For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

F5 Threat Report - November 19th, 2025

CISA Flags Imminent Threat As Akira Ransomware Starts Hitting Nutanix AHV

The US Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the FBI and European law enforcement, has issued an updated advisory on the Akira ransomware operation, noting its expansion to target Nutanix AHV virtual machines. This development follows observations of attacks against Nutanix hypervisors since June, adding to Akira's previous targeting of VMware ESXi and Hyper-V environments. The group, which has extorted an estimated $244.17 million, primarily gains initial access by exploiting vulnerabilities in VPN products, specifically citing CVE-2024-40766 in misconfigured SonicWall SSL-VPNs, as well as through compromised VPN credentials, brute-forcing VPN endpoints, password spraying, and exploiting SSH protocol vulnerabilities. After initial access, Akira actors move laterally, exploiting publicly known vulnerabilities in Veeam Backup and Replication servers, such as CVE-2023-27532 and CVE-2024-40711, before deploying encryption payloads on Nutanix AHV platforms. Akira, which emerged in 2023 as a Conti offshoot, has targeted critical sectors including manufacturing, education, healthcare, and finance, with notable victims including Lush, Stanford University, and the Toronto Zoo. Recommended mitigations include patching known exploited vulnerabilities, deploying multi-factor authentication, enforcing strong password policies, maintaining offline backups, and implementing network segmentation.

