The Breach News
Ivanti Addresses EPMM Vulnerabilities Leading to Remote Code Execution in Select Attacks
May 14, 2025
Vulnerability / Endpoint Security
Ivanti has issued security updates to remedy two vulnerabilities in its Endpoint Manager Mobile (EPMM) software, which have been exploited in limited attacks for remote code execution. The vulnerabilities include:
- CVE-2025-4427 (CVSS score: 5.3) – An authentication bypass that enables attackers to access protected resources without valid credentials.
- CVE-2025-4428 (CVSS score: 7.2) – A remote code execution vulnerability allowing arbitrary code execution on affected systems.
Exploiting these vulnerabilities could allow an attacker to chain them together to execute arbitrary code on a compromised device without authentication. The affected versions of the product are:
- 11.12.0.4 and earlier (fixed in 11.12.0.5)
- 12.3.0.1 and earlier (fixed in 12.3.0.2)
- 12.4.0.1 and earlier (fixed in 12.4.0.2)
- 12.5.0.0 and earlier (fixed in 12.5.0.1)
Ivanti has credited CERT-EU for reporting these vulnerabilities.
Vulnerability / Endpoint Security
Ivanti Issues Patches for Vulnerabilities in EPMM Software Exploited in Limited Attacks On May 14, 2025, Ivanti announced critical security updates addressing two vulnerabilities in its Endpoint Manager Mobile (EPMM) software. These flaws have been utilized in limited attacks to facilitate remote code execution, raising significant concerns for businesses relying…
Ivanti Addresses EPMM Vulnerabilities Leading to Remote Code Execution in Select Attacks
May 14, 2025
Vulnerability / Endpoint Security
Ivanti has issued security updates to remedy two vulnerabilities in its Endpoint Manager Mobile (EPMM) software, which have been exploited in limited attacks for remote code execution. The vulnerabilities include:
- CVE-2025-4427 (CVSS score: 5.3) – An authentication bypass that enables attackers to access protected resources without valid credentials.
- CVE-2025-4428 (CVSS score: 7.2) – A remote code execution vulnerability allowing arbitrary code execution on affected systems.
Exploiting these vulnerabilities could allow an attacker to chain them together to execute arbitrary code on a compromised device without authentication. The affected versions of the product are:
- 11.12.0.4 and earlier (fixed in 11.12.0.5)
- 12.3.0.1 and earlier (fixed in 12.3.0.2)
- 12.4.0.1 and earlier (fixed in 12.4.0.2)
- 12.5.0.0 and earlier (fixed in 12.5.0.1)
Ivanti has credited CERT-EU for reporting these vulnerabilities.
Финал “Воскрешения” утек в сеть с русским дубляжем
Unauthorized Release of Dexter: Resurrection Episodes Sparks Concerns Over Distribution Security In a startling revelation for fans, the highly anticipated finale of Dexter: Resurrection has leaked online, with episodes 9 and 10 emerging in a Russian-dubbed format nearly a week prior to their scheduled release. This incident echoes similar events…
Google Alerts: Mass Data Theft Targeting Salesloft’s AI Agent Expands Significantly
Google Issues Security Alerts Following Breach of Salesloft Drift AI Chat Agent In a critical advisory, Google has alerted users of the Salesloft Drift AI chat platform to regard all security tokens associated with the service as compromised. This warning follows the detection of unauthorized access to Google Workspace accounts,…
New Malware Threat: SpyNote, BadBazaar, and MOONSHINE Target Android and iOS Users Through Fake Apps
April 11, 2025
Spyware / Mobile Security
Cybersecurity experts have uncovered a dangerous trend where threat actors are using deceptive websites on newly registered domains to spread SpyNote, a notorious Android malware. These fraudulent sites mimic Google Play Store installation pages for popular apps like the Chrome browser, aiming to trick users into downloading the malware. According to the DomainTools Investigations (DTI) team, the attackers employed a combination of English and Chinese-language delivery sites and even included Chinese-language comments in the site code and the malware itself.
SpyNote (also known as SpyMax) is a remote access trojan infamous for its capability to collect sensitive information from compromised Android devices by exploiting accessibility services. In May 2024, the malware was distributed via another fake site that posed as a legitimate antivirus program, Avast. Further analysis from mobile security firm Zimperium revealed additional tactics employed by these cybercriminals…
Spyware / Mobile Security
SpyNote, BadBazaar, and MOONSHINE Malware Exploit Fake Apps to Target Android and iOS Users April 11, 2025 Focus on Spyware / Mobile Security Recent investigations by cybersecurity experts have unveiled a concerning trend: threat actors are leveraging newly registered domains to create deceptive websites that distribute a dangerous Android malware…
New Malware Threat: SpyNote, BadBazaar, and MOONSHINE Target Android and iOS Users Through Fake Apps
April 11, 2025
Spyware / Mobile Security
Cybersecurity experts have uncovered a dangerous trend where threat actors are using deceptive websites on newly registered domains to spread SpyNote, a notorious Android malware. These fraudulent sites mimic Google Play Store installation pages for popular apps like the Chrome browser, aiming to trick users into downloading the malware. According to the DomainTools Investigations (DTI) team, the attackers employed a combination of English and Chinese-language delivery sites and even included Chinese-language comments in the site code and the malware itself.
