eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Critical Vulnerability in Fortinet FortiWeb Exploited in the Wild
Bottom Line: A critical authentication bypass vulnerability in Fortinet's FortiWeb Web Application Firewall (WAF) is being actively exploited in the wild enabling attackers to create unauthorized admin accounts. With Proof-of-Concept (PoC) exploit code also publicly available, unpatched FortiWeb devices face a significant risk of being exploited.
On November 13th, 2025, Rapid7 published a report on an actively exploited zero-day vulnerability within Fortinet’s FortiWeb Web Application Firewall (WAF) products. The vulnerability, tracked as CVE-2025-64446 (CVSS: 9.8) is a path traversal vulnerability in FortiWeb that can allow unauthenticated attackers to perform any privileged action via crafted HTTP or HTTPS requests. The vulnerability was first identified by the cybersecurity company Defused on October 6th, 2025, who reported on an unknown Fortinet exploit being observed in the wild.
Rapid7 had noted that Proof-of-Concept (PoC) exploit code for the vulnerability was publicly available, and during their testing, indicated that it appeared to work on FortiWeb versions 8.0.1 and prior, but not on version 8.0.2. At the time of publication for Rapid7's report, Fortinet had not issued a statement addressing the vulnerability, nor was a CVE identifier assigned to it. On November 14th, Fortinet published their advisory, confirming the vulnerability’s identification as CVE-2025-64446, and provided the following list of patched versions: 7.0.12, 7.2.12, 7.4.10, 7.6.5, and 8.0.2. Mitigation steps provided by Fortinet include disabling the HTTP or HTTPS interfaces for Internet-facing devices until upgrades can be completed. Fortinet also notes that if the HTTP/ HTTPS Management interface is internally accessible only, as per their recommended best practice, the risk of exploitation is significantly reduced.
Also on November 14th, watchTowr Labs published a report on the vulnerability, providing a highly technical breakdown of how exploitation of CVE-2025-64446 works. Within their analysis, watchTowr Labs provides additional PoC exploit code, and demonstrates exploitation of the vulnerability, resulting in the creation of a new administrative account. watchTowr Labs also indicates that exploitation of CVE-2025-64446 has been ongoing for the past few weeks, underscoring its criticality. Along with their report, watchTowr Labs published a detection artifact generator on GitHub, which can be used by organizations to determine if their FortiWeb device is vulnerable.
eSentire Threat Intelligence Analysis:
What is notable about CVE-2025-64446 is that Fortinet appears to have patched the vulnerability in the latest version of its FortiWeb software, which was released at the end of October 2025. However, the patch notes for the latest version (8.0.2) currently do not contain any mention of the flaw. This seems to suggest that Fortinet may have tried to silently address the vulnerability following Defused's reports of exploitation, without having to potentially address it publicly. This potentially could have resulted in organizations being unable to assess risk appropriately, by not knowing that the latest FortiWeb patch addressed a critical vulnerability that was being exploited in the wild, leading to a number of unpatched devices being exposed.
Following the emerging reports of exploitation, CISA added CVE-2025-64446 to its Known Exploited Vulnerabilities (KEV) catalog on November 14th, giving federal agencies until November 21st to apply relevant patches. CISA is only providing a timeframe of one week to address the vulnerability, instead of its standard three-week deadline, a trend observed with other critical vulnerabilities as well. The public availability of PoC exploit code also adds to the criticality of this vulnerability, as PoC exploit code lowers the barrier of entry for threat actors to leverage the flaw within attacks. PoC code has been weaponized in the past within hours of being published, and is often a precursor to widespread exploitation. eSentire's Threat Intelligence team assesses with high-confidence that exploitation of CVE-2025-64446 will become widespread in the near future.
Given that exploitation has already been observed, organizations should perform a full business impact review to determine if they are vulnerable to CVE-2025-64446; organizations that are impacted should apply relevant patches or follow recommended mitigation steps immediately. Organizations should also follow Fortinet's best practice recommendations and ensure that the HTTP/ HTTPS Management interface for FortiWeb is only internally accessible, or by approved IP addresses only if possible, and follow Fortinet’s FortiWeb best practices guide. eSentire's Threat Response Unit (TRU) is publishing an advisory for CVE-2025-64446, developed detections to identify exploitation of the vulnerability, and is performing threat hunts for known Indicators of Compromise (IoCs). eSentire's Managed Vulnerability Service (MVS) has plugins for the vulnerability listed as “Coming Soon”. eSentire's Threat Intelligence team continues to track this topic for additional information as it becomes available.
