vulnerability
    CVE-2025-29812 - DirectX Graphics Kernel Elevation of Privilege Vulnerability
    CVE-2025-29822 - Microsoft OneNote Security Feature Bypass Vulnerability

A complete list of all the other vulnerabilities Microsoft disclosed this month is available on its update page.

In response to these vulnerability disclosures, Talos is releasing a new Snort rule set that detects attempts to exploit some of them. Please note that additional rules may be released at a future date and current rules are subject to change pending additional information. Cisco Security Firewall customers should use the latest update to their ruleset by updating their SRU. Open-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.

The rules included in this release that protect against the exploitation of many of these vulnerabilities are 58316, 58317, 64432, 64746 - 64757, 64760 - 64762. There are also these Snort 3 rules: 301176 - 301179.


CVE ID: CVE-2025-3469 CVE-2025-32696 CVE-2025-32697
                 CVE-2025-32698 CVE-2025-32699 CVE-2025-32700

Multiple security issues were discovered in MediaWiki, a website engine
for collaborative work, which could result in information disclosure,
cross-site scripting or restriction bypass.

Reference https://security-tracker.debian.org/tracker/source-package/mediawiki

For the stable distribution (bookworm), these problems have been fixed in
version 1:1.39.12-1~deb12u1.


PHP Core Security Audit Results

# PHP Core Security Audit Results

Published on Apr 10, 2025 by [Roman Pronskiy](https://twitter.com/pronskiy)

[News](https://thephp.foundation/blog/tag/news)

The PHP Foundation is pleased to announce the completion of a comprehensive security audit of the PHP source code ([php/php-src](https://github.com/php/php-src)), **commissioned by the [Sovereign Tech Agency](https://www.sovereign.tech/)**.

This initiative was organized in partnership with the [Open Source Technology Improvement Fund](https://ostif.org/) (OSTIF) and executed by the esteemed security group [Quarkslab](https://www.quarkslab.com/).

## Audit Overview

Conducted over a two-month period in 2024, the audit encompassed:

*   Development of a threat model tailored to php-src
*   Manual code reviews
*   Dynamic testing procedures
*   Cryptographic assessments

The collaboration between Quarkslab’s auditors and PHP maintainers ensured a thorough examination of the codebase.

> _⚠_
> Due to budget constraints, the recent security audit focused on the most critical components of the PHP source code rather than the entire codebase. Organizations interested in sponsoring a comprehensive audit or additional assessments are encouraged to [contact us](mailto:contact@thephp.foundation)!
> _⚠_

## Key Findings

The audit identified 27 issues, with 17 having security implications:

*   3 High-severity
*   5 Medium-severity
*   9 Low-severity

Additionally, 10 informational findings were reported.

Notably, four vulnerabilities received CVE identifiers:

*   CVE-2024-9026: Log tampering vulnerability in PHP-FPM, allowing potential manipulation or removal of characters from log messages.
*   CVE-2024-8925: Flaw in PHP’s multipart form data parsing, potentially leading to data misinterpretation.
*   CVE-2024-8928: Memory-related vulnerability in PHP’s filter handling, leading to segmentation faults.
*   CVE-2024-8929: Issue where a malicious MySQL server could cause the client to disclose heap content from other SQL requests.

## Recommendations and Resolutions

Quarkslab’s report commended the overall high quality and specification adherence of the php/php-src project.

The PHP development team has addressed all identified issues. Users are strongly encouraged to upgrade to the latest PHP versions to benefit from these security enhancements.

## Acknowledgments

We extend our gratitude to the individuals and organizations that made this audit possible:

*   **The PHP Foundation Team and PHP maintainers:**
    Jakub Zelenka, Arnaud Le Blanc, Niels Dossche, Ilija Tovilo, Stas Malyshev, Dmitry Stogov, Derick Rethans, and Roman Pronskiy.
*   **Quarkslab Team:**
    Angèle Bossuat, Julio Loayza Meneses, Mihail Kirov, Sebastien Rolland, Ramtine Tofighi Shirazi.
*   **Sovereign Tech Agency:**
    Abigail Garner and the team – for commissioning the audit and all the help.
*   **OSTIF:**
    Amir Montazery, Derek Zimmer, Helen Woeste – for organizing the collaboration.

