CVE-2025-32433
published 2025-04-16CVE-2025-32433: Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an…
PriorityP1100critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2025-06-30
Exploited in the wild
EPSS
98.59%
99.9th percentile
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Affected
36 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cloud_native_broadband_network_gateway | < 2025.03.1 | 2025.03.1 |
| cisco | confd_basic | < 7.7.19.1 | 7.7.19.1 |
| cisco | confd_basic | >= 8.0.18 < 8.1.16.2 | 8.1.16.2 |
| cisco | confd_basic | >= 8.2 < 8.2.11.1 | 8.2.11.1 |
| cisco | confd_basic | >= 8.3 < 8.3.8.1 | 8.3.8.1 |
| cisco | confd_basic | >= 8.4 < 8.4.4.1 | 8.4.4.1 |
| cisco | enterprise_nfv_infrastructure_software | < 4.18 | 4.18 |
| cisco | ncs_2000_shelf_virtualization_orchestrator_firmware | < 25.1.1 | 25.1.1 |
| cisco | network_services_orchestrator | < 5.7.19.1 | 5.7.19.1 |
| cisco | network_services_orchestrator | >= 5.8 < 6.1.16.2 | 6.1.16.2 |
| cisco | network_services_orchestrator | >= 6.2 < 6.2.11.1 | 6.2.11.1 |
| cisco | network_services_orchestrator | >= 6.3 < 6.3.8.1 | 6.3.8.1 |
| cisco | network_services_orchestrator | >= 6.4 < 6.4.1.1 | 6.4.1.1 |
| cisco | network_services_orchestrator | >= 6.4.2 < 6.4.4.1 | 6.4.4.1 |
| cisco | optical_site_manager | < 25.2.1 | 25.2.1 |
| cisco | products_unauthenticated | — | — |
| cisco | smart_phy | < 25.2 | 25.2 |
| cisco | staros | < 2025.03 | 2025.03 |
| cisco | ultra_cloud_core | < 2025.03.1 | 2025.03.1 |
| cisco | ultra_packet_core | < 2025.03 | 2025.03 |
| debian | debian_linux | — | — |
| debian | erlang | < erlang 1:25.2.3+dfsg-1+deb12u1 (bookworm) | erlang 1:25.2.3+dfsg-1+deb12u1 (bookworm) |
| erlang | erlang_otp | < 25.3.2.20 | 25.3.2.20 |
| erlang | erlang_otp | >= 0 < 1:23.2.6+dfsg-1+deb11u2 | 1:23.2.6+dfsg-1+deb11u2 |
| erlang | erlang_otp | >= 0 < 1:25.2.3+dfsg-1+deb12u1 | 1:25.2.3+dfsg-1+deb12u1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Any commands executed via CVE-2025-32433 run with SSH daemon privileges (often root) — alert on unexpected child processes spawned by the SSH daemon, especially with root context. ↗
- →Create high-severity SIEM alerts for scheduled task creation, deletion, or execution matching the pattern 'gentlemen*' — a known post-exploitation persistence indicator for The Gentlemen ransomware. ↗
- →Monitor for wevtutil usage to clear Security/System event logs — used by The Gentlemen for defense impairment post-exploitation. ↗
- →Monitor for vssadmin and wmic commands deleting Volume Shadow Copies — a pre-encryption step used by The Gentlemen ransomware. ↗
- →Monitor for anomalous outbound traffic matching known SystemBC C2 communication signatures — used by The Gentlemen for command and control. ↗
- →Monitor for internal use of Advanced IP Scanner — frequently used by The Gentlemen for internal network reconnaissance and mapping. ↗
- →The Gentlemen ransomware uses a hybrid cryptographic scheme (X25519 + XChaCha20) — look for this combination in memory or binary analysis of suspected ransomware samples. ↗
- →The Gentlemen ransomware (Go variant) is obfuscated with Garble — use Go binary analysis tools and look for Garble obfuscation artifacts when triaging suspected samples. ↗
- →Shodan query for Erlang/OTP SSH exposure returns over 600,000 IPs — use this to identify and prioritize patching of internet-facing Erlang/OTP SSH daemons vulnerable to CVE-2025-32433. ↗
- ·CVE-2025-32433 only affects Erlang/OTP SSH server/daemon — Apache CouchDB is NOT vulnerable as it does not use the SSH server or client features from Erlang/OTP. ↗
- ·The Pastebin PoC for CVE-2025-32433 was NOT confirmed to successfully exploit Erlang/OTP SSH — only the ProDefense GitHub PoC was validated as working. ↗
- ·Patched versions for CVE-2025-32433 are OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20 (NVD) / 25.3.2.10 and 26.2.4 (BleepingComputer early reporting) — verify against official Erlang/OTP release notes for the exact fixed version applicable to your branch. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
osv10.0CRITICAL
vulncheck10.0CRITICAL
cisa10.0CRITICAL
vendor_cisco10.0CRITICAL
vendor_debian10.0CRITICAL
vendor_msrc10.0CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-32433: Erlang/OTP is a set of libraries for the Erlang programming language
osv·2025-04-16·CVSS 10.0
CVE-2025-32433 [CRITICAL] CVE-2025-32433: Erlang/OTP is a set of libraries for the Erlang programming language
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
VulnCheck
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
vulncheck·2025·CVSS 10.0
CVE-2025-32433 [CRITICAL] CWE-306 Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.
