eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Critical Fortinet FortiSIEM Vulnerability Disclosed
Bottom Line: FortiGuard disclosed and published an advisory for the critical Remote Code Execution vulnerability CVE-2025-64155, impacting FortiSIEM. As Proof-of-Concept exploit code is publicly available, organizations should ensure that relevant security patches are applied immediately.
On January 13th, 2026, Fortinet disclosed a critical vulnerability, CVE-2025-64155 (CVSS: 9.4), impacting multiple versions of FortiSIEM. It is an OS command injection flaw caused by improper neutralization of special elements within OS commands. The exploitation of the vulnerability may enable an unauthorized attacker to execute arbitrary code or commands through specially crafted TCP requests. Horizon3.ai reported the flaw to Fortinet and released a Proof-of-Concept (PoC) exploit code demonstrating CVE-2025-64155 exploitation on the day it was announced.
The vulnerability exists in the phMonitor service of FortiSIEM, specifically within the elastic_test_url.sh script. The script allows user-controlled input to be passed to a CURL command, making it possible to write files to arbitrary locations. This can be leveraged by an attacker to achieve Remote Code Execution (RCE). Horizon3.ai analysis showed that argument injection into the CURL command is possible that writes arbitrary content to arbitrary locations with administrative privileges. The PoC demonstrated exploitation of the flaw by writing a reverse shell to an already existing file that is executed periodically on the FortiSIEM server. The attack was further extended by writing a reverse shell to a binary that runs every minute, which enabled privilege escalation from the admin user to root, ultimately resulting in full compromise of the server. The PoC exploit code for CVE-2025-64155 has been published in Horizon3.ai's GitHub repository. On January 15th, 2026, Defused reported exploitation of CVE-2025-64155 observed through their honeypot deployments and shared a list of IP addresses associated with the activity.
FortiSIEM operates using three node types, Supervisor, Worker, and Collector, each serving specific functions. Fortinet confirmed that the vulnerability does not affect Collector nodes. The disclosure provided a list of affected FortiSIEM versions along with their corresponding security updates, noting that FortiSIEM Cloud and version 7.5 remain unaffected. Organizations operating vulnerable instances of FortiSIEM are recommended to upgrade to a suitable secure version.
eSentire Threat Intelligence Analysis:
Vulnerabilities in Fortinet appliances, especially in Internet-facing devices, have been a favourable target for threat actors as they allow an easy entrance to victim organization’s environment. It is common for exploitation reports to emerge after PoC exploit code is made publicly available. While reports of exploitation of CVE-2025-64155 are currently limited to honeypot observations, with the lack of an authentication requirement, the eSentire Threat Intelligence team assesses that threat actors will leverage the available PoC or develop new exploits to compromise additional networks in near future.
Since the PoC indicates that the vulnerability exists in the phMonitor service of FortiSIEM, Fortinet advises organizations that cannot immediately upgrade to restrict access to the phMonitor port (7900). In August 2025, another critical FortiSIEM vulnerability, CVE-2025-25256 (CVSS: 9.8), with similar workaround, was disclosed. Fortinet confirmed it was actively exploited, noting circulation of a practical PoC exploit. The flaw was addressed in a security advisory published by the eSentire Threat Intelligence team on August 14th, 2025. These vulnerabilities underscore that the phMonitor service remains a central point of concern in FortiSIEM vulnerabilities.
Organizations are recommended to conduct a business impact review and update the FortiSIEM instances to secure versions immediately. eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-64155. The eSentire Threat Intelligence team published a security advisory covering the flaw on January 14th, 2026.
RedVDS Fueling Global Cybercrime Operations
Bottom Line: RedVDS is an Infrastructure-as-a-Service platform that is used by threat actors to conduct global cybercrime operations. In coordination with U.S. and international law enforcement agencies, Microsoft conducted an operation to disrupt RedVDS infrastructure.
On January 14th, 2026, Microsoft Threat Intelligence published a report on RedVDS, a Virtual Dedicated Server (VDS) provider that has been utilized within many financially motivated cybercrime campaigns throughout 2025. RedVDS operates under an Infrastructure-as-a-Service (IaaS) model, allowing threat actors to purchase access to unlicensed Windows-based Remote Desktop Protocol (RDP) servers, that provide full administrator control and no usage limits, and have been used to stage cybercrime operations globally. Microsoft has identified financially motivated campaigns targeting various sectors, including legal, construction, manufacturing, real estate, healthcare, and education across countries such as the United States, United Kingdom, Canada, France, Germany, and Australia.
