A critical zero-day vulnerability in Fortinet FortiWeb has been actively exploited in the wild, allowing attackers to gain complete administrator access without any prior authentication. The flaw affects Fortinet’s Web Application Firewall, which is designed to protect web applications from malicious traffic. Vulnerability Discovery and Exploitation On October 6, 2025, cyber deception company Defused published […]
The rise of cryptocurrency has created new opportunities for cybercriminals to exploit unsuspecting users.
Attackers are now disguising the notorious DarkComet remote access trojan as Bitcoin-related applications, targeting cryptocurrency enthusiasts who download tools from unverified sources.
This malware campaign demonstrates how old threats continue to resurface with modern social engineering techniques.
DarkComet RAT is a well-known remote access trojan that allows attackers to gain complete control over infected systems.
Despite being discontinued by its creator years ago, the malware continues to circulate in underground forums and remains highly effective.
It provides attackers with extensive capabilities including keystroke logging, file theft, webcam surveillance, and remote desktop control.
These features make it particularly dangerous for cryptocurrency users, as stolen credentials can lead directly to financial losses.
The malicious file analyzed in this campaign was distributed as a compressed RAR archive containing an executable disguised as “94k BTC wallet.exe.”
This delivery method helps attackers bypass email filters and reduces detection rates. The executable was packed with UPX (Ultimate Packer for Executables) to further evade antivirus software and hide its true nature from security analysis.
Point Wild security analysts identified the malware after investigating suspicious Bitcoin-related applications. The research team discovered that once extracted and executed, the fake Bitcoin tool immediately activates DarkComet’s full capabilities.
Instead of providing any legitimate cryptocurrency functionality, the malware begins establishing persistence on the infected system and attempts to communicate with its command-and-control server.
Technical Breakdown and Infection Mechanism
The malware establishes persistence by copying itself to %AppData%\Roaming\MSDCSC\explorer.exe and creating a registry key under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
File Info image (Source – Point Wild)
This ensures the malware executes automatically every time the system restarts. This shows the file information of the compressed RAR archive, while the one below shows the UPX packing structure visible in CFF Explorer.
UPX Packed (Source – Point Wild)
Analysis revealed the sample’s embedded configuration containing critical operational details.
The malware uses a mutex named DC_MUTEX-ARULYYD to prevent multiple instances from running simultaneously.
Network analysis showed attempted connections to the command-and-control server at kvejo991.ddns.net over TCP port 1604.
Although the C2 server was offline during testing, the repeated connection attempts confirmed active beaconing behavior consistent with DarkComet operations.
The unpacked executable revealed multiple standard PE sections, including .text, .data, and .idata.
The malware injects its payload into legitimate Windows processes like notepad.exe to perform keylogging and screen capture while remaining hidden.
Captured keystrokes are stored in log files with names like “2025-10-29-4.dc” before being exfiltrated through the C2 channel.
File hashes for detection include SHA256: 11bf1088d66bc3a63d16cc9334a05f214a25a47f39713400279e0823c97eb377 for the compressed archive and SHA256: 5b5c276ea74e1086e4835221da50865f872fe20cfc5ea9aa6a909a0b0b9a0554 for the packed executable.
Users should avoid downloading cryptocurrency tools from untrusted sources and maintain updated security software to detect such threats effectively.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
A critical vulnerability in Fortinet’s FortiWeb Web Application Firewall (WAF) is being actively exploited by threat actors, potentially as a zero-day attack vector.
The flaw, which enables unauthenticated attackers to gain administrator-level access to the FortiWeb Manager panel and WebSocket command-line interface, was first highlighted through a proof-of-concept (PoC) exploit shared by cyber deception firm Defused on October 6, 2025. This discovery came after Defused’s honeypot captured real-world attempts targeting exposed FortiWeb instances.
Unknown Fortinet exploit (possibly a CVE-2022-40684 variant) from 64.95.13.8 ( BLNWX )
FortiWeb serves as a vital defense mechanism, designed to detect and block malicious traffic aimed at web applications, making it a prime target for attackers seeking to undermine organizational security postures.
The vulnerability appears to stem from a path traversal issue that allows remote exploitation without prior access, potentially leading to full device compromise and subsequent lateral movement within networks.
Security firm Rapid7 confirmed the exploit’s efficacy through testing, noting it successfully creates unauthorized admin accounts like “hax0r” on vulnerable versions.
The testing revealed significant differences in responses between the affected and patched versions.
On FortiWeb 8.0.1, released in August 2025, a successful exploit returns an HTTP 200 OK response with JSON details of the new admin user, including encrypted passwords and access profiles.
