The Breach News

Public Exploit Combines Two Critical SAP Vulnerabilities, Leaving Unpatched Systems Open to Remote Code Execution

Date: Aug 19, 2025
Category: Vulnerability / Cyber Espionage

A new exploit has emerged that leverages two critical, now-patched vulnerabilities in SAP NetWeaver, putting organizations at significant risk of system compromise and data theft. This exploit chains CVE-2025-31324 and CVE-2025-42999 to bypass authentication and enable remote code execution, according to SAP security firm Onapsis.

  • CVE-2025-31324 (CVSS score: 10.0) – Lacks authorization checks in SAP NetWeaver’s Visual Composer development server
  • CVE-2025-42999 (CVSS score: 9.1) – Vulnerability due to insecure deserialization in the same server

These vulnerabilities were patched by SAP in April and May 2025, but not before they were exploited as zero-days by threat actors as early as March. Multiple ransomware and data extortion groups, including Qilin, BianLian, and RansomExx, have been seen exploiting these flaws, along with several espionage groups linked to China targeting critical infrastructures.

Public Exploit for Chained SAP Vulnerabilities Poses Risk of Remote Code Execution August 19, 2025 A concerning new exploit has come to light that leverages two critical security vulnerabilities in SAP NetWeaver, introducing significant risks for organizations that have yet to apply patches. This exploit combines CVE-2025-31324 and CVE-2025-42999, enabling…

Read More

Public Exploit Combines Two Critical SAP Vulnerabilities, Leaving Unpatched Systems Open to Remote Code Execution

Date: Aug 19, 2025
Category: Vulnerability / Cyber Espionage

A new exploit has emerged that leverages two critical, now-patched vulnerabilities in SAP NetWeaver, putting organizations at significant risk of system compromise and data theft. This exploit chains CVE-2025-31324 and CVE-2025-42999 to bypass authentication and enable remote code execution, according to SAP security firm Onapsis.

  • CVE-2025-31324 (CVSS score: 10.0) – Lacks authorization checks in SAP NetWeaver’s Visual Composer development server
  • CVE-2025-42999 (CVSS score: 9.1) – Vulnerability due to insecure deserialization in the same server

These vulnerabilities were patched by SAP in April and May 2025, but not before they were exploited as zero-days by threat actors as early as March. Multiple ransomware and data extortion groups, including Qilin, BianLian, and RansomExx, have been seen exploiting these flaws, along with several espionage groups linked to China targeting critical infrastructures.

Released ProxyLogon Exploit PoC: A Potential Catalyst for Increased Cyber Attacks

March 11, 2021

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory on Wednesday, highlighting ongoing exploitation of vulnerabilities in Microsoft Exchange on-premises products by both nation-state actors and cybercriminals. “CISA and FBI assess that adversaries could exploit these vulnerabilities to compromise networks, steal sensitive information, encrypt data for ransom, or conduct destructive attacks,” the agencies stated. They also noted that compromised networks might be sold on the dark web. Recent attacks have mainly targeted local governments, academic institutions, NGOs, and businesses across various sectors such as agriculture, biotechnology, aerospace, defense, legal services, power utilities, and pharmaceuticals—consistent with previous activities linked to Chinese cyber threats. Tens of thousands of entities, including the Eur…

ProxyLogon Exploit Now Public, Heightening Cyber Threats Date: March 11, 2021 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have issued an urgent advisory concerning the exploitation of serious vulnerabilities within Microsoft Exchange on-premises products. This advisory comes in the wake of confirmed…

Read More

Released ProxyLogon Exploit PoC: A Potential Catalyst for Increased Cyber Attacks

March 11, 2021

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory on Wednesday, highlighting ongoing exploitation of vulnerabilities in Microsoft Exchange on-premises products by both nation-state actors and cybercriminals. “CISA and FBI assess that adversaries could exploit these vulnerabilities to compromise networks, steal sensitive information, encrypt data for ransom, or conduct destructive attacks,” the agencies stated. They also noted that compromised networks might be sold on the dark web. Recent attacks have mainly targeted local governments, academic institutions, NGOs, and businesses across various sectors such as agriculture, biotechnology, aerospace, defense, legal services, power utilities, and pharmaceuticals—consistent with previous activities linked to Chinese cyber threats. Tens of thousands of entities, including the Eur…

Bank of America Website Targeted in Cyber Attack by Islamic Hackers

Sept 19, 2012

The Bank of America’s website faced intermittent outages on Tuesday due to cyber attacks claimed to be in retaliation for “Innocence of Muslims,” a controversial film that has sparked violent protests across the Middle East. The group “Cyber Fighters of Izz ad-Din Al Qassam” announced its intent to target the Bank of America and the New York Stock Exchange as part of a broader campaign against what they term “American-Zionist Capitalists.” Following recent successful attacks on YouTube servers by various Muslim groups, there has been a surge in threats of similar actions. The hackers stated, “As long as the supporters of the sacrilegious film attempt to penalize its cast and crew, this conflict will continue, and the cyber realm will remain treacherous for all enemies of Islam.” Reports of the attacks have emerged from across the nation.

