November 12, 2025
Headlines
Home » vulnerability » Page 2

Tag: vulnerability

BGP upstream map highlighting AS30823 (aurologic) feeding multiple high-risk hosting ASNs across Europe

Sanctions vs. Transit: Aeza’s Reliance on aurologic Connectivity

yohanmanuja05 mins

aurologic GmbH (AS30823) operates a multi-terabit backbone out of Langen and connects multiple high-risk hosting providers including sanction-linked entities—giving malware C2 and staging servers durable reach. This analysis explains why upstream neutrality often translates into enablement, how TAEs cluster under aurologic, and what blue teams can do: upstream-aware detections, deny-by-default on risky cones, flowspec/RTBH during incidents, and procurement levers that force faster de-peering.

Read More
Legacy CVEs and misconfigured IIS enable stealth access via msbuild and DCSync

China-Aligned Abuse msbuild, DCSync After Legacy CVE Break-ins

yohanmanuja05 mins

A China-linked crew still breaks in through legacy CVEs Log4j, Struts, Confluence, GoAhead then hides behind scheduled tasks and msbuild.exe to run memory-resident payloads. They probe domain controllers with DCSync, and they target misconfigured IIS by abusing ASP.NET machine keys to deploy TOLLBOOTH with SEO cloaking. Reduce risk by patching edge services, restricting LOLBAS on servers, rotating machine keys, and alerting on replication from non-DC hosts.

Read More
Claude Desktop extension dialog on macOS with a security prompt, highlighting sanitized AppleScript parameters and blocked shell operators

Claude Desktop Extensions Vulnerable to Command Injection

yohanmanuja05 mins

Researchers documented CVSS 8.9 command injection in three official Claude Desktop extensions Chrome, iMessage, and Apple Notes. Because those connectors built AppleScript commands with unescaped user input, prompt injection could pivot from web content to local shell execution on macOS. Anthropic patched the issues. This analysis explains the exploit chain, the fixes, and the validation steps security teams should run to keep MCP servers safe.

Read More
Signed MSI delivers EndClient RAT while AutoIt loader runs in memory

EndClient RAT Targets NGOs via Signed MSI Installer

yohanmanuja14 mins

EndClient RAT arrives as a signed MSI named “StressClear.msi,” which abuses code-signing trust and SmartScreen gaps. The package decoys with a VeraPort component while an obfuscated AutoIt loader executes in memory, establishes the IoKlTr task, and opens a JSON-over-TCP C2. To reduce risk, restrict MSI installs, enforce SmartScreen blocking, instrument MSI→AutoIt lineage, and remove scheduled tasks used for persistence.

Read More