In contrast, version 8.0.2, released at the end of October, rejects the attempt with an HTTP 403 Forbidden error, indicating potential mitigation.
Rapid7 emphasized that while the public PoC fails against 8.0.2, it’s unclear if this update includes a deliberate silent fix or coincidental changes.
Exploitation in the wild has been reported since October 2025, with Defused claiming targeted attacks on exposed devices. Global scanning and spraying of the exploit have escalated, involving IP addresses from regions like the US, Europe, and Asia.
Adding to the urgency, on November 6, 2025, Rapid7 spotted an alleged zero-day exploit for FortiWeb offered for sale on a prominent black hat forum, though its relation to this flaw remains unconfirmed.
Hacker Forum claims
As of November 13, 2025, Fortinet has not issued official guidance, assigned a CVE identifier, or published a matching advisory on its PSIRT feed.
Organizations using FortiWeb versions before 8.0.2 face immediate risk and should prioritize emergency updates or isolate management interfaces from public exposure. Defenders are also urged to scan logs for suspicious admin account creations and monitor Fortinet’s channels for impending disclosures.
The absence of vendor acknowledgment heightens concerns, especially given Fortinet’s history of targeted attacks.
Researchers at watchTowr Labs have even released tools to detect vulnerable instances by generating random admin users.
This incident underscores the need for rapid patching in critical infrastructure, as broad exploitation could soon follow initial targeted hits. Updates to this story will incorporate any official responses from Fortinet.
Payment processor Checkout.com revealed on Thursday that notorious hacking group ShinyHunters had infiltrated a legacy third-party cloud file storage system, exposing internal documents from years past.
The breach, which the company attributes to its own oversight in decommissioning the outdated platform, affects less than 25% of its current merchant base but spares critical payment infrastructure.
The incident surfaced last week when ShinyHunters, a collective known for high-profile data thefts including breaches at Microsoft, AT&T, and Ticketmaster, contacted Checkout.com demanding a ransom.
The group claimed possession of sensitive data tied to the London-based fintech firm, which processes billions in transactions annually for e-commerce giants worldwide.
Upon investigation, Checkout.com confirmed unauthorized access to a cloud system used before 2020 for internal operational documents and merchant onboarding materials. “This was our mistake, and we take full responsibility,” stated Mariano Albera, the company’s Chief Technology Officer, in an official blog post.
What are the Data Affected
The legacy setup, managed by a third-party provider, was not properly retired, creating a vulnerability that threat actors exploited. Crucially, the hackers never reached the live payment processing platform; no merchant funds, card numbers, or real-time transaction data were compromised.
ShinyHunters, active since at least 2020, has built a reputation for selling stolen data on dark web forums, often targeting financial and tech sectors.
Their tactics typically involve exploiting misconfigurations or weak access controls, aligning with the decommissioning lapse here. Security experts note this as a reminder of “zombie systems” forgotten infrastructure that lingers as easy prey for cybercriminals.
Checkout.com emphasized transparency in its response, vowing not to yield to extortion. “We will not pay this ransom,” Albera declared. Instead, the company plans to donate an equivalent amount to Carnegie Mellon University and the University of Oxford’s Cyber Security Center, funding research to combat cybercrime.
“Security, transparency, and trust are the foundation of our industry,” he added. “We will own our mistakes, protect our merchants, and invest in the fight against the criminal actors who threaten our digital economy.”
The firm is now notifying affected merchants, collaborating with law enforcement, and regulators to mitigate fallout. “We are sorry. We regret that this incident has caused worry for our partners,” Albera wrote, offering direct support through account managers.
Threat actors are actively exploiting a critical authentication bypass vulnerability in Fortinet’s FortiWeb web application firewall (WAF) worldwide, prompting defenders to heighten vigilance.
Researchers at watchTowr Labs have responded by releasing a Detection Artefact Generator script, designed to help organizations scan their environments for vulnerable FortiWeb appliances and mitigate risks swiftly.
The vulnerability, tracked as CVE-2025-52970, stems from improper parameter handling in FortiWeb, enabling unauthenticated remote attackers to log in as any existing user via crafted requests.
With a CVSS score of 7.7, it requires some non-public knowledge of the device but poses severe risks, including privilege escalation and potential remote code execution on affected systems.
Fortinet patched the flaw in versions 8.0.2 and later, but in-the-wild attacks have surged since a partial proof-of-concept surfaced publicly in August 2025, targeting exposed FortiWeb instances indiscriminately.
Security firms report dozens of compromises, underscoring the urgency for immediate patching amid ongoing exploitation campaigns.