Severity: Critical

Sources

Threat Details and IOCs

Malware:Akira, Akira_v2, Akirav2, BadCandy, BurntCigar, Conti, Coroxy, DroxiDat, Fog, Interlock, LaZagne, Lost in the Fog, Megazord, Mimikatz, OVERSTEP, POORTRY, Rhadamanthys, Ryuk, STONETOP, SystemBC, VenomRAT, Venom Software
CVEs:CVE-2019-6693, CVE-2020-3259, CVE-2020-3580, CVE-2021-21972, CVE-2022-40684, CVE-2023-20269, CVE-2023-27532, CVE-2023-28252, CVE-2024-37085, CVE-2024-40711, CVE-2024-40766
Technologies:Amazon Web Services, AnyDesk, Cisco Adaptive Security Appliance, Cisco Firepower Threat Defense (FTD), Cisco Firepower Threat Defense Software, Cisco VPN, Gladinet Triofox, Linux, LogMeIn, Microsoft 365, Microsoft Active Directory, Microsoft Hyper-V, Microsoft Windows, Microsoft Windows Server, Nutanix AHV, Python, SonicWall, SonicWall Firewall, SonicWall Secure Mobile Access (SMA), SonicWall SonicOS, SonicWall SSL-VPN, SonicWall VPN, Veeam Backup & Replication, VMware ESXi, Watchdog Anti-Malware, WatchGuard Firebox, Zemana AntiMalware
Threat Actors:Akira, Conti, GoldSahara, HowlingScorpius, Megazord, Storm-1567, Storm1567, UNC6148, WIZARDSPIDER
Attacker Countries:Myanmar, Russia, United States
Attacker Domains:akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion, level.io
Attacker URLs:https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion/#apacheopenoffice
Attacker Hashes:03aa12ac2884251aa24bf0ccd854047de403591a8537e6aba19e822807e06a45, 08cf869a19c76ca718ba80ef73636e7bc38218b8, 0b5b31af5956158bfbd14f6cbf4f1bca23c5d16a40dbf3758f3289146c565f43, 0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd9438696d, 0d700ca5f6cc093de4abba9410480ee7a8870d5e8fe86c9ce103eec3872f225f, 0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c, 131da83b521f610819141d5c740313ce46578374abb22ef504a7593955a65f07, 17c624693f5dd575485ec4286b0ba786, 18051333e658c4816ff3576a2e9d97fe2a1196ac0ea5ed9ba386c46defafdb88, 24e19d29a47b6b5e1a39bf5e4c313194, 2e88e55cc8ee364bf90e7a51671366efb3dac3e9468005b044164ba0f1624422, 2f629395fdfa11e713ea8bf11d40f6f240acf2f5fcf9a2ac50b6f7fbc7521c83, 2fed7579556f01161bb1fdfd1c3e9e6c, 3298d203c2acb68c474e5fdad8379181890b4403d6491c523c13730129be3f75, 3a25d3f82651567e5760e48ad06c9f6caab4f9fdc071e98919163b3a71e67168, 3d2b58ef6df743ce58669d7387ff94740ceb0122c4fc1c4ffd81af00e72e60a4, 40221e1c2e0c09bc6104548ee847b6ec790413d6ece06ad675fff87e5b8dc1d5, 4dc9f9684f715f50946e85557b82af80fcb45576efad47eee1bf054c15e570f0, 57d1aeb41d9cfea4d6899724bc4b09a5, 58359209e215a9fc0dafd14039121398559790dba9aa2398c457348ee1cb8a4d, 58afef43cec0ee7a2fbfd9cdd5b71f55f971672d5e523a400b82b98c752ca5b7, 5961a99181df157b81d35a50eeb27f96577a2fa2, 5e1e3bf6999126ae4aa52146280fdb913912632e8bac4f54e98c58821a307d32, 5ea65e2bb9d245913ad69ce90e3bd9647eb16d992301145372565486c77568a2, 643061ac0b51f8c77f2ed202dc91afb9879f796ddd974489209d45f84f644562, 6f9d50bab16b2532f4683eeb76bd25449d83bdd6c85bf0b05f716a4b49584f84, 7266e2afb5c70788c018d684698b0940eded4cb863f2b33f4edd31b59d1eab1d, 74f497088b49b745e6377b32ed5d9dfaef3c84c7c0bb50fabf30363ad2e0bfb1, 77d48e8c13ce066b197905cc8fc69969af69b74d25f5e95dcd1302ada2e7ccec, 7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be, 814310fb7a59f23e3e137ee6fee04fa1, 8e12c8eb39cec9a414b56a36acbcc1a5b31dc96a38bc668138a00f94f7c26ea5, 95477703e789e6182096a09bc98853e0a70b680a4f19fa2bf86cbb9280e8ec5a, 9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f23d065, 9f393516edf6b8e011df6ee991758480c5b99a0efbfd68347786061f0e04426c, a2df5477cf924bd41241a3326060cc2f913aff2379858b148ddec455e4da67bc, aaa6041912a6ba3cf167ecdb90a434a62feaf08639c59705847706b9f492015d, bfd5fc6cd3dea74738ac7025fa14ea844f400708df2293572796568f65bd6b61, c0f706ff43936c1bb19db4f39b11129c3fc8ddafbd159852475ef99a246b2f79, c56b31c9080b993d57c100b91d096c33, c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0, cf3465d7e49b609defa1e2b6cfcc86ffa30c72246cb2744dbf50736c5f3d74d5, cfa209d56e296c40b32815270060e539963d68cda3285c5f393c97eb3c960d37, d2fd0654710c27dcf37b6c1437880020824e161dd0bf28e3a133ed777242a0ca, d5efaa22a74aab87d17f8666686b554e41fb389a, dcfa2800754e5722acf94987bb03e814edcb9acebda37df6da1987bf48e5b05e, dfe6fddc67bdc93b9947430b966da2877fda094edf3e21e6f0ba98a84bc53198, e1321a4b2b104f31aceaf4b19c5559e40ba35b73a754d3ae13d8e90c53146c0f, e57340a208ac9d95a1f015a5d6d98b94, ef328f68c6d865ba4ef4223b5d8ee9efb5667420, fef09b0aa37cbdb6a8f60a6bd8b473a7e5bffdc7fd2e952444f781574abccf64, ffd9f58e5fe8502249c67cad0123ceeeaa6e9f69b4ec9f9e21511809849eb8fc
Victim Industries:Agriculture, Automotive, Business Services, Construction, Consulting Services, Critical Manufacturing, Education, Energy, Financials, Financial Services, Government, Healthcare, Health Care Technology, Hospitality, Industrials, Information Technology, Insurance, Legal Services, Manufacturing, Media and Entertainment, Oil & Gas, Public Administration, Public Health, Public Sector, Real Estate, Retail, Software, Technology Hardware, Telecommunications, Transportation, Transportation & Logistics
Victim Countries:Afghanistan, Australia, Bangladesh, Bhutan, Brunei, Cambodia, Canada, China, Czech Republic, Denmark, Fiji, Finland, France, Germany, India, Indonesia, Italy, Japan, Kiribati, Laos, Malaysia, Maldives, Marshall Islands, Micronesia, Mongolia, Myanmar, Nauru, Nepal, Netherlands, New Zealand, Nigeria, North Korea, Pakistan, Palau, Papua New Guinea, Philippines, Samoa, Singapore, Solomon Islands, South Africa, South Korea, Spain, Sri Lanka, Sweden, Taiwan, Thailand, Timor-Leste, Tonga, Turkey, Tuvalu, United Kingdom, United States, Uruguay, Vanuatu, Vietnam

Mitigation Advice

  • Immediately patch all SonicWall SSL-VPN devices to remediate vulnerability CVE-2024-40766.
  • Apply patches to all Veeam Backup and Replication servers to remediate CVE-2023-27532.
  • Apply patches to all Veeam Backup and Replication servers to remediate the critical remote code execution vulnerability CVE-2024-40711.
  • Audit Nutanix AHV hypervisor logs for any unauthorized access, unexpected VM modifications, or other anomalous activity.
  • Review VPN access logs for signs of brute-force attacks, password spraying, or logins from unusual geographic locations or at unusual times.
  • Scan the network perimeter for any exposed SSH services on routers or other network devices and disable them or restrict access to trusted IP addresses immediately.

