Threat Landscape Update
Weekly Threat Landscape Briefing
Executive Summary
NEW
Likelihood: High | Potential Impact: High | Confidence: High An actively exploited, critical remote code execution (RCE) vulnerability in Oracle Identity Manager (CVE-2025-61757) has been added to CISA's KEV catalog, indicating a significant and immediate threat to identity and access management systems
Likelihood: High | Potential Impact: High | Confidence: High An actively exploited, critical remote code execution (RCE) vulnerability in Oracle Identity Manager (CVE-2025-61757) has been added to CISA's KEV catalog, indicating a significant and immediate threat to identity and access management systems.
Likelihood: High | Potential Impact: High | Confidence: High An actively exploited, critical remote code execution (RCE) vulnerability in Oracle Identity Manager (CVE-2025-61757) has been added to CISA's KEV catalog, indicating a significant and immediate threat to identity and access management systems.
- Likelihood
- High
- Impact
- High
- Confidence
- High** An actively exploited, critical remote code execution (RCE) vulnerability in Oracle Identity Manager (CVE-2025-61757) has been added to CISA's KEV catalog, indicating a significant and immediate threat to identity and access management systems
NEW
Likelihood: High | Potential Impact: High | Confidence: High Threat actors are exploiting a patched vulnerability in Microsoft Windows Server Update Services (WSUS) (CVE-2025-59287) to deploy the ShadowPad backdoor, posing a severe risk of deep network compromise for organizations using WSUS for patch management
Likelihood: High | Potential Impact: High | Confidence: High Threat actors are exploiting a patched vulnerability in Microsoft Windows Server Update Services (WSUS) (CVE-2025-59287) to deploy the ShadowPad backdoor, posing a severe risk of deep network compromise for organizations using WSUS for patch management.
Likelihood: High | Potential Impact: High | Confidence: High Threat actors are exploiting a patched vulnerability in Microsoft Windows Server Update Services (WSUS) (CVE-2025-59287) to deploy the ShadowPad backdoor, posing a severe risk of deep network compromise for organizations using WSUS for patch management.
- Likelihood
- High
- Impact
- High
- Confidence
- High** Threat actors are exploiting a patched vulnerability in Microsoft Windows Server Update Services (WSUS) (CVE-2025-59287) to deploy the ShadowPad backdoor, posing a severe risk of deep network compromise for organizations using WSUS for patch management
NEW
Likelihood: Medium | Potential Impact: High | Confidence: High A widespread software supply chain campaign, "Shai-Hulud," is compromising hundreds of npm packages to steal developer credentials, creating a substantial risk of downstream attacks and intellectual property theft
Likelihood: Medium | Potential Impact: High | Confidence: High A widespread software supply chain campaign, "Shai-Hulud," is compromising hundreds of npm packages to steal developer credentials, creating a substantial risk of downstream attacks and intellectual property theft.
Likelihood: Medium | Potential Impact: High | Confidence: High A widespread software supply chain campaign, "Shai-Hulud," is compromising hundreds of npm packages to steal developer credentials, creating a substantial risk of downstream attacks and intellectual property theft.
- Likelihood
- Medium
- Impact
- High
- Confidence
- High** A widespread software supply chain campaign, "Shai-Hulud," is compromising hundreds of npm packages to steal developer credentials, creating a substantial risk of downstream attacks and intellectual property theft
NEW
Likelihood: Medium | Potential Impact: High | Confidence: High A maximum-severity (CVSS 10.0) privilege escalation vulnerability (CVE-2025-41115) in Grafana's SCIM component allows for potential user impersonation and full system takeover, affecting organizations that use Grafana for analytics and monitoring
Likelihood: Medium | Potential Impact: High | Confidence: High A maximum-severity (CVSS 10.0) privilege escalation vulnerability (CVE-2025-41115) in Grafana's SCIM component allows for potential user impersonation and full system takeover, affecting organizations that use Grafana for analytics and monitoring.
