Threat Watch Feed
🚩 – IOCs Added
The red flag indicates that Indicators of Compromise (IOCs) have been added to SRA’s Threat Feed used by CyberSOC clients. Articles may not be flagged if IOCs are not available at the time or are not applicable to the article.
Active FortiGate SSO Abuse Observed After Fortinet Auth Bypass Flaws (CVE-2025-59718, CVE-2025-59719)
Arctic Wolf reports active intrusions involving malicious SSO logins against FortiGate appliances beginning December 12, 2025, shortly after Fortinet disclosed two critical authentication bypass vulnerabilities, CVE-2025-59718 and CVE-2025-59719. The flaws allow unauthenticated administrative access via crafted SAML messages when FortiCloud SSO is enabled. While FortiCloud SSO is disabled by default, it is automatically enabled during FortiCare registration through the GUI unless administrators explicitly opt out, creating widespread exposure across FortiOS, FortiProxy, FortiWeb, and FortiSwitchManager deployments. Observed activity shows successful SSO logins to the admin account from a small set of cloud hosting providers, followed by immediate configuration exports via the GUI. This behavior strongly suggests post-authentication reconnaissance and credential material collection, with stolen configuration files posing downstream risk for offline password cracking and follow-on compromise.
Impact: Successful exploitation grants attackers administrative access to firewall and VPN infrastructure without credentials. Exfiltrated configurations may expose hashed credentials, VPN secrets, network topology, and trust relationships, enabling lateral movement, persistent access, or future attacks against internal networks. Because the activity leverages legitimate SSO workflows, compromises may blend into normal administrative logs and evade immediate detection.
Recommendation: Organizations should upgrade all affected Fortinet products to vendor-fixed versions and disable FortiCloud SSO until patching is complete. Review system logs for admin logins with method=sso, especially from unfamiliar cloud-hosted IPs, and check for configuration downloads following those logins. If suspicious activity is identified, assume firewall credentials are compromised and reset all administrative and VPN credentials. Restrict management interface access to trusted internal networks only, enforce strong passwords and MFA where supported, and audit FortiCare registration settings to ensure FortiCloud SSO is explicitly disabled if not required.
🚩 AWS Links Years-Long Critical Infrastructure Intrusions to GRU-Associated Cluster Exploiting Misconfigured Edge Devices
Amazon Threat Intelligence reports a years-long Russian state-sponsored campaign targeting Western critical infrastructure, with a clear shift in 2025 toward abusing misconfigured customer network edge devices as the primary initial access vector while classic vulnerability exploitation declined. AWS assesses with high confidence the activity is associated with Russia’s GRU based on infrastructure overlap with known Sandworm patterns and consistent targeting, especially across the energy sector. The tradecraft focuses on gaining persistent access through exposed management interfaces on routers, VPN concentrators, and network management appliances, then harvesting credentials for later replay against victim organizations’ online services and cloud-hosted infrastructure. Across 2021 to 2025, AWS observed a progression from WatchGuard exploitation and misconfig targeting, to Confluence and Veeam exploitation, and finally sustained emphasis on misconfiguration-driven access in 2025. AWS telemetry also shows the actor targeting customer network appliances hosted on AWS (EC2-based appliance deployments) through persistent interactive connections. The observed pattern is compromise of edge devices, use of native packet capture capability, credential harvesting from intercepted traffic, and credential replay attempts against victim services, which enables lateral movement while reducing the operational risk and cost of exploit development.
Impact: This approach allows attackers to achieve the same outcomes as exploit-heavy campaigns, including long-term access, credential theft, and pivoting into business systems, while producing fewer obvious exploitation signals. For energy and critical infrastructure operators and their supply chain partners, compromised edge devices can become surveillance points for authentication traffic and a staging base for follow-on access to collaboration platforms, source repositories, and cloud services. Organizations may not detect compromise immediately because the initial foothold can look like routine administrative access to a device that was simply exposed to the internet.
Recommendation: Organizations should audit all edge devices for exposed management interfaces and signs of packet capture use, then isolate management planes behind private subnets, bastions, or VPN with MFA and strong credential hygiene. Monitor authentication logs for delayed credential replay attempts, especially reuse of corporate credentials following suspected device compromise, and flag unexpected interactive sessions to router and appliance portals from unfamiliar source IPs. Eliminate plaintext management protocols, enforce least-privilege device administration, and enable network flow logging and centralized telemetry to detect persistent connections to appliance instances. In AWS environments, apply tight security group rules, enable VPC Flow Logs, CloudTrail, and GuardDuty, and use Amazon Inspector to identify unintended exposure of appliance workloads.