Compliance Best Practices

  • Develop a plan to deploy phishing-resistant Multi-Factor Authentication (MFA), such as FIDO2/WebAuthn, for all remote access services, including VPNs, SSH, and cloud services.
  • Implement a network segmentation architecture to isolate critical infrastructure, such as hypervisor management networks (Nutanix, VMware, Hyper-V) and backup servers, from the general user and server networks.
  • Enforce a strict password policy that requires long, unique passphrases for all accounts and deploy a credential monitoring service to detect when employee credentials appear in public data breaches.
  • Review and redesign the backup and recovery strategy to ensure that critical data backups are stored offline or in an immutable cloud storage tier, and regularly test the restoration process.
  • Establish a continuous attack surface management program to regularly identify, assess, and remediate all internet-facing services and systems.

RONINGLOADER Uses Signed Drivers to Disable Microsoft Defender and Bypass EDR

Elastic Security Labs has uncovered RONINGLOADER, a sophisticated multi-stage loader attributed to the Dragon Breath APT group (APT-Q-27), primarily targeting Chinese-speaking users through trojanized installers masquerading as legitimate software like Google Chrome and Microsoft Teams. This campaign weaponizes legitimately signed kernel drivers, specifically `ollama.sys` issued by Kunming Wuqi E-commerce Co., Ltd., to terminate security processes including Microsoft Defender, Kingsoft Internet Security, Tencent PC Manager, Qihoo 360 Total Security, and Huorong Security from kernel mode. RONINGLOADER further employs Protected Process Light (PPL) abuse, leveraging `ClipUp.exe` to overwrite `MsMpEng.exe` and disable Microsoft Defender, alongside deploying custom unsigned Windows Defender Application Control (WDAC) policies to block other security solutions. The attack chain also utilizes phantom DLL side-loading, thread pool injection, and firewall manipulation, ultimately injecting a modified gh0st RAT as its final payload. This RAT maintains C2 communication over encrypted TCP channels and performs keystroke logging, clipboard hijacking, and cryptocurrency wallet monitoring, particularly for MetaMask and Telegram interactions, signifying a notable advancement in APT capabilities through sophisticated abuse of legitimate Windows features and signed drivers to neutralize endpoint security.

Severity: Critical

Sources

Threat Details and IOCs

Malware:C.Rufus, Farfli, gh0st RAT, Gh0st RAT, Ghost RAT, Moudoor, RoningLoader, RONINGLOADER, SugarGh0st RAT, Zegost
Technologies:Microsoft Defender Antivirus, Microsoft Windows
Threat Actors:APT27, APT-Q-27
Attacker Countries:China
Attacker Domains:qaqkongtiao.com, www.baidu.com
Attacker URLs:http://www.baidu.com/
Attacker Hashes:1613a913d0384cbb958e9a8d6b00fffaf77c27d348ebc7886d6c563a6f22f2b7, 1c1528b546aa29be6614707cbe408cb4b46e8ed05bf3fe6b388b9f22a4ee37e2, 2515b546125d20013237aeadec5873e6438ada611347035358059a77a32c54f5, 33b494eaaa6d7ed75eec74f8c8c866b6c42f59ca72b8517b3d4752c3313e617c, 395f835731d25803a791db984062dd5cfdcade6f95cc5d0f68d359af32f6258d, 3dd470e85fe77cd847ca59d1d08ec8ccebe9bd73fd2cf074c29d87ca2fd24e33, 4d5beb8efd4ade583c8ff730609f142550e8ed14c251bae1097c35a756ed39e6, 507e41a0831a8f3a81f2cd6be76ea4d757f463524f6c93bba15d47984f9e29c1, 82794015e2b40cc6e02d3c1d50241465c0cf2c2e4f0a7a2a8f880edaee203724, 96f401b80d3319f8285fa2bb7f0d66ca9055d349c044b78c27e339bcfb07cdf0, c65170be2bf4f0bd71b9044592c063eaa82f3d43fcbd8a81e30a959bcaad8ae5, da2c58308e860e57df4c46465fd1cfc68d41e8699b4871e9a9be3c434283d50b, fc63f5dfc93f2358f4cba18cbdf99578fff5dac4cdd2de193a21f6041a0e01bc, fd4dd9904549c6655465331921a28330ad2b9ff1c99eb993edf2252001f1d107
Victim Industries:E-commerce, Financial Services, Gambling & Gaming, Gaming, Information Security, Software
Victim Countries:China

Mitigation Advice

  • Create a block rule in your endpoint security software to deny the execution of any files signed by the certificate issued to "Kunming Wuqi E-commerce Co., Ltd.".
  • Use endpoint detection and response (EDR) or system management tools to scan all endpoints for the presence of the file `ollama.sys`.
  • Create a detection rule in your EDR or SIEM to alert on the `ClipUp.exe` process attempting to write to or modify the `MsMpEng.exe` file located in the Microsoft Defender program directory.
  • Configure file integrity monitoring (FIM) to alert on the creation or modification of files, particularly `.p7b` files, within the `C:\Windows\System32\CodeIntegrity\` directory.

