Cybersecurity researchers have uncovered new components in the Cavern (aka Cav3rn) command-and-control (C2) framework, used by Iranian nation-state hackers in attacks targeting…
[MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian…
Group-IB has discovered a new espionage implant named HollowGraph that hijacks Microsoft 365 calendars for command-and-control (C2) and data exfiltration. The malware,…
Iranian state-sponsored hackers affiliated with the Ministry of Intelligence and Security (MOIS) have been using a previously undocumented modular command-and-control (C2) framework…
SmarterMail is an email server product affected by CVE-2025-52691, a remote code execution vulnerability exploited by MuddyWater.
Laravel Livewire is a full-stack framework for Laravel affected by CVE-2025-54068, a remote code execution vulnerability exploited by MuddyWater.
CVE-2025-52691 is a critical remote code execution vulnerability in SmarterMail exploited by MuddyWater in reconnaissance campaigns.
CVE-2025-9316 is a critical vulnerability in N-central allowing unauthenticated sessionID generation, exploited by MuddyWater.
CVE-2025-54068 is a critical remote code execution vulnerability in Laravel Livewire exploited by MuddyWater.
Security researcher Bert-Jan Pals analyzed roughly 3,000 live ClickFix payloads and presented findings at OrangeCon in early June, publishing details on June…