Affected: Erlang Erlang/OTP
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if
CISA ICS
Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL (Update A)
cisa_ics·2025-09-16·CVSS 10.0
[CRITICAL] Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL (Update A)
ICS Advisory
##
Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL (Update A)
Last RevisedSeptember 16, 2025
Alert CodeICSA-25-140-07
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Schneider Electric
- Equipment: Galaxy VS, Galaxy VL, Galaxy VXL
- Vulnerability: Missing Authentication for Critical Function
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker to perform unauthenticated remote code execution.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
The following versions of Schneider Electric products are affected:
- Galaxy VS: Versions prior to v6.118
Ubuntu
Erlang vulnerability
vendor_ubuntu·2025-07-17
CVE-2025-32433 Erlang vulnerability
Title: Erlang vulnerability
Summary: Erlang could be made to run programs if it received specially crafted
network traffic.
USN-7443-1 fixed a vulnerability in Erlang. This update provides the
corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.
Original advisory details:
Fabian Bäumer, Marcel Maehren, Marcus Brinkmann, and Jörg Schwenk
discovered that Erlang OTP’s SSH module incorrect handled authentication. A
remote attacker could use this issue to execute arbitrary commands without
authentication, possibly leading to a system compromise.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
CISA
Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
cisa·2025-06-09·CVSS 10.0
CVE-2025-32433 [CRITICAL] CWE-306 Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Vulnerability: Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function Vulnerability
Affected: Erlang Erlang/OTP
Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of
Ubuntu
Erlang vulnerability
vendor_ubuntu·2025-04-23
CVE-2025-32433 Erlang vulnerability
Title: Erlang vulnerability
Summary: Erlang could be made to run programs if it received specially crafted
network traffic.
USN-7443-1 fixed a vulnerability in Erlang. This update provides the
corresponding update for Ubuntu 25.04.
Original advisory details:
Fabian Bäumer, Marcel Maehren, Marcus Brinkmann, and Jörg Schwenk
discovered that Erlang OTP’s SSH module incorrect handled authentication.
A remote attacker could use this issue to execute arbitrary commands
without authentication, possibly leading to a system compromise.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Cisco
Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server: April 2025
vendor_cisco·2025-04-22·CVSS 10.0
CVE-2025-32433 [CRITICAL] CWE-306 Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server: April 2025
Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server: April 2025
On April 16, 2025, a critical vulnerability in the Erlang/OTP SSH server was disclosed. This vulnerability could allow an unauthenticated, remote attacker to perform remote code execution (RCE) on an affected device.
The vulnerability is due to a flaw in the handling of SSH messages during the authentication phase.
For a description of this vulnerability, see the Erlang announcement.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy
Ubuntu
Erlang vulnerability
vendor_ubuntu·2025-04-17
CVE-2025-32433 Erlang vulnerability
Title: Erlang vulnerability
Summary: Erlang could be made to run programs if it received specially crafted
network traffic.
Fabian Bäumer, Marcel Maehren, Marcus Brinkmann, and Jörg Schwenk
discovered that Erlang OTP’s SSH module incorrect handled authentication. A
remote attacker could use this issue to execute arbitrary commands without
authentication, possibly leading to a system compromise.
Instructions: After a standard system update you need to reboot your computer to make all
the necessary changes.
