eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Fortinet Warns of New FortiWeb Zero-Day Exploited in Attacks
Bottom Line: Fortinet disclosed an OS injection vulnerability within FortiWeb, tracked as CVE-2025-58034, that can enable authenticated attackers to execute code on impacted devices. Given reports that exploitation has been observed in the wild, organizations should ensure that relevant patches are applied as soon as possible.
Fortinet announced on November 18th, 2025, that FortiWeb appliances are vulnerable to an actively exploited zero-day, identified as CVE-2025-58034. The vulnerability is an OS command injection vulnerability due to improper neutralization of special elements used in an OS command and is now rated at a CVSS base score of 7.2 (High), up from the originally listed 6.7 (Medium). This vulnerability may allow an authenticated attacker to execute arbitrary code on the vulnerable system via crafted HTTP requests or CLI commands. Successful exploitation can enable an attacker to gain complete control over the compromised device.
The affected versions of FortiWeb include 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11. This vulnerability was reported by Jason McFadyen from Trend Micro under responsible disclosure. Fortinet reported that the vulnerability was being leveraged by attackers in real-world intrusions. Following this confirmation, CISA added CVE-2025-58034 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that U.S. Federal agencies apply patches by November 25, 2025. The Canadian Centre for Cyber Security (CCCS) also released an alert shortly after the disclosure, highlighting the related CVE-2025-58034 and emphasizing the broader risk associated with these vulnerabilities.
At the time of writing, technical details regarding the exploitation of the vulnerability are not available, and Proof-of-Concept (PoC) exploit code has not been identified.
eSentire Threat Intelligence Analysis:
Fortinet recently revealed another high-severity vulnerability, tracked as CVE-2025-64446, on November 14th, 2025. It is still uncertain whether this flaw has any connection to CVE-2025-58034 or whether the two could be chained together for multi-stage attacks. The key distinction is that CVE-2025-64446 allows unauthenticated attackers to exploit a path traversal flaw to create administrator-level accounts without valid credentials, providing immediate privileged access. In contrast, CVE-2025-58034 requires authenticated access, but once a valid session is obtained, the vulnerability enables arbitrary command execution on the underlying system, allowing attackers to escalate their activity post-authentication. The overlap in the impacted FortiWeb versions noted in Fortinet’s advisory raises concern about potential shared root causes or attack paths that adversaries may attempt to leverage.
Given the short timeframe between the initial observation of CVE-2025-64446 and the public acknowledgement of CVE-2025-58034, organizations should prioritize immediate action. At the time of writing, the only solution provided in the official advisory is to upgrade FortiWeb to a patched version. The recommended versions are 8.0.2 or later, 7.6.6 or later, 7.4.11 or later, 7.2.12 or later, and 7.0.12 or later. No alternative mitigations (such as configuration changes or workarounds) have been published. Organizations should prioritize upgrading affected appliances immediately to reduce exposure, especially given that this vulnerability is actively exploited and listed in CISA’s KEV Catalog.
eSentire's Threat Response Unit (TRU) has released an advisory for CVE-2025-58034 on November 19th, 2025. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices that are vulnerable to CVE-2025-58034. The Threat Intelligence team is actively tracking this topic for additional details and detection opportunities. For additional context on CVE-2025-64446, eSentire’s Threat Intelligence team has published an advisory and included analysis of the vulnerability in its Weekly Threat Briefing - November 10 - November 14.
ShinySp1d3r: New Ransomware-as-a-Service created by ShinyHunters
Bottom Line: ShinyHunters has announced that they will be launching their own Ransomware-as-a-Service (RaaS) operation, ShinySp1d3r, expanding their presence in the threat landscape from an extortion group to a RaaS operator.
On November 19th, 2025, BleepingComputer reported on a new Ransomware-as-a-Service (RaaS) operation that will be run by ShinyHunters under the name Scattered LAPSUS$ Hunters, highlighting the alliance between the three groups. Previous ransomware attacks by one of the three groups, Scattered Spider, have involved using encryptors from other RaaS operations, including Qilin, DragonForce, and RansomHub. The new ShinySp1d3r RaaS will include an encryptor developed by ShinyHunters, designed to target Windows, Linux, and ESXi environments.
