CTI status
As of:
Last pipeline run:
Source reliability
Information credibility
NATO Admiralty (AJP-2.1) grades confidence, independent of the risk score. Cross-source corroboration isn't tracked for non-CVE news, so single-source items are capped at a lower credibility number; a low number does not imply low quality.
The report adds to patch information by indicating an active, state-attributed search for exposed firewalls, putting edge devices in the attack focus independently of any single CVE.
The campaign shows how APT29 attacks mobile devices via a compromised third-party analytics script , a risk that goes beyond classic patch processes.
Active exploitation of Ivanti Connect Secure zero-days by state-backed actors highlights the threat to exposed remote-access infrastructure, even though Ivanti itself is not deployed.
The flaw requires pre-existing local code execution but is rated high at CVSS 8.8 and is well suited as an escalation step after initial compromise.
The alert only describes the vulnerability; there is no information on active exploitation or attack campaigns.
The campaign shows that attackers use external Teams chats for social engineering and deliver malware within 15 minutes , a direct attack vector against Microsoft 365.
The report highlights that backup infrastructure is an attractive target and that deactivating MFA can significantly jeopardize recovery after an attack,even without known active exploitation.
The report adds that a root RCE vulnerability in the APT package manager is exploitable via manipulated HTTP mirrors or proxies and the default retries starting with Ubuntu 22.04.
The vulnerabilities affect peripheral Creative Cloud components (Bridge, Substance 3D) that are often overlooked in patch cycles even though they process local files and file formats.
The report shows that APT retries failed downloads by default, allowing package verification to be bypassed and enabling root code execution.
The advisory provides no CVE IDs or exploitation evidence, so individual vulnerabilities cannot be prioritized specifically.
The BSI update bundles multiple local Linux kernel vulnerabilities without CVE or exploitation details, so prioritization by immediate threat is not possible.
The alert provides no CVE IDs and no evidence of exploitation; it merely confirms that several unspecified flaws exist in UniFi components.
Without a CVE reference, it remains unclear whether patches or exploitation already exist; the attack vector is an opened Office file.