Clop Ransomware Group’s Custom Web Shell Tactics
Clop (aka Cl0p) is a prolific ransomware group known for mass exploitation of file transfer and PLM software. They deploy custom web…
Tag: web shell
CVE-2026-0740: Ninja Forms WordPress Plugin Vulnerability
A vulnerability in the Ninja Forms WordPress plugin exploited in a global CMS campaign for web shell deployment.
CVE-2025-12057: WavePlayer WordPress Plugin Vulnerability
A vulnerability in the WavePlayer WordPress plugin exploited in a global CMS campaign for web shell deployment.
CVE-2025-7852: WPBookit WordPress Plugin Vulnerability
A vulnerability in the WPBookit WordPress plugin exploited in a global CMS campaign for web shell deployment.
CVE-2026-3844: Breeze Cache WordPress Plugin Vulnerability
A vulnerability in the Breeze Cache WordPress plugin exploited in a global CMS campaign for web shell deployment.
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence…
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
A suspected China-aligned threat activity cluster tracked as UNK_MassTraction by Proofpoint has been exploiting critical Roundcube webmail vulnerabilities to target physics and…
SquareShell: Web Shell Deployed via Roundcube RCE
SquareShell is a web shell deployed by UNK_MassTraction using a PHP gadget shell command after exploiting CVE-2025-49113 in Roundcube. It is accessible…
CVE-2024-12356: Previously Exploited BeyondTrust Vulnerability
A previously exploited security flaw in BeyondTrust Remote Support and PRA products that allowed attackers to deploy web shells and backdoors.
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks…