A critical authentication bypass vulnerability has emerged in Nokia’s CloudBand Infrastructure Software (CBIS) and Nokia Container Service (NCS) Manager API, designated as CVE-2023-49564.

This high-severity flaw, scoring 9.6 on the CVSS v3.1 scale, enables unauthorized attackers to circumvent authentication mechanisms through specially crafted HTTP headers, potentially granting complete access to restricted API endpoints without valid credentials.

The vulnerability affects CBIS 22 and NCS 22.12 versions, impacting enterprises, service providers, and public sector organizations utilizing Nokia’s cloud and network infrastructure solutions.

The flaw was publicly disclosed on September 18, 2025, following discovery by Orange Cert researchers who identified the security gap during routine security assessments.

Nokia security researchers identified the root cause as a weak verification mechanism embedded within the authentication implementation of the Nginx Podman container running on the CBIS/NCS Manager host machine.

This architectural weakness allows threat actors to manipulate HTTP header fields to trick the authentication system into believing a request is legitimate.

The exploitation vector requires adjacent network access (CVSS AV:A), making it particularly concerning for enterprise environments where attackers might already have gained initial network foothold.

Once exploited, the vulnerability provides complete compromise capabilities with high confidentiality, integrity, and availability impact, allowing attackers to access sensitive configuration data, modify system settings, and potentially disrupt network operations.

Technical Attack Mechanism

The authentication bypass operates through header manipulation targeting the Nginx container’s verification logic.

When processing API requests, the system fails to properly validate authentication tokens embedded in HTTP headers, creating an opportunity for crafted requests to bypass security controls.

The vulnerability allows unauthenticated users to reach sensitive endpoints that should require administrative privileges.

Organizations can partially mitigate risks by implementing external firewall restrictions on management network access while applying the patches provided in CBIS 22 FP1 MP1.2 and NCS 22.12 MP3 versions.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Nokia CBIS/NCS Manager API Vulnerability Let Attackers Bypass Authentication appeared first on Cyber Security News.

In early 2025, cybersecurity researchers observed an unprecedented collaboration between two Russian APT groups targeting Ukrainian organizations.

Historically, Gamaredon has focused on broad spear-phishing campaigns against government and critical infrastructure, while Turla has specialized in high-value cyberespionage using sophisticated implants.

Their joint operations mark a significant escalation: Gamaredon gains initial access using its established toolkit, then Turla deploys its advanced Kazuar backdoor to maintain stealthy long-term presence.

This alliance leverages Gamaredon’s noisy compromise methods to deliver Turla’s modular espionage implant on carefully selected machines, suggesting a strategic alignment within the FSB’s internal cyber-intelligence apparatus.

Emerging primarily through malicious LNK files and spear-phishing emails delivered via removable media, the attack chain begins with Gamaredon’s PteroGraphin downloader.

Once on a victim system, PteroGraphin retrieves additional payloads through encrypted Telegra.ph channels. On February 27, 2025, PteroGraphin, residing at %APPDATA%\86.ps1, fetched and decrypted a second-stage downloader, PteroOdd, using a hardcoded 3DES key.

PteroOdd then retrieved and executed Kazuar v3 in memory by side-loading into legitimate processes, effectively evading conventional defenses.

Welivesecurity analysts noted this dual-stage delivery mechanism was critical in restarting and deploying Kazuar implants after initial crashes or installation of endpoint security products.

The seamless handoff between Gamaredon tools and Turla’s backdoor illustrates an evolution in Russian APT tactics, where inter-group cooperation amplifies impact while limiting detection.

Despite Gamaredon’s hundreds of noisy intrusions, Turla selectively installs Kazuar only on machines deemed highly valuable.

This precision targeting reduces the implant’s exposure and minimizes forensic footprints.

Once deployed, Kazuar v3 establishes encrypted command-and-control channels over WebSockets and Exchange Web Services, supporting three distinct roles—KERNEL, BRIDGE, and WORKER—to modularize functionality and maintain resilience against takedown attempts.

Infection Mechanism Deep Dive

The infection mechanism of Kazuar centers on sophisticated PowerShell loaders and side-loading techniques that exploit legitimate Windows processes. After PteroOdd retrieves the base64-encoded PowerShell payload, it executes a command similar to:-

Start-Process -FilePath "C:\Program Files\SomeApp\vncutil64[.]exe" -ArgumentList "- EncodedCommand","[base64-encoded Kazuar loader]"

This approach masks the backdoor as part of a trusted application, preventing signature-based detection.