Bank of America Website Faces Cyber Attacks Amid Rising Tensions September 19, 2012 On Tuesday, the website of Bank of America experienced significant disruptions due to targeted cyber attacks, which have been linked to escalating geopolitical tensions. These attacks stem from a response to “Innocence of Muslims,” a controversial film…

Read More

Bank of America Website Targeted in Cyber Attack by Islamic Hackers

Sept 19, 2012

The Bank of America’s website faced intermittent outages on Tuesday due to cyber attacks claimed to be in retaliation for “Innocence of Muslims,” a controversial film that has sparked violent protests across the Middle East. The group “Cyber Fighters of Izz ad-Din Al Qassam” announced its intent to target the Bank of America and the New York Stock Exchange as part of a broader campaign against what they term “American-Zionist Capitalists.” Following recent successful attacks on YouTube servers by various Muslim groups, there has been a surge in threats of similar actions. The hackers stated, “As long as the supporters of the sacrilegious film attempt to penalize its cast and crew, this conflict will continue, and the cyber realm will remain treacherous for all enemies of Islam.” Reports of the attacks have emerged from across the nation.

New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Techniques

August 19, 2025
Malware / Cyber Attack

Financial institutions, particularly trading and brokerage firms, are currently facing a new threat from a remote access trojan known as GodRAT. According to Kaspersky researcher Saurabh Sharma, this malware is spread through malicious .SCR (screen saver) files disguised as financial documents sent via Skype Messenger. Active as recently as August 12, 2025, the attacks utilize steganography to hide shellcode within image files, enabling the download of the malware from a command-and-control (C2) server. Since September 9, 2024, these screen saver artifacts have targeted regions including Hong Kong, the United Arab Emirates, Lebanon, Malaysia, and Jordan. Based on Gh0st RAT, GodRAT employs a plugin-based architecture to enhance its capabilities for gathering sensitive information and delivering additional payloads like AsyncRAT.

Emerging GodRAT Trojan Targets Trading Firms with Steganographic Techniques On August 19, 2025, cybersecurity firm Kaspersky disclosed a significant new threat affecting trading and brokerage firms: a remote access Trojan (RAT) dubbed GodRAT. This new malware leverages a technique known as steganography to conceal its malicious code within image files,…

Read More

New GodRAT Trojan Targets Trading Firms Using Steganography and Gh0st RAT Techniques

August 19, 2025
Malware / Cyber Attack

Financial institutions, particularly trading and brokerage firms, are currently facing a new threat from a remote access trojan known as GodRAT. According to Kaspersky researcher Saurabh Sharma, this malware is spread through malicious .SCR (screen saver) files disguised as financial documents sent via Skype Messenger. Active as recently as August 12, 2025, the attacks utilize steganography to hide shellcode within image files, enabling the download of the malware from a command-and-control (C2) server. Since September 9, 2024, these screen saver artifacts have targeted regions including Hong Kong, the United Arab Emirates, Lebanon, Malaysia, and Jordan. Based on Gh0st RAT, GodRAT employs a plugin-based architecture to enhance its capabilities for gathering sensitive information and delivering additional payloads like AsyncRAT.

Vulnerabilities in Two Major WordPress Plugins Impact Over 7 Million Sites

On March 18, 2021, researchers revealed security flaws in several WordPress plugins, which, if exploited, could enable attackers to execute arbitrary code and potentially take control of affected websites. The vulnerabilities were found in Elementor, a widely-used website builder plugin installed on more than seven million sites, and WP Super Cache, a popular tool for serving cached pages on WordPress. According to Wordfence, which identified the weaknesses in Elementor, the issue involves a series of stored cross-site scripting (XSS) vulnerabilities (CVSS score: 6.4). This occurs when malicious scripts are injected directly into a vulnerable web application. Specifically, the lack of server-side validation for HTML tags allows an attacker to inject executable JavaScript into posts or pages through crafted requests. “Since posts created by contributors are usually reviewed by editors or administrators before publication, any JavaScript added to one of the…

Vulnerabilities in Two Major WordPress Plugins Expose Over 7 Million Sites Researchers have revealed critical vulnerabilities in several WordPress plugins that pose high security risks, potentially enabling attackers to execute arbitrary code and seize control of affected websites. The identified flaws are present in Elementor, a widely used website builder…