Microsoft
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
vendor_msrc·2025-04-08·CVSS 10.0
CVE-2025-32433 [CRITICAL] CWE-306 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://lea
Debian
CVE-2025-32433: erlang - Erlang/OTP is a set of libraries for the Erlang programming language. Prior to v...
vendor_debian·2025·CVSS 10.0
CVE-2025-32433 [CRITICAL] CVE-2025-32433: erlang - Erlang/OTP is a set of libraries for the Erlang programming language. Prior to v...
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials. This issue is patched in versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.
Scope: local
bookworm: resolved (fixed in 1:25.2.3+dfsg-1+deb12u1)
bullseye: resolved (fixed in 1:23.2.6+dfsg-1+deb11u2)
forky: resolved (fixed in 1:27.3.3+dfsg-1)
sid: resolved (fixed in 1:27.3.3+dfsg-1)
trixie: re
Cisco
Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server: April 2025
vendor_cisco·CVSS 3.1
CVE-2025-32433 Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server: April 2025
CVE-2025-32433: Multiple Cisco Products Unauthenticated Remote Code Execution in Erlang/OTP SSH Server: April 2025
On April 16, 2025, a critical vulnerability in the Erlang/OTP SSH server was disclosed. This vulnerability could allow an unauthenticated, remote attacker to perform remote code execution (RCE) on an affected device. The vulnerability is due to a flaw in the handling of SSH messages during the authentication phase. For a description of this vulnerability, see the Erlang announcement . This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy
CVSS: 3.1
CWE: CWE-306, CWE-306
Bug IDs: CSCwo83759, CSCwo83796, CSCwo83751, CSCwo83750, CSCwo83806
Suricata
ET INFO Potentially Vulnerable Cisco ConfD SSH Server Banner (CVE-2025-32433)
suricata·2025-04-23·CVSS 10.0
CVE-2025-32433 [CRITICAL] ET INFO Potentially Vulnerable Cisco ConfD SSH Server Banner (CVE-2025-32433)
ET INFO Potentially Vulnerable Cisco ConfD SSH Server Banner (CVE-2025-32433)
Rule: alert ssh $HOME_NET any -> any any (msg:"ET INFO Potentially Vulnerable Cisco ConfD SSH Server Banner (CVE-2025-32433)"; flow:established,to_client; flowbits:set,ET.ErlangOTPBanner; ssh.software; content:"ConfD-"; reference:url,sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy; reference:cve,2025-32433; classtype:misc-activity; sid:2061806; rev:2; metadata:affected_product Erlang_OTP, affected_product Cisco_NSO, affected_product Cisco_ConfD, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_04_23, cve CVE_2025_32433, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Informational, t
Suricata
ET EXPLOIT SSH Erlang/OTP SSH Server Unencryped Channel Request (Message Type 98) (CVE-2025-32433)
suricata·2025-04-22·CVSS 10.0
CVE-2025-32433 [CRITICAL] ET EXPLOIT SSH Erlang/OTP SSH Server Unencryped Channel Request (Message Type 98) (CVE-2025-32433)
ET EXPLOIT SSH Erlang/OTP SSH Server Unencryped Channel Request (Message Type 98) (CVE-2025-32433)
Rule: alert ssh any any -> $HOME_NET any (msg:"ET EXPLOIT SSH Erlang/OTP SSH Server Unencryped Channel Request (Message Type 98) (CVE-2025-32433)"; flow:established,to_server; flowbits:isset,ET.ErlangOTPBanner; content:"exec"; fast_pattern; byte_jump:0,0,relative,post_offset -13; content:"|62|"; within:1; reference:cve,2025-32433; reference:url,github.com/darses/CVE-2025-32433/blob/main/README.md; classtype:attempted-admin; sid:2061797; rev:3; metadata:affected_product Erlang_OTP, attack_target Server, tls_state plaintext, created_at 2025_04_22, cve CVE_2025_32433, deployment Perimeter, deployment Internal, performance_impact Significant, confidence High, signature_severity Major, tag Exploi
Suricata
ET INFO Potentially Vulnerable Erlang/OTP SSH Server Banner (CVE-2025-32433)
suricata·2025-04-22·CVSS 10.0
CVE-2025-32433 [CRITICAL] ET INFO Potentially Vulnerable Erlang/OTP SSH Server Banner (CVE-2025-32433)
ET INFO Potentially Vulnerable Erlang/OTP SSH Server Banner (CVE-2025-32433)
