The Lotus Blossom Advanced Persistent Threat (APT) group, also known as Lotus Panda, Billbug, and Spring Dragon, has intensified its cyberespionage efforts with new variants of the Sagerunex backdoor. These developments highlight the group’s evolving tactics, including leveraging Windows Management Instrumentation (WMI) for post-exploitation activities and employing legitimate cloud services for command-and-control (C2) communications. The […]
The post Lotus Blossom APT Exploits WMI for Post-Exploitation Activities appeared first on Cyber Security News.
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a Malware Analysis Report (MAR-25993211-r1.v1) detailing the exploitation of a critical vulnerability in Ivanti Connect Secure devices (CVE-2025-0282). This vulnerability allows attackers to gain unauthorized access and deploy sophisticated malware variants, including the newly identified RESURGE and SPAWNSLOTH. CISA’s analysis revealed that RESURGE operates as a […]
The post CISA Warns of ESURGE Malware Exploiting Ivanti RCE Vulnerability appeared first on Cyber Security News.