eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
MongoDB Vulnerability Exploited in the Wild
Bottom Line: Ongoing exploitation of a critical information disclosure vulnerability in MongoDB has been observed, tracked as CVE-2025-14847. As Proof-of-Concept (PoC) exploit code is publicly available, organizations are urged to apply relevant security patches immediately.
In late December, a severe vulnerability affecting multiple versions of MongoDB was confirmed to be actively exploited in the wild. Disclosed on November 19th, 2025, CVE-2025-14847 (CVSS: 8.7) allows an unauthenticated attacker to retrieve sensitive information by sending specially crafted network packets to a vulnerable server. Reports of exploitation emerged shortly after the release of Proof-of-Concept (PoC) exploit code and public technical analysis of the vulnerability.
MongoDB stated that CVE-2025-14847 is a client-side vulnerability affecting its zlib compression mechanism, which may result in the exposure of uninitialized heap memory without requiring authentication to the server. A critical fix was released alongside the disclosure, with organizations advised to upgrade to the patched versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. Following the disclosure, Elastic Security published PoC exploit code, referred to as MongoBleed, while security firm OX Security released detailed technical analysis of CVE-2025-14847. Technical analysis conducted by OX Security determined that the vulnerability resided in the “message_compressor_zlib.cpp” file. The code responsible for returning the size of decompressed data mistakenly returned the amount of allocated memory rather than the actual length of the decompressed content, resulting in the remote exposure of sensitive in-memory data.
On December 27th, 2025, VX Underground reported a breach affecting Ubisoft’s Rainbow Six Siege online gaming platform. According to the report, multiple threat actor groups targeted the game and were able to ban and unban players, display false ban messages on the ban ticker, grant all players approximately 2 billion R6 Credits and Renown, and unlock all cosmetic items. Two of these groups claimed to have leveraged the MongoBleed exploit to exfiltrate user data and internal source code for extortion purposes. The compromised data is believed to span from the 1990s to the present, encompassing software development kits and multiplayer service assets.
With reports on real-world exploitation of CVE-2025-14847, it is advised that the organizations act promptly to mitigate the flaw by upgrading to secure versions.
eSentire Threat Intelligence Analysis:
CVE-2025-14847 is particularly significant as it is a pre-authentication flaw that requires no user interaction, allowing attackers to remotely access sensitive data and potentially carry out data theft attacks. MongoDB is an open-source Database Management System (DBMS) and is among the most widely used databases in organizations globally. Given the popularity of MongoDB, it is critical for organizations to apply the relevant patches immediately to reduce the risk of potential exploitation.
Security Researcher Kevin Beaumont stated that the PoC exploit code by Elastic Security was functional and required only the target MongoDB server’s IP address to retrieve sensitive data. The ease of exploitation using the MongoBleed PoC exploit poses a severe risk particularly to Internet-facing MongoDB servers. Censys reported that more than 87,000 potentially vulnerable MongoDB instances were exposed to the Internet as of December 27th, 2025, while Wiz observed that 42% of cloud environments contain at least one vulnerable MongoDB instance. In addition to the MongoBleed exploit code, a Canadian Centre for Cyber Security (CCCS) advisory issued on December 29th, 2025, noted that multiple PoC exploits are available, further emphasizing the elevated risk of exploitation against publicly accessible, vulnerable MongoDB servers.
Based on the MongoBleed PoC exploit code, a security researcher developed hunting queries to identify potential exploitation of CVE-2025-14847. Organizations should prioritize upgrading to secure server versions. If upgrading is not immediately feasible, MongoDB recommends disabling zlib compression on the server and using alternative compression methods such as Snappy or Zstandard (zstd). Organizations are advised to restrict MongoDB server access to trusted IP addresses only and to continuously monitor logs for anomalous pre-authentication connection attempts or unexpected error activity.
The eSentire Threat Intelligence team published a security advisory addressing CVE-2025-14847 on December 29th, 2025. eSentire's Threat Response Unit (TRU) created new eSentire MDR for Network rules to identify exploitation attempts and eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-14847.
IBM Warns of Critical API Connect Auth Bypass Vulnerability
Bottom Line: IBM disclosed a critical vulnerability, CVE-2025-13915, impacting its widely used API Connect enterprise platform. Given the severity of the authentication bypass flaw, organizations are recommended to apply relevant patches immediately.
IBM disclosed a critical authentication bypass vulnerability (CVE-2025-13915) in IBM API Connect that allows remote, unauthenticated attackers to gain unauthorized access to API management components. The flaw requires no user interaction and has a CVSS score of 9.8, making exploitation highly impactful in exposed environments.
IBM API Connect is IBM’s full‑lifecycle API management platform that lets organizations design, publish, secure, manage, and monitor APIs across on‑premises, cloud, and hybrid environments. Common scenarios where IBM API Connect is used include banking and financial services, where it is used for secure integration between internal systems and third-party applications. It is also used in retail organizations that use API Connect to connect e-commerce platforms, payment gateways, and inventory systems. Telecommunications companies rely on API Connect to manage APIs for customer services, billing systems, and partner integrations.