Rule: alert ssh $HOME_NET any -> any any (msg:"ET INFO Potentially Vulnerable Erlang/OTP SSH Server Banner (CVE-2025-32433)"; flow:established,to_client; flowbits:set,ET.ErlangOTPBanner; ssh.software; content:"Erlang/"; pcre:"/^(?:(?:4\x2e(?:[0-9]|1[0-5])\x2e[0-3]\x2e(?:[0-9]|1[0-1]))|(?:5\x2e2\x2e(?:[0-9]))|(?:5\x2e1\x2e[0-4]\x2e[0-7]))/R"; reference:url,www.runzero.com/blog/erlang-otp-ssh/; reference:cve,2025-32433; classtype:misc-activity; sid:2061790; rev:3; metadata:affected_product Erlang_OTP, attack_target Server, tls_state plaintext, created_at 2025_04_22, cve CVE_2025_32433, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Informational, tag Exploit,
Suricata
ET EXPLOIT SSH Client Key Exchange Init Cookie Null
suricata·2025-04-22·CVSS 10.0
CVE-2025-32433 [CRITICAL] ET EXPLOIT SSH Client Key Exchange Init Cookie Null
ET EXPLOIT SSH Client Key Exchange Init Cookie Null
Rule: alert ssh any any -> $HOME_NET any (msg:"ET EXPLOIT SSH Client Key Exchange Init Cookie Null"; flow:established,to_server; flowbits:isset,ET.ErlangOTPBanner; content:"|14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; reference:cve,2025-32433; reference:url,github.com/darses/CVE-2025-32433/blob/main/README.md; classtype:attempted-admin; sid:2061798; rev:3; metadata:affected_product Erlang_OTP, attack_target Server, tls_state plaintext, created_at 2025_04_22, deployment Perimeter, deployment Internal, performance_impact Significant, confidence High, signature_severity Major, tag Exploit, updated_at 2025_06_26, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_
Metasploit
Erlang OTP Pre-Auth RCE Scanner and Exploit
metasploit·CVSS 10.0
CVE-2025-32433 [CRITICAL] Erlang OTP Pre-Auth RCE Scanner and Exploit
Erlang OTP Pre-Auth RCE Scanner and Exploit
This module detect and exploits CVE-2025-32433, a pre-authentication vulnerability in Erlang-based SSH servers that allows remote command execution. By sending crafted SSH packets, it executes a payload to establish a reverse shell on the target system. The exploit leverages a flaw in the SSH protocol handling to execute commands via the Erlang `os:cmd` function without requiring authentication.
Nuclei
Erlang/OTP SSH - Remote Code Execution
nuclei·CVSS 10.0
CVE-2025-32433 [CRITICAL] Erlang/OTP SSH - Remote Code Execution
Erlang/OTP SSH - Remote Code Execution
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protocol message handling, a malicious actor could gain unauthorized access to affected systems and execute arbitrary commands without valid credentials.
Template:
id: CVE-2025-32433
info:
name: Erlang/OTP SSH - Remote Code Execution
author: iamnoooob,rootxharsh,pdresearch,darses
severity: critical
description: |
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthent
Unit42
No Manners Here: The Ruthless Rise of The Gentlemen Ransomware
blogs_unit42·2026-07-10
CVE-2024-55591 No Manners Here: The Ruthless Rise of The Gentlemen Ransomware
## No Manners Here: The Ruthless Rise of The Gentlemen Ransomware
Matt Brady
Published: July 10, 2026
Hospitality Hacks and Retail Reality Checks
Insights
Howling Scorpius
RaaS
Spikey Scorpius
## Executive Summary
The Gentlemen (aka Storm-2697 ) is a Ransomware-as-a-Service (RaaS) program active since at least July 2025. Public reporting indicates that the operators were likely active months earlier as an affiliate (known as ArmCorp) of Qilin RaaS, which Unit 42 tracks as Spikey Scorpius. Their ransomware variants are written in both C and Go programming languages , enabling the threat actors to spread their encryptors across different operating systems and virtual infrastructure. Figure 1 below illustrates the desktop wallpaper used by the ransomware after deployment.
Additio
Hackernews
The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm
blogs_hackernews·2026-06-11
CVE-2024-55591 The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## The Gentlemen Ransomware Claims 478 Victims, Can Spread Like a Worm
A new analysis of The Gentlemen operation has revealed that the financially motivated threat group initially operated as an affiliate responsible for conducting double extortion attacks, while leveraging resources from various ransomware-as-a-service (RaaS) schemes like LockBit (aka Tenacious Mantis), Qilin (aka Pestilent Mantis), and Medusa (aka Venomous Mantis).
