Threat Intelligence - RH-ISAC Blog

Context Ivanti has disclosed a critical vulnerability, CVE-2025-22457 (CVSS 9.0), affecting multiple product lines including Connect Secure, Policy Secure, and ZTA Gateways. The flaw, a stack-based buffer overflow, allows unauthenticated remote attackers to execute arbitrary code, and has been actively exploited in the wild. Google’s Mandiant team identified threat activity tied to UNC5221, a China-nexus group, which…

Context Sekoia researchers have released updates on ClearFake, a malicious JavaScript framework that infects compromised websites to deliver malware through drive-by downloads and social engineering tactics. Initially observed in July 2023, ClearFake utilized fake browser update prompts to trick users into downloading malware. The latest 2025 variant introduces new lures, including fake reCAPTCHA and Cloudflare Turnstile verifications,…

Executive Summary Cybersecurity researchers at SecureList by Kaspersky have uncovered a sophisticated cyber espionage campaign by SideWinder, an Advanced Persistent Threat group targeting hospitality and consulting organizations, among others, across South and Southeast Asia, the Middle East, Europe, and Africa. The group relies on spear-phishing emails containing malicious documents that exploit CVE-2017-11882, a dated but effective Microsoft…

Executive Summary Cisco Talos has uncovered a sophisticated attack campaign exploiting CVE-2024-4577, a critical PHP-CGI remote code execution vulnerability, to compromise organizations in several countries. Attackers deploy Cobalt Strike beacons and use the TaoWu toolkit for post-exploitation activities, leveraging HTTP POST requests for initial access. GreyNoise telemetry indicates that this exploitation is more widespread than initially reported, affecting regions including the United States,…

Executive Summary Microsoft Threat Intelligence has identified a shift in tactics for Silk Typhoon, a Chinese state-sponsored espionage group, to target remote management tools and cloud applications for initial access. The group has now shifted to exploiting unpatched vulnerabilities in IT infrastructure to elevate privileges and move laterally into cloud environments, enabling data exfiltration and…