BleepingComputer identified a ShinySp1d3r RaaS sample uploaded to VirusTotal and, with assistance from ransomware recovery firm Coveware, confirmed that the payload was built entirely from scratch rather than relying on previously leaked code such as LockBit’s. The ransomware’s capabilities include spreading to other devices on the local network, detecting open network shares for encryption, and encrypting files using varying chunk sizes and offsets. Each file is assigned a unique encryption extension generated through a mathematical formula that leverages ChaCha20 and RSA-2048. Ransom notes placed in all encrypted folders outline what happened to the victim’s data, provide negotiation instructions, include a TOX address for communication, and a link to Tor data leak site (currently a placeholder URL). In addition to the identified Windows sample, the group claims to have nearly completed versions for both Linux and ESXi, as well as a 'lightning version' written in assembly.
ShinyHunters will lead the RaaS operation, with members from Scattered Spider and LAPSUS$ also participating. The group noted that the RaaS platform is still under development and that additional features will be incorporated over time. They further claimed that the service will not be used to target any organizations in the healthcare sector including pharmaceutical companies, hospitals, clinics, and insurance providers and will prohibit attacks against Russia and other Commonwealth of Independent States (CIS) countries.
eSentire Threat Intelligence Analysis:
Although the Scattered LAPSUS$ Hunters group (aka Trinity of Chaos) was formed in August 2025, its constituent groups have been active individually for a while now. LAPSUS$ has operated since 2021, while Scattered Spider and ShinyHunters have been active since 2022 and 2023, respectively. These groups are believed to be part of The Com, a loosely connected network of members, particularly those who are English-speaking. The Scattered LAPSUS$ Hunters alliance combines the strengths of each group: Scattered Spider conducts social engineering attacks to obtain initial access, LAPSUS$ provides expertise in lateral movement, and ShinyHunters focuses on data exfiltration and extortion. Although Scattered Spider previously carried out ransomware attacks on its own, the trio has primarily concentrated on extortion operations. With the introduction of the ShinySp1d3r RaaS, the alliance is now entering the broader ransomware marketplace, positioning itself to compete with established RaaS operations such as Qilin and Akira.
In 2025, Scattered LAPSU$$ Hunters have conducted some of the most disruptive attacks causing financial as well as reputation loss for multiple organizations, including the Salesforce Salesloft data breach and the Jaguar Land Rover security incident. The group has emerged as a leading actor in extortion attacks and seeks to uphold its reputation among peer extortion groups. In October 2025, they announced their plan to operate as an Extortion-as-a-Service (EaaS), and with the subsequent introduction of their RaaS offering, the group has actively worked to sustain its prominence in the cybercrime ecosystem.
Following the Salesforce data theft campaign, the group announced a temporary pause in their operations. Their exit post mentioned that multiple companies had been compromised and clarified that the association of their name with these incidents did not necessarily indicate ongoing activity. Shortly thereafter, the group launched their EaaS offering and a data leak site publicly threatening Salesforce and other organizations impacted by their data theft campaign, demanding payment by October 10th, 2025. While the site was seized by the Federal Bureau of Investigation (FBI) on October 9th, 2025, ShinyHunters demonstrated resiliency by stating they will launch a new data leak site hosting data stolen during the Salesloft and Gainsight campaigns. The Gainsight data theft campaign, reported by Salesforce on November 19th, 2025, was confirmed by Google Threat Intelligence Group (GTIG) to involve ShinyHunters. Notably, Gainsight had previously been a victim of the Salesloft campaign, though there is no evidence linking the recent activity to the earlier breach. The group’s temporary retirement likely indicated a pause after conducting widespread data theft in order to focus on extortion activities. In the meantime, to demonstrate their technical capabilities, the group appears to have announced the launch of a RaaS operation.
The Scattered LAPSUS$ Hunters group employs social engineering and compromised OAuth tokens to carry out data breach attacks. Although the group claims to have halted operations, it remains critical for organizations to implement measures to mitigate risks posed by such threats. Organizations are advised to conduct regular security awareness training focused on social engineering tactics, monitor their Software-as-a-Service (SaaS) integrations for suspicious activity, regularly review OAuth tokens, and rotate credentials immediately if any anomalous activity is detected. eSentire’s Threat Intelligence team has been consistently monitoring Scattered LAPSU$$ Hunters group activity.
