The Threat Signal created by the FortiGuard Labs is intended to provide you with insight on emerging issues that are trending within the cyber threat landscape. The Threat Signal will provide concise technical details about the issue, mitigation recommendations and a perspective from the FortiGuard Labs team in an FAQ style format.
|
What is the Vulnerability? |
React2Shell is a critical unauthenticated RCE vulnerability impacting React Server Components (RSC) and frameworks that implement the Flight protocol, including affected versions of Next.js. A remote attacker can send a specially crafted RSC request that triggers server-side deserialization and arbitrary code execution with no user interaction required.
CISA has added CVE-2025-55182 to the Known Exploited Vulnerabilities (KEV) catalog following evidence of active exploitation on 5 December 2025. AWS Security has identified exploitation activity originating from IP addresses and infrastructure historically associated with known China state-nexus threat actors. China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) | AWS Security Blog
|
|
What is the recommended Mitigation? |
|
|
What FortiGuard Coverage is available? |
|
|
What is the Vulnerability? |
CVE-2025-61757 is a critical pre-authentication remote code execution vulnerability in Oracle Identity Manager’s REST WebServices. This vulnerability allows an unauthenticated attacker to exploit URI and matrix parameter parsing weaknesses to bypass authentication and execute arbitrary code over HTTP.
|
|
What is the recommended Mitigation? |
|
|
What FortiGuard Coverage is available? |
|
|
What is the Attack? |
A suspected Iran-linked espionage group tracked as UNC1549 is actively targeting aerospace, defense, and telecommunications organizations across Europe and other regions. The threat actor employs a combination of highly tailored spear-phishing, credential theft from third-party services, and abuse of virtual desktop infrastructure such as Citrix, VMware, and Azure VDI to gain initial access and move laterally within target networks.
UNC1549 employs a range of custom malware families and stealth techniques to maintain persistent and covert access. MINIBIKE is a modular backdoor used to steal credentials, log keystrokes, capture screenshots, and deploy additional payloads. TWOSTROKE enables remote access, system control, and persistence, while DEEPROOT extends similar functionality to Linux environments. For stealthy command-and-control, the group leverages LIGHTRAIL and GHOSTLINE, tunneling tools that disguise malicious communications within legitimate cloud traffic to facilitate covert data exfiltration and resilient connectivity. |
|
What is the recommended Mitigation? |
|
|
What FortiGuard Coverage is available? |
|
|
What is the Attack? |
On November 24, 2025, Shai Hulud launches a second supply-chain attack, compromising Zapier, ENS, AsyncAPI, PostHog, and Postman, along with over 25,000 affected repositories across ~350 unique users.
On September 8, 2025, attackers phished the npm maintainer “qix” and stole their two-factor authentication (2FA) credentials. With that access, they published malicious versions of some very popular npm packages (including debug, chalk, and ansi-styles).
|
|
What is the recommended Mitigation? |
|
|
What FortiGuard Coverage is available? |
|
|
What is the Attack? |
Cisco has disclosed a state-sponsored espionage campaign targeting Cisco Adaptive Security Appliances (ASA) , which are widely deployed for firewall, VPN, and security functions.
This campaign highlights a sustained effort by sophisticated adversaries to weaponize zero-day flaws in widely deployed Cisco security appliances, with the goal of espionage and long-term persistence.
|
|
What is the recommended Mitigation? |
|
|
What FortiGuard Coverage is available? |
|
|
What is the EDR‑Freeze? |
EDR‑Freeze is a proof‑of‑concept technique that leverages legitimate Windows Error Reporting (WER) components to suspend (place into a ‘frozen’ state) endpoint protection processes from user mode. Instead of exploiting drivers or kernel vulnerabilities, EDR‑Freeze abuses trusted OS services and relies on race conditions and process interaction to temporarily pause security products.
|
|
What is the recommended Mitigation? |
|
|
What FortiGuard Coverage is available? |
|
Today, the United States Cybersecurity and Infrastructure Security Agency (CISA), in conjunction with the Department of the Treasury (TREASURY), the Federal Bureau of Investigation (FBI), and U.S. Cyber Command (USCYBERCOM) released a joint Technical Alert that have attributed malicious cyber activity to the North Korean government.
The Technical Alert provides detailed analysis of North Korean government activity in an automated teller machine (ATM) cash-out scheme-referred to by the U.S. Government as "FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks." "BeagleBoyz" is a newly identified group that is a subset of activity by the threat actors known as HIDDEN COBRA/LAZARUS/APT 38. In addition to the release of the joint Technical Alert, three Malware Analysis Reports (MAR) were released as well and they are:
MAR-10301706.-1.v1 - 4 samples (ECCENTRICBANDWAGON)
MAR-10301706.-2..v1 - 6 samples (VIVACIOUSGIFT)
MAR-10257062.-1.v2 - 3 samples (FASTCASH)
Why is Hidden Cobra Significant? Also, is this Hidden Cobra Renamed?