According to a detailed report published by PRODAFT, the group, which it tracks as Phantom Mantis, is led by a Russian-speaking cybercriminal it calls LARVA-368, who goes by the online aliases hast
Checkpoint
Thus Spoke…The Gentlemen
blogs_checkpoint·2026-05-13·CVSS 9.8
CVE-2024-55591 [CRITICAL] Thus Spoke…The Gentlemen
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
AI Research 2
Android Malware 23
Artificial Intelligence 4
ChatGPT 3
Check Point Research Publications 455
Cloud Security 1
CPRadio 44
Crypto 2
Data & Threat Intelligence 2
Data Analysis 0
Demos 22
Global Cyber Attack Reports 408
How To Guides 13
Ransomware 5
Russo-Ukrainian War 1
Security Report 1
Threat and data analysis 0
Threat Research 174
Web 3.0 Security 11
Wipers 0
## Thus Spoke…The Gentlemen
## Key Points
On May 4th, 2026, The Gentlemen RaaS administrator acknowledged on underground forums that an internal backend database ( Rocket ) had been leaked.
Tenable
Operation Epic Fury: Why exposure data changes everything about Iran's cyber-kinetic campaign
blogs_tenable·2026-03-17
Operation Epic Fury: Why exposure data changes everything about Iran's cyber-kinetic campaign
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Operation Epic Fury: cyber threat data in the Iran War
blogs_tenable·2026-03-17·CVSS 7.8
[HIGH] Operation Epic Fury: cyber threat data in the Iran War
Blog / Cyber Exposure Alerts
Subscribe
# Operation Epic Fury: Why exposure data changes everything about Iran's cyber-kinetic campaign
Robert Huber
March 17, 2026
13 Min Read
Iran's retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable's exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn't the headline threat, it's a Microsoft Word N-day affecting nearly 14 million assets.
## Key takeaways:
1. Exposure data rebalances the threat picture. A Microsoft Word N-day (CVE-2026-21514) accounts for nearly 14 million of the 15.5 million affected assets across the seven target countries, two orders of magnitude more than the conflict's headline threats. Organizations
Tenable
CVE-2026-21514 FAQ: OLE bypass N-Day in Microsoft Word | Tenable®
blogs_tenable·2026-03-17·CVSS 7.8
CVE-2026-21514 [HIGH] CVE-2026-21514 FAQ: OLE bypass N-Day in Microsoft Word | Tenable®
Blog / Cyber Exposure Alerts
Subscribe
# FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word
Research Special Operations
March 17, 2026
10 Min Read
An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings.
## Key takeaways:
1. CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts
2. Tenable's exposure data analysis identified nearly 14 million affected assets across seven Tier-1 countries still vulnerable to CVE-2026-21514
3. Prioritize patching CVE-2026-21514 across all managed endpoints and deplo
Tenable
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word
blogs_tenable·2026-03-17·CVSS 7.8
[HIGH] FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Wiz
Twenty Years of Cloud Security Research | Wiz Blog
blogs_wiz·2026-03-13
Twenty Years of Cloud Security Research | Wiz Blog
On March 14, 2006, AWS announced S3, marking the first AWS service that was generally available and what AWS celebrates as their start. Azure and GCP can each be traced back to slightly later dates, so March 14, 2026 is therefore the 20 year anniversary of the cloud.
A lot has changed about the details from that initial S3 announcement. The price has been reduced by an order of magnitude, and many new features were added (and some removed). But that announcement also mentions a feature of the S3 bucket is that you can “share it for reading”, meaning it can be configured as a public S3 bucket. From day one, it has been possible to do great things with the cloud, but also to make misconfigurations.
This post will look at the past 20 years of cloud security research, separating the two deca
Wiz
Twenty Years of Cloud Security Research | Wiz Blog
blogs_wiz·2026-03-13
Twenty Years of Cloud Security Research | Wiz Blog
On March 14, 2006, AWS announced S3, marking the first AWS service that was generally available and what AWS celebrates as their start. Azure and GCP can each be traced back to slightly later dates, so March 14, 2026 is therefore the 20 year anniversary of the cloud.
