Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

CVE-2025-32975: The Open Directory Behind the KACE SMA Breach and 60+ Downstream Victims

hunt.io | incident | CVE-2025-32975 | #incident-response | #threat-intelligence | #authentication-bypass | #data-exposure | #msp | #open-directory | #cve-2025-32975 | #quest-kace

Summary

Hunt.io captured an open directory staged three days into the KACE SMA CVE-2025-32975 exploitation wave, exposing the attacker's toolkit and a 512 MB database dump from an MSP managing 60+ clients.
CVE
CVE-2025-32975
Published
Collected

original ↗

Related coverage

vulnerability · hunt.io
[CVE-2026-15409] UK Council Attack Linked to SonicWall SMA 1000 Campaign
Hunt.io links a UK council breach to mass exploitation of SonicWall SMA1000 CVE-2026-15409: LDAP credentials from 168 appliances, secretsdump run on-device, DCSync in five AD environments.
blog · hunt.io
Ababil of Minab Exposed: LA Metro SCADA Backups and Israeli Victim Data Left Open on an Iranian Staging Server
Hunt.io AttackCapture found Ababil of Minab's staging server wide open: 5 GB of victim data including LA Metro SCADA backups and Israeli organizations' credentials, configs, and database dumps.
incident · hunt.io
TheGentlemen Ransomware Toolkit Found on Russian Proton66 Server
A live TheGentlemen ransomware toolkit surfaced on Russian bulletproof host Proton66: 126 files with victim hashes in Mimikatz logs, a 35 KB pre-deployment script, and plaintext ngrok tokens.
incident · hackerone.com
What We Can Learn From Recent Ransomware Attacks
The Kaseya VSA zero-day compromise unleashed REvil ransomware on roughly 1,500 organizations via MSPs. The article explains REvil's ransomware-as-a-service model and double-extortion tactics.
incident · netspi.com
LiteLLM Supply Chain Compromise
Malicious PyPI builds of LiteLLM 1.82.7/1.82.8, published via a compromised maintainer account, exfiltrated API keys and system data, exposing a user's entire LLM provider surface.
incident · netspi.com
Healthcare’s Guide to Ryuk Ransomware: Advice for Prevention and Remediation
Making its debut in 2018, the Ryuk ransomware strand has wreaked havoc on hundreds of businesses and is responsible for one-third of all ransomware attacks that took place in 2020.
back