According to the advisory, the vulnerability was identified during internal testing. The vulnerability impacts API Connect version 10.0.11.0 as well as versions 10.0.8.0 through 10.0.8.5. The potential attack is considered low in complexity and does not require any user interaction, which makes it highly exploitable. IBM has released interim fixes and updated versions to address the issue and strongly advises customers to apply patches as soon as possible.
eSentire Threat Intelligence Analysis:
This vulnerability highlights the risk posed by exposed API management platforms, which often sit at the center of enterprise application ecosystems. By bypassing authentication entirely, attackers can potentially enumerate APIs, manipulate configurations, or pivot into backend services that rely on API Connect for access control. The low attack complexity and lack of authentication requirements significantly lower the barrier to exploitation, increasing the likelihood of opportunistic attacks once Proof-of-Concept (PoC) details become widely available. Given API Connect’s role in managing authentication, rate limiting, and routing for downstream services, compromise at this layer could result in broad service abuse, data exposure, or service disruption.
Although there is currently no evidence that the vulnerability has been exploited in the wild, IBM strongly recommends upgrading all vulnerable installations to the latest release immediately. For organizations that cannot apply the patch right away, IBM advises disabling self-service sign-up on the Developer Portal if it is enabled. This measure will help reduce exposure to the vulnerability. Detailed instructions for applying the patch in VMware, OpenShift Container Platform (OCP), and Kubernetes environments are available in IBM’s official support documentation.
The Worm Returns: Shai Hulud's Latest Resurgence
Bottom Line: The Shai Hulud worm remains a concerning threat, with a recent report on a new campaign, and confirmation that previous Shai Hulud activity resulted in the compromise of Trust Wallet, and theft of cryptocurrency.
On December 28th, 2025, Aikido identified a new strain of Shai Hulud, the self-propagating worm that is designed to compromise npm packages and publish exposed secrets, such as credentials, API keys, or cloud access tokens, to GitHub. The new variant of the malware was detected in the npm package ‘@vietmoney/react-big-calendar’, but unlike previous instances of Shai Hulud, widespread infection had not been identified.
Aikido's analysis of the new Shai Hulud variant uncovered changes that had been made to the malware, which include an updated file structure, improved error handling, and the removal of the dead man switch, which was previously used to wipe data if the propagation and exfiltration channels were severed. Aikido also identified a possible mistake in the code, involving the retrieval of a JSON file from GitHub, but that gets saved under a different file name that includes a possible typo. Exfiltrated data from this variant would be uploaded to a GitHub repository with the description ‘Goldox-T3chs: Only Happy Girl’. Aikido suggests that based on the changes to the code and lack of reports on widespread infections, this may have been a test of the new strain by its developers.
Following this report, Trust Wallet disclosed a recent incident that was identified on December 25th, 2025, which involved a malicious version of the Trust Wallet Browser Extension being published to the Chrome Web Store. This malicious browser extension version was identified as 2.68 and allowed attackers to “access sensitive wallet data and execute transactions without authorization”. The attack impacted users who opened this version of the browser extension between December 24th - December 26th at 11:00 UTC. Trust Wallet identified 2,520 wallet addresses that were impacted, which resulted in the theft of $8.5 million in cryptocurrency. Investigation into the incident determined that the initial compromise stemmed from the November 2025 wave of Shai Hulud, where developer secrets for Trust Wallet were exposed. This exposed data included the source code for the browser extension, and the Chrome Web Store API key, which allowed attackers to upload builds directly to the store, bypassing Trust Wallet's internal release process. Trust Wallet has since published a newer version of the browser extension and are working on reimbursing impacted users.
eSentire Threat Intelligence Analysis:
In September 2025, the first wave of the Shai Hulud npm supply chain attack was identified, which resulted in the compromise of over 500 npm packages. The second wave of Shai Hulud was observed in November 2025, where over 700 npm packages were confirmed to be compromised, along with 25,000 GitHub repositories having been created. Widespread infections from both waves only lasted a few days before compromised npm package versions were removed, but changes made to the malware in between waves were likely a contributing factor for the second wave's increased spread. Prior to Shai Hulud's first wave, an npm supply chain attack was identified in August 2025, which is believed to be attributed to the same threat actors, and to have potentially been an initial test of the malware. Although Aikido assessed that the newly identified variant was also a possible test, changes made to Shai Hulud are likely attempts by its developers for a potential third wave of Shai Hulud, with the likely goal of spreading to a greater number of packages.
Wiz published a timeline of Shai Hulud's second wave, where they indicated that by November 27th, 2025, approximately 15 malicious npm packages remained active. The linkage of Trust Wallet's breach to the second Shai Hulud wave highlights the critical severity of the malware, through the type of sensitive data that is leaked during infections. The exposed data enabled attackers to directly upload a malicious version of a trusted application one month after the spread of Shai Hulud had been stopped, underscoring the importance of applying mitigation steps and that repercussions of these supply chain attacks continue to be felt, even by users that had no direct exposure. Given the success of this attack and potential testing of new Shai Hulud variants, eSentire's Threat Intelligence team assesses with high confidence that Shai Hulud operations will continue into 2026.
Organizations that were impacted by Shai Hulud malware should rotate all credentials and API keys that may have been exposed, to reduce any potential impact. Organizations should also follow the OWASP npm Security Best Practices guide, along with implementing robust Software Bill of Materials (SBOM) tracking to maintain visibility into software supply-chain dependencies. eSentire's Threat Intelligence team published advisories on the first and second waves of Shai Hulud, and continues to track this topic for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