This audit underscores our commitment to enhancing PHP’s security and reliability. We remain dedicated to ongoing improvements and collaborations to ensure PHP’s robustness for the global development community.

## Further Reading

*   [Audit Report](/assets/files/24-07-1730-REP-V1.4_temp.pdf)
*   [OSTIF Blog](https://ostif.org/php-audit-complete/)
*   [Quarkslab Blog](https://blog.quarkslab.com/security-audit-of-php-src.html)

If your company is interested in commissioning another round of security audit, please contact The PHP Foundation team: [contact@thephp.foundation](mailto:contact@thephp.foundation).


# Security Advisory

# SonicWall SMA100 SSL-VPN Affected By Multiple Vulnerabilities

9.8

Overview

Advisory ID	SNWLID-2024-0018

First Published	2024-12-03

Last Updated	2025-04-29

Workaround	false

Status	Applicable

CVE	CVE-2024-38475, CVE-2024-40763, CVE-2024-45318, CVE-2024-45319, CVE-2024-53702, CVE-2024-53703

CWE	CWE-35, CWE-121, CWE-122, CWE-798, CWE-338

CVSS v3	9.8

CVSS Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Direct Link

Summary

1.  Path traversal vulnerability – attributed to publicly known Apache HTTP Server vulnerability (CVE-2024-38475)

Improper escaping of output in mod\_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to file system locations that are permitted to be served by the server.

CVSS Score: 9.8
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-35: Path traversal vulnerability

2.  CVE-2024-40763 - SonicWALL SMA100 Heap-based buffer overflow vulnerability

Heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN due to the use of strcpy. This allows remote authenticated attackers to cause Heap-based buffer overflow and potentially lead to code execution.

CVSS Score: 7.5
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-122: Heap-based Buffer Overflow

3.  CVE-2024-45318 - Stack-based buffer overflow vulnerability

A vulnerability in the SonicWall SMA100 SSLVPN web management interface allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.

CVSS Score: 8.1
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-121: Stack-based Buffer Overflow

4.  CVE-2024-45319 - Certificate-based authentication bypass

A vulnerability in the SonicWall SMA100 SSLVPN allows a remote authenticated attacker can circumvent the certificate requirement during authentication.

CVSS Score: 6.3
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CWE-798: Use of Hard-coded Credentials

5.  CVE-2024-53702 - Insecure randomness

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in the SonicWall SMA100 SSLVPN backup code generator that, in certain cases, can be predicted by an attacker, potentially exposing the generated secret.

CVSS Score: 5.3
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

6.  CVE-2024-53703 - Stack-based buffer overflow vulnerability

A vulnerability in the SonicWall SMA100 SSLVPN mod\_httprp library loaded by the Apache web server allows remote attackers to cause Stack-based buffer overflow and potentially lead to code execution.

CVSS Score: 8.1
CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-121: Stack-based Buffer Overflow

SonicWall SSL VPN SMA1000 series products are not affected by these vulnerabilities.

SonicWall strongly advises users of the SMA 100 series products (SMA 200, 210, 400, 410, and 500v) to upgrade to the mentioned fixed release version to address these vulnerabilities.

Affected Product(s)

Affected Product(s)

Affected Versions<o:p></o:p>

SMA 100 Series
(SMA 200, 210, 400, 410, 500v)<o:p></o:p>

10.2.1.13-72sv and earlier versions.<o:p></o:p>

_SonicWall SSL VPN SMA1000 series products are not affected by these vulnerabilities._

CPE(s)

Workaround

None

Fixed Software

Fixed Product(s)

Fixed Versions<o:p></o:p>

SMA 100 Series
(SMA 200, 210, 400, 410, 500v)<o:p></o:p>

10.2.1.14-75sv and higher versions.<o:p></o:p>

Comments

During further analysis, SonicWall and trusted security partners identified an additional exploitation technique using CVE-2024-38475, through which unauthorized access to certain files could enable session hijacking. SMA100 devices updated with the fixed firmware version 10.2.1.14-75sv are not vulnerable to CVE-2024-38475 or the related session hijacking technique described.

**Note: This is potentially being exploited in the wild.**

**SonicWall PSIRT recommends that customers review their SMA devices to ensure no unauthorized logins.**

Credit(s)

Alain Mowat of Orange Cyberdefense, Switzerland.