A lot has changed about the details from that initial S3 announcement. The price has been reduced by an order of magnitude, and many new features were added (and some removed). But that announcement also mentions a feature of the S3 bucket is that you can “share it for reading”, meaning it can be configured as a public S3 bucket. From day one, it has been possible to do great things with the cloud, but also to make misconfigurations.
This post will look at the past 20 years of cloud security research, separating the two deca
Rapid7
Rapid7 Detection Coverage for Iran-Linked Cyber Activity
blogs_rapid7·2026-03-11
Rapid7 Detection Coverage for Iran-Linked Cyber Activity
The tension arising out of the conflict in Iran is beginning to show signs of expanding beyond a strictly regional crisis. Following our recent published advisories, this communication is intended to outline and summarize the detection and enrichment coverage available to Rapid7 customers, broadly assess the macro cyber threat landscape, and demonstrate the specific actions undertaken within the Rapid7 portfolio to assure our customers of the protection they receive and can expect moving forward. For a research-driven companion piece from Rapid7 Labs, dive into Iran’s Cyber Playbook in the Escalating Regional Conflict.
## Tracking the campaigns associated with the current conflict
There exists a number of threat campaigns (both directly and indirectly) associated with groups associated w
Rapid7
Rapid7 Detection Coverage for Iran-Linked Cyber Activity
blogs_rapid7·2026-03-11
Rapid7 Detection Coverage for Iran-Linked Cyber Activity
The tension arising out of the conflict in Iran is beginning to show signs of expanding beyond a strictly regional crisis. Following our recent published advisories, this communication is intended to outline and summarize the detection and enrichment coverage available to Rapid7 customers, broadly assess the macro cyber threat landscape, and demonstrate the specific actions undertaken within the Rapid7 portfolio to assure our customers of the protection they receive and can expect moving forward. For a research-driven companion piece from Rapid7 Labs, dive into Iran’s Cyber Playbook in the Escalating Regional Conflict .
## Tracking the campaigns associated with the current conflict
There exists a number of threat campaigns (both directly and indirectly) associated with groups associated
Securelist
Exploits and vulnerabilities in Q2 2025
blogs_securelist·2025-08-27·CVSS 8.2
CVE-2025-32433 [HIGH] Exploits and vulnerabilities in Q2 2025
Table of Contents
Statistics on registered vulnerabilities
Exploitation statistics
Windows and Linux vulnerability exploitation
Most common published exploits
Vulnerability exploitation in APT attacks
C2 frameworks
Interesting vulnerabilities
CVE-2025-32433: vulnerability in the SSH server, part of the Erlang/OTP framework
CVE-2025-6218: directory traversal vulnerability in WinRAR
CVE-2025-3052: insecure data access vulnerability in NVRAM, allowing bypass of UEFI signature checks
CVE-2025-49113: insecure deserialization vulnerability in Roundcube Webmail
CVE-2025-1533: stack overflow vulnerability in the AsIO3.sys driver
Conclusion and advice
Authors
Alexander Kolesnikov
Vulnerability registrations in Q2 2025 proved to be quite dynamic. Vulnerabilities that were published i
Securelist
Vulnerability landscape analysis for Q2 2025
blogs_securelist·2025-08-27
Vulnerability landscape analysis for Q2 2025
Table of Contents
- Statistics on registered vulnerabilities
- Exploitation statistics
- Vulnerability exploitation in APT attacks
- C2 frameworks
- Interesting vulnerabilities
- Conclusion and advice
Authors
- Alexander Kolesnikov
Vulnerability registrations in Q2 2025 proved to be quite dynamic. Vulnerabilities that were published impact the security of nearly every computer subsystem: UEFI, drivers, operating systems, browsers, as well as user and web applications. Based on our analysis, threat actors continue to leverage vulnerabilities in real-world attacks as a means of gaining access to user systems, just like in previous periods.
This report also describes known vulnerabilities used with popular C2 frameworks during the first half of 2025.
## Statistics on registered vulnera
Unit42
Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
blogs_unit42·2025-08-11·CVSS 10.0
CVE-2025-32433 [CRITICAL] Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
## Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
Adam Robbie
Yiheng An
Malav Vyas
Cecilia Hu
Matthew Tennis
Hugo Perez
Zhanhao Chen
Rick Wyble
Published: August 11, 2025
Threat Research
Vulnerabilities
5G
CVE-2025-32433
Erlang
Operational Technology
Remote Code Execution
## Executive Summary
This article presents our observations of exploit attempts targeting CVE-2025-32433 . This vulnerability allows unauthenticated remote code execution (RCE) in the Secure Shell (SSH) daemon (sshd) from certain versions of the Erlang programming language's Open Telecom Platform (OTP).