Compliance Best Practices

  • Implement Windows Defender Application Control (WDAC) in enforcement mode to create an application allowlist, ensuring only approved applications, scripts, and installers can execute.
  • Use Windows Defender Application Control (WDAC) to establish a strict policy that blocks all kernel-mode drivers by default and only allows the execution of explicitly approved drivers required for operations.
  • Establish a recurring security awareness training program focused on identifying and avoiding phishing attempts and the risks of downloading and installing software from unofficial websites.
  • Enable and enforce tamper protection features for all endpoint security solutions, including Microsoft Defender and third-party EDR agents, to prevent their services and configurations from being disabled.
  • Develop and tune correlation rules in your SIEM to detect attack sequences, such as an NSIS installer execution followed by the creation of a new system service and the loading of a new kernel driver.

Fortinet FortiWeb Flaw Actively Exploited in the Wild before Company's Silent Patch

An authentication bypass vulnerability in Fortinet FortiWeb Web Application Firewall (WAF) is being actively exploited in the wild, allowing attackers to create new administrator accounts and fully compromise devices. This flaw, silently patched in FortiWeb version 8.0.2, enables privileged actions through an HTTP POST request to the `/api/v2.0/cmdb/system/admin?/../../../../../cgi-bin/fwbcgi` endpoint. Observed exploitation includes the creation of admin accounts with usernames and passwords such as "Testpoint / AFodIUU3Sszp5" and "trader1 / 3eMIXX43." Cybersecurity researchers have reproduced the vulnerability, developed a proof-of-concept, and released an artifact generator tool to identify susceptible devices. Organizations running FortiWeb versions prior to 8.0.2 are urged to apply patches immediately, as unpatched systems are likely already compromised, though Fortinet has not yet assigned a CVE identifier or issued an official advisory.

Severity: Critical

Sources

Threat Details and IOCs

Malware:LANDFALL, Lumma, LummaC2, Lumma Stealer, NetSupport Manager RAT, NetSupport RAT, PROMPTFLUX, SesameOp
Technologies:Fortinet
Attacker Countries:United States
Attacker IPs:107.152.41.19, 144.31.1.63, 185.192.70.0/24, 185.192.70.25, 185.192.70.31, 185.192.70.33, 185.192.70.36, 185.192.70.39, 185.192.70.43, 185.192.70.46, 185.192.70.49, 185.192.70.50, 185.192.70.53, 185.192.70.57, 64.95.13.8, 89.169.55.168
Attacker URLs:/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi
Victim Industries:Data Centers, Education, Financial Services, Government, Healthcare, Hospitality, Information Technology, Managed Service Providers, Manufacturing, Oil & Gas, Retail, Telecommunications
Victim Countries:United States

Mitigation Advice

  • Immediately upgrade all Fortinet FortiWeb appliances to version 8.0.2 or a later version.
  • Audit all Fortinet FortiWeb devices for any unauthorized administrator accounts, specifically searching for the usernames 'Testpoint', 'trader1', 'trader', 'test1234point', or any other recently created, unknown admin users.
  • Create a detection rule in your SIEM to generate a high-priority alert for any inbound HTTP POST requests to URI paths containing '/cgi-bin/fwbcgi' targeting FortiWeb devices.
  • Implement a blocking rule on your network IPS or edge firewall to deny inbound HTTP POST requests to the URI path '/api/v2.0/cmdb/system/admin?/../../../../../cgi-bin/fwbcgi'.
  • Use a vulnerability scanner or the publicly available proof-of-concept tools to scan your network and identify all Fortinet FortiWeb appliances that have not been patched to version 8.0.2.

Compliance Best Practices

  • Implement a network security policy to ensure administrative interfaces for all critical appliances, including FortiWeb, are not exposed to the public internet and are only accessible from a secure, segregated management network or via a VPN with multi-factor authentication.
  • Establish a formal threat intelligence process that incorporates monitoring of security researcher publications, technical forums, and third-party reports in addition to official vendor security advisories.
  • Configure all critical network devices, including FortiWeb, to send system and audit logs to a centralized SIEM, and create an automated alerting rule to trigger an investigation whenever a new user account with administrative privileges is created.