RedVDS was first launched in 2019 and is developed and operated by a threat actor group that Microsoft tracks as Storm-2470. Purchasing access to RedVDS provides threat actors with a virtual Windows cloud server, which was cloned from a Windows Server 2022 image. Microsoft states that the threat actors cloned the server repeatedly without customizing its identity, meaning that a single, cloned image is reused across the service that contains a unique technical fingerprint. RedVDS itself does not perform harmful actions but provides threat actors with infrastructure that they can use to stage their campaigns. Through the examination of multiple RedVDS instances, Microsoft identified a common set of tools installed on the cloned servers, which include mass mailer utilities, email address harvesters, privacy and Operational Security (OPSEC) tools, Remote Monitoring and Management (RMM) tools, and automation and scripting environments. RedVDS servers have been identified in campaigns that involve account compromise, credential theft, and financial fraud.
Since March 2025, Microsoft indicates that RedVDS infrastructure has been identified in campaigns that have resulted in $40 million USD in reported fraud losses in the United States alone. Due to the threat that RedVDS poses, Microsoft's Digital Crimes Unit (DCU) has conducted global operations, in partnership with United States, United Kingdom, and international law enforcement agencies, to disrupt RedVDS infrastructure. The global operations have reportedly resulted in the seizing of two domains that host the RedVDS marketplace and customer portal, while also “laying the groundwork to identify the individuals behind them”.
eSentire Threat Intelligence Analysis:
RedVDS is notable due to its placement in the “as-a-Service” cybercrime ecosystem, which includes Phishing-as-a-Service (PhaaS), Malware-as-a-Service (MaaS), and Ransomware-as-a-Service (RaaS) offerings. Examples of these include the Tycoon2FA phishing kit, the information stealer malware Amatera Stealer, and Qilin ransomware, which all offer threat actors access to fully functional phishing, malware, and ransomware platforms for a subscription fee. RedVDS follows this trend, where threat actors can purchase access to disposable virtual servers for as little as $24 USD per month, that can be used to stage attacks. RedVDS lowers the barrier of entry for attackers, as it provides simple access to scalable and disposable infrastructure. Microsoft indicates that in one month, they identified 2600 RedVDS servers that sent an average of one million phishing messages per day, and that since September 2025, attacks utilizing RedVDS infrastructure have led to fraudulent access to more than 191,000 organizations worldwide. These figures demonstrate RedVDS's popularity among cybercriminals, likely due to its ease of use and IaaS structure.
One of the common attacks associated with RedVDS infrastructure involved financial loss relating to payment diversion. These types of attacks involve threat actors gaining access to a user's email account, and either searching for emails relating to payments or wire transfers, or maintaining long-term persistent access to an account while monitoring for such activity. When detected, threat actors will use impersonation to redirect funds into their own accounts. Microsoft states that this technique was commonly observed to facilitate real estate payment diversion scams, impacting more than 9,000 customers in Canada and Australia. In April 2025, the FBI released their Annual Internet Crime Report for 2024, indicating that over $16 billion was reported in losses relating to Internet crime. These statistics demonstrate how prevalent and effective these types of attacks are, and will likely continue to be into 2026, with services like RedVDS opening the door for more threat actors.
RedVDS is not the only cybercrime operation that Microsoft's DCU has aided in disrupting in 2025, with others including Operation Endgame in May 2025 to disrupt Lumma Stealer, and in September 2025 to disrupt the RaccoonO365 phishing kit. These operations are notable as they contribute to the combat of Cybercrime-as-a-Service (CaaS) operations, with a focus on infrastructure that enables attacks rather than targeting specific threat actors, in their attempt at “stopping cybercrime at scale”. As many of the campaigns identified by Microsoft utilizing RedVDS infrastructure involved phishing and brute force attacks, organizations should ensure that strong passwords and Multi-Factor Authentication (MFA) are enforced on all accounts, and to conduct training to educate users on how to identify and report phishing and other malicious content. eSentire's Threat Intelligence team continues to track this topic for additional information and detection opportunities.
UAT-8837 Targets Critical Infrastructure Sectors in North America
Bottom Line: A report on Chinese APT UAT-8837, targeting North American critical infrastructure, emphasizes Chinese threat activity focused on breaching key industries to establish a foothold for potential disruptive attacks.
