LR pixel

BRICKSTORM Espionage Campaign

von | 2. Okt. 2025 | Unkategorisiert

What is the Attack? BRICKSTORM is a stealthy, Go-based backdoor deployed by the China-nexus actor UNC5221, enabling long-term persistence and espionage via compromised network appliances in US organizations. Since March 2025, GTIG (Google Threat Intelligence Group)...

AndroxGh0st Malware Actively Used in the Wild

von | 2. Okt. 2025 | Unkategorisiert

FortiGuard Labs is aware that AndroxGh0st malware is actively used in the field to primarily target .env files that contain confidential information such as credentials for various high profile applications such as – AWS, O365, SendGrid, and Twilio from the...

npm Supply Chain Attack

von | 24. Sep. 2025 | Unkategorisiert

What is the Attack? On September 8, 2025, attackers phished the npm maintainer “qix” and stole their two-factor authentication (2FA) credentials. With that access, they published malicious versions of some very popular npm packages (including debug, chalk, and...

Citrix NetScaler ADC and NetScaler RCE

von | 16. Sep. 2025 | Unkategorisiert

What is the Vulnerability? FortiGuard Labs has observed active network telemetry relating to CVE-2025-7775, a memory overflow vulnerability in Citrix NetScaler ADC and Gateway that enables remote code execution (RCE) and denial of service (DoS) under certain...

Kunbus RevPi Webstatus Authentication Bypass

von | 10. Sep. 2025 | Unkategorisiert

What is the Vulnerability? FortiGuard Labs has detected active attack attempts targeting the Kunbus Revolution Pi Webstatus authentication bypass vulnerability (CVE-2025-41646), a flaw that allows remote attackers to log in without a password by exploiting improper...

Salesloft Drift Supply Chain Attack

von | 3. Sep. 2025 | Unkategorisiert

What is the Attack?Threat actors tracked as UNC6395 exploited the Salesloft Drift integration, an AI chatbot tool linked to Salesforce and other platforms, to steal access tokens. These tokens allowed them to bypass normal authentication controls and gain access to...

ShadowSilk Data Exfiltration Attack

von | 29. Aug. 2025 | Unkategorisiert

What is the Attack?Nearly three dozen organizations across Central Asia and the Asia-Pacific region, predominantly government agencies, have been compromised in data exfiltration campaigns attributed to the Russian and Chinese-speaking threat group known as...

Multiple ZTNA Products Authentication Bypass

von | 14. Aug. 2025 | Unkategorisiert

What is the Vulnerability?A series of critical vulnerabilities affecting leading zero trust platforms – Zscaler, Netskope, and Check Point (Perimeter 81) – have been disclosed following a seven-month research campaign by security researchers David Cash and...