WatchTowr Labs’ open-source tool, hosted on GitHub at watchTowr-vs-Fortiweb-AuthBypass, simplifies detection by simulating the bypass mechanism. The Python script generates a unique username and password (e.g., “35f36895”) and sends an exploit payload to the target IP, such as python watchTowr-vs-Fortiweb-AuthBypass.py 192.168.1.99.
If successful, it confirms vulnerability by creating a temporary user, alerting administrators to remediate. Authored by Sina Kheirkhah (@SinSinology) and Jake Knott (@inkmoro), the script targets FortiWeb versions below 8.0.2, with specifics available via FortiGuard Labs PSIRT.
Organizations should prioritize scanning internet-facing appliances, applying patches, and monitoring for anomalous logins. As supply chain attacks evolve, tools like this empower proactive defense in a threat landscape where WAFs ironically become entry points.
Most federal workers will receive their first paycheck in more than a month between Saturday and Wednesday of next week, and it should include at least most of the backpay that is due, Trump administration officials said Thursday.
Lawmakers included a provision guaranteeing full backpay for furloughed workers in the deal to end the 43-day government shutdown after the White House repeatedlyinsinuated it might break a 2019 law enacted during President Trump’s first term requiring all feds be paid upon the restoration of appropriations.
A senior administration official told Government Executive that federal HR workers are aiming to get the first post-shutdown checks out to employees within the next week. For many agencies, these paychecks will reflect pay furloughed and excepted workers would have earned from Oct. 1 through Nov. 1.
General Services Administration and Office of Personnel Management employees can expect to see a paycheck Saturday, while Energy, Health and Human Services, Veterans Affairs and Defense Department civilian workers will be paid Sunday. On Monday, paychecks are set to go out for workers at the Education, State, Interior and Transportation departments, as well as the Environmental Protection Agency, NASA, National Science Foundation, Nuclear Regulatory Commission and the Social Security Administration.
Another tranche of workers must wait until Wednesday, Nov. 19, to see their backpay, though their checks will also include pay for the Nov. 2-Nov. 15 biweekly pay period, effectively making them whole for time during the shutdown and paying them for their work between Thursday and Saturday of this week: the Agriculture, Commerce, Homeland Security, Housing and Urban Development, Justice, Labor and Treasury departments, and the Small Business Administration.
Guidance issued Wednesday by OPM Associate Director for Workforce Policy and Innovation Veronica Hinton to agency chief human capital officers provides additional details on how that backpay will be calculated—with the caveat that in agencies’ haste to get checks out, there may be some mistakes.
“To facilitate making retroactive payments as quickly as possible, payroll providers may have to make some adjustments,” Hinton wrote. “Thus, the initial retroactive pay that an employee receives after a lapse in appropriations has ended may not fully reflect application of all the guidance in this document regarding the treatment of hours for pay, leave and other purposes. Payroll providers will work with agencies to make any necessary adjustments as soon as practicable.”
Excepted employees should be paid for the time they worked during the shutdown, including overtime pay for any time in excess of their normal tour of duty. And furloughed employees should be paid for the time they would have spent at work, had they not been forced to stay home due to the appropriations lapse. That includes overtime, provided the employee is “regularly scheduled” to work excess hours.
“A furloughed employee who, before the lapse in appropriations, had been regularly scheduled to perform, during the period subsequently covered by the lapse, overtime work or to perform work at night or during a period for which any other form of premium pay would otherwise be payable is entitled to receive overtime pay, night pay, or other premium pay as if the work had been performed,” OPM wrote. “Allowances, differentials and other payments otherwise payable on a regular basis (e.g., administratively uncontrollable overtime pay and law enforcement availability pay) must be paid as if the furloughed employee continued to work.”
Ineligible for backpay are individuals who were scheduled to be in leave without pay status during the lapse, or suspended. And excepted employees placed in absent without leave status for “missed assigned work hours” similarly will not be paid for that time. The Social Security Administration controversially refused some employees’ request to be placed in intermittent furlough status and labeled them AWOL instead.
A Russian-speaking threat behind an ongoing, mass phishing campaign has registered more than 4,300 domain names since the start of the year.
The activity, per Netcraft security researcher Andrew Brandt, is designed to target customers of the hospitality industry, specifically hotel guests who may have travel reservations with spam emails. The campaign is said to have begun in earnest around
Cybercriminals are now exploiting remote monitoring and management tools to spread dangerous malware while avoiding detection by security systems.
The attack campaign targets users who download what appears to be popular software, such as Notepad++, 7-Zip, or ChatGPT, from fake websites.