Increase in Lumma Stealer Activity and Reemergence of DanaBot
Bottom Line: Lumma Stealer and DanaBot have re-entered the threat landscape following brief periods of inactivity. Law-enforcement actions are heavily targeting Malware-as-a-Service offerings, but the threat actors behind these operations have shown significant resiliency.
In 2025, both Lumma Stealer and DanaBot malware operations encountered significant setbacks due to legal crackdowns. On May 13th, Lumma Stealer's infrastructure was dismantled through a coordinated effort by Microsoft alongside government agencies across the United States, Europe, and Japan. This takedown was later intensified by a doxxing campaign in September, which exposed key individuals involved with Lumma Stealer. Meanwhile, from May 19th to May 22nd, DanaBot's infrastructure faced interruptions during the Europol-led Operation Endgame, which also targeted other malware networks. Despite these disruptions, recent reports highlight a resurgence in activity from both Lumma Stealer and DanaBot, signifying a notable uptick in their operations.
On November 13th, 2025, Trend Micro reported rise on the Lumma Stealer activity since October 20th, 2025, with an addition of an advanced browser fingerprinting feature to its existing Command-and-Control (C2) structure. Lumma Stealer is capable of stealing user credentials, financial information, cryptocurrency wallets, and browser data. The malware utilizes JavaScript payloads deployed via dedicated fingerprinting C2 server to collect detailed environment and system characteristics including browser profiling, system, network and hardware data from the compromised device. This feature is believed to provide Lumma Stealer operators with enhanced detection evasion, refined targeting, and operational continuity. Lumma Stealer has been observed performing remote thread injection into the Chrome browser process, allowing the malware to execute within the context of a trusted browser process, effectively disguising malicious actions as regular network activity.
On November 10th, 2025, Zscaler security researchers reported re-emergence of DanaBot with its 669th version out now. DanaBot was first identified as a banking trojan in 2018 delivered via email and malvertising. The malware possesses extensive capabilities from information stealing and remote access to deploying secondary malware. The new version currently only targets victim’s cryptocurrency wallets. To avoid network-based takedowns, the malware's operators have integrated a mix of new C2 servers, utilizing both traditional IP-based and Tor-hosted domains. Additionally, backconnect C2 servers facilitate reverse shell connections for persistent access to compromised systems.
eSentire Threat Intelligence Analysis:
Resurgence of malware families after major law enforcement interventions underscore the malware operators’ efforts to stay relevant in the threat landscape by building resilient infrastructure and regain the reputation damaged as a result of the legal actions. Following the takedown of Lumma Stealer, there was considerable speculation about other information stealers trying to fill its void. The reappearance of Lumma Stealer suggests that threat actors are unwilling to concede, given the stealer's success prior to its disruption. Similarly, operators of DanaBot saw users withdraw after its dismantling, yet the introduction of a new version indicates an intention to reestablish their customer base. While currently focusing on cryptowallets with limited capacity, the operators may progressively enhance the malware's capabilities.
Lumma Stealer was first observed in August 2022 and gained prominence after law enforcement agencies disrupted the infrastructures of RedLine Stealer and META information stealer in October 2024 as a part of Operation Magnus. Its distribution via the ClickFix Initial Access Vector (IAV) since April 2025 significantly raised its success rate. Following the legal actions in May 2025, Lumma Stealer steadily resurfaced by July 2025, marking a notable comeback just two months after its takedown. The current increase in Lumma Stealer activity further underscores the operators' persistent efforts. Given its profitability for operators and affiliates, their determination to revive it is clear. Enhancements in C2 Operations and a reduction in darkweb advertising by the group suggest deliberate measures to avoid further law enforcement scrutiny and interference from other threat actors.
