Threat Watch Feed
🚩 – IOCs Added
The red flag indicates that Indicators of Compromise (IOCs) have been added to SRA’s Threat Feed used by CyberSOC clients. Articles may not be flagged if IOCs are not available at the time or are not applicable to the article.
Ashen Lepus (WIRTE) deploys new “AshTag” espionage suite using phishing, DLL sideloading, and hidden HTML payloads to target Middle Eastern governments and diplomats.
The Hamas-affiliated cyber threat group Wirte, tracked by Palo Alto Networks’ Unit 42 as Ashen Lepus, continues to conduct sophisticated espionage operations across the Middle East despite ongoing regional conflicts. The group targets victims through phishing emails containing PDFs related to the Israel-Palestine conflict, which direct recipients to file-sharing services hosting malicious RAR archives. When victims open these files, the attack triggers a dynamic link library sideloading technique that deploys the AshTag malware suite in the background while displaying the expected document. AshTag consists of three main components: a loader that extracts payloads embedded within HTML header tags on command-and-control servers, a stager, and a modular backdoor that retrieves additional capabilities from commented-out HTML tags where most detection programs do not scan. The group encrypts its payloads using AES-CTR-256 encryption and regularly rotates encryption keys to evade detection. Recent infrastructure changes show the attackers now register subdomains of legitimate domains rather than hosting their own infrastructure, allowing malicious traffic to blend with normal internet activity. The group has also expanded beyond pure espionage, deploying the SameCoin wiper in destructive attacks against Israeli targets timed to significant dates in the conflict.
Impact: Wirte has expanded its targeting beyond traditional focus areas like Egypt, Jordan, and the Palestinian Authority to include nations with less direct involvement in the Israel-Palestine conflict, such as Oman, Morocco, and Turkey. Compromised organizations may experience theft of sensitive diplomatic correspondence, internal government documents, and politically significant intelligence that adversaries can exploit for strategic advantage. The group’s demonstrated ability to maintain operations throughout the Gaza conflict suggests resilience and potentially indicates operations from locations outside the most affected conflict zones, making disruption efforts more challenging.
Recommendation: Treat unsolicited conflict-themed documents and links as high risk: block known malicious file-sharing domains, enforce robust email filtering and attachment sandboxing, and remove the ability for unprivileged users to load unsigned or unexpected DLLs. Maintain endpoint and network monitoring tuned for DLL sideloading behaviors, suspicious process ancestry, and unusual outbound connections to HTML pages that contain anomalous payload patterns.
🚩 BlackForce Phishing Kit Performs Real-Time MFA Bypass Through Man-in-the-Browser Attacks
Zscaler ThreatLabz discovered the BlackForce phishing-as-a-service kit in August 2025, which has evolved through five distinct versions while impersonating over 11 major brands including Disney, Netflix, DHL, and UPS. The kit is actively sold on Telegram forums for €200-€300 and enables Man-in-the-Browser (MitB) attacks to dynamically bypass multi-factor authentication through real-time operator intervention. BlackForce deploys cache-busted JavaScript files with filename patterns like index-[hash].js, where 99% of content consists of legitimate React and React Router production builds to evade detection. The phishing infrastructure features dual-channel exfiltration, sending stolen credentials simultaneously to the attacker’s C2 panel and Telegram channels, ensuring data persistence even if the phishing panel is taken down.
Impact: BlackForce enables complete account takeover through MFA bypass techniques that defeat standard two-factor authentication protections. The real-time operator model ensures attacks adapt dynamically to each victim’s authentication flow, maximizing compromise success rates. Organizations face immediate credential theft risks as the kit’s legitimate-appearing React codebase evades traditional phishing detection mechanisms. Widespread brand impersonation capabilities allow attackers to target diverse victim populations across entertainment, logistics, and financial services sectors.
Recommendation: Organizations should implement zero trust architecture to limit access scope even after successful credential theft. Monitor for JavaScript files with cache-busting hash patterns and unusually large React/React Router bundles on suspicious domains. Deploy behavioral detection for rapid sequential authentication attempts following credential entry, indicating potential MitB attacks in progress. Block all identified indicators of compromise. Monitor for sessionStorage operations storing credentials across page loads and train users to verify URL authenticity before entering authentication codes.
Critical Authentication Bypass in FortiCloud SSO Affects Multiple Fortinet Products
Fortinet disclosed a critical cryptographic signature verification vulnerability (CVE-2025-59718, CVE-2025-59719) affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager that allows unauthenticated attackers to bypass FortiCloud SSO login authentication through crafted SAML messages. The vulnerability stems from improper verification of cryptographic signatures (CWE-347) and affects FortiOS versions 7.0.0-7.0.17, 7.2.0-7.2.11, 7.4.0-7.4.8, and 7.6.0-7.6.3, with similar version ranges for other affected products. While FortiCloud SSO is disabled by default in factory settings, the feature automatically enables when administrators register devices to FortiCare unless explicitly disabled via the “Allow administrative login using FortiCloud SSO” toggle during registration. The vulnerability allows complete authentication bypass through malicious SAML message manipulation, granting unauthorized administrative access to affected devices. Fortinet internally discovered the issue through their Product Security team members Yonghui Han and Theo Leleu, with a CVSS v3 score of 9.1 indicating critical severity. Emergency mitigation requires disabling FortiCloud login via System Settings or CLI command “config system global set admin-forticloud-sso-login disable end” until patches are applied. All affected products have received security updates with FortiOS requiring upgrades to versions 7.0.18, 7.2.12, 7.4.9, or 7.6.4 depending on the deployed branch.