On January 15th, 2026, Cisco Talos Intelligence released a report on an Advanced Persistent Threat (APT) activity cluster designated UAT-8837. Talos assesses with medium confidence that this threat actor is China-nexus, based on overlaps in Tactics, Techniques, and Procedures (TTPs) with other known China-linked threat actors. Since at least 2025, UAT-8837 has consistently focused its operations on organizations within critical infrastructure sectors in North America. The primary objective of UAT-8837 seems to be gaining initial access to high-value networks and systems. The actor achieves this through multiple vectors, including the exploitation of publicly accessible vulnerabilities in Internet-facing applications, as well as the use of compromised credentials.
In recent campaign, Talos observed the group exploiting a ViewState Deserialization zero-day vulnerability in Sitecore products (CVE-2025-53690) to gain initial access into target environments. After successfully gaining access, UAT-8837 immediately begins reconnaissance and environment mapping. The threat actor executes a range of built-in Windows commands to gather information about the compromised host and its configuration. Additionally, the actor disables Windows RestrictedAdmin mode for Remote Desktop Protocol (RDP) to harvest credentials and facilitate lateral movement.
UAT-8837 conducts its operations using a variety of open-source tools to enable credential theft, tunneling, remote command execution, and Active Directory enumeration. These tools include:
- Earthworm, a network tunneling utility used to expose internal endpoints to external infrastructure
- SharpHound, for collecting Active Directory data
- DWAgent, facilitating remote administration and dropping subsequent malware to the machine
- Certipy, to perform certificate and Active directory abuse
- Impacket, to download Impacket-based binaries
- Rubeus, a C# based toolset for Kerberos abuse
- GoTokenTheft and GoExec, which provide token theft and remote execution capabilities
To ensure persistence and facilitate long‑term access, UAT‑8837 creates and manipulates domain accounts to add new users and to place those users into privileged groups.
eSentire Threat Intelligence Analysis:
Recent reporting from Cisco Talos and other security researchers highlights a continued pattern of Chinese‑nexus threat activity focused on exploiting zero‑day and N‑day vulnerabilities to gain long‑term, espionage‑driven access across critical infrastructure environments. UAT‑6382 exploited the Cityworks CVE‑2025‑0994 zero‑day to compromise U.S. local government networks, rapidly deploying multiple Chinese‑linked web shells and malware loaders such as TetraLoader/MaLoader to install Cobalt Strike and VShell beacons, conduct reconnaissance, and stage data for exfiltration. This activity was indicative of Chinese‑speaking operators seeking persistent access.
Similarly, UAT‑5918 has been conducting a long‑running campaign against Taiwanese critical infrastructure, using unpatched Internet‑facing servers for initial access and relying on Chinese APT‑adjacent tooling such as FRPC, FScan, Earthworm, Neo‑reGeorg, Mimikatz, and Impacket to harvest credentials, create administrative accounts, and move laterally via RDP and WMIC.
In February 2025, Recorded Future’s Insikt Group uncovered a Chinese state-sponsored threat group identified as RedMike, which corresponds to the group named Salt Typhoon by Microsoft, targeting unpatched, Internet-facing Cisco network devices, predominantly affecting global telecommunications providers between December 2024 and January 2025.
In parallel, Cisco disclosed the active exploitation of CVE‑2025‑20393, a critical remote code execution vulnerability in Cisco Secure Email appliances, by UAT‑9686, who deployed a Python‑based backdoor (AquaShell) and tunneling tools (AquaTunnel and Chisel) to establish covert persistence and enable lateral movement, supported by AquaPurge to wipe logs and hinder forensic visibility.
Collectively, these campaigns demonstrate a consistent strategic intent by Chinese‑aligned operators to infiltrate and maintain durable access within high‑value networks. Exploiting a Sitecore ViewState deserialization zero-day highlights advanced operational capability. Most financially motivated actors rely on n-day vulnerabilities. UAT-8837’s use of CVE-2025-53690 increases risk for organizations running internet-facing platforms. Perimeter defenses primarily rely on matching known exploit patterns, known malicious payload structures, or published CVE signatures or behaviors. The first clear indicators of compromise often emerge only after attackers begin post-exploitation actions such as downloading tools, executing commands, harvesting credentials, or pivoting laterally within the environment. Organizations in the targeted sectors should assume that identity protection, certificate monitoring, and lateral movement detection are as crucial as Endpoint and network controls, and they should adopt layered mitigation strategies to reduce dwell time and eliminate the adversary from the environment.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