Read More

Vulnerabilities in Two Major WordPress Plugins Impact Over 7 Million Sites

On March 18, 2021, researchers revealed security flaws in several WordPress plugins, which, if exploited, could enable attackers to execute arbitrary code and potentially take control of affected websites. The vulnerabilities were found in Elementor, a widely-used website builder plugin installed on more than seven million sites, and WP Super Cache, a popular tool for serving cached pages on WordPress. According to Wordfence, which identified the weaknesses in Elementor, the issue involves a series of stored cross-site scripting (XSS) vulnerabilities (CVSS score: 6.4). This occurs when malicious scripts are injected directly into a vulnerable web application. Specifically, the lack of server-side validation for HTML tags allows an attacker to inject executable JavaScript into posts or pages through crafted requests. “Since posts created by contributors are usually reviewed by editors or administrators before publication, any JavaScript added to one of the…

Bharatiya Janata Party Website Hacked and Defaced by Anonymous Collective

September 19, 2012

The official website of the Bharatiya Janata Party (BJP.org) was hacked and defaced last night by members of the Anonymous Indian group. The hackers posted a series of messages and images expressing their disapproval of various government actions, including the approval of 51% FDI in multi-brand retail, the increase in diesel prices, corruption scandals, the cartoon controversy, and the Kudankulam Power Project.

They also called for public participation in the #OccupyIndiaground protest, scheduled for September 23, 2012 (this Sunday) at several key locations across India, including India Gate in Delhi, Freedom Park in Bangalore, Marine Beach in Chennai, Park Street Crossing in Kolkata, MG Road in Pune, and Subhash Park in Kochi.

The affected domains include:

Additionally, the group shared a YouTube video featuring a message from Anonymous, highlighting their concerns regarding the declining state of free speech in India and the government’s measures to restrict social media.

Bharatiya Janata Party Website Compromised by Anonymous Hackers On the evening of September 19, 2012, the official website of the Bharatiya Janata Party, BJP.org, fell victim to a cyberattack attributed to a group associated with Anonymous. This incident involved a significant defacement of the site, during which hackers displayed a…

Read More

Bharatiya Janata Party Website Hacked and Defaced by Anonymous Collective

September 19, 2012

The official website of the Bharatiya Janata Party (BJP.org) was hacked and defaced last night by members of the Anonymous Indian group. The hackers posted a series of messages and images expressing their disapproval of various government actions, including the approval of 51% FDI in multi-brand retail, the increase in diesel prices, corruption scandals, the cartoon controversy, and the Kudankulam Power Project.

They also called for public participation in the #OccupyIndiaground protest, scheduled for September 23, 2012 (this Sunday) at several key locations across India, including India Gate in Delhi, Freedom Park in Bangalore, Marine Beach in Chennai, Park Street Crossing in Kolkata, MG Road in Pune, and Subhash Park in Kochi.

The affected domains include:

Additionally, the group shared a YouTube video featuring a message from Anonymous, highlighting their concerns regarding the declining state of free speech in India and the government’s measures to restrict social media.

Exploitation of Apache ActiveMQ Vulnerability Leads to DripDropper Malware Deployment on Cloud Linux Systems

August 19, 2025
Linux / Malware

Threat actors are leveraging a nearly two-year-old security vulnerability in Apache ActiveMQ to gain persistent access to cloud-based Linux systems and install the DripDropper malware. In an unexpected turn, these unidentified attackers have been seen patching the exploited vulnerability after gaining access, likely to prevent further exploitation by others and to evade detection, according to a report from Red Canary shared with The Hacker News. “Follow-on command-and-control (C2) tools varied by endpoint and included Sliver and Cloudflare Tunnels, allowing for covert long-term control,” researchers Christina Johns, Chris Brook, and Tyler Edmonds noted.

The attacks exploit a critical security flaw in Apache ActiveMQ (CVE-2023-46604, CVSS score: 10.0), a remote code execution vulnerability that enables the execution of arbitrary shell commands. This issue was addressed in late October 2023 but has since faced significant exploitation.

Exploitation of Apache ActiveMQ Vulnerability Leads to DripDropper Malware Deployment on Cloud Linux Systems August 19, 2025 In a troubling development for cybersecurity, threat actors are leveraging a significant vulnerability in Apache ActiveMQ, which has been known for nearly two years, to compromise cloud-based Linux systems. Their primary aim is…

Read More

Exploitation of Apache ActiveMQ Vulnerability Leads to DripDropper Malware Deployment on Cloud Linux Systems

August 19, 2025
Linux / Malware

Threat actors are leveraging a nearly two-year-old security vulnerability in Apache ActiveMQ to gain persistent access to cloud-based Linux systems and install the DripDropper malware. In an unexpected turn, these unidentified attackers have been seen patching the exploited vulnerability after gaining access, likely to prevent further exploitation by others and to evade detection, according to a report from Red Canary shared with The Hacker News. “Follow-on command-and-control (C2) tools varied by endpoint and included Sliver and Cloudflare Tunnels, allowing for covert long-term control,” researchers Christina Johns, Chris Brook, and Tyler Edmonds noted.