Palo Alto PAN-OS Flaw Lets Attackers Force Firewall Reboots via Malicious Packets

Palo Alto Networks has disclosed a denial-of-service vulnerability, CVE-2025-4619, in its PAN-OS software, impacting PA-Series and VM-Series firewalls, as well as Prisma Access deployments. This flaw allows unauthenticated attackers to force firewalls into unexpected reboots and potentially maintenance mode by sending specially crafted network packets through the data plane, thereby disrupting network security operations. Exploitation requires the firewall to be configured with URL proxy functionality or a decrypt policy. The vulnerability carries a CVSS 4.0 score of 6.6 (base 8.7), indicating a high product availability impact and low attack complexity, requiring no user interaction or privileges. Affected versions include specific builds of PAN-OS 10.2, 11.1, and 11.2, while PAN-OS 10.1, 11.2.5 or later, 12.1, and Cloud NGFW deployments are not vulnerable. Organizations should prioritize patching to fixed versions, such as 11.2.2-h2, 11.2.3-h6, 11.2.4-h4, or 11.2.5+ for PAN-OS 11.2; 11.1.2-h18 or later for PAN-OS 11.1; and 10.2.14 or later for PAN-OS 10.2, although no active exploitation has been reported as of November 12, 2025.

Severity: Critical

Sources

Threat Details and IOCs

Malware:Gokcpdoor, Lumma, LummaC2, Lumma Stealer, NetSupport Manager, NetSupport RAT
CVEs:CVE-2025-4619
Technologies:Palo Alto Networks
Victim Industries:Financial Services, Healthcare, Industrial Control Systems, Manufacturing, Oil & Gas, Public Sector, Retail, Telecommunications, Utilities

Mitigation Advice

  • Identify all Palo Alto Networks PA-Series and VM-Series firewalls currently deployed in the environment.
  • For all identified Palo Alto firewalls, verify if they are configured with either 'URL proxy functionality' or a 'decrypt policy'.
  • Upgrade all vulnerable firewalls running affected PAN-OS 11.2 versions to 11.2.5 or a later patched release.
  • Upgrade all vulnerable firewalls running affected PAN-OS 11.1 versions to 11.1.2-h18 or a later patched release.
  • Upgrade all vulnerable firewalls running affected PAN-OS 10.2 versions to 10.2.14 or a later patched release.
  • Implement monitoring and alerting for unexpected reboots or maintenance mode transitions on all Palo Alto firewalls.

Compliance Best Practices

  • Develop and implement a comprehensive patch management policy for all network infrastructure devices, defining timelines and procedures for testing and deploying security updates.
  • Review the architecture of critical network segments and implement high-availability (HA) configurations for firewalls to ensure redundancy and failover capabilities.
  • Enhance network segmentation and implement strict access control lists (ACLs) to limit access to firewall data plane interfaces from untrusted or unnecessary network zones.
  • Establish a quarterly review process to audit firewall configurations and disable any non-essential features or policies to adhere to the principle of least functionality.

Clop Ransomware Steals HR Data From Washington Post's Oracle E-Business Suite

The Washington Post confirmed that human resources data for 9,720 current and former employees and contractors was stolen from its Oracle E-Business Suite environment. This incident is linked to a data theft and extortion campaign by the Clop ransomware group, which exploited a zero-day vulnerability, CVE-2025-61882, affecting Oracle E-Business Suite. A "bad actor" first contacted the company on September 29, leading to an investigation that determined unauthorized access to its Oracle environment occurred between July 10 and August 22. The compromised data includes names, bank account numbers, routing numbers, and Social Security numbers. Oracle disclosed and patched the vulnerability on October 4, and other organizations, such as Envoy Air and GlobalLogic, have also been impacted by this campaign. Clop, known for exploiting vulnerabilities in file-transfer services and demanding ransom, typically threatens to leak stolen data if payment is not received.

