eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Proof-of-Concept Exploit Code Released for Critical HPE OneView Vulnerability
Bottom Line: Proof-of-Concept (PoC) exploit code for a critical vulnerability within HPE OneView was recently published, enabling unauthenticated Remote Code Execution (RCE). Given the public availability of PoC, along with a recently published Metasploit module, organizations should prioritize patching prior to potential widespread exploitation.
On December 16th, 2025, Hewlett Packard Enterprise (HPE) published an advisory, disclosing a critical vulnerability within its OneView software, that can enable unauthenticated attackers to perform Remote Code Execution (RCE). HPE OneView is an infrastructure management platform that automates IT operations, simplifying infrastructure lifecycle management. The vulnerability is tracked as CVE-2025-37164, and has a CVSS score of 10, underscoring its criticality. HPE states that the vulnerability has been fully remediated in HPE OneView version 11, but have also issued emergency hotfixes for versions 5.20 through 10.20. Successful exploitation of CVE-2025-37164 can lead to full system compromise through the creation of reverse shells or achieving root access to the appliance.
On December 19th, 2025, Rapid7 published a technical analysis of the vulnerability, along with Proof-of-Concept (PoC) exploit code. Within their analysis, Rapid7 indicates that CVE-2025-37164 impacts the ID Pools REST API within HPE OneView, where the ‘executeCommand’ method in the PoolController class was configured to bypass authentication checks, leading to possible RCE. Rapid7 suspects, based on the findings of their investigation, that only HPE OneView for VMs version 6.x is vulnerable to CVE-2025-37164, while all unpatched versions of HPE OneView for HPE Synergy are vulnerable. Along with PoC release, Rapid7 also confirmed that a Metasploit module is available for CVE-2025-37164, making exploitation of the vulnerability easy to weaponize in attacks.
eSentire Threat Intelligence Analysis:
The Metasploit Framework is a penetration testing platform that contains a suite of tools enabling users to test security vulnerabilities, enumerate networks, execute attacks, and evade detection. Although designed for security testing, Metasploit has been adopted by threat actors, and is known to be used within attacks, likely due to its availability and ease of use. The availability of PoC exploit code follows a similar trend, where it is often claimed to be for research purposes, but can be quickly adopted for use by threat actors, as it can provide attackers with ready-to-use code that can be easily weaponized for nefarious purposes.
With the addition of the Metasploit module, this offers two methods that threat actors, of all skill levels, can easily make use of in attacks. Pre-built tools and code allow threat actors to adopt them into their toolkits, and in the case of CVE-2025-37164, opens the door for possible widespread exploitation. At the time of writing, there are currently no reports indicating that exploitation of CVE-2025-37164 has been identified. However, eSentire's Threat Intelligence team assesses with high confidence that CVE-2025-37164 will be exploited in the near future, based on the readily available PoC and Metasploit module.
To mitigate this threat, organizations are recommended to upgrade to HPE OneView version 11.0 as soon as possible. If upgrades are not feasible, HPE has issued emergency hotfixes for HPE OneView versions 5.20 through 10.20, which should be applied. HPE states that a reapplication of the hotfix is required if HPE OneView is upgraded from version 6.60.xx to 7.00.0, or if an HPE Synergy Composer reimage is performed. Other recommendations to mitigate risk include restricting access to management infrastructure to trusted IP addresses only. eSentire published an advisory for CVE-2025-37164 on December 23rd, 2025, and eSentire MDR for Network has detections in place to identify exploitation of the vulnerability. eSentire's Threat Response Unit (TRU) is continuing to track this topic for additional information and detection opportunities.
Nezha: The Monitoring Tool That’s Also a Perfect RAT
Bottom Line: Details have emerged about legitimate tools like Nezha that are used by adversaries for post-compromise control. Its multi-platform reach and zero-detection footprint allow attackers to evade signatures while obtaining full system access.
Cybersecurity researchers at Ontinue discovered threat actors exploiting Nezha, a legitimate open-source server monitoring tool, as a Remote Access Trojan (RAT) for post-exploitation activities. Nezha is originally developed for the IT community and is used to help administrators observe system health, receive alerts, and perform remote maintenance. The platform consists of a central dashboard server and lightweight agents deployed on monitored systems.
Ontinue’s Cyber Defense Center discovered a case where attackers deployed Nezha as part of a post-exploitation operation. In this incident, a bash script was used to silently install the Nezha agent on a compromised device. The script contained configuration values pointing to an attacker-controlled Command-and-Control (C2) infrastructure and included a shared secret used by the agent to authenticate to the dashboard. The script’s status messages were written in the Chinese language. Using the attacker’s C2 details in a sandbox environment, researchers observed that the Nezha dashboard could display hundreds of connected endpoints, indicating widespread compromise controlled through the tool. The infrastructure hosting the dashboard was identified in Alibaba Cloud IP space and geo-located to Japan.
The agent runs with elevated privileges; root on Linux and SYSTEM on Windows, because it needs access to system metrics and configuration. When an interactive terminal session is requested, the agent spawns a shell that inherits these privileges, giving attackers full control without requiring privilege escalation. Authentication for the dashboard is based on username and password, with default credentials set to “admin:admin.” Agents authenticate using a shared secret token. If attackers obtain this token, they can connect rogue agents or interact with existing ones.
The agent supports multiple task types, including command execution, interactive terminal sessions, and file management. These capabilities allow attackers to execute arbitrary commands, manage files, and maintain persistent access.
eSentire Threat Intelligence Analysis:
One of the main factors enabling Nezha’s abuse is that it is legitimate open-source software, actively maintained and widely used. As a result, signature-based security products, including major antivirus engines, do not flag the Nezha binary as malicious. According to Ontinue’s analysis, the Nezha agent returned a low detection score (0/72) on VirusTotal.