Erlang/OTP sshd is widely used in critical infrastructure and operational technology (OT) networks.With a CVSS score of 10.0, CVE-2025-32433 enables unaut
Unit42
Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
blogs_unit42·2025-08-11·CVSS 10.0
CVE-2025-32433 [CRITICAL] Keys to the Kingdom: Erlang/OTP SSH Vulnerability Analysis and Exploits Observed in the Wild
## Executive Summary
This article presents our observations of exploit attempts targeting CVE-2025-32433. This vulnerability allows unauthenticated remote code execution (RCE) in the Secure Shell (SSH) daemon (sshd) from certain versions of the Erlang programming language's Open Telecom Platform (OTP).
Erlang/OTP sshd is widely used in critical infrastructure and operational technology (OT) networks.With a CVSS score of 10.0, CVE-2025-32433 enables unauthenticated clients to execute commands by sending SSH connection protocol messages (codes >= 80) to open SSH ports, which should only be processed after successful authentication. Vulnerable versions include Erlang/OTP prior to OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20.
A patch is available in Erlang/OTP versions OTP-27.3.3, OTP-26.2.5
Wiz
Crying Out Cloud Newsletter - May 2025 | Wiz
blogs_wiz·2025-05-01·CVSS 10.0
CVE-2025-32433 [CRITICAL] Crying Out Cloud Newsletter - May 2025 | Wiz
Welcome back! This month we’ve seen a lot of action, with both vulnerabilities and security incidents that have left users affected. We bring you the latest cloud security highlights, to help you stay informed and stay secure.
Here are our top picks of cloud security highlights!
Hype or no hype – Critical Vulnerability in Erlang/OTP SSH Implementation
CVE-2025-32433 is a critical vulnerability (CVSS 10.0) in the Erlang/Open Telecom Platform (OTP) SSH implementation that allows unauthenticated remote attackers to execute arbitrary code by exploiting flaws in how the SSH protocol sequence is handled. Specifically, the vulnerability stems from the improper enforcement of message ordering, enabling attackers to send malicious SSH protocol messages before authentication and gain code executi
Tenable
Reducing Remediation Time Remains a Challenge: How Tenable Vulnerability Watch Can Help
blogs_tenable·2025-04-25
Reducing Remediation Time Remains a Challenge: How Tenable Vulnerability Watch Can Help
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Critical Erlang/OTP SSH RCE bug now has public exploits, patch now
blogs_bleepingcomputer·2025-04-19·CVSS 10.0
CVE-2025-32433 [CRITICAL] Critical Erlang/OTP SSH RCE bug now has public exploits, patch now
## Critical Erlang/OTP SSH RCE bug now has public exploits, patch now
## Lawrence Abrams
Public exploits are now available for a critical Erlang/OTP SSH vulnerability tracked as CVE-2025-32433, allowing unauthenticated attackers to remotely execute code on impacted devices.
Researchers at the Ruhr University Bochum in Germany disclosed the flaw on Wednesday, warning that all devices running the daemon were vulnerable.
"The issue is caused by a flaw in the SSH protocol message handling which allows an attacker to send connection protocol messages prior to authentication," reads a disclosure on the OpenWall vulnerability mailing list.
The flaw was fixed in versions 25.3.2.10 and 26.2.4, but as the paltform is commonly used in telecom infrastructure, databases, and high-availability syst
Tenable
CVE-2025-32433: Erlang/OTP SSH Unauthenticated Remote Code Execution Vulnerability
blogs_tenable·2025-04-18·CVSS 10.0
[CRITICAL] CVE-2025-32433: Erlang/OTP SSH Unauthenticated Remote Code Execution Vulnerability
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Critical Erlang/OTP SSH pre-auth RCE is 'Surprisingly Easy' to exploit, patch now
blogs_bleepingcomputer·2025-04-17·CVSS 10.0
CVE-2025-32433 [CRITICAL] Critical Erlang/OTP SSH pre-auth RCE is 'Surprisingly Easy' to exploit, patch now
## Critical Erlang/OTP SSH pre-auth RCE is 'Surprisingly Easy' to exploit, patch now
## Lawrence Abrams
A critical vulnerability in the Erlang/OTP SSH, tracked as CVE-2025-32433, has been disclosed that allows for unauthenticated remote code execution on vulnerable devices.