The attacks exploit a critical security flaw in Apache ActiveMQ (CVE-2023-46604, CVSS score: 10.0), a remote code execution vulnerability that enables the execution of arbitrary shell commands. This issue was addressed in late October 2023 but has since faced significant exploitation.

Urgent: High-Severity RCE Vulnerability Discovered in Apache OFBiz ERP Software – Immediate Patch Required

On March 22, 2021, the Apache Software Foundation disclosed a critical vulnerability in Apache OFBiz that poses a significant risk. Tracked as CVE-2021-26295, this flaw allows unauthenticated attackers to potentially take remote control of the open-source enterprise resource planning (ERP) system. It impacts all versions prior to 17.12.06 and involves an “unsafe deserialization” vulnerability that enables remote code execution on susceptible servers.

Apache OFBiz is a Java-based web framework designed for automating various enterprise processes, including accounting, customer relationship management, manufacturing, order management, supply chain fulfillment, and warehouse management. By exploiting this vulnerability, an attacker can manipulate serialized data to introduce arbitrary code. Once deserialized, this code can lead to unauthorized remote execution. It is crucial for users to implement the necessary patches immediately.

Critical Remote Code Execution Vulnerability Discovered in Apache OFBiz ERP Software—Immediate Patch Recommended On March 22, 2021, the Apache Software Foundation reported a critical vulnerability in the Apache OFBiz enterprise resource planning (ERP) system that poses significant risks to users. Identified as CVE-2021-26295, this high-severity flaw could potentially enable an…

Read More

Urgent: High-Severity RCE Vulnerability Discovered in Apache OFBiz ERP Software – Immediate Patch Required

On March 22, 2021, the Apache Software Foundation disclosed a critical vulnerability in Apache OFBiz that poses a significant risk. Tracked as CVE-2021-26295, this flaw allows unauthenticated attackers to potentially take remote control of the open-source enterprise resource planning (ERP) system. It impacts all versions prior to 17.12.06 and involves an “unsafe deserialization” vulnerability that enables remote code execution on susceptible servers.

Apache OFBiz is a Java-based web framework designed for automating various enterprise processes, including accounting, customer relationship management, manufacturing, order management, supply chain fulfillment, and warehouse management. By exploiting this vulnerability, an attacker can manipulate serialized data to introduce arbitrary code. Once deserialized, this code can lead to unauthorized remote execution. It is crucial for users to implement the necessary patches immediately.

9 Million PCs Compromised by ZeroAccess Botnet

In recent months, the Win32/Sirefef and Win64/Sirefef rootkit family, also known as the ZeroAccess Botnet, has significantly expanded its reach, infecting millions of computers worldwide. This botnet has updated its command and control protocols and now connects to over one million systems globally. Previously, it was noted for creating hidden partitions on hard drives and utilizing alternative data streams to conceal its presence. However, recent changes by its developers have shifted its infection tactics, moving away from kernel-mode components in the latest version. Security firms have been actively monitoring the increase in x64 version infections. SophosLabs has recently uncovered a significant change in the ZeroAccess botnet’s strategy, which now operates entirely in user-mode memory. Two distinct ZeroAccess botnets exist, each featuring both 32-bit and 64-bit versions, resulting in a total of four unique botnets. Each one operates independently, communicating through a specific hard-coded port number embedded in the bot executable.

Surge in ZeroAccess Botnet Infections: 9 Million PCs Compromised On September 19, 2012, alarming reports surfaced concerning the ZeroAccess botnet, a sophisticated rootkit family identified as Win32/Sirefef and Win64 This malware has undergone significant evolution, effectively updating its command and control protocols to infiltrate an estimated 9 million computers worldwide.…

Read More

9 Million PCs Compromised by ZeroAccess Botnet

In recent months, the Win32/Sirefef and Win64/Sirefef rootkit family, also known as the ZeroAccess Botnet, has significantly expanded its reach, infecting millions of computers worldwide. This botnet has updated its command and control protocols and now connects to over one million systems globally. Previously, it was noted for creating hidden partitions on hard drives and utilizing alternative data streams to conceal its presence. However, recent changes by its developers have shifted its infection tactics, moving away from kernel-mode components in the latest version. Security firms have been actively monitoring the increase in x64 version infections. SophosLabs has recently uncovered a significant change in the ZeroAccess botnet’s strategy, which now operates entirely in user-mode memory. Two distinct ZeroAccess botnets exist, each featuring both 32-bit and 64-bit versions, resulting in a total of four unique botnets. Each one operates independently, communicating through a specific hard-coded port number embedded in the bot executable.