Impact: This vulnerability enables unauthenticated attackers to gain full administrative access to critical network security infrastructure without valid credentials. Compromised FortiGate firewalls, FortiWeb WAFs, and FortiProxy systems expose entire network perimeters to unauthorized configuration changes, traffic interception, and security policy manipulation. Organizations face immediate risks of network breach, data exfiltration, and complete security control bypass through exploitation of trusted SSO mechanisms. The automatic enablement during FortiCare registration means many organizations may be unknowingly exposed despite never manually configuring FortiCloud SSO.
Recommendation: Organizations must immediately disable FortiCloud SSO login on all vulnerable devices via “config system global set admin-forticloud-sso-login disable end” command until patches are applied. Prioritize upgrading FortiOS to 7.6.4/7.4.9/7.2.12/7.0.18, FortiProxy to 7.6.4/7.4.11/7.2.15/7.0.22, FortiWeb to 8.0.1/7.6.5/7.4.10, and FortiSwitchManager to 7.2.7/7.0.6 based on current versions. Review FortiCare registration procedures to ensure SSO toggle is explicitly disabled during device onboarding. Use Fortinet’s upgrade path tool at docs.fortinet.com/upgrade-tool to plan coordinated updates across infrastructure.
Critical PCIe IDE Protocol Flaws Enable Transaction Reordering and Cross-Domain Data Leakage
PCI-SIG disclosed three vulnerabilities (CVE-2025-9612, CVE-2025-9613, CVE-2025-9614) affecting PCIe Base Specification Revision 5.0 and later implementations of Integrity and Data Encryption (IDE) features. The Forbidden IDE Reordering flaw allows Man-in-the-Middle attackers to reorder IDE-protected Transaction Layer Packets without triggering detection at receivers, bypassing integrity protections designed to secure PCIe communications. Delayed Posted Redirection occurs when security modules fail to properly flush or re-key IDE streams during device rebinding, allowing stale write transactions from previous security contexts to leak into new trusted domains. Completion Timeout Redirection enables tag aliasing when Non-Posted Request timeouts release tags back to the pool, potentially delivering completions to incorrect security contexts. The vulnerabilities affect systems implementing IDE and Trusted Domain Interface Security Protocol (TDISP), exposing isolation boundaries between trusted execution environments. Exploitation requires MITM positioning for reordering attacks or timing-based attacks leveraging completion timeouts and device rebinding operations. All three flaws compromise the fundamental security guarantees of IDE protocol, which was designed to protect PCIe transactions from tampering and ensure confidentiality between isolated security domains.
Impact: These vulnerabilities enable attackers to breach isolation between trusted execution environments in systems relying on PCIe IDE for hardware-level security. Transaction reordering attacks violate data integrity protections allowing undetected manipulation of protected communications between PCIe components. Cross-context data leakage through stale transactions compromises confidentiality between isolated security domains, potentially exposing sensitive data from one virtual machine or container to another. Organizations using IDE-enabled hardware for secure computing, confidential computing, or multi-tenant isolation face immediate risks to their security boundaries.
Recommendation: Organizations should review PCI-SIG Engineering Change Notifications (ECN) document 22976 and work with hardware vendors to determine vulnerability exposure in PCIe components. Implement proper IDE stream flushing and re-keying procedures during device rebinding operations to prevent stale transaction leakage. Deploy firmware and driver updates from vendors implementing the ECN mitigations as they become available. Consider additional security layers beyond IDE for critical isolation requirements until patches are widely deployed.
🚩 Storm-0249 Exploits Security Software to Enable Ransomware Attacks
Threat actor group “Storm-0249” has evolved its attack methodology to weaponize trusted security software, specifically targeting SentinelOne’s SentinelAgentWorker.exe process through DLL sideloading techniques. The threat actor initiates attacks using ClickFix social engineering tactics that manipulate users into executing malicious commands through the Windows Run dialog. Once inside a network, Storm-0249 deploys trojanized DLLs via MSI packages that execute with SYSTEM-level privileges, placing malicious files in the user’s AppData folder alongside legitimate SentinelOne executables. The legitimate security agent then loads the malicious DLL instead of its authentic component, allowing attackers to conduct reconnaissance, establish command-and-control communications, and maintain persistence while appearing as routine security operations. Storm-0249 employs additional evasion methods including Microsoft domain spoofing – using URL paths like /us.microsoft.com/ on attacker-controlled infrastructure – and fileless PowerShell execution by piping curl.exe output directly into memory.
