KNUCKLEBALL: Python Script Used in SonicWall Exploitation
KNUCKLEBALL is a Python script deployed by threat actors to launch Suo5, an open-source HTTP proxy, and a Behinder-like web shell named…
Tag: web shell
ORANGETAIL: Custom Java Web Shell Deployed in SonicWall Attacks
ORANGETAIL is a Behinder-like custom Java web shell used by threat actors to maintain persistent access on compromised SonicWall SMA 1000 appliances.…
SonicWall SMA Zero-Days Exploited Before Disclosure to Gain Root Access
A previously undocumented threat actor, tracked as UTA0533 by Volexity, exploited two zero-day vulnerabilities in SonicWall Secure Mobile Access (SMA) 1000 series…
Weekly Cybersecurity Recap: ShareFile Threat, Citrix Bleed 2 Ransomware, AI Coding Attacks, and More
This week's cybersecurity landscape is marked by a series of critical threats and vulnerabilities. Progress has urged ShareFile customers to shut down…
SHELLSTORM: Large-Scale Web Shell Access Brokerage Operation
SHELLSTORM is a large-scale operation that exploited 27 CVEs in WordPress plugins to deploy web shells on over 1.4 million domains. The…
CVE-2025-6389: Sneeit Framework Vulnerability
A vulnerability in the Sneeit Framework exploited in a global CMS campaign for web shell deployment.
CVE-2025-12352: Gravity Forms WordPress Plugin Vulnerability
A vulnerability in the Gravity Forms WordPress plugin exploited in a global CMS campaign for web shell deployment.
CVE-2025-32432: Craft CMS Vulnerability
A vulnerability in Craft CMS exploited in a global CMS campaign for web shell deployment.
CVE-2026-3395: MaxSite CMS Vulnerability
A vulnerability in MaxSite CMS exploited in a global CMS campaign for web shell deployment.
CVE-2026-29014: MetInfo CMS Vulnerability
A vulnerability in MetInfo CMS exploited in a global CMS campaign for web shell deployment.