Likelihood: Medium | Potential Impact: High | Confidence: High A maximum-severity (CVSS 10.0) privilege escalation vulnerability (CVE-2025-41115) in Grafana's SCIM component allows for potential user impersonation and full system takeover, affecting organizations that use Grafana for analytics and monitoring.
- Likelihood
- Medium
- Impact
- High
- Confidence
- High** A maximum-severity (CVSS 10
NEW
Likelihood: Medium | Potential Impact: Medium | Confidence: High A malicious Visual Studio Code extension ("prettier-vscode-plus") found on the official marketplace was used to deploy the Anivia Stealer malware, highlighting an ongoing threat vector targeting software developers
Likelihood: Medium | Potential Impact: Medium | Confidence: High A malicious Visual Studio Code extension ("prettier-vscode-plus") found on the official marketplace was used to deploy the Anivia Stealer malware, highlighting an ongoing threat vector targeting software developers.
Likelihood: Medium | Potential Impact: Medium | Confidence: High A malicious Visual Studio Code extension ("prettier-vscode-plus") found on the official marketplace was used to deploy the Anivia Stealer malware, highlighting an ongoing threat vector targeting software developers.
- Likelihood
- Medium
- Impact
- Medium
- Confidence
- High** A malicious Visual Studio Code extension ("prettier-vscode-plus") found on the official marketplace was used to deploy the Anivia Stealer malware, highlighting an ongoing threat vector targeting software developers
Immediate Priority Actions
- Patch Immediately: Prioritize patching Oracle Identity Manager for CVE-2025-61757, as it is under active exploitation.
- Patch & Hunt: Apply the patch for the WSUS vulnerability (CVE-2025-59287) and hunt for signs of post-exploitation activity, such as unusual processes spawned by WSUS services.
- Audit Developer Environments: Instruct development teams to audit all npm packages for signs of the "Shai-Hulud" campaign and remove the malicious "prettier-vscode-plus" VSCode extension.
- Update Grafana: Immediately update Grafana instances to remediate the critical CVE-2025-41115 vulnerability, especially where SCIM is used for user provisioning.
- Monitor Supply Chain: Review access logs for third-party applications connected to Salesforce following the Gainsight breach and notify customers of the Iberia Airlines supplier breach if relevant.
Additional Intelligence Sections
Vulnerability & Exploitation Watch
| CVE | Product/Version | CVSS v3.1 | EPSS (%) | KEV? | Exploit Availability | Affected in estate? | Patch/Config Fix | Priority | Rationale | Sources (URL, UTC) |
|---|---|---|---|---|---|---|---|---|---|---|
| CVE-2025-61757 | Oracle Identity Manager | 9.8 | — | Yes | In the Wild | Unknown | Patch available | P1 | Critical RCE in an identity product, confirmed exploited. Mandated by CISA KEV. | CISA (2025-11-21T12:00:00Z) |
| CVE-2025-59287 | Microsoft Windows Server Update Services (WSUS) | — | — | No | In the Wild | Unknown | Patch available | P1 | Actively exploited RCE in a core infrastructure management tool, leading to ShadowPad deployment. | Security Affairs (2025-11-24T12:35:42Z) |
| CVE-2025-41115 | Grafana (SCIM Component) | 10.0 | — | No | Theoretical | Unknown | Patch available | P2 | Maximum severity vulnerability allowing privilege escalation in a widely used analytics platform. | SOC Prime (2025-11-24T11:24:23Z), THN (2025-11-21T21:10:00+0530) |
| CVE-2025-11001 | 7-Zip | — | — | No | PoC Available | Unknown | Manual update to v25.01 | P2 | Critical vulnerability with a public exploit in a ubiquitous file archive utility. | HackRead (2025-11-23T12:48:05Z) |
| CVE-2025-58034 | Fortinet FortiWeb | 6.7 | — | No | In the Wild | Unknown | Patch available | P2 | Authenticated OS command injection vulnerability confirmed exploited in the wild. | THN (2025-11-19T09:50:00+0530) |
| CVE-2025-40601 | SonicWall SonicOS (SSLVPN) | 7.5 | — | No | Theoretical | Unknown | Patch available | P2 | High-severity buffer overflow can cause firewall crashes (Denial of Service). | Security Affairs (2025-11-23T10:34:28Z) |
| CVE-2025-41733 | METZ CONNECT EWIO2 | 9.8 | — | No | Theoretical | Unknown | Update to firmware v2.2.0 | P3 | Critical authentication bypass in an ICS product allows root credential setting. | CISA (2025-11-18T12:00:00Z) |
| CVE-2024-3871 | Emerson Appleton UPSMON-PRO | 9.8 | — | No | Theoretical | Unknown | End-of-Life product. Block UDP port 2601. | P3 | Critical stack-based buffer overflow in an End-of-Life ICS product. | CISA (2025-11-20T12:00:00Z) |
Indicators of Compromise (IOCs)
No new, high-confidence indicators of compromise were identified in the provided sources this week. Most reporting focused on vulnerabilities and TTPs rather than specific infrastructure.