HIDDEN COBRA has been linked to multiple high-profile, financially-motivated attacks in various parts of the world - some of which have caused massive infrastructure disruptions. Notable attacks include the 2014 attack on a major entertainment company and a 2016 Bangladeshi financial institution heist that almost netted nearly $1 Billion (USD) for the attackers. Had it not been for a misspelling in an instruction that caused a bank to flag and block thirty transactions, HIDDEN COBRA would have pulled off a heist unlike any other. Although HIDDEN COBRA failed in their attempt, they were still able to net around 81 million dollars in total.
The most recent and most notable attack attributed to HIDDEN COBRA was the Wannacry Ransomware attack, which resulted in massive disruption and damage worldwide to numerous organizations, especially manufacturers. Various estimates of the impact were in the hundreds of millions of dollars, with some estimates claiming billions. Other verticals which this group has targeted include critical infrastructures, entertainment, finance, healthcare, and telecommunication sectors across multiple countries.
According to the Technical Alert, the BeagleBoyz are now attributed by the United States government as being behind the $81 million heist from the financial institution in Bangladesh; whereas past reports linked it to HIDDEN COBRA/LAZARUS activity.
What is the Severity of Impact?
The severity should be regarded as MEDIUM, due to the fact that these campaigns have been observed in limited to targeted attacks.
It Appears that Some Malware Variants have Been Reported Before. Is this Correct?
Yes. Some of the malware variants in this report, such as CROWDEDFLOUNDER, HOPLIGHT, and ELECTRICFISH were previously reported back in February of this year, as well as in 2019.
What is the status of AV/IPS and Web Filtering coverage?
FortiGuard Labs deployed coverage to ensure protections were in place immediately after the announcement by the United States Cybersecurity and Infrastructure Security Agency (CISA). CISA in coordination with the Cyber Threat Alliance (CTA), shared the samples ahead of the announcement with CTA partners to ensure that customers of CTA members were immediately protected.
Customers running the latest definition sets are protected by the following (AV) signatures:
W32/Alreay.BG!tr
W32/KeyLogger.BHFC!tr
W32/Banker.ADRO!tr.spy
W32/Alreay.A!tr
W32/Agent.0D36!tr
W64/Agent.AP!tr
W32/Generic!tr
W64/Banker.AX!tr.spy
W32/Banker.ADRO!tr.bdr
W64/Agent.AP!tr
W32/Alreay.BB!tr
Customers running the latest definition sets are protected by the following (IPS) signatures:
ElectricFish.Tunneling.Tool
|
What is the Vulnerability? |
High-severity vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) were disclosed in early November 2025. A malicious or compromised container image can abuse how runc handles masked paths, bind-mounts, and special files to write to the host /proc filesystem and escape the container boundary - enabling remote code execution on the host, persistence, or cluster-wide denial-of-service. These issues affect virtually all Linux container stacks that use runc (Docker, containerd, CRI-O, Kubernetes, and managed services)
|
|
What is the recommended Mitigation? |
Patch runc/update node images: Apply vendor runc updates. AWS lists patched runc (package version runc-1.3.2-2 for Amazon Linux variants) and updated AMIs/Bottlerocket releases; AWS also automated Fargate/ECS updates where applicable. If using other distros, install the distribution-provided patched runc packages per vendor guidance.
|
|
What FortiGuard Coverage is available? |
|
|
What is the Vulnerability? |
A critical Out-of-Bounds Write vulnerability (CVE-2025-9242) exists in the WatchGuard Fireware OS iked process, which handles IKEv2 VPN connections. The flaw allows a remote, unauthenticated attacker to execute arbitrary code on affected devices.
|
|
What is the recommended Mitigation? |
|
|
What FortiGuard Coverage is available? |
|
|
What is the Vulnerability? |
CVE-2025-59287 is a critical unauthenticated remote code execution (RCE) vulnerability affecting Windows Server Update Services (WSUS). The flaw stems from unsafe deserialization of untrusted data, allowing attackers to execute arbitrary code on vulnerable servers without authentication. A public proof-of-concept exploit has been released, and CISA has added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing active exploitation in the wild. Organizations should prioritize immediate patching or isolation of any internet-facing or exposed WSUS servers to prevent compromise. |
|
What is the recommended Mitigation? |
The vulnerability impacts Windows Server installations with the WSUS role enabled, including Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025.
|
|
What FortiGuard Coverage is available? |
|