Severity: Critical

Sources

Threat Details and IOCs

Malware:Akira, AMOS, Atomic macOS Stealer, Atomic Stealer, BARBWIRE, C10p, CIop, Cl0p, CL0P, CL0P^_- LEAKS, Cl0p Ransomware, Clop, Clop Ransomware, CryptFile2, CryptoMix, Cryptomix Clop, CryptoMix Clop, CryptoShield, DEWMODE, FIN11, FlawedAmmyy, FlawedGrace, Get2, GetandGo, GOLDVEIN, GOLDVEIN.JAVA, GraceWire, HelloKitty, Kraken, LEMURLOOT, LOSTKEYS, Odyssey Stealer, OSX.AtomStealer, OSX.Odyssey, Poseidon Stealer, Ransom.Clop, SAGEGIFT, SAGELEAF, SAGEWAVE, SDBot, Silence.Downloader, TA505, TrueBot, ValleyRAT, Winos 4.0, Zeta
CVEs:CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104, CVE-2021-35211, CVE-2022-48503, CVE-2023-0669, CVE-2023-34362, CVE-2023-35036, CVE-2024-40766, CVE-2024-50623, CVE-2024-55956, CVE-2025-2746, CVE-2025-2747, CVE-2025-33073, CVE-2025-59367, CVE-2025-61882, CVE-2025-61884
Technologies:Accellion File Transfer Appliance, Apple iOS, Apple macOS, Apple Safari, Apple tvOS, Apple watchOS, ASUS Routers, Cleo Harmony, Fortra GoAnywhere MFT, Google Android, Kentico Xperience, Linux, Microsoft Active Directory, Microsoft Excel, Microsoft Hyper-V, Microsoft SQL Server, Microsoft Windows, Nutanix AHV, Oracle E-Business Suite, Oracle Java, Progress MOVEit Transfer, SolarWinds Serv-U, SonicWall SonicOS, Uhale Platform, VMware ESXi
Threat Actors:0ktapus, Akira, ATK103, Chimborazo, Cl0p, Clop, DEV0950, EvilCorp, FIN11, GoldEvergreen, GoldTahoe, GracefulSpider, HELLCAT, Hive0065, Kraken, LaceTempest, Lapsus, MuddledLibra, OctoTempest, ScatteredLAPSUSHunters, ScatteredSpider, ScatterSwine, SectorJ04, ShadowSyndicate, ShinyHunters, Silence, SpandexTempest, Storm-0875, Storm1567, TA505, UNC2546, UNC3944, VanillaTempest
Attacker Countries:Azerbaijan, Brazil, China, Iran, Lebanon, North Korea, Russia, United Kingdom, United States
Attacker IPs:100.21.161.34, 103.214.147.176, 103.214.147.177, 103.214.147.178, 103.214.147.181, 103.214.147.182, 103.214.147.187, 103.224.182.249, 103.244.54.149, 104.194.11.200, 104.194.222.107, 104.200.72.149, 104.21.7.153, 104.253.170.58, 106.75.139.199, 107.181.161.207, 13.248.213.45, 13.248.216.40, 138.197.152.201, 139.60.160.166, 141.101.68.154, 141.101.68.166, 141.98.82.198, 141.98.82.242, 142.44.212.178, 143.31.133.99, 146.0.77.141, 146.0.77.155, 146.0.77.183, 147.45.112.203, 147.45.112.205, 147.45.112.219, 147.45.112.220, 147.45.112.231, 147.45.112.253, 147.78.46.112, 147.78.46.115, 147.78.46.117, 147.78.46.134, 147.78.46.163, 147.78.46.164, 147.78.46.26, 147.78.46.69, 147.78.46.81, 147.78.46.97, 147.78.47.178, 147.78.47.236, 147.78.47.243, 148.113.152.144, 148.113.159.146, 148.113.159.213, 15.235.13.184, 15.235.83.73, 152.57.231.216, 161.97.99.49, 162.158.129.79, 162.244.34.26, 162.244.35.6, 162.255.119.122, 162.55.17.215, 166.70.47.90, 172.67.130.82, 172.71.134.76, 173.254.236.131, 179.60.145.216, 179.60.149.223, 179.60.149.244, 179.60.149.249, 179.60.150.121, 179.60.150.132, 179.60.150.143, 179.60.150.151, 185.104.194.134, 185.104.194.156, 185.104.194.24, 185.104.194.40, 185.117.88.17, 185.117.88.2, 185.162.128.75, 185.174.100.17, 185.174.100.215, 185.174.100.250, 185.181.229.240, 185.181.229.73, 185.181.60.11, 185.183.32.122, 185.185.50.172, 185.232.67.101, 185.232.67.15, 185.33.86.225, 185.33.87.126, 185.55.242.97, 185.80.52.230, 185.81.113.156, 185.99.3.99, 188.241.58.244, 192.187.111.219, 192.187.111.220, 192.187.111.221, 192.187.111.222, 192.42.116.191, 193.142.30.100, 193.142.30.134, 193.142.30.137, 193.142.30.144, 193.142.30.165, 193.142.30.194, 193.142.30.205, 193.142.30.242, 193.142.30.37, 193.142.30.39, 193.142.30.66, 193.142.30.99, 193.169.245.79, 193.24.211.240, 193.24.211.242, 193.24.211.244, 193.24.211.249, 193.29.13.150, 193.29.13.153, 193.29.13.240, 193.42.38.196, 194.165.16.113, 194.165.16.54, 194.165.16.92, 194.165.16.93, 194.33.40.103, 194.33.40.104, 194.33.40.164, 194.34.239.33, 194.34.239.36, 194.34.239.44, 194.67.71.34, 195.38.8.241, 198.12.76.214, 198.137.247.10, 198.199.74.207, 198.245.13.4, 198.27.75.110, 198.54.117.200, 199.115.115.102, 199.115.115.116, 