New Flodrix Botnet Variant Takes Advantage of Langflow AI Server RCE Vulnerability for DDoS Attacks

Cybersecurity researchers have identified a new campaign that actively exploits a recently revealed critical security flaw in Langflow to deploy the Flodrix botnet malware. According to Trend Micro researchers Aliakbar Zahravi, Ahmed Mohamed Ibrahim, Sunil Bharti, and Shubham Singh in their technical report, attackers are leveraging this vulnerability to execute downloader scripts on compromised Langflow servers, which subsequently retrieve and install the Flodrix malware. This activity involves the exploitation of CVE-2025-3248 (CVSS score: 9.8), a missing authentication vulnerability affecting Langflow, a Python-based visual framework for creating AI applications. Successful exploitation allows unauthenticated attackers to execute arbitrary code through specially crafted HTTP requests. Langflow addressed this flaw with version 1.3.0, released in March 2025. Last month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) highlighted…

New Variant of Flodrix Botnet Leverages Langflow AI Server RCE Vulnerability for DDoS Operations

On June 17, 2025, cybersecurity professionals alerted the public to an ongoing campaign targeting vulnerabilities in Langflow, a Python-based platform for developing artificial intelligence applications. This campaign is primarily focused on delivering the Flodrix botnet malware, following the exploitation of a newly uncovered critical security flaw. Cybersecurity researchers from Trend Micro, including Aliakbar Zahravi, Ahmed Mohamed Ibrahim, Sunil Bharti, and Shubham Singh, detailed their findings in a technical report, outlining the mechanics of this emerging threat.

The threat actors are capitalizing on CVE-2025-3248, a critical authentication bypass vulnerability rated with a CVSS score of 9.8. This vulnerability allows attackers to execute downloader scripts on compromised Langflow servers, which subsequently retrieve and install the Flodrix malware. By exploiting this flaw, unauthorized individuals can execute arbitrary code by sending specially crafted HTTP requests to vulnerable instances of Langflow.

The Langflow development team issued a patch for this vulnerability in March 2025, releasing version 1.3.0 to mitigate the risks associated with the flaw. Despite this remedy, attackers are actively utilizing the vulnerability, raising significant concerns among cybersecurity professionals and businesses relying on the platform.

The potential ramifications of such exploitation are alarming, as the Flodrix botnet can be employed to orchestrate distributed denial-of-service (DDoS) attacks against targeted networks, leading to service disruptions and potential financial losses for affected organizations. The likelihood of subsequent attacks underscores the urgency for businesses to apply the latest security patches and monitor their systems for signs of compromise.

As the campaign unfolds, it is crucial to recognize the tactics and techniques potentially employed by the attackers, as mapped by the MITRE ATT&CK framework. Initial access is achieved through the exploitation of the vulnerability, with opportunities for privilege escalation likely presenting themselves once the malware is installed. Persistence mechanisms may also be implemented to ensure continued access to compromised systems.

The implications of such threats extend beyond immediate service disruptions. Businesses must remain vigilant, not only in ensuring that their systems are up-to-date with patches, but also in adopting comprehensive cybersecurity strategies that encompass monitoring, response planning, and employee education.

Ultimately, the exploitation of this vulnerability serves as a stark reminder of the dynamic nature of cybersecurity threats. It emphasizes the need for organizations to prioritize security posture and response capabilities in the face of increasingly sophisticated attack vectors. The proactive application of the MITRE ATT&CK framework may aid in understanding and mitigating similar threats in the future, equipping businesses with the knowledge necessary to defend against potential exploitation.

Source link

Related Posts

Apple Fixes Zero-Click Vulnerability in Messages App Used for Targeted Spyware Attacks on Journalists

June 13, 2025
Spyware / Vulnerability

Apple has revealed that a recently patched security flaw in its Messages app was actively exploited to carry out sophisticated cyber attacks on civil society members. Identified as CVE-2025-43200, the vulnerability was remedied on February 10, 2025, through updates to iOS 18.3.1, iPadOS 18.3.1, iPadOS 17.7.5, macOS Sequoia 15.3.1, macOS Sonoma 14.7.4, macOS Ventura 13.7.4, watchOS 11.3.1, and visionOS 2.3.1. According to the company, “A logic issue existed when processing a maliciously crafted photo or video shared via an iCloud Link,” which was resolved with improved security checks. Apple also acknowledged awareness that this vulnerability may have been exploited in “extremely sophisticated” attacks targeting specific individuals. Notably, the updates for iOS 18.3.1, iPadOS 18.3.1, and iPadOS 17.7.5 also fixed another actively exploited zero-day vulnerability, CVE-2025-24200.

Ransomware Groups Exploit Unpatched SimpleHelp Vulnerabilities for Double Extortion Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported on Thursday that ransomware criminals are taking advantage of unpatched SimpleHelp Remote Monitoring and Management (RMM) systems to compromise clients of an unnamed utility billing software provider. “This incident highlights a growing trend of ransomware groups exploiting unpatched versions of SimpleHelp RMM since January 2025,” the agency stated in an advisory. Earlier this year, SimpleHelp identified several vulnerabilities (CVE-2024-57727, CVE-2024-57728, and CVE-2024-57726) that could lead to information disclosure, privilege escalation, and remote code execution. These vulnerabilities have been actively exploited, including by ransomware groups like DragonForce, to breach specific targets. In a recent report, Sophos revealed that a Managed Service Provider’s SimpleHelp system was compromised by threat actors using these flaws.

Critical Vulnerability in TP-Link Routers (CVE-2023-33538) Under Active Exploitation, CISA Issues Urgent Warning

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently included a critical security flaw affecting TP-Link wireless routers in its Known Exploited Vulnerabilities (KEV) catalog, highlighting evidence of ongoing exploitation. The vulnerability, identified as CVE-2023-33538 (CVSS score: 8.8), involves a command injection issue that could allow arbitrary system command execution when handling the ssid1 parameter in a specially crafted HTTP GET request. Affected models include the TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2, which expose this flaw through the /userRpm/WlanNetworkRpm component. CISA has warned that some impacted devices may be at end-of-life (EoL) or end-of-service (EoS), advising users to stop using them if no mitigations are available. Currently, there is limited public information on the nature of the active exploitation, including attack scale and targeted entities.

Critical RCE Threat from Hard-Coded ‘b’ Password in Sitecore XP Exposes Enterprises

June 17, 2025
Vulnerability / Enterprise Software

Cybersecurity experts have identified three significant vulnerabilities in the widely-used Sitecore Experience Platform (XP) that could be exploited to achieve pre-authenticated remote code execution (RCE). Sitecore XP is an enterprise software solution that offers tools for content management, digital marketing, and analytics.

The vulnerabilities are as follows:

  • CVE-2025-34509 (CVSS score: 8.2) – Use of hard-coded credentials
  • CVE-2025-34510 (CVSS score: 8.8) – Post-authenticated RCE via path traversal
  • CVE-2025-34511 (CVSS score: 8.8) – Post-authenticated RCE via Sitecore PowerShell Extension

Researcher Piotr Bazydlo from watchTowr Labs pointed out that the default user account “sitecore\ServicesAPI” has a hard-coded single-character password set to “b.” Notably, Sitecore’s documentation advises against altering default credentials. Although the user account lacks roles and permissions, the vulnerabilities still pose a serious risk.