SpyNote (also known as SpyMax) is a remote access trojan infamous for its capability to collect sensitive information from compromised Android devices by exploiting accessibility services. In May 2024, the malware was distributed via another fake site that posed as a legitimate antivirus program, Avast. Further analysis from mobile security firm Zimperium revealed additional tactics employed by these cybercriminals…
Google Alerts Users of Potential Vulnerability for Billions of Gmail Accounts Following Data Breach
Google Issues Alert on ShinyHunters Attack Campaign Targeting Gmail Users Google has recently issued a significant security warning regarding the ShinyHunters hacking group, which has utilized Gmail to conduct attacks on users. This alert highlights the potential vulnerabilities affecting millions, as the group has gained access to sensitive data during…
Fortinet Addresses CVE-2025-32756: Critical Zero-Day RCE Vulnerability in FortiVoice Systems
May 14, 2025
Vulnerability / Network Security
Fortinet has issued a fix for a severe security vulnerability exploited as a zero-day in attacks against FortiVoice enterprise phone systems. Identified as CVE-2025-32756, this flaw has a high CVSS score of 9.6 out of 10.0. According to the company’s advisory, “A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera may enable a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted HTTP requests.” Fortinet has confirmed that the flaw has been actively exploited in the wild within FortiVoice systems, although details regarding the scope of the attacks and the identities of the attackers remain undisclosed. Notably, the attacker engaged in network scans of devices, deleted system crash logs, and enabled FCGI debugging to capture credentials from the system and SSH login attempts. The vulnerability impacts the following products and versions: FortiCamera 1.1, 2.0 (Update to a secure release recommended).
Vulnerability / Network Security
Fortinet Addresses Critical Zero-Day RCE Vulnerability in FortiVoice Systems On May 14, 2025, cybersecurity provider Fortinet announced the resolution of a significant security vulnerability identified as CVE-2025-32756. This flaw, which carries a critical CVSS score of 9.6, has reportedly been exploited in live attacks against FortiVoice enterprise phone systems. The…
Fortinet Addresses CVE-2025-32756: Critical Zero-Day RCE Vulnerability in FortiVoice Systems
May 14, 2025
Vulnerability / Network Security
Fortinet has issued a fix for a severe security vulnerability exploited as a zero-day in attacks against FortiVoice enterprise phone systems. Identified as CVE-2025-32756, this flaw has a high CVSS score of 9.6 out of 10.0. According to the company’s advisory, “A stack-based overflow vulnerability [CWE-121] in FortiVoice, FortiMail, FortiNDR, FortiRecorder, and FortiCamera may enable a remote unauthenticated attacker to execute arbitrary code or commands via specially crafted HTTP requests.” Fortinet has confirmed that the flaw has been actively exploited in the wild within FortiVoice systems, although details regarding the scope of the attacks and the identities of the attackers remain undisclosed. Notably, the attacker engaged in network scans of devices, deleted system crash logs, and enabled FCGI debugging to capture credentials from the system and SSH login attempts. The vulnerability impacts the following products and versions: FortiCamera 1.1, 2.0 (Update to a secure release recommended).
Winter Vivern APT Exploits Zimbra Vulnerability to Target European Government Entities
Mar 31, 2023
Cyber Espionage / APT
The advanced persistent threat (APT) group known as Winter Vivern is currently focusing its cyber espionage efforts on officials in Europe and the U.S. According to a recent report by Proofpoint, this group, also referred to as TA473, has been exploiting an unpatched Zimbra vulnerability in publicly accessible webmail portals since at least February 2023. This vulnerability allows them to access the email accounts of government bodies across Europe.
Proofpoint has identified the group’s activities as closely aligned with the geopolitical objectives of Russia and Belarus. While Winter Vivern may not be the most sophisticated actor, its persistence is notable. Recently, the group has been linked to cyber attacks on state authorities in Ukraine and Poland, as well as government officials in India, Lithuania, Slovakia, and the Vatican. The ongoing wave of intrusions related to NATO involves exploitation of CVE…
Cyber Espionage / APT
Winter Vivern APT Exploits Zimbra Vulnerability to Target European Government Entities March 31, 2023 – A new report from Proofpoint reveals that the advanced persistent threat (APT) group known as Winter Vivern is actively engaged in a cyber espionage campaign directed at government officials across Europe and the United States.…
Winter Vivern APT Exploits Zimbra Vulnerability to Target European Government Entities
Mar 31, 2023
Cyber Espionage / APT
The advanced persistent threat (APT) group known as Winter Vivern is currently focusing its cyber espionage efforts on officials in Europe and the U.S. According to a recent report by Proofpoint, this group, also referred to as TA473, has been exploiting an unpatched Zimbra vulnerability in publicly accessible webmail portals since at least February 2023. This vulnerability allows them to access the email accounts of government bodies across Europe.
Proofpoint has identified the group’s activities as closely aligned with the geopolitical objectives of Russia and Belarus. While Winter Vivern may not be the most sophisticated actor, its persistence is notable. Recently, the group has been linked to cyber attacks on state authorities in Ukraine and Poland, as well as government officials in India, Lithuania, Slovakia, and the Vatican. The ongoing wave of intrusions related to NATO involves exploitation of CVE…
AI and the Evolving Landscape of Observability
Artificial Intelligence & Machine Learning, Cloud Security, Governance & Risk Management Leonard Bertelli from FPT Discusses the Shift from Reactive Monitoring to Proactive Insights Yamini Kalra • August 29, 2025 Leonard Bertelli, Senior Vice President, Enterprise and AI Solutions, FPT Americas Once regarded as a niche area of engineering, observability…
