Our Weekly Threat Intelligence Summary is compiled by expert threat analysts, highlighting the key threat events you should know about and offering mitigation recommendations.

Top Intelligence Events

Threat Hunting

• Threat Hunt: Neptune RAT
• Date: 04/10/25
• Log Dependencies: EDR Solutions (SentinelOne and CrowdStrike), eSIEMSummary: Neptune is a Remote Access Trojan (RAT) written in Visual Basic .NET. It incorporates multiple features like stealing credentials from over 270 apps, deploying ransomware, and even monitoring desktops in real-time. It tries to avoid antivirus detection and employs anti-analysis techniques to hide its activities. This malware also makes use of the catbox[.]me API to store malicious scripts and files. Recently, the latest version of the malware was shared on GitHub by its developer.

Top Intelligence Trends

Vulnerabilities

• CVE-2025-0282 – A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
• CVE-2025-29927 – Next.js is a React framework for building full-stack web applications. Prior to 14.2.25 and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. If patching to a safe version is infeasible, it is recommended that you prevent external user requests which contain the x-middleware-subrequest header from reaching your Next.js application. This vulnerability is fixed in 14.2.25 and 15.2.3.
• CVE-2024-55591 – An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.
• CVE-2025-24813 – Path Equivalence: ‘file.Name’ (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files via write enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.2, from 10.1.0-M1 through 10.1.34, from 9.0.0.M1 through 9.0.98. If all of the following were true, a malicious user was able to view security sensitive files and/or inject content into those files: – writes enabled for the default servlet (disabled by default) – support for partial PUT (enabled by default) – a target URL for security sensitive uploads that was a sub-directory of a target URL for public uploads – attacker knowledge of the names of security sensitive files being uploaded – the security sensitive files also being uploaded via partial PUT If all of the following were true, a malicious user was able to perform remote code execution: – writes enabled for the default servlet (disabled by default) – support for partial PUT (enabled by default) – application was using Tomcat’s file based session persistence with the default storage location – application included a library that may be leveraged in a deserialization attack Users are recommended to upgrade to version 11.0.3, 10.1.35 or 9.0.99, which fixes the issue.
• CVE-2025-0411 – 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of archived files. When extracting files from a crafted archive that bears the Mark-of-the-Web, 7-Zip does not propagate the Mark-of-the-Web to the extracted files. An attacker can leverage this vulnerability to execute arbitrary code in the context of the current user.

InfoStealer Malware