The loader writes a DLL named LaunchGFExperienceLOC[.]dll alongside LaunchGFExperience[.]exe, initiating Kazuar’s launch through DLL side-loading.

In memory, two distinct KERNEL payloads appear, labeled AGN-RR-01 and AGN-XX-01, indicating redundant execution paths that enhance implant robustness.

Once active, Kazuar collects system metadata—computer name, volume serial number, running processes—and exfiltrates these via a Cloudflare Workers subdomain under Turla’s control.

Subsequent HTTP POSTs confirm successful implant launch and provide bridge nodes with adaptive payloads. By leveraging dynamic loader scripts and dual-payload execution chains, Turla ensures continuous access even if one delivery path fails or is detected.

This infection mechanism underscores the sophistication of modern APT alliances: combining Gamaredon’s wide reach with Turla’s stealth backdoor yields a versatile espionage capability capable of infiltrating high-value targets while minimizing detection risk.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Russian Hacking Groups Gamaredon and Turla Attacking Organizations to Deploy Kazuar Backdoor appeared first on Cyber Security News.

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning regarding sophisticated malware campaigns targeting Ivanti Endpoint Manager Mobile (EPMM) systems.

Cybercriminals are actively exploiting two critical vulnerabilities, CVE-2025-4427 and CVE-2025-4428, to deploy advanced persistent threats that enable complete system compromise and arbitrary code execution on targeted servers.

The attack campaign emerged shortly after Ivanti disclosed the vulnerabilities on May 13, 2025, with threat actors beginning exploitation around May 15, 2025, following the publication of proof-of-concept code.

The vulnerabilities affect all Ivanti EPMM versions including 11.12.0.4 and prior, 12.3.0.1 and prior, 12.4.0.1 and prior, and 12.5.0.0 and prior, representing a significant attack surface for organizations relying on mobile device management infrastructure.

The malicious actors demonstrate sophisticated techniques by chaining CVE-2025-4427, an authentication bypass vulnerability, with CVE-2025-4428, a code injection flaw, to gain unauthorized access to EPMM deployments.

Once inside the system, attackers target the /mifs/rs/api/v2/ endpoint using HTTP GET requests with malicious remote commands embedded in the ?format= parameter, enabling them to collect system information, download malicious payloads, enumerate network resources, and extract LDAP credentials.

CISA Cyber Team analysts identified two distinct malware sets during their investigation, each containing sophisticated loaders and malicious listeners designed to maintain persistent access to compromised infrastructure.

The first set consists of three components: Loader 1 (web-install.jar), ReflectUtil.class, and SecurityHandlerWanListener.class, while the second set includes Loader 2 (web-install.jar) and WebAndroidAppInstaller.class, with each component serving specific functions in the attack chain.

The threat actors employ advanced evasion techniques to bypass security controls and deliver their malware effectively.

Rather than uploading complete malicious files that might trigger security alerts, the attackers segment their payloads into multiple Base64-encoded chunks and transmit each segment through separate HTTP requests.

This approach serves dual purposes: circumventing signature-based detection systems and avoiding file size limitations that might prevent successful malware deployment.

Advanced Payload Delivery and Persistence Mechanisms

The malware deployment process showcases remarkable technical sophistication in how threat actors establish and maintain persistence on compromised systems.

The attack begins with Java Expression Language injection techniques that create malicious JAR files in the /tmp directory through a methodical chunk-based reconstruction process.

For the initial payload delivery, attackers craft HTTP GET requests containing Java EL injection code that creates FileOutputStream objects to write Base64-decoded malware segments directly to the target system.

The malicious request structure follows this pattern: GET /mifs/rs/api/v2/featureusage?format=${""getClass().forName("java.io.FileOutputStream").getConstructor("".getClass(),"".getClass().forName("[Z").getComponentType()).newInstance("/tmp/web-install.jar",true).write("".getClass().forName("java.util.Base64").getMethod("getDecoder").invoke(null).decode("[BASE64_CHUNK]"))}.

This technique enables the malware to evade signature-based detection while reconstructing complete executable files on the target system.

Once the malware components are successfully deployed, Set 1 operates through a sophisticated three-stage process.

Loader 1 contains and dynamically loads ReflectUtil.class, which then manipulates Java objects to inject SecurityHandlerWanListener into the Apache Tomcat server running on the compromised system.