Revision History

*   Version

*   1.0

*   Date

*   04-Dec-2024

*   Description

*   Initial Release.

\---------------------------------------

*   Version

*   1.1

*   Date

*   05-Dec-2024

*   Description

*   Updated credit(s) section - Included vulnerability researcher name.

\---------------------------------------

*   Version

*   1.2

*   Date

*   29-Apr-2025

*   Description

*   Comment added - During further analysis, SonicWall and trusted security partners identified an additional exploitation technique using CVE-2024-38475, through which unauthorized access to certain files could enable session hijacking. SMA100 devices updated with the fixed firmware version 10.2.1.14-75sv are not vulnerable to CVE-2024-38475 or the related session hijacking technique described

# Reference(s)

Source [https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2024-0018)


# Viasat Modems Zero-Day Vulnerabilities Let Attackers Execute Remote Code
A severe zero-day vulnerability has been uncovered in multiple Viasat satellite modem models, including the RM4100, RM4200, EM4100, RM5110, RM5111, RG1000, RG1100, EG1000, and EG1020.

Identified by ONEKEY Research Lab through automated binary static analysis, the flaw, tracked as CVE-2024-6198, affects the “SNORE” web interface running on lighttpd over TCP ports 3030 and 9882.

![Zero-Day Vulnerabilities](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2GkiTmtaGoi2B23qw1MoymbWw2UGG7c7VOkZvNhjMCaI1WiKZv2Wdackkh-9bT4WRaCt1toCi9mJRKzA_gxlcV08KPa1irn7h8m6fDJrkUqlvO7bZArl4d6GpQWXQ4mZgpntUvm67VMLYMAO23XFqAnx7yJm8SUiR3e8QsY37A310EZTmKNThGm5icNc/s16000/Excerpts%20of%20the%20lighttpd%20configuration.webp)

Excerpts of the lighttpd configuration

With a CVSS score of 7.7 (High), this vulnerability enables unauthenticated remote code execution (RCE) by exploiting a stack [buffer overflow](https://gbhackers.com/spawnchimera-malware-exploits-ivanti-buffer-overflow-vulnerability/) due to insecure path parsing in the index.cgi binary.

\- Advertisement - [![Google News](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtF4v5Ejzb9hD6O8UG7KJJziqO1ZP5zcUuKXNsyjb4g3FugqSKlBjBKmUNqGCjtqOq8kEb1lM6uZOBXm0lUCSTqXKyP4hz81q77L_k5I4RBy3afKYWuunQXOVo9zA4MFlD75XmYOjxT0sNIO9RR8UZPin1ZBVShx5Xj-5D9SyEp0QgEPoA6vxXp3Q4DInb/s16000/Don%E2%80%99t%20miss%20our%20latest%20stories%20on%20Google%20News%20(1).png)](https://news.google.com/publications/CAAqKAgKIiJDQklTRXdnTWFnOEtEV2RpYUdGamEyVnljeTVqYjIwb0FBUAE?hl=en-IN&gl=IN&ceid=IN%3Aen)

This critical issue, discovered on the day a customer enabled binary zero-day analysis on ONEKEY’s platform, exposes devices to potential compromise over LAN or OTA interfaces, posing significant risks to sensitive infrastructures relying on these modems.

**Technical Details and Exploitation Path**
-------------------------------------------

The vulnerability stems from flawed handling of HTTP requests within the SNORE interface’s CGI binary located at /usr/local/SNORE.

Specifically, environment variables REQUEST\_METHOD and REQUEST\_URI are processed unsafely during GET, POST, or DELETE requests.

![Zero-Day Vulnerabilities](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgtha-6Oem1uhamtqFitj6AoI41lnCrGnq-5g5NN2wLMt5bFhjz9kPKaUK0mRbcltMfubEHyp164qm8W3FI_O2ZTT87c9BmaTqA9UTQsNDDzOQB9lqLKwd1BoffrWFOQ2CvlieEfuV3sg6SwIwe6nD0CTIZhrRzdBYfg_gXTN_emHcKnYXPueQO7KYfUzQ/s16000/Analysis%20Configuration.webp)

Analysis Configuration

An unsafe call to sscanf extracts URI components into a fixed-size buffer without proper bounds checking, allowing attackers to overflow the stack by crafting [malicious requests](https://gbhackers.com/xss-vulnerability-in-bing-com/), such as http://192.168.100.1:9882/snore/blackboxes/ followed by 512 repeated characters.

