Threat briefs

Adversaries utilize native Windows utilities to enumerate local file systems for improperly stored private keys and cryptographic credentials.

Detection of the Nimgrab utility, a command-line tool often used for remote file downloads and potentially leveraged for stages of command-and-control operations.

Threat actors leverage the legitimate Microsoft signed script 'Pubprn.vbs' to proxy the execution of arbitrary scripts and evade security controls.

Detection engineering brief regarding the use of the Hashcat password recovery tool in Windows environments, which is frequently used by adversaries for credential access via offline hash cracking.

The abuse of the Unblock-File cmdlet is used by attackers to bypass Mark-of-the-Web (MotW) protections on downloaded files, facilitating the execution of malicious payloads.

Adversaries may use PowerShell to open a handle to disk volumes via DOS device paths to perform direct, unauthorized file system access or bypass security controls.

Adversaries often downgrade PowerShell execution policies to execute unauthorized scripts, bypassing security controls by invoking the Set-ExecutionPolicy cmdlet with 'Unrestricted' or 'Bypass' parameters.

Adversaries use PowerShell script blocks to enumerate active security software processes by filtering system process listings for known defensive product names and company identifiers.

Detection of the Get-ADReplAccount cmdlet from the DSInternals toolkit, which is frequently used by adversaries for unauthorized Active Directory credential dumping.

Adversaries can utilize PowerShell to programmatically create Volume Shadow Copies, enabling the offline extraction of sensitive files like the Active Directory ntds.dit database.

Adversaries utilize Windows script engines, wscript.exe and cscript.exe, to initiate outbound network connections for downloading malicious payloads or communicating with command and control infrastructure.

Detection of BITS transfer jobs saving files with potentially malicious extensions, a technique used by adversaries to download and execute payloads while evading traditional security monitoring.

A vulnerability (CVE-2026-66066) in Ruby on Rails Active Storage allows unauthenticated attackers to achieve arbitrary file read and remote code execution during the variant processing phase.

An improper authorization flaw in the Master Addons for Elementor WordPress plugin allows authenticated users with editor-level access to achieve remote code execution via arbitrary file uploads.

The Support Genix WordPress plugin is vulnerable to authentication bypass and administrator account takeover due to a weak cryptographic implementation in the guest ticket login feature.

An unauthenticated stored XSS vulnerability in the Listdom WordPress plugin allows attackers to inject arbitrary scripts when specific premium add-ons are enabled.

The Affiliate Super Assistent plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability via the doCommentShortcode function, allowing unauthenticated attackers to execute arbitrary scripts in the context of a victim's session.

An unauthenticated remote command injection vulnerability in the mail-report.sh script of Cobham SATCOM VSAT7090 devices allows attackers to execute arbitrary system commands via crafted JSON input.

CVE-2024-57429 is a Cross-Site Request Forgery (CSRF) vulnerability in the pjActionUpdate function of PHPJabbers Cinema Booking System v2.0, allowing attackers to perform administrative account takeover via malicious web requests.

CVE-2019-6447 allows unauthenticated attackers on a local Wi-Fi network to execute arbitrary commands and exfiltrate files from Android devices running vulnerable versions of ES File Explorer.

The WPLP Cookie Consent WordPress plugin is vulnerable to unauthenticated arbitrary file upload due to improper authorization and missing file type validation, enabling remote code execution.

A local privilege escalation vulnerability in the 'below' system monitoring tool allows attackers to gain root access via a symlink attack targeting log files.

An unauthenticated time-based SQL injection vulnerability (CVE-2024-6028) exists in Ays-pro Quiz Maker plugin versions 6.5.8.3 and earlier, allowing attackers to exfiltrate database content via crafted POST requests.

Hyperledger FireFly versions 1.4.0 and earlier contain an SSRF vulnerability in the Webhook Subscription component, allowing unauthenticated remote attackers to perform unauthorized requests via manipulation of the URL argument.

ShopEx ECShop versions up to 2.5.1 contain an unrestricted file upload vulnerability in the check_img_type function that allows unauthenticated remote attackers to upload malicious files via the pack_img argument.

Devtron versions 2.2.0 and earlier contain an authorization flaw in the orchestrator webhook endpoint that allows authenticated users to retrieve plaintext super-admin API tokens.

RedPort Optimizer wXa-203, wXa-213, and wXa-223 devices running firmware up to 20260704 are vulnerable to unauthenticated remote code execution due to command injection in the System Clock component.

QVidium Opera11 version 3.3.2a26-Ax4x-opera11 is vulnerable to unauthenticated remote command injection via the ipaddr parameter in the /cgi-bin/net_tr.cgi script, which lacks security updates due to the vendor ceasing operations.

Dokploy versions up to 0.29.7 are vulnerable to remote path traversal via the writeTraefikConfigInPath function, allowing attackers to access arbitrary files on the system.

Threat actors are using forged User-Agent strings to masquerade as AI crawlers from OpenAI, Anthropic, and other firms to scan for and exfiltrate environment files and cloud credentials from misconfigured web servers.