The Continued Bridging of Cyber and Kinetic Warfare
Bottom Line: Amazon published a report on Iranian state-sponsored threat actors utilizing cyber-attacks to bridge the gap between cyber and kinetic warfare. In two observed instances, threat actors compromised CCTV cameras for real-time visual intelligence, which was used to adjust plans for missile strikes, highlighting the direct link between cyber and physical military objectives.
On November 19th, 2025, Amazon released a report providing details on cyber-attacks that were conducted by Iranian state-sponsored APT groups, which were used by the Iranian government to support military objectives. Amazon identifies this trend as “cyber-enabled kinetic targeting”, which they indicate is a term used to describe when state-sponsored threat actors utilize cyber operations to enable and enhance physical operations. Amazon claims that the lines between cyber and kinetic warfare are rapidly blurring, where state-sponsored APT groups are “pioneering a new operational model where cyber reconnaissance directly enables kinetic targeting”. Amazon indicates that they were able to gather this intelligence through the unique visibility provided to them through their global cloud operations provided through Amazon Web Services (AWS), customers providing real-world data about threat actor activities, and through threat intelligence sharing and partner collaboration.
Amazon provides two case studies to support their claims, both involving Iranian state-sponsored APT groups, Imperial Kitten and MuddyWater. Imperial Kitten is a group linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) and was observed targeting the Automatic Identification System (AIS) platform on maritime vessels, enabling access to critical shipping information. Amazon indicates that they utilized this access to conduct targeted searches for specific shipping vessels and have also compromised Closed Circuit Television (CCTV) systems on ships for real-time surveillance. Amazon states that US Central Command reported missile strikes by Houthi forces against vessels that Imperial Kitten was tracking, linking cyber reconnaissance and kinetic strikes. Another example provided by Amazon involves the group MuddyWater, who they claim operates “at the behest” of Iran’s Ministry of Intelligence and Security (MOIS). These attacks, observed in June 2025, involve the APT group compromising servers that contained live CCTV streams from Jerusalem, which Israel claims were used by Iran to provide real-time intelligence and guide missile strikes.
eSentire Threat Intelligence Analysis:
During the bombings of London during World War II, known as the Blitz, newspapers were subject to censorship by the government to prevent information, such as success of attacks, targets hit, and casualties, from reaching enemies. In modern society, this is no longer possible, as CCTV systems and satellites can provide real-time information, making them prime targets in cyber warfare. As Amazon notes, cyber-enabled kinetic targeting will continue to become increasingly common during conflicts, but is also not a novel technique as it has been used for the past several years in various ways. In the ongoing Russia-Ukraine war, Russia was reported to be compromising CCTV systems for missile targeting and damage assessment, while also claiming that Ukraine has been connecting to unprotected CCTV cameras, as well as using dating apps and social networking sites, to collect information and identify locations of Russian soldiers.
These examples highlight how cyber-attacks are leveraged during physical conflicts between countries for surveillance and targeting but can also be used to cause physical damage as well. The Canadian Centre for Cyber Security (CCCS) recently published an advisory on hacktivists targeting Industrial Control Systems (ICS) within Canada. The advisory provides details on recent attacks observed against ICS devices impacting critical infrastructure, and how they can cause real-world harm, such as water and food shortages. Although the report indicates that hacktivists were targeting these systems, APT groups were also observed targeting them. APT groups have also been seen deploying wiper malware, a type of malware designed to destroy data, against strategic targets during conflicts. An example of this is the Russian APT Sandworm, linked to Russia's General Staff Main Intelligence Directorate (GRU), who deployed wiper malware against organizations in Ukraine's grain sector, a main export for the country, in a likely attempt to weaken their war economy and cause food shortages.
As countries continue to develop their cyber operations, state-sponsored APT groups will be used to perform more than just cyber-espionage attacks to enhance political objectives but support and enhance physical military objectives too. As highlighted by Amazon, this continued evolution in the threat landscape suggests that future conflicts will continue to expand beyond military targets, moving traditional warfare into cyberspace where individuals and organizations unrelated to conflicts will be targeted to support military objectives. In response to this growing threat, Singapore recently announced that it has opted to share classified threat intelligence with organizations within sectors it considers to be critical, such as energy, telecommunications, and finance, to prevent cyber-attacks that may jeopardize national security. To protect against these ongoing threats, organizations should implement security training to educate users on how to identify and report malicious content and ensure that a robust patch management solution is in place to quickly identify and patch vulnerabilities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