This overflow grants control over critical registers, including the program counter, enabling attackers to hijack execution flow.

Despite the binary’s non-executable stack hardening, exploitation remains feasible through return-oriented programming (ROP) chains, reusing existing code blocks to execute arbitrary code.

Affected firmware versions include those below 3.8.0.4 for RM4100, RM4200, and EM4100, and up to 4.3.0.1 for other models, with fixes deployed in versions 3.8.0.4 and 4.3.0.2, respectively.

Viasat has rolled out automated over-the-air updates, and users are urged to ensure their devices are online to receive patches and to verify the updated firmware version via the administrative interface.

This discovery underscores the systemic risks posed by opaque firmware in critical devices and the power of proactive binary analysis in uncovering latent threats.

According to the [Report](https://www.onekey.com/resource/security-advisory-rce-on-viasat-modems-cve-2024-6198), ONEKEY’s automated firmware inspection, which flagged the issue during routine daily monitoring, highlights the necessity of such tools for OEMs and integrators to safeguard connected environments.

The coordinated disclosure process with Viasat, initiated on May 15, 2024, showcased effective communication despite multiple deadline extensions, culminating in public disclosure on May 25, 2025, after ensuring a significant ratio of devices in the field were patched.

Nevertheless, the incident emphasizes the urgent need for transparency in embedded software to mitigate risks in modern infrastructures.

As satellite modems underpin vital communication networks, such vulnerabilities could have far-reaching consequences if left unaddressed, making diligent firmware scrutiny and timely updates non-negotiable for security.

****Find this News Interesting! Follow us on [Google News](https://news.google.com/publications/CAAqKAgKIiJDQklTRXdnTWFnOEtEV2RpYUdGamEyVnljeTVqYjIwb0FBUAE?hl=en-IN&gl=IN&ceid=IN%3Aen), [LinkedIn](https://www.linkedin.com/company/cybersecurity-news/), & [X](https://x.com/The_Cyber_News) to Get Instant Updates!****

[![Aman Mishra](https://secure.gravatar.com/avatar/bd79cd6eb54cdb58da970ed5b4342e977a9830c1c9d8c1a9743c75cf320b54f8?s=500&d=mm&r=g)](https://gbhackers.com/author/aman-mishra/ "Aman Mishra")

[Aman Mishra](https://gbhackers.com/author/aman-mishra/)

Aman Mishra is a Security and privacy Reporter covering various data breach, cyber crime, malware, & vulnerability.


Ivanti - SA:CVE-2024-21894 (Heap Overflow), CVE-2024-22052 (Null Pointer Dereference), CVE-2024-22053 (Heap Overflow), CVE-2024-22023 (XML entity expansion or XXE) and CVE-2024-29205 for Ivanti Connect Secure and Ivanti Policy Secure Gateways

Vulnerabilities have been discovered in Ivanti Connect Secure (ICS), (formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways and a patch is available now. These vulnerabilities impact all supported versions – Version 9.x and 22.x (refer to Granular Software Release EOL Timelines and Support Matrix for supported versions).

We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure.

Refer to KB43892 – What releases will Pulse Secure apply fixes to resolve security vulnerabilities for our End of Engineering (EOE) and End of Life (EOL) policies.

| **CVE**        | Description                                                                                | CVSS | Vector                                  |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | --------------------------------------- |
| CVE-2024-21894 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code | 8.2  | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
 |
| CVE-2024-22052 | A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack                                                          | 7.5  | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 |
| CVE-2024-22053 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack or in certain conditions read contents from memory.
             | 8.2  | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
 |
| CVE-2024-22023 | An XML entity expansion or XEE vulnerability in SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated attacker to send specially crafted XML requests in-order-to temporarily cause resource exhaustion thereby resulting in a limited-time DoS.                         | 5.3  | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
 |
| CVE-2024-29205 | An Improper Check for Unusual Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a remote unauthenticated attacker to send specially crafted requests in order to cause service disruptions.                                      | 7.5  | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H     |

Update 17 April: An issue that was initially identified as a product defect, disclosed in the release notes, and fixed in the patch released on 3 April has since been identified as a security issue and we are reporting it as CVE-2024-29205. Customers who have applied the patch released on 3 April are protected from this vulnerability, and no other action is required. Following the public disclosure, we are aware of a limited number of customers who have been impacted by this vulnerability.


