AtRisk: The Consensus Security Vulnerability Alert

ISC provides a free analysis and warning service to thousands of Internet users and organizations, and is actively working with Internet Service Providers to fight back against the most malicious attackers. https://isc.sans.edu/about.html

It's 2025... so why are obviously malicious advertising URLs still going strong?

Published: 2025-04-21

Last Updated: 2025-04-21 08:48:44 UTC

by Jan Kopriva (Version: 1)

While the old adage stating that 'the human factor is the weakest link in the cyber security chain' will undoubtedly stay relevant in the near (and possibly far) future, the truth is that the tech industry could Ð and should Ð help alleviate the problem significantly more than it does today.

One clear example of this was provided by a phishing e-mail that was delivered to our mailbox here at the Internet Storm Center this morning.

For anyone aware of modern phishing techniques, the fact that the message was fraudulent would have been obvious at first glance, as you may see from the following pictureÉ In fact, it even used a 'standard' layout that has been commonly used in phishing campaigns for some time now ...

Read the full entry: https://isc.sans.edu/diary/Its+2025+so+why+are+obviously+malicious+advertising+URLs+still+going+strong/31880/

RedTail, Remnux and Malware Management [Guest Diary]

Published: 2025-04-16

Last Updated: 2025-04-17 01:05:49 UTC

by Guy Bruneau (Version: 1)

[This is a Guest Diary by Jacob Claycamp, an ISC intern as part of the SANS.edu BACS program]

Introduction

When I first saw malware being uploaded to my honeypot, I was lacking the requisite experience to reverse engineer it, and to understand what was happening with the code. Even though I could use any text editor to examine the associated scripts that were being uploaded with RedTail malware, I couldn't see what was happening with the RedTail malware itself. So, I decided to create a how-to on setting up a malware analysis program.

The malware analysis platform I chose to use, is Remnux which is a linux distribution, packaged with a variety of analysis tools originally created by Lenny Zeltser, a SANS instructor. My original intent for the Remnux environment was to set it up inside a docker, so it was completely isolated from my computer. This way if I accidentally detonated a malware sample, I could easily just wipe away the docker. I can also wipe away the docker, after I've finished analyzing a sample, and start with a fresh install each time I begin a new investigation.

For this how-to, I'll also make use of kasm workspaces which is a docker container streaming platform, and I'll deploy it inside of a free tier of AWS EC2 instance, this approach will make it easy to access your workspace, from a web browser.

Read the full entry: https://isc.sans.edu/diary/RedTail+Remnux+and+Malware+Management+Guest+Diary/31868/

Honeypot Iptables Maintenance and DShield-SIEM Logging (2025.04.23) https://isc.sans.edu/diary/Honeypot+Iptables+Maintenance+and+DShieldSIEM+Logging/31876/

xorsearch.py: "Ad Hoc YARA Rules" (2025.04.22) https://isc.sans.edu/diary/xorsearchpy+Ad+Hoc+YARA+Rules/31856/

Wireshark 4.4.6 Released (2025.04.20) https://isc.sans.edu/diary/Wireshark+446+Released/31872/

The list is assembled by pulling recent vulnerabilities from NIST NVD, Microsoft, Twitter mentions of vulnerabilities, ISC Diaries and Podcast, and the CISA list of known exploited vulnerabilities. There are also some unscored, but significant, vulnerabilities at the end. This includes vulnerabilities that have not been added to the NVD yet.

CVE-2025-31200 - tvOS, visionOS, iOS, iPadOS, and macOS Sequoia are vulnerable to memory corruption from processing a maliciously crafted media file, potentially leading to code execution, with reports suggesting this vulnerability may have been exploited in sophisticated attacks against certain targeted individuals on iOS.

tvOS, visionOS, iOS, iPadOS, and macOS Sequoia are vulnerable to memory corruption from processing a maliciously crafted media file, potentially leading to code execution, with reports suggesting this vulnerability may have been exploited in sophisticated attacks against certain targeted individuals on iOS.

Product: Apple macOS

CVSS Score: 7.5

** KEV since 2025-04-17 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-31200

NVD References:

• https://support.apple.com/en-us/122282
• https://support.apple.com/en-us/122400
• https://support.apple.com/en-us/122401
• https://support.apple.com/en-us/122402

CVE-2025-31201

tvOS, visionOS, iOS, iPadOS, and macOS Sequoia versions 18.4.1 and 15.4.1 are vulnerable to an attack that may allow an attacker to bypass Pointer Authentication, potentially exploited in highly sophisticated attacks on specific individuals.

Product: Apple macOS

CVSS Score: 6.8

** KEV since 2025-04-17 **

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-31201

NVD References:

• https://support.apple.com/en-us/122282
• https://support.apple.com/en-us/122400
• https://support.apple.com/en-us/122401
• https://support.apple.com/en-us/122402

CVE-2025-24797

Meshtastic is vulnerable to an attacker-controlled buffer overflow via invalid protobuf data in mesh packets, potentially leading to remote code execution without authentication or user interaction, fixed in version 2.6.2.

Product: Meshtastic

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24797

NVD References: https://github.com/meshtastic/firmware/security/advisories/GHSA-33hw-xhfh-944r

Meshtastic is vulnerable to an attacker-controlled buffer overflow via invalid protobuf data in mesh packets, potentially leading to remote code execution without authentication or user interaction, fixed in version 2.6.2.

Product: Meshtastic

CVSS Score: 9.4

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-24797

NVD References:

• https://github.com/meshtastic/firmware/security/advisories/GHSA-33hw-xhfh-944r

The TOTOLINK A810R V4.1.2cu.5182_B20201026 router is vulnerable to a remote command execution flaw in the setNoticeCfg function.

Product: TOTOLINK A810R

CVSS Score: 9.8

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-28137

NVD References:

• https://github.com/Zerone0x00/CVE/blob/main/TOTOLINK/CVE-2025-28137.md
• https://sudsy-eyeliner-a59.notion.site/RCE1-1ab72b8cd95f80d09eded269810f3756?pvs=4
• https://sudsy-eyeliner-a59.notion.site/RCE1-1ab72b8cd95f80d09eded269810f3756