🚩 Microsoft Reports Active React2Shell (CVE-2025-55182) Exploitation Driving Coin Miners, RATs, and Cloud Credential Theft
Microsoft Defender researchers report that exploitation of CVE-2025-55182 (React2Shell) was detected as early as December 5, 2025, impacting both Windows and Linux environments. The bug is a pre-authentication RCE (CVSS 10.0) in React Server Components where crafted POST requests can trigger unsafe deserialization and execute attacker code under the Node.js runtime. Microsoft observed real-world exploitation attempts and several hundred confirmed compromises across diverse organizations, with follow-on payloads including coin miners, SNOWLIGHT, VShell, EtherRAT, ShadowPad, and related tooling. Post-exploitation behavior included persistence through new user creation, RMM tools like MeshAgent, SSH authorized_keys changes, root login enablement, and defense evasion using Cloudflare Tunnel endpoints and bind mounts to hide artifacts. Microsoft also observed cloud credential targeting across Azure, AWS, GCP, and Tencent IMDS endpoints, plus secret discovery via TruffleHog and Gitleaks and attempts to harvest AI and cloud-native credentials such as OpenAI API keys and Kubernetes service account tokens.
Impact: Successful exploitation gives attackers immediate code execution on vulnerable React and Next.js servers with no authentication, enabling rapid deployment of miners or backdoors, credential theft, and lateral movement into cloud resources. Because many affected apps are deployed in containers and default configurations are vulnerable, compromise can spread from a single exposed service into broader infrastructure depending on container isolation and cloud permissions.
Recommendation: Patch listed fixed versions for React and Next.js and prioritize internet-facing workloads first, including container images and build artifacts that may still carry vulnerable dependencies. Consider using Defender Vulnerability Management and Defender for Cloud to inventory vulnerable packages, then monitor for exploitation signals such as Node or next-server spawned shell commands, suspicious downloads, Cloudflare tunnel usage, bind-mount hiding tactics, and secret discovery tooling execution. Review and implement Microsoft’s provided threat hunting queries related to the threat. Use Defender Vulnerability Management and Defender for Cloud to inventory vulnerable packages, then monitor for exploitation signals such as Node or next-server spawned shell commands, suspicious downloads, Cloudflare tunnel usage, bind-mount hiding tactics, and secret discovery tooling execution. Apply Azure WAF custom rules as a temporary control while patching is in progress, and if you suspect exploitation, isolate affected workloads and treat it as an incident due to the observed post-exploitation focus on persistence and cloud credential theft.
🚩 PyStoreRAT Malware Exploits GitHub Supply Chain to Target Security Professionals via AI-Generated Projects
Morphisec Threat Labs uncovered PyStoreRAT, a JavaScript/HTA backdoor deployed through coordinated GitHub supply chain attacks targeting IT administrators, cybersecurity analysts, and OSINT professionals. Dormant GitHub accounts, some inactive for years, suddenly reactivated to publish polished AI-generated projects including OSINT tools, DeFi bots, GPT wrappers, and security utilities that climbed into GitHub’s top trending lists. After gaining legitimate traction and trust, attackers introduced subtle “maintenance” commits deploying the previously undocumented PyStoreRAT backdoor. The malware performs extensive system profiling, deploys the Rhadamanthys stealer, and dynamically adjusts execution techniques when detecting CrowdStrike Falcon or Reason-related AV products by switching to alternate launch paths. PyStoreRAT features circular rotating C2 infrastructure using node{i}-py-store and py-installer domains enabling seamless payload updates and resilience against takedowns. The malware spreads through removable drives and dynamically pulls additional modules from operators while maintaining long-term access. Russian-language strings including “СИСТЕМА” found in the codebase indicate dual targeting of both Russian and non-Russian victims.
Impact: PyStoreRAT enables complete compromise of security professionals’ workstations through trusted development channels that bypass traditional security awareness training. The targeting of OSINT and cybersecurity tools ensures infection of high-value systems with access to sensitive threat intelligence, investigation data, and security infrastructure. AI-generated project legitimacy defeats manual code review processes as repositories contain functional, well-documented code that passes initial scrutiny. The adaptive execution paths based on detected security products demonstrate advanced evasion capabilities specifically designed to bypass enterprise EDR solutions. Long-term persistence through removable drive propagation and modular architecture enables lateral movement across air-gapped research environments.