199.115.115.118, 199.115.115.119, 199.59.240.200, 199.59.242.153, 199.59.243.200, 199.59.243.201, 199.59.243.220, 199.59.243.221, 199.59.243.222, 199.59.243.224, 200.107.207.102, 200.107.207.15, 200.107.207.26, 200.107.207.31, 20.47.120.195, 206.221.182.106, 208.115.199.25, 208.91.197.87, 209.127.116.122, 209.127.4.22, 209.222.103.170, 209.222.98.25, 209.97.137.33, 212.32.237.101, 213.121.182.84, 216.120.146.200, 216.120.146.201, 216.144.248.20, 23.237.114.154, 23.237.56.234, 23.82.12.29, 23.82.12.30, 23.82.12.31, 23.82.12.32, 24.3.132.168, 3.101.53.11, 31.41.33.240, 31.41.33.241, 31.41.33.242, 34.196.13.28, 35.160.246.24, 37.156.246.165, 37.156.246.166, 37.156.246.168, 44.206.3.111, 45.145.20.212, 45.156.248.206, 45.182.189.107, 45.182.189.109, 45.182.189.181, 45.182.189.183, 45.182.189.194, 45.182.189.200, 45.182.189.224, 45.182.189.228, 45.182.189.229, 45.182.189.71, 45.182.189.72, 45.227.252.199, 45.227.252.226, 45.227.253.133, 45.227.253.147, 45.227.253.29, 45.227.253.50, 45.227.253.6, 45.227.253.82, 45.227.255.195, 45.227.255.214, 45.227.255.28, 45.227.255.29, 45.227.255.31, 45.227.255.74, 45.56.165.248, 46.161.27.113, 46.161.27.155, 46.161.27.158, 50.118.217.154, 50.7.118.90, 51.254.175.185, 5.149.248.68, 5.149.250.74, 5.149.250.90, 5.149.250.92, 5.149.252.51, 5.178.1.12, 5.178.1.13, 5.178.1.16, 5.178.1.17, 5.178.1.19, 5.178.1.7, 5.178.1.9, 5.188.206.214, 5.188.206.76, 5.188.206.78, 5.188.86.114, 5.188.86.162, 5.188.86.163, 5.188.86.18, 5.188.86.184, 5.188.86.185, 5.188.86.189, 5.188.86.205, 5.188.86.206, 5.188.86.213, 5.188.86.217, 5.188.86.231, 5.188.86/24, 5.188.86.250, 5.188.86.66, 5.188.86.70, 5.188.86.71, 5.188.86.72, 5.188.87.194, 5.188.87.226, 5.188.87.27, 5.188.87.35, 5.188.87.37, 5.188.87.38, 5.188.87.39, 5.188.87.40, 5.188.87.46, 5.188.87.49, 52.38.113.95, 5.252.23.116, 5.252.25.88, 5.34.178.27, 5.34.178.28, 5.34.178.30, 5.34.178.31, 5.34.180.205, 5.34.180.48, 54.184.187.134, 5.42.246.34, 54.39.133.41, 62.112.11.57, 62.182.82.19, 62.182.85.234, 63.141.242.43, 63.141.242.44, 63.141.242.45, 63.141.242.46, 63.143.42.242, 66.85.26.215, 66.85.26.234, 66.85.26.248, 68.156.159.10, 68.183.120.53, 74.218.67.242, 75.101.131.237, 75.2.26.18, 76.117.196.3, 76.223.65.111, 76.223.67.189, 77.83.197.66, 78.128.112.137, 78.128.112.138, 78.128.112.222, 79.141.160.78, 79.141.160.83, 79.141.161.82, 79.141.166.119, 79.141.173.94, 81.17.18.198, 81.17.29.149, 81.19.135.30, 81.19.136.231, 81.19.138.52, 81.56.49.148, 82.117.252.141, 82.117.252.142, 82.117.252.97, 84.234.96.104, 84.234.96.31, 88.214.25.211, 88.214.25.213, 88.214.25.214, 88.214.25.221, 88.214.25.228, 88.214.25.242, 88.214.25.243, 88.214.26.25, 88.214.26.37, 88.214.26.38, 88.214.27.100, 88.214.27.101, 88.214.27.172, 88.214.27.175, 88.214.27.177, 88.214.27.179, 88.214.27.43, 88.214.27.72, 89.39.104.118, 89.39.105.108, 91.195.240.94, 91.199.163.59, 91.199.163.65, 91.202.4.76, 91.222.174.68, 91.222.174.95, 91.223.227.140, 91.229.76.187, 91.238.181.229, 91.238.181.236, 91.38.135.67, 92.118.36.199, 92.118.36.204, 92.118.36.210, 92.118.36.213, 92.118.36.249, 93.190.142.131, 96.10.22.178, 96.44.181.131, 99.83.153.108
Attacker Emails:support@pubstorm.com, support@pubstorm.net
Attacker Domains:bak0-store.com, cl-leaks.com, conversepharmagroup.com, goto-pay.com, he1p-center.com, he1p-me.com, in2pay.com, ms-pipes-service.com, pubstorm.com, pubstorm.net, santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion, teams-download.buzz, teams-download.top, teams-install.run, xbox-ms-store-debug.com