The latest phase of Operation Endgame, which previously disrupted DanaBot, targeted the Rhadamanthys information stealer, VenomRAT, a Remote Access Trojan, and the Elysium botnet. Rhadamanthys and VenomRAT both were offered as a MaaS which allow less-skilled threat actors to execute complex attacks, effectively lowering the skills barrier. The active involvement of law enforcement agencies in dismantling such malware introduces instability to the cyber threat landscape, impacting both operators and affiliates who benefit from this framework. It is likely that impacted malware services will attempt to resurface and resume activities, similar to Lumma Stealer and DanaBot. This underscores the importance for organizations to adopt a layered security approach to effectively detect and mitigate such threats. Organizations should educate employees on malware distribution techniques like ClickFix, regularly conduct Phishing and Security Awareness Training (PSAT), deploy robust Endpoint Detection and Response (EDR) solutions and continuously monitor network for malicious activity.
eSentire continues to detect activity associated with Lumma Stealer, although observation of this threat has decreased significantly since early 2025. The eSentire Threat Intelligence team assesses that it is probable Lumma Stealer activity will continue to increase leading into 2026. eSentire MDR of Endpoint and Network can detect the ClickFix IAV, Lumma Stealer, and DanaBot related activity.
AI-Orchestrated Cyber Espionage Campaign
Bottom Line: A Chinese state-sponsored group (GTG-1002) is reported to have carried out a large-scale cyber espionage campaign using agentic AI to perform 80–90% of intrusion operations, marking a major escalation in AI-enabled cyber threats and lowering barriers for sophisticated attacks.
Anthropic, the creator of the Claude AI model, has reported the first cyber campaign using agentic AI to execute most attack steps with minimal human involvement. The activity was detected in mid-September 2025, and impacted at least thirty separate organizations including technology firms, financial institutions, chemical manufacturers, and government agencies. At this time, the campaign is attributed to a Chinese state-sponsored threat actor that Anthropic tracks as GTG-1002.
In the observed attacks, threat actors developed an attack framework via Claude Code, that would autonomously compromise a chosen target with minimal human involvement. In order to bypass Claude guardrails that are meant to prevent malicious use, the attacks were broken down into small tasks, that when viewed individually, appear to be innocent. Additionally, Claude was instructed to act as an employee of a cybersecurity firm conducting legitimate security testing.
Claude was employed to perform reconnaissance, identifying high value databases and notable vulnerabilities, before developing its own exploits targeting the vulnerabilities. The framework was then employed to steal user credentials, allowing further access and the exfiltration of sensitive data. Access to high-privilege accounts was also used to deploy newly created backdoors, enabling persistent access and continued data theft. Lastly, Claude would produce documentation on all performed actions to enable decision making on future attacks or secondary actions.
Anthropic fully disrupted the campaign within ten days of identification.
eSentire Threat Intelligence Analysis:
This is the first public report of an AI enabled campaign removing 80-90% of human interaction that would otherwise be required. Claude Code enabled reconnaissance, credential harvesting, lateral movement, and data exfiltration. While this campaign has been disrupted, the eSentire Threat Intelligence team assesses that it is almost certain that GTG-1002 will update their tactics based on the results of recent attacks and resume similar activity. Additionally, the proven success, with the compromise of thirty organizations, will inspire other threat groups, both state-sponsored and financially motivated, to invest resources in developing their own AI-enabled autonomous attacks. At its core, this campaign serves as a proof of concept for large-scale autonomous attacks, showing how AI can dramatically reduce the need for skilled human operators, and increase the speed at which attacks are executed.
AI has already been adopted by various state actors and cybercriminal groups. Google and Microsoft have both recently released reports on real-world observations of AI abuse. These reports highlighted use of AI in attacks performed by threat actors from China, Russia, Iran, and North Korea. AI was used to develop and support malware, as well as performing reconnaissance and data exfiltration. Details and analysis on the Google and Microsoft AI abuse reports can be found in the eSentire Weekly Threat Briefing for November 3rd – 7th. Unlike earlier reports from Google and Microsoft that focused on AI-assisted tasks such as phishing or malware generation, Anthropic’s findings reveal near-complete automation of the attack lifecycle.
It should be noted that while this represents a major advancement for malicious AI usage, the malicious actions performed are not novel. As attacks involve known malicious behaviours, activity can still be detected via EDR and network security solutions. The reported attacks exploited known vulnerabilities, highlighting the importance of security audits and ensuring the rapid patching of flaws. Vulnerability management services can greatly assist organizations in identifying and remediating these issues. The eSentire Threat Intelligence team continues to closely monitor developments surrounding AI adoption by threat actors.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