Recommendation: Organizations should implement strict GitHub repository vetting processes including verification of contributor history and sudden reactivation patterns of dormant accounts. Monitor for JavaScript/HTA files introduced through “maintenance” commits in previously clean repositories, particularly those targeting security tools. Alert on execution technique changes based on security product detection, specifically alternate launch paths when CrowdStrike Falcon or Reason products are identified. Implement USB device controls to prevent removable drive propagation and monitor for Russian-language strings in unexpected contexts. Consider deploying Automated Moving Target Defense (AMTD) solutions that deny malware stable execution environments rather than relying on signature-based detection.
Apple Patches Two Zero-Day WebKit Vulnerabilities Exploited in Sophisticated Targeted Attacks
Apple released iOS 26.2 and iPadOS 26.2 on December 12, 2025, fixing multiple security issues across core components including WebKit, Kernel, FaceTime, Messages, and system frameworks. Apple notes that at least two WebKit vulnerabilities were exploited in “extremely sophisticated” attacks against specific targeted individuals on versions of iOS prior to iOS 26, and issued CVE-2025-14174 in response to this reporting. Among the fixes are issues that could lead to arbitrary code execution or memory corruption when processing maliciously crafted web content in WebKit, as well as privilege and data exposure risks such as an app gaining root privileges (Kernel), access to sensitive payment tokens (App Store), and exposure of hidden photos without authentication.
Impact: Organizations with iOS and iPadOS fleets face elevated risk from web-based exploitation paths, particularly via Safari or embedded WebKit content. The presence of in-the-wild exploitation signals that these flaws can be used for targeted compromise, and unpatched devices may remain exposed to drive-by or link-based attack chains that lead to code execution, data exposure, or privilege escalation.
Recommendation: Update all eligible devices to iOS 26.2 and iPadOS 26.2, prioritizing users in high-risk roles or who handle sensitive data. Enforce rapid OS patching through MDM, restrict untrusted browsing and link handling where possible, and monitor for signs of targeted mobile exploitation such as unusual Safari crashes, unexpected profile or configuration changes, and anomalous account activity following web interactions. Confirm Safari and platform updates are applied consistently across managed endpoints and review mobile security posture for gaps in update compliance.
CISA Adds Exploited GeoServer Vuln to Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a previously reported vulnerability, CVE-2025-58360, affecting OSGeo GeoServer, to its Known Exploited Vulnerabilities (KEV) Catalog. Details of the nature of the active exploitation were not provided. GeoServer is used for collecting/sharing geospatial data. The vulnerability is an XML External Entities (XXE) exploit, whereby improperly sanitized XML input via specific operations can allow an attacker to define external entities within the request, opening the door to a potential compromise. The vulnerability affects older versions up to 2.25.5 as well as 2.26.0 through 2.26.1, but versions 2.25.6 or 2.26.2 and above are patched.
Impact: Exploitation of this vulnerability could enable an attacker to undertake various malicious actions, such as accessing sensitive files, Server-Side Request Forgery (SSRF), or Denial of Service (DoS) attacks.
Recommendation: Organizations using GeoServer should ensure that they are running a patched version and keep an eye out for more details regarding active exploitation.
Sign up here!
To receive the TIGR Threat Watch email bulletin and critical vulnerability notifications, simply complete the form below.
Follow on Twitter
@SRA_ThreatWatch will keep you up to date with the most recent posts on your social media feed.
Subscribe to the RSS
Just copy and add this link to your RSS app and be notified immediately when new intel is posted.
How to use RSS
Following the RSS feed is easy. RSS can be added in your Outlook desktop app, and there are many free RSS readers available for your mobile device.
To follow using Outlook:
- In Outlook, right-click the RSS Feeds folder and choose Add a New RSS Feed.
- In the New RSS Feed dialog box, enter the URL of the RSS Feed: https://sra.io/category/tigr/feed
(click here for detailed instructions and additional options for Outlook)
Popular mobile RSS reader apps include:
- Feedly
- NewsBlur
- RSS Reader
- Inoreader
After installing your preferred RSS reader, you will be able to add this feed by entering the URL: https://sra.io/category/tigr/feed
Threat Bulletin Archive
About TIGR Threat Watch
Our Threat Intelligence Gathering & Research (TIGR) team is focused on threat intelligence and curates a daily intelligence report, TIGR Threat Watch, with information collected from several industry intel sources. We also create and publish ad-hoc critical vulnerability notifications in case of critical and time-sensitive vulnerabilities or threats. These notifications include details and recommendations for mitigation/remediation.