Threat Actors & Campaigns
- Name: China-linked APTs
- Sponsor/Motive: State-sponsored / Espionage, Information Theft
- Targeting: Broad, including Russian IT sector (APT31), aerospace, and various entities in Taiwan.
- Typical TTPs: T1190 (Exploit Public-Facing Application), T1588.002 (Tool: Code Repositories), T1059.001 (PowerShell), T1574.002 (DLL Side-Loading).
- Recent Activity:
- Observed exploiting CVE-2025-59287 (WSUS) to deliver ShadowPad malware (The Hacker News, 2025-11-24T12:48:00+0530).
- APT24 (aka BadAudio group) conducted a nearly three-year campaign using supply chain attacks to deploy the BADAUDIO malware (The Hacker News, 2025-11-21T16:12:00+0530).
- APT31 targeted the Russian IT sector between 2024-2025 using cloud services to maintain persistence (The Hacker News, 2025-11-22T20:49:00+0530).
- Confidence: High
Sector & Geo Risk Signals
- Technology Sector: Russian IT companies, particularly those serving as government contractors, were targeted by China-linked APT31 in long-term espionage campaigns (The Hacker News, 2025-11-22T20:49:00+0530).
- Travel/Aviation Sector: Iberia Airlines notified customers of a data breach stemming from a compromise at a third-party supplier (BleepingComputer, 2025-11-23T08:46:25-0500).
- Legal & Regulatory: The U.S. SEC has voluntarily dismissed its lawsuit against SolarWinds and its CISO, a significant development in the legal landscape regarding CISO liability for security incidents (The Hacker News, 2025-11-21T13:35:00+0530).
Third-Party & Supply Chain Notes
- UPDATE: Iberia Airlines has disclosed a data breach originating from a third-party supplier, days after a threat actor claimed to have stolen 77GB of data (Security Affairs, 2025-11-23T17:25:24+0000). The scope of exposed customer data is not yet fully detailed.
- NEW: Salesforce / Gainsight: Salesforce issued a security advisory regarding unusual activity involving Gainsight-published applications, which may have enabled unauthorized access to some customers' Salesforce data (The Hacker News, 2025-11-21T11:02:00+0530).
- NEW: npm Registry: The "Shai-Hulud" campaign represents a significant supply chain threat, compromising hundreds of developer packages to steal credentials via preinstall scripts (The Hacker News, 2025-11-24T18:33:00+0530).
- NEW: VSCode Marketplace: A malicious extension named 'prettier-vscode-plus' was identified and removed from the official marketplace. It was designed to deploy the Anivia Stealer malware on developer machines (HackRead, 2025-11-24T12:43:57+0000).