Impact: Organizations face detection challenges because Storm-0249 conceals malicious activity within digitally signed, whitelisted security processes that security teams naturally trust. Traditional signature-based defenses and perimeter controls fail to identify threats when attackers funnel encrypted command-and-control traffic through legitimate EDR agents using TLS encryption, which renders deep packet inspection ineffective. The attackers’ use of MSI packages with SYSTEM privileges creates persistent footholds that survive standard remediation efforts including agent reinstalls and security patches, allowing them to maintain access for extended periods.
Recommendation: Organizations should monitor security software for unusual behavior, including unexpected connections to newly created domains and suspicious file loading patterns. Security teams must establish controls that limit which users and systems can execute common administrative tools, preventing attackers from abusing legitimate programs for malicious purposes.
Critical XXE Flaw in Apache Tika Enables Remote File Access via Malicious PDFs
A newly disclosed Apache Tika vulnerability, CVE-2025-66516, carries a CVSS score of 10.0 and significantly expands the scope of a previously reported XXE flaw (CVE-2025-54988). The issue impacts tika-core, tika-parser-pdf-module, and earlier tika-parsers packages across versions 1.13 through 3.2.1, allowing attackers to trigger XML External Entity injection using a crafted XFA object embedded inside a PDF. While earlier reporting suggested the vulnerable entry point was the PDF parser module, maintainers clarified that the root cause and fix reside inside tika-core, meaning organizations that only upgraded parser modules remain exposed. Further review confirmed that older 1.x versions of Tika—which house the PDFParser within the general tika-parsers bundle—were also vulnerable but were not previously included in the affected package list. The flaw allows adversaries to abuse XML entity expansion to read arbitrary files on the server, perform SSRF-like requests, or in some cases chain the issue toward remote code execution depending on how Tika is embedded into downstream applications. Given Tika’s widespread use in document ingestion pipelines, indexing systems, content scanners, and data processing workflows, exploitation risks extend across a broad ecosystem.
Impact: Threat actors can weaponize PDFs containing malicious XFA structures to force server-side file disclosure, internal network probing, or other XXE-driven attacks wherever Tika processes untrusted documents. This may expose sensitive credentials, application configs, IAM tokens, or proprietary data stored on the server, potentially enabling lateral movement or deeper compromise. Because many orgs embed Tika indirectly via search platforms, content management systems, or threat-intel pipelines, they may be unknowingly vulnerable even if Tika is not explicitly deployed.
Recommendation: Organizations should upgrade tika-core and tika-parser-pdf-module to version 3.2.2 or higher, and migrate any remaining 1.x or 2.x parser bundles to fixed releases (parser updates alone do not resolve the flaw unless core is updated). Inventory all applications and dependencies that rely on Tika—directly or via transitive Maven dependencies—and validate that build systems are pulling patched artifacts. Reinforce document-processing workflows with sandboxing, XML entity resolution hardening, and strict isolation of PDF ingestion services. Finally, monitor for suspicious PDF submissions containing XFA objects, anomalous file-read attempts, or unexpected outbound network requests originating from Tika-based services.
Sign up here!
To receive the TIGR Threat Watch email bulletin and critical vulnerability notifications, simply complete the form below.
Follow on Twitter
@SRA_ThreatWatch will keep you up to date with the most recent posts on your social media feed.
Subscribe to the RSS
Just copy and add this link to your RSS app and be notified immediately when new intel is posted.
How to use RSS
Following the RSS feed is easy. RSS can be added in your Outlook desktop app, and there are many free RSS readers available for your mobile device.
To follow using Outlook:
- In Outlook, right-click the RSS Feeds folder and choose Add a New RSS Feed.
- In the New RSS Feed dialog box, enter the URL of the RSS Feed: https://sra.io/category/tigr/feed
(click here for detailed instructions and additional options for Outlook)
Popular mobile RSS reader apps include:
- Feedly
- NewsBlur
- RSS Reader
- Inoreader
After installing your preferred RSS reader, you will be able to add this feed by entering the URL: https://sra.io/category/tigr/feed
Threat Bulletin Archive
TB20250408 – Microsoft Patch Tuesday
TB20250325 – IngressNightmare_Critical Remote Code Execution Vulnerabilities in Ingress NGINX Controller Enable Kubernetes Cluster Takeover
TB2025318 – GitHub Action “tj-actions/changed-files” Compromised to Leak Secrets for Repositories Using the CI/CD Workflow
TB20250211 – Microsoft Patch Tuesday
TB20250211 – Microsoft Patch Tuesday
About TIGR Threat Watch
Our Threat Intelligence Gathering & Research (TIGR) team is focused on threat intelligence and curates a daily intelligence report, TIGR Threat Watch, with information collected from several industry intel sources. We also create and publish ad-hoc critical vulnerability notifications in case of critical and time-sensitive vulnerabilities or threats. These notifications include details and recommendations for mitigation/remediation.