Dissecting PipeMagic: Inside the architecture of a modular backdoor framework

Among the plethora of advanced attacker tools that exemplify how threat actors continuously evolve their tactics, techniques, and procedures TTPs to evade detection and maximize impact, PipeMagic, a highly modular backdoor used by Storm-2460 masquerading as a legitimate open-source ChatGPT Deskto...

Dissecting PipeMagic: Inside the architecture of a modular backdoor framework

Among the plethora of advanced attacker tools that exemplify how threat actors continuously evolve their tactics, techniques, and procedures TTPs to evade detection and maximize impact, PipeMagic, a highly modular backdoor used by Storm-2460 masquerading as a legitimate open-source ChatGPT Deskto...

my-testutil (1.0.1), storm-test (0.0.1) +1 more potentially affected by unknown CVE via wepack-cli (0.0.1-security)

wepack-cli NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on wepack-cli and may be impacted: - my-testutil 1.0.1 - storm-test 0.0.1 - stormydb =0.1.1, =0.5.2 Source cves: unknown CVE Source advisory: OSV:MAL-2025-39082...

MAL-2025-35378 Malicious code in test-mlw2-fremd-storm (npm)

The package test-mlw2-fremd-storm was found to contain malicious code...

Malicious code in test-mlw2-fremd-storm (npm)

The package test-mlw2-fremd-storm was found to contain malicious code...

Enhancing Privacy in Decentralized Min-Max Optimization: a Differentially Private Approach

Decentralized min-max optimization allows multi-agent systems to collaboratively solve global min-max optimization problems by facilitating the exchange of model updates among neighboring agents, eliminating the need for a central server. However, sharing model updates in such systems carry a ris...

Storm-2603 Deploys DNS-Controlled Backdoor in Warlock and LockBit Ransomware Attacks

The threat actor linked to the exploitation of the recently disclosed security flaws in Microsoft SharePoint Server is using a bespoke command-and-control C2 framework called AK47 C2 also spelled ak47c2 in its operations. The framework includes at least two different types of clients, HTTP-based...

Packet Storm New Exploits for July, 2025

This archive contains all of the 132 exploits added to Packet Storm in July, 2025...

Storm-2603 Exploits SharePoint Flaws to Deploy Warlock Ransomware on Unpatched Systems

Microsoft has revealed that one of the threat actors behind the active exploitation of SharePoint flaws is deploying Warlock ransomware on targeted systems. The tech giant, in an update shared Wednesday, said the findings are based on an "expanded analysis and threat intelligence from our continu...

Microsoft Links Ongoing SharePoint Exploits to Three Chinese Hacker Groups

Microsoft has formally tied the exploitation of security flaws in internet-facing SharePoint Server instances to two Chinese hacking groups called Linen Typhoon and Violet Typhoon as early as July 7, 2025, corroborating earlier reports. The tech giant said it also observed a third China-based...

Packet Storm New Exploits for June, 2025

This archive contains all of the 126 exploits added to Packet Storm in June, 2025...

Packet Storm New Exploits for May, 2025

This archive contains all of the 129 exploits added to Packet Storm in May, 2025...

CVE-2024-53881

NVIDIA vGPU software contains a vulnerability in the host driver, where it can allow a guest to cause an interrupt storm on the host, which may lead to denial of service...

CVE-2021-38294

A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution RCE prior to authentication...

CVE-2018-11779

In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user provided bytes into a Java class...

CVE-2010-2158

Multiple cross-site scripting XSS vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the 1 fullname, 2 phone, or 3 im parameter in a stormperson action to index.php...

CVE-2019-0202

The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm. In Apache Storm versions 0.9.1-incubating to 1.2.2, it is possible to read files off the host's file system that were not intended to be accessible via these endpoints...

CVE-2011-2058

The cat6000-dot1x component in Cisco IOS 12.2 before 12.233SXI7 does not properly handle an external loop between a pair of dot1x enabled ports, which allows remote attackers to cause a denial of service traffic storm via unspecified vectors that trigger many unicast EAPoL Protocol Data Units PDU...

CVE-2011-2057

The cat6000-dot1x component in Cisco IOS 12.2 before 12.233SXI7 does not properly handle 1 a loop between a dot1x enabled port and an open-authentication dot1x enabled port and 2 a loop between a dot1x enabled port and a non-dot1x port, which allows remote attackers to cause a denial of service...

CVE-2012-2963

The administrative interface in the embedded web server on the BreakingPoint Storm appliance before 3.0 does not require authentication for the gwt/BugReport script, which allows remote attackers to obtain sensitive information by downloading a .tgz file...