Detections & Response Playbook Updates
- New/Updated Sigma Rules:
9d58e38bbcd2: Updated rule for "Potential CVE-2024-3400 Exploitation" to improve selection criteria (SigmaHQ GitHub, 2025-11-24T08:54:29.000Z).bbbfb67ab0a2: Added new rules for "Atomic MacOS Stealer" persistence and file grabber activity (SigmaHQ GitHub, 2025-11-24T02:52:52.000Z).37024247ae01: Added a new rule for "Suspicious Kerberos Ticket Request via CLI" (SigmaHQ GitHub, 2025-11-23T15:27:40.000Z).0d7658fb3a66: Added new rules for "Windows Default Domain GPO Modification" (SigmaHQ GitHub, 2025-11-23T14:51:08.000Z).5121401b0184: Added new rule for "HackTool - WSASS Execution" and updated detection for PPL Tampering via WerFaultSecure (SigmaHQ GitHub, 2025-11-23T14:15:17.000Z).
Assumptions, Gaps, and Tasking
- Assumptions:
- We assume the organization operates a standard enterprise environment that includes Microsoft Windows Servers (and potentially WSUS), identity management solutions, and software development teams using common tools like npm and VSCode. (Confidence: High)
- Intelligence Gaps:
- The specific compromised npm packages in the "Shai-Hulud" campaign are not listed in the provided sources.
- Specific Indicators of Compromise (IPs, domains, hashes) for the active exploitation of CVE-2025-61757 (Oracle) and CVE-2025-59287 (WSUS) are not available in these reports.
- The full scope and impact of the Iberia and Gainsight/Salesforce supply chain incidents are still unknown.
- Tasking:
- Asset Management: Identify all instances of Oracle Identity Manager, WSUS servers, and Grafana installations within the environment. Confirm their patch status and exposure.
- SOC/Threat Hunting:
- Initiate a 30-day retro-hunt for anomalous process chains on all WSUS servers.
- Hunt for evidence of the 'prettier-vscode-plus' extension or its associated malware, Anivia Stealer, on developer endpoints.
- Development/DevSecOps:
- Communicate the threat of the "Shai-Hulud" campaign to all development teams.
- Mandate scans of all active projects for dependencies potentially affected by this or similar campaigns.
Source Log
- AhnLab SEcurity intelligence Center (via Security Affairs). (2025, November 24). Attackers deliver ShadowPad via newly patched WSUS RCE bug. https://securityaffairs.com/185007/malware/attackers-deliver-shadowpad-via-newly-patched-wsus-rce-bug.html
- BleepingComputer. (2025, November 21). CISA warns Oracle Identity Manager RCE flaw is being actively exploited. https://www.bleepingcomputer.com/news/security/cisa-warns-oracle-identity-manager-rce-flaw-is-being-actively-exploited/
- BleepingComputer. (2025, November 23). Iberia discloses customer data leak after vendor security breach. https://www.bleepingcomputer.com/news/security/iberia-discloses-customer-data-leak-after-vendor-security-breach/
- CISA. (2025, November 20). Emerson Appleton UPSMON-PRO. https://www.cisa.gov/news-events/ics-advisories/icsa-25-324-06
- CISA. (2025, November 18). METZ CONNECT EWIO2. https://www.cisa.gov/news-events/ics-advisories/icsa-25-322-05
- CISA. (2025, November 21). CISA Adds One Known Exploited Vulnerability to Catalog. https://www.cisa.gov/news-events/alerts/2025/11/21/cisa-adds-one-known-exploited-vulnerability-catalog
- HackRead. (2025, November 24). Fake Prettier Extension on VSCode Marketplace Dropped Anivia Stealer. https://hackread.com/prettier-extension-vscode-marketplace-anivia-stealer/
- HackRead. (2025, November 23). Critical 7 Zip Vulnerability With Public Exploit Requires Manual Update. https://hackread.com/7-zip-vulnerability-public-exploit-manual-update/