The ReflectUtil.class component bypasses Java Development Kit module restrictions, iterates through object contexts, and attempts to load the malicious listener class using hard-coded strings that masquerade as legitimate JUnit framework components.

SecurityHandlerWanListener establishes a persistent backdoor by intercepting specific HTTP requests containing predetermined authentication tokens.

The listener monitors for requests containing the string “pass 7c6a8867d728c3bb”, a “Referer” header, and the header value “https://www[.]live.com”.

When these conditions are met, the malware retrieves Base64-encoded payloads from the request stream, decodes them, and decrypts the data using AES encryption with the stored key, creating new Java class files that enable arbitrary code execution.

Set 2 operates through a more streamlined but equally effective approach, with Loader 2 containing and loading WebAndroidAppInstaller.class at runtime.

This component masquerades as part of the legitimate com.mobileiron.service package and intercepts HTTP requests with specific Content-Type headers containing “application/x-www-form-urlencoded”.

The malware retrieves password parameters from incoming requests, performs Base64 decoding and AES decryption using the hard-coded key “3c6e0b8a9c15224a”, and dynamically creates new malicious classes based on the decrypted instructions.

The sophisticated nature of these attacks demonstrates the threat actors’ deep understanding of Java-based enterprise applications and their ability to exploit complex software architectures for persistent access.

Organizations must immediately upgrade their Ivanti EPMM installations to the latest patched versions and implement additional monitoring for mobile device management systems, treating them as high-value assets requiring enhanced security controls and continuous surveillance.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post CISA Warns of Hackers Exploiting Ivanti Endpoint Manager Mobile Vulnerabilities to Deploy Malware appeared first on Cyber Security News.

The emergence of a new campaign weaponizing legitimate remote monitoring and management software has alarmed security teams worldwide.

Attackers are distributing trojanized installers for ConnectWise ScreenConnect—now known as ConnectWise Control—to deliver dual payloads: the widely used AsyncRAT and a custom PowerShell-based RAT.

By leveraging trusted software footprints and open directories, adversaries bypass signature-based defenses and maintain long-term access to compromised networks.

Initial incidents surfaced in May 2025, when analysts observed anomalous ScreenConnect installers hosted on exposed file servers.

These installers contained ClickOnce loaders that, upon execution, fetched malicious components at runtime rather than embedding payloads directly.

In one instance, a compromised installer silently launched a VBS script that executed a weaponized shortcut, triggering PowerShell with execution-policy bypass to run a loader script.

Hunt.io Cyber Team researchers identified this tactic after correlating telemetry from multiple exposed hosts and correlating IOCs across open directories.

Subsequent analysis revealed a repeatable infrastructure pattern. Infected installers pivoted to repositories hosting .zip archives named logs.ldk, logs.idk, and logs.idr, which unpacked into dropper scripts (Ab.vbs or Ab.js), the PowerShell loader (Skype.ps1), a native injector DLL (libPK.dll), and a shortcut file (Microsoft.lnk).

The VBS launcher uses WScript.Shell to invoke the shortcut, which in turn runs PowerShell with hidden windows to launch Skype.ps1.

This script reconstructs an embedded payload blob, invokes the DLL’s exported Execute function for in-memory native staging, and creates a scheduled task named SystemInstallTask for persistence.

Infection Mechanism

The infection chain begins with a seemingly benign ScreenConnect client installer.

Once executed, it drops the VBS loader (Ab.vbs) into a public folder and registers a Windows shortcut. The shortcut’s target is crafted to launch PowerShell with -ExecutionPolicy Bypass -WindowStyle Hidden, calling a small script file named Skype.ps1.

Skype.ps1 contains base64-encoded payload segments that it decodes into a .NET assembly or native shellcode, depending on detected security products.

If the script detects antivirus like TotalAV or Avast, it performs in-memory assembly loading via System.Reflection.Assembly.Load; otherwise it dynamically imports libPK.dll using PowerShell’s Add-Type and calls Execute to inject payloads into legitimate host processes.

To maintain resilience, the loader also schedules recurring tasks (every 2–10 minutes) ensuring rapid re-execution if terminated.

Additionally, the use of open directories for initial staging allows attackers to rotate files and domains frequently, complicating detection.

The combination of modular scripts, scheduled tasks, and dual execution paths exemplifies a sophisticated multi-stage delivery framework that blends legitimate RMM software abuse with bespoke RAT payloads.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Beware of Weaponized ScreenConnect App That Delivers AsyncRAT and PowerShell RAT appeared first on Cyber Security News.