Instead of getting the real program, victims unknowingly install LogMeIn Resolve or PDQ Connect, which gives hackers complete control over their computers.
The attack begins when users visit websites that appear to be official download pages for trusted utilities.
These fake pages offer downloads for programs such as notepad++.exe, 7-zip.exe, winrar.exe, and even chatgpt.exe.
Download page of Digestive Utility (Source – ASEC)
When someone clicks the download button, they receive a modified version of LogMeIn Resolve that connects directly to the attacker’s command server.
The malicious installer files have been found using names like Microsoft.exe, OpenAI.exe, and windows12_installer.exe to trick users into thinking they are legitimate.
ASEC security researchers identified this campaign after investigating unusual activity involving RMM tools in Korea.
They discovered that three different threat actors were behind the attacks, each using unique company identification numbers embedded in the LogMeIn configuration files.
The researchers found company IDs 8347338797131280000, 1995653637248070000, and 4586548334491120000 being used to control infected systems.
Once the fake LogMeIn or PDQ Connect software gets installed, hackers can run PowerShell commands remotely to download additional malware.
The attackers use these tools to drop a backdoor called PatoRAT onto victim computers. This malware, developed in Delphi, includes Portuguese-language strings in its code, suggesting the developers may be from Portuguese-speaking regions.
How the Malware Gains Control
PatoRAT operates by establishing a connection to command-and-control servers and sending detailed information about the infected computer.
The malware collects the computer name, username, operating system details, memory usage, screen resolution, and active windows.
This data gets encrypted using a simple XOR cipher with the key 0xAA and stored in the resource section under “APPCONFIG”.
The backdoor supports dangerous functions, including mouse control, screen capture, keylogging, stealing browser passwords, and even installing port-forwarding tools.
Security teams recommend downloading software only from official websites, checking digital certificates, and keeping antivirus programs up to date to prevent these attacks.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
ANY.RUN experts recently uncovered a new XWorm campaign that uses steganography to conceal malicious payloads inside seemingly harmless PNG images.
What appears to be an ordinary graphic actually contains encrypted loaders that execute entirely in memory, allowing the malware to bypass most traditional detection methods and signature-based defenses.
Let’s break down how this attack works and what analysts and hunters should look for.
Attack Overview with Real-World Example
The infection starts with a malicious JavaScript installer named PurchaseOrder_25005092.JS, delivered through phishing emails and web pages (T1566.001).
The script is obfuscated using an Immediately Invoked Function Expression (IIFE) pattern (T1027) and writes three staged files to: C:\Users\PUBLIC\
These files are named:
Kile.cmd
Vile.png
Mands.png
While the .png extension suggests images, these are not image files. Instead, they act as storage containers for Base64-encoded and AES-encrypted payloads (T1036.008); a common trick to avoid quick signature-based detection.
You can view the full attack chain and download an actionable analysis report from a real-world run inside ANY.RUN’s interactive sandbox:
Execution Chain Breakdown: What Analysts Need to Know
Below is a concise, step-by-step breakdown of the execution chain to help analysts quickly identify key artifacts and pivot points.
Follow each stage to see where to hunt, which logs to inspect, and which indicators to extract for detection and response.
Persistence and setup
The JavaScript creates a scheduled task (T1053.005) to maintain persistence after reboot. It checks for required artifacts and recreates them using long Base64 blobs and AES-encrypted strings (T1027.013).
Obfuscated batch staging (Kile.cmd)
Kile.cmd contains heavy obfuscation: variable noise, percent-substitutions, and chunked Base64 fragments. At runtime it reassembles commands and launches the PowerShell loader (T1059).
Two-stage PowerShell loader
Stage 1 – Command runner: Reads Mands.png, Base64-decodes and AES-decrypts it, then decodes the contained commands and executes them via Invoke-Expression (IEX).
Stage 2 – In-memory assembly loader: Reads Vile.png, Base64-decodes and AES-decrypts it to raw bytes, then loads a .NET assembly directly into memory and invokes its entry point (T1620). The combined result is a fileless, in-memory loader that launches XWorm.
XWorm execution chain with hidden PNG
Pro Threat Hunting Tips: Detecting Fileless and Steganographic Loaders
Below is a focused checklist for analysts and hunters to identify steganography-backed, in-memory loaders like XWorm. Use these steps to spot unusual patterns early and validate findings through behavioral analysis:
Inspect image files: Scan .png and .jpg files for unusually long Base64 strings, text chunks, or non-image data. High text-to-binary ratios or embedded AES-encrypted sections often indicate hidden payloads.