- Infosecurity Magazine. (2025, November 24). CISA Urges Patch of Actively Exploited Flaw in Oracle Identity Manager. https://www.infosecurity-magazine.com/news/cisa-kev-oracle-identity-manager/
- Infosecurity Magazine. (2025, November 21). New Gainsight Supply Chain Hack Could Affect Salesforce Customers. https://www.infosecurity-magazine.com/news/new-gainsight-supply-chain-hack/
- Security Affairs. (2025, November 23). Iberia discloses security incident tied to supplier breach. https://securityaffairs.com/184985/data-breach/iberia-discloses-security-incident-tied-to-supplier-breach.html
- Security Affairs. (2025, November 22). U.S. CISA adds an Oracle Fusion Middleware flaw to its Known Exploited Vulnerabilities catalog. https://securityaffairs.com/184935/security/u-s-cisa-adds-an-oracle-fusion-middleware-flaw-to-its-known-exploited-vulnerabilities-catalog.html
- Security Affairs. (2025, November 23). SonicWall flags SSLVPN flaw allowing firewall crashes. https://securityaffairs.com/184967/security/sonicwall-flags-sslvpn-flaw-allowing-firewall-crashes.html
- SigmaHQ GitHub Commit. (2025, November 24). Merge PR #5769. https://github.com/SigmaHQ/sigma/commit/9d58e38bbcd23d2303d9003af38d8c0e75228d36
- SigmaHQ GitHub Commit. (2025, November 24). Merge PR #5669. https://github.com/SigmaHQ/sigma/commit/bbbfb67ab0a2cb05af5a3f0329ab28f4fac6d3b7
- SigmaHQ GitHub Commit. (2025, November 23). Merge PR #5761. https://github.com/SigmaHQ/sigma/commit/37024247ae013b5e59725d3d05282c71d23aaf47
- SigmaHQ GitHub Commit. (2025, November 23). Merge PR #5717. https://github.com/SigmaHQ/sigma/commit/0d7658fb3a666c11dc89caef9c598c4cdfedb655
- SigmaHQ GitHub Commit. (2025, November 23). Merge PR #5652. https://github.com/SigmaHQ/sigma/commit/5121401b01843e2cc18881eb43025e4c9fa1682e
- SOC Prime. (2025, November 24). CVE-2025-41115: A Maximum-Severity Privilege Escalation Vulnerability in the Grafana SCIM Component. https://socprime.com/blog/cve-2025-41115-vulnerability/
- The Hacker News. (2025, November 24). Second Shai-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft. https://thehackernews.com/2025/11/second-Shai-Hulud-wave-affects-25000.html
- The Hacker News. (2025, November 24). ShadowPad Malware Actively Exploits WSUS Vulnerability for Full System Access. https://thehackernews.com/2025/11/shadowpad-malware-actively-exploits.html
- The Hacker News. (2025, November 22). CISA Warns of Actively Exploited Critical Oracle Identity Manager Zero-Day Vulnerability. https://thehackernews.com/2025/11/cisa-warns-of-actively-exploited.html
- The Hacker News. (2025, November 21). Grafana Patches CVSS 10.0 SCIM Flaw Enabling Impersonation and Privilege Escalation. https://thehackernews.com/2025/11/grafana-patches-cvss-100-scim-flaw.html
- The Hacker News. (2025, November 21). Salesforce Flags Unauthorized Data Access via Gainsight-Linked OAuth Activity. https://thehackernews.com/2025/11/salesforce-flags-unauthorized-data.html
- The Hacker News. (2025, November 22). China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services. https://thehackernews.com/2025/11/china-linked-apt31-launches-stealthy.html
- The Hacker News. (2025, November 21). APT24 Deploys BADAUDIO in Years-Long Espionage Hitting Taiwan and 1,000+ Domains. https://thehackernews.com/2025/11/apt24-deploys-badaudio-in-years-long.html
- The Hacker News. (2025, November 19). Fortinet Warns of New FortiWeb CVE-2025-58034 Vulnerability Exploited in the Wild. https://thehackernews.com/2025/11/fortinet-warns-of-new-fortiweb-cve-2025.html
- The Hacker News. (2025, November 21). SEC Drops SolarWinds Case After Years of High-Stakes Cybersecurity Scrutiny. https://thehackernews.com/2025/11/sec-drops-solarwinds-case-after-years.html