Security Advisory April 2025 for Ivanti EPM 2024 and EPM 2022 SU6

Security Advisory Ivanti EPM 2022 SU6 and EPM 2024 (Multiple CVEs)

Summary

Ivanti has released updates for Ivanti Endpoint Manager which addresses medium and high vulnerabilities.

We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure.

ding

| CVE Number     | Description                                                                                | CVSS Score (Severity) | CVSS Vector                                  | CWE     |
| -------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | -------------------------------------------- | ------- |
| CVE-2025-22464 | An untrusted pointer dereference vulnerability in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an attacker with local access to write arbitrary data into memory causing a denial-of-service condition. | 6.1 (Medium)          | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H | CWE-822 |
| CVE-2025-22465 | Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required.           | 6.1 (Medium)          | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | CWE-79  |
| CVE-2025-22466 | Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.                                               | 8.2 (High)            | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N | CWE-79  |
| CVE-2025-22458 | DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System.                                                                                | 7.8 (High)            | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CWE-427 |
| CVE-2025-22459 | Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers.                             | 4.8 (Medium)          | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | CWE-296 |
| CVE-2025-22461 | SQL injection in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote authenticated attacker with admin privileges to achieve code execution.                                                          | 7.2 (High)            | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | CWE-89  |

Ref: [https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US](https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6?language=en_US)


Security Advisory Ivanti Endpoint Manager Mobile (EPMM) May 2025 (CVE-2025-4427 and CVE-2025-4428)

Ivanti has released updates for Endpoint Manager Mobile (EPMM) which addresses one medium and one high severity vulnerability. When chained together, successful exploitation could lead to unauthenticated remote code execution.

We are aware of a very limited number of customers whose solution has been exploited at the time of disclosure.

| CVE Number     | Description                                                                                | CVSS Score (Severity) | CVSS Vector                                  | CWE     |
| -------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | -------------------------------------------- | ------- |
| CVE-2025-4427 | An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials.   | 5.3 (Medium)          | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CWE-288 |
| CVE-2025-4428 | A remote code execution vulnerability in Ivanti Endpoint Manager Mobile allowing attackers to execute arbitrary code on the target system | 7.2 (High)            | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | CWE-94  |

Mitigation or Workaround

Customers can mitigate the threat by following best practice guidance of filtering access to the API using either the built in Portal ACLs functionality or an external WAF. You can find additional information on using the Portal ACLs functionality HERE.

- The risk to customers is significantly reduced if they already filter access to the API using either the built in Portal ACLs functionality or an external WAF.
- When reviewing or implementing additional API restrictions, please ensure you are using the “API Connection” type.
- We do NOT recommend using the “ACLs” functionality, as it blocks all access by network ranges, not just access to specific functionality.
- While this is an effective mitigation, it could impact the functionality of your solution depending on your specific configurations. In particular integrations where IPs are difficult to determine or change often will be impacted, such as:
- Windows Device Registrations using Autopilot
- Microsoft Device Compliance and Graph API integrations
- Additionally, an RPM file can be provided if customers need an alternative option. Customers will need to open a Support Case to receive the RPM file.  Here's a step-by-step guide to install the RPM file:
- Use SSH to connect to the instance and log in to the system CLI as the admin user. The admin account is created during system installation.
- Type enable and provide the corresponding system password (set during the system installation) to enter EXEC PRIVILEGED mode. You’ll notice the command line prompt changes from > to #.

    - Run the command install rpm url https://hostname/pathtorpm to download and install the RPM file.
    - Once the RPM installation is complete, type reload to restart the system. This will apply the update effectively.

The RPM file has been tested on supported versions of EPMM (versions 12.3, 12.4. and 12.5). The RPM may work on older versions, but Ivanti has not tested the mitigation on unsupported versions. We strongly recommend customers move to a supported version of the product.

Ref: [https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US](https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US)