CVE-2025-55182

Unit 42 identified an AI-powered espionage campaign, tracked as CL-UNK-1211, targeting government entities and state-affiliated Linux infrastructure from October 2025 to April 2026. The attackers used AI-generated payloads, including malicious PHP scripts and custom malware such as SysGoRAT—a cross-platform Go-based remote access Trojan—to maintain persistence, conduct reconnaissance, and exfiltrate sensitive data like government mailboxes and databases. The campaign employed diverse techniques including web shells, credential harvesting via .bashrc hijacking and PHP loggers, reverse shells, and anti-forensics methods such as log tampering and timestomping to evade detection.

The article discusses the evolving threat landscape due to AI-accelerated development and exploitation, highlighting the importance of Application Security Posture Management (ASPM) to manage increased risk velocity. It references a specific critical vulnerability, CVE-2025-55182 (React2Shell), which enables remote code execution in Next.js applications, leading to widespread exposure across micro-frontends and containerized workloads. The vulnerability results in thousands of findings across repositories and container images, necessitating contextual prioritization to identify exploitable instances. Wiz Code is presented as a solution to correlate scanner findings with cloud exposure and runtime context to prioritize remediation.

Datadog Security Research has identified two credential harvesting platforms, Loot and UltraVault, which are used to inventory, validate, and exploit stolen credentials, including API keys for cloud and AI services. The platforms are accessible without authentication and support automated validation and post-exploitation actions, such as re-probing credentials and recommending local privilege escalation exploits. The attacker infrastructure has been observed abusing Amazon Bedrock through API calls like GetCallerIdentity, ListFoundationModels, and InvokeModel, indicating active exploitation of compromised AWS credentials, including both long-term and temporary STS credentials.

Dysphoria 是一个自2026年初开始活跃的新兴僵尸网络家族，已控制超过20万台设备。该僵尸网络通过弱口令爆破和多个已知IoT漏洞进行传播，包括CVE-2017-17215、CVE-2020-8515等。其技术演进迅速，引入了基于以太坊ENS和Solana SNS区块链域名的C2隐蔽解析机制，并将受感染主机转化为C2中继节点，增强了抗打击能力。最新变种使用自定义RC4加密算法、UPnP内网穿透和动态中继架构，具备强大的DDoS攻击能力，宣称可达到4Tbps，并已实现商业化攻击服务运营。

The Dysphoria DDoS botnet has infected approximately 200,000 devices worldwide by exploiting weak credentials and known vulnerabilities in IoT devices. It evolved from 'jackskid' and 'fbot' malware, incorporating a blockchain-based command-and-control mechanism using Ethereum ENS and Solana SNS domains for resilience. The botnet conducts DDoS attacks and can transform infected devices into network proxies, leveraging UPnP to expose internal services. Its operators claim a maximum attack capacity of 4 Tbps, promoting the service on a clearnet website as a stress-testing tool.

Next.js is transitioning to a scheduled security release model to address vulnerabilities in a predictable and coordinated manner, replacing ad-hoc patching. This change follows high-severity incidents like React2Shell (CVE-2025-55182), a critical remote code execution flaw in React Server Components that was widely exploited. The new program enables advance notice of patches, allowing organizations time to plan upgrades and implement mitigations. Vercel cites increasing vulnerability discovery rates due to AI-assisted tools as a driver for more frequent and structured releases.

The Gentlemen, also known as Storm-2697, is a Ransomware-as-a-Service (RaaS) operation active since July 2025, believed to have evolved from the Qilin RaaS affiliate ArmCorp. They offer affiliates an unusually high 90% ransom payout, contributing to rapid growth, with over 580 victims claimed across 77 countries by mid-2026. The group uses diverse initial access methods, custom tools like the 'GentleKiller' EDR killer, and exploits vulnerabilities in edge devices and protocols to target enterprises, particularly in manufacturing.