Attacker URLs:198.199.74.207:1234/update.jsp, 5.188.206.76:8000/se1.dll, /configurator/UiServlet, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion//ansell-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion//davidyurman-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/entrust-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/fluke-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/forbesmarshall-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/helixesg-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/integralife-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/kirbycorp-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/maritz-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion//mastec-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/pens-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/sato-global-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/tpicomposites-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/washingtonpost-com, http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/zanaco-co-zm, /OA_HTML/configurator/UiServlet, /OA_HTML/SyncServlet
Attacker Hashes:1234387dc20796ac8142d46b173bc635339c5041e2b108ca07274a90cc512268, 2c0c80c66246d13871f05b663d42767b0e7511df9ab18c26d3504b0ae80b2045, 43c8923f1ed3fcac411db874e2facc611254be1def53d72638321ed57663588a, 5cce1b8f04cb3766b2d70738ad35c5d8b0ef1e802f193baccc5058478e9859a3, 678266acbbb36795e41a210f15e25af212a2e65f34c282cb52c023ba55e164d5, 6877d8531901040aedfc7dc3d9af121bf1800c66c8960a60cc3fd4c361135869, 6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b, 76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d, 7b04ac63dc41d61d409b936d2fdce47c255461f0d1d5ae86a9ddecd39e964548, 8c614d8111aca771e32ed304b9253992c5c7c8faa5b62c9141aaca595f061df3, aa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121, aa6d071d787ea8e8d054f7a699301f732cf73552d1df09a0155a5307b43df293, b1eff60fe6c57a5a4d1136b7d2c711d058aae6d0242ba4aa1a00c3027cbdca09, bd613b3be57f18c3bceb0aaf86a28ad8b6df7f9bccacf58044f1068d1787f8a5, f95812cbb46f0a664a8f2200592369b105d17dfe8255054963aac4e2df53df51
Victim Industries:Advertising Services, Aerospace, Airlines, Automotive, Chemical, Communication Services, Construction, Consumer Electronics, Critical Manufacturing, Defense, Digital Media, Distribution, Education, Energy, Financial, Financial Services, Financial Technology, Food & Beverage, Government, Healthcare, Hospitality, Industrials, Information Technology, Insurance, Logistics, Luxury Goods, Manufacturing, Media and Entertainment, Metals & Mining, Mining, Oil & Gas, Pharmaceuticals, Professional, Scientific, and Technical Services, Professional Services, Public Administration, Public Sector, Restaurants, Retail, Technology Hardware, Telecommunications, Textiles, Transportation, Transportation & Logistics, Travel, Utilities
Victim Countries:Afghanistan, Australia, Belgium, Canada, China, Denmark, France, Germany, India, Ireland, Japan, Kuwait, Malawi, Netherlands, New Zealand, Panama, Singapore, South Africa, South Korea, Switzerland, United Kingdom, United States, Vietnam

Mitigation Advice

  • Immediately apply the Oracle security patch for CVE-2025-61882 to all Oracle E-Business Suite instances in the environment.
  • Conduct a threat hunt within the Oracle E-Business Suite environment, searching logs and system files for indicators of compromise associated with the Clop ransomware group and CVE-2025-61882 exploitation.
  • Review and restrict all external network access to the Oracle E-Business Suite environment, ensuring only essential and authorized connections are permitted.

Compliance Best Practices

  • Establish a formal vulnerability management program that includes automated asset discovery, regular vulnerability scanning, risk-based prioritization, and defined service-level agreements (SLAs) for patching.
  • Implement data-at-rest encryption for databases containing sensitive employee and customer information, such as the data stored in HR and financial applications.
  • Develop and implement a network segmentation strategy to isolate critical enterprise applications, such as ERP systems, from general corporate and user networks.
  • Develop and regularly test a formal incident response plan that includes specific playbooks for data breach scenarios involving critical business applications.
  • Establish a third-party risk management program to evaluate the security practices of critical software vendors and service providers.
Published Nov 18, 2025
Version 1.0
security
threat report
No CommentsBe the first to comment