Research from Huntress documented similar abuse of the Nezha tool as a remote access channel. Chinese-linked threat actors conducted a cyber campaign targeting organizations across Asia using the Nezha monitoring tool, affecting over 100 machines primarily in Taiwan, Japan, South Korea, and Hong Kong. The attacks began with exploiting vulnerable phpMyAdmin panels, followed by the deployment of web shells and the Nezha tool. Attackers weaponized it alongside malware like Ghost RAT, which was used to enhance stealth, persistence, and long‑term control of the affected systems.
Legitimate Remote Monitoring and Management (RMM) tools have been abused by threat actors to provide an easy method of accessing a compromised device. Due to the widespread use of these tools, they can easily blend into an organization’s typical usage, making it more difficult to detect malicious activity. Organizations can take proactive measures by implementing technical controls that restrict the use of certain tools on their systems or by blocking connections to known malicious RMM-related infrastructure. Additionally, deploying Endpoint agents on all supported assets within the organization can significantly aid in the identification and containment of threats. Ongoing education is essential to keep users informed about the latest methods employed by threat actors.
For more insights into how threat actors are gaining initial access and exploiting legitimate RMM tools, eSentire’s Threat Response Unit (TRU) has released an advisory on email bombing and ConnectWise ScreenConnect Exploitation. TRU also published a technical report on an incident involving malicious ScreenConnect use in conjunction with AsyncRAT. To support customers, eSentire MDR for Endpoint includes detections to identify and alert on misuse of RMM tooling.
Cyber Criminals Are Recruiting Insiders
Bottom Line: Cybercriminals are increasingly leveraging insider recruitment to obtain direct access to corporate assets, environments, and identities. This trend reflects a preference for exploiting trusted internal access, significantly reducing the effort required to infiltrate networks and carry out subsequent attacks.
On December 19th, 2025, Check Point published a report detailing threat actor activity focused on recruiting insiders within banking, telecommunications, and technology organizations through darknet forums. These advertisements urged employees to voluntarily provide or sell sensitive data in exchange for financial incentives, typically ranging from $3,000 to $15,000 USD, with some offers reaching up to $25,000 USD. Ransomware groups were also observed using Telegram to recruit insiders and penetration testers, inviting them to profit from their criminal operations.
The listings primarily targeted cryptocurrency firms and financial institutions, seeking insiders for roles ranging from one-time or selective information access to the provision of large cryptocurrency-related datasets and long-term access arrangements with recurring weekly payments. Advertisements referenced major cryptocurrency companies such as Coinbase, Binance, Kraken, and Gemini, as well as consulting firms including Accenture and Genpact. Insiders from streaming platforms such as Spotify and Netflix were also mentioned. In the banking sector, threat actors specifically sought access to the U.S. Federal Reserve or its partner banks, a major European bank, and Russian tax authorities.
Technology and telecommunications organizations were specifically targeted for malicious activities, including customer email account resets and SIM-swapping operations. The advertisements referenced insiders from companies such as Apple, Samsung, Xiaomi, Cox Communications, and various cloud service providers. Additionally, insiders within logistics organizations capable of facilitating services such as customs checks or shipment manipulation were offered payments ranging from $500 to $5,000 USD.
eSentire Threat Intelligence Analysis:
Insider threats pose a significant risk to organizations, as they can bypass traditional security controls designed to prevent unauthorized access by threat actors. The Check Point report emphasizes that adversaries increasingly rely on insiders across multiple stages of the attack lifecycle, leveraging trusted access to reduce the time, effort, and resources required to obtain initial access, exfiltrate sensitive data, or maintain persistent presence within compromised networks. This threat underscores the need for organizations to implement security measures that extend beyond the traditional ones.
The listings referenced in the report, while presented in formal language, also employed manipulative messaging to entice potential recruits, using phrases such as “escape the endless work cycle” and offering profit-sharing opportunities that appeal to motivations rooted in greed or revenge-driven ideologies. With the growing adoption of Artificial Intelligence (AI) by threat actors, recruitment campaigns are likely to increasingly leverage AI-driven techniques to entice victims, as observed in recent phishing campaigns where email content is generated using AI. The combination of technology and social engineering is expected to further enhance adversaries’ ability to attract and manipulate targets.
The report highlighted recruitment efforts by ransomware gangs via Telegram, targeting insiders, penetration testers, and Initial Access Brokers (IABs), inviting them to participate and profit from each encrypted device. Collaborations between ransomware groups and such personnel facilitate rapid ransomware development while allowing the gangs to concentrate on post-encryption activities, such as ransom negotiations. Recently, an extortion group known as Scattered LAPSUS$ Hunters, which was previously involved in ransomware operations, attempted to recruit insiders. The eSentire Threat Intelligence team reported this incident in the Weekly Threat Briefing dated November 28th, 2025, noting that a CrowdStrike employee was terminated for selling information to the group. Users must recognize that while such activities may be portrayed as easy money or a path to financial independence, they are illegal and carry serious legal and professional repercussions.
Organizations are advised to implement stricter access controls and actively monitor for suspicious user activity as initial measures to mitigate insider threats. Proper handling of user data should be prioritized, as it enables the detection of potential exfiltration of sensitive information. Organizations should educate employees on the risks associated with insider threats through regular security trainings. Leveraging tools and resources provided by CISA can further assist organizations in effectively implementing the necessary security controls to mitigate such threats.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