The flaw was discovered by Fabian Bäumer, Marcus Brinkmann, Marcel Maehren, and Jörg Schwenk of the Ruhr University Bochum in Germany and given a maximum severity score of 10.0.
All devices running the Erlang/OTP SSH daemon are impacted by the vulnerability and are advised to upgrade to versions 25.3.2.10 and 26.2.4 to fix the flaw.
Erlang is a programming language known for its fault-tolerance and concurrency, making it commonly used in telecom infrastructure and high -availability systems. Erlang/OTP is a set of
Recorded Future
H1 2025 Malware and Vulnerability Trends
blogs_recorded_future
H1 2025 Malware and Vulnerability Trends
## H1 2025 Malware and Vulnerability Trends
## Executive Summary
The first half of 2025 (H1 2025) reflected a rapidly evolving threat landscape defined by the convergence of persistent legacy threats and advanced new tactics.
The total disclosed CVEs increased by 16% from H1 2024, and threat actors exploited 161 vulnerabilities with assigned CVEs, with nearly half linked to malware or ransomware campaigns. Microsoft remained the most targeted vendor, while edge security and gateway devices continued to be high-value targets for initial access. Malware activity was similarly dynamic: while law enforcement takedowns disrupted major players like LummaC2, a resurgence of legacy malware such as Sality indicated that old tools still offer utility for modern actors. Remote access trojans (RATs
Greynoiseio
NoiseLetter April 2025
blogs_greynoiseio
NoiseLetter April 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Recorded Future
H1 2025 Malware and Vulnerability Trends
blogs_recorded_future
H1 2025 Malware and Vulnerability Trends
# H1 2025 Malware and Vulnerability Trends
## Executive Summary
The first half of 2025 (H1 2025) reflected a rapidly evolving threat landscape defined by the convergence of persistent legacy threats and advanced new tactics.
The total disclosed CVEs increased by 16% from H1 2024, and threat actors exploited 161 vulnerabilities with assigned CVEs, with nearly half linked to malware or ransomware campaigns. Microsoft remained the most targeted vendor, while edge security and gateway devices continued to be high-value targets for initial access. Malware activity was similarly dynamic: while law enforcement takedowns disrupted major players like LummaC2, a resurgence of legacy malware such as Sality indicated that old tools still offer utility for modern actors. Remote access trojans (RATs)
CTF
FesseMisk / README
ctf_writeups·2025·CVSS 5.3
CVE-2025-30208 [MEDIUM] FesseMisk / README
# CVE-Safari
**FesseMisk by HAL50000**
## Initial Reconnaissance
Every boot2root starts with nmap. I always run `nmap -T5 -A IP -vv` because I'm impatient and like my scans aggressive.
**NMAP Results:**
```
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.14
5173/tcp open unknown
```
Port 5173 showed Vite configuration errors and blocked requests in the fingerprint.
## Step 1: Alpha User (Vite CVE-2025-30208)
Checked out port 5173 and found it was running **Vite v6.2.1**:
```bash
curl -v http://10.128.8.84:5173/
# Output shows: VITE v6.2.1
```
From the challenge context, I guessed there's a CVE from 2025 in that Vite version.
**EXPERT LEVEL GOOGLE DORKING INCOMING:** I found basically all POCs in this challenge by typing `THING CVE-2025 poc github`. Sign u
https://github.com/erlang/otp/commit/0fcd9c56524b28615e8ece65fc0c3f66ef6e4c12https://github.com/erlang/otp/commit/6eef04130afc8b0ccb63c9a0d8650209cf54892fhttps://github.com/erlang/otp/commit/b1924d37fd83c070055beb115d5d6a6a9490b891https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2http://www.openwall.com/lists/oss-security/2025/04/16/2http://www.openwall.com/lists/oss-security/2025/04/18/1http://www.openwall.com/lists/oss-security/2025/04/18/2http://www.openwall.com/lists/oss-security/2025/04/18/6http://www.openwall.com/lists/oss-security/2025/04/19/1https://lists.debian.org/debian-lts-announce/2025/04/msg00028.htmlhttps://security.netapp.com/advisory/ntap-20250425-0001/https://github.com/ProDefense/CVE-2025-32433/blob/main/CVE-2025-32433.pyhttps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZyhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-32433
2025-04-16
Published
2025-06-09
Added to CISA KEV
Exploited in the wild