Monitor PowerShell activity: Track commands using Invoke-Expression, FromBase64String, or AES routines. Correlate these with script origins like wscript.exe or .cmd files to spot reflective execution and in-memory loaders.
Correlate scheduled task creation: Look for tasks created by JavaScript or batch scripts from user directories rather than system paths. Such entries often indicate persistence after initial compromise.
Use dynamic analysis: Static scans miss many steganographic loaders. Run suspicious scripts and files in an interactive sandbox like ANY.RUN to observe decryption, staging, and memory execution in real time, and extract IOCs from each stage.
How a Sandbox Speeds Up Detection in Steganographic Attacks
Steganographic loaders like XWorm rely on multi-stage execution and memory-only payloads, which makes them nearly invisible to static scanners.
A sandbox environment changes that by showing what’s actually happening under the surface; file writes, decryption routines, and PowerShell commands executed in real time.
With ANY.RUN’s interactive sandbox, analysts can:
Watch the full chain unfold; from the initial JavaScript dropper to in-memory execution.
Extract and visualize IOCs such as decoded scripts, file paths, and registry modifications.
Confirm persistence and C2 activity without waiting for signatures or EDR alerts.
This level of visibility turns a stealthy, fileless infection into a transparent, traceable process, helping threat hunters respond faster and with evidence-based clarity.
Turn Complex Attacks into Clear Evidence in Seconds
Attackers are getting better at blending in; the only reliable defense is to observe their behavior, not just their dropped files.
In nearly 90% of cases, ANY.RUN reveals full attack behavior in under 60 seconds, turning fleeting, fileless activity into concrete evidence analysts can act on immediately.
Key benefits for analysts & threat hunters:
Real-time visibility for faster decisions: Instantly see how loaders unpack, decrypt, and execute without waiting for static scans or vendor signatures.
Fewer false positives: Behavioral context makes it easy to distinguish real threats from benign automation or scripts.
End-to-end understanding: Watch how each process connects, what files are written, and how persistence is achieved.
Time savings in triage and investigation: Complete analysis and IOC extraction in minutes, not hours.
Seamless workflow integration: Push results directly to SIEM, SOAR, or case management tools through ready-made connectors.
Collaboration made easy: Share live sessions, findings, and visual reports across teams for quicker consensus.
Continuous learning and hunting: Mapped MITRE ATT&CK TTPs and decoded artifacts enrich detection logic and threat intelligence feeds.
Ready to see it in action? Talk to ANY.RUN experts and discover how interactive analysis helps your team find and stop threats static tools miss.
Google security researchers recently uncovered a sophisticated criminal operation called “Lighthouse” that has victimized over one million people across more than 120 countries.
This phishing-as-a-service platform represents one of the most damaging SMS-based scam networks in recent years, prompting Google to file litigation aimed at dismantling the entire operation.
The attack’s scale reveals how well-organized cybercriminals have become, deploying coordinated attacks that exploit trusted brand names to trick victims into surrendering sensitive information.
The Lighthouse platform enables attackers to launch massive “smishing” campaigns, which are phishing attacks delivered through text messages rather than email.
Criminals using this kit send deceptive SMS messages pretending to come from legitimate companies like E-Z Pass, USPS, and toll collection services.
These messages typically prompt recipients to click links that lead to fraudulent websites designed to steal credentials and financial data.
Google security analysts identified at least 107 website templates featuring Google’s branding on sign-in screens specifically crafted to appear legitimate.
These fraudulent websites asked unsuspecting users to enter email addresses, passwords, banking credentials, and other sensitive information.
The operation has stolen between 12.7 million and 115 million credit cards in the United States alone, representing a significant financial impact to victims.
Technical Infrastructure and Attack Mechanism
The Lighthouse platform operates as a complete criminal service offering, providing bad actors with readily-made phishing kits and infrastructure to execute attacks at scale.
The service simplifies the attack process by allowing operators with minimal technical expertise to launch convincing campaigns.
Criminals can customize templates for different target brands, manage victim databases, and harvest stolen credentials through a centralized command-and-control infrastructure.
Google’s legal action targets the operation under multiple laws, including the Racketeer Influenced and Corrupt Organizations Act, the Lanham Act for trademark violations, and the Computer Fraud and Abuse Act.
The company is also implementing defensive measures, including AI-powered detection systems to flag suspicious messages and expanded account recovery options to help compromised users regain access to their accounts more safely.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
.webp)
.webp)
Unknown Fortinet exploit (possibly a CVE-2022-40684 variant) from 64.95.13.8 
( BLNWX ) 
(@cyb3rops) .webp)
