UnsafeMalware
Last reported 16 days ago, by CISA advisories6 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1059.003Windows Command Shell
“The attacker enabled xp_cmdshell parameters to allow SQL Server to spawn a Windows command shell and pass in a string for execution.”
- T1110Brute Force
“Sekoia TDR observed an MS-SQL honeypot compromised by brute force within an hour, then used to deploy Mallox ransomware via PureCrypter.”
- T1490Inhibit System Recovery
“Mallox use bcedit to inhibit system recovery.”
- T1505.003Web Shell
“Across nearly every category, whether it be Web Shells, Reverse Shells, or Proof of Execution, you'll find an unmistakable spike between 150-400 bytes.”
- T1620Reflective Code Loading
“It is executed using the Reflective Code Loading technique by the previous payload.”
- T1684Social Engineering
“CISA also recommends users take the following measures to protect themselves from social engineering attacks:”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
Grid Protection Alliance openPDC and openHistorian“…ction, Server-Side Request Forgery (SSRF), Use of Hard-coded Credentials, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')”
-
Mallox ransomware affiliate uses PureCrypter in MS-SQL attacks“The attacker created an assembly named “shell” and stored it on the "msdb" database with "Unsafe" permission.”
-
Restricted CLI escape using Lua“An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] in FortiOS and FortiProxy may allow an authenticated admin to execute lua scripts via crafted CLI commands.”
-
Autonomous fuzzing process under LLM supervision“…verage"), and the identification of unsafe pointer operations from the work of Vital (TOSEM 2025, "MCTS-Guided Symbolic Execution Toward Unsafe Pointers").”
-
There's Payloads, And Then There's pAIloads: A Look At Selected Opportunistic (And Possibly AI-"Enhanced") React2Shell Probes and Attacks“React Server Components Unsafe Deserialization CVE-2025-55182 RCE Attempt”
-
CVE-2025-55182 (React2Shell) Opportunistic Exploitation In The Wild: What The GreyNoise Observation Grid Is Seeing So Far“React Server Components Unsafe Deserialization CVE-2025-55182 RCE Attempt”
Indicators in its reports
named in the reports above- hxxp://91.215.85[.]142/QWEwqdsvsf/ap.phpin 1 report
- 91.215.85[.]142in 1 report
- hxxps://whyers[.]ioin 1 report
- whyers[.]ioin 1 report
- hxxps://www.isxhost[.]uk/in 1 report
- www.isxhost[.]ukin 1 report
- vps-zap812595-1.zap-srv[.]comin 1 report
- bewildered-cock-lover[.]onlinein 1 report
- hxxp://200.4.115[.]1/promocionao.phpin 1 report
- 200.4.115[.]1in 1 report
- 267b27460704e41e27d6f2591066388fin 1 report
- hxxp://23.235.188[.]3:652/qMqSbin 1 report
- 23.235.188[.]3in 1 report
- 2f7ac6.ceye[.]ioin 1 report
- 45.157.233[.]80in 1 report
- 5axzi7.dnslog[.]cnin 1 report
- hxxp://162.215.170[.]26:3000/sex.shin 1 report
- 162.215.170[.]26in 1 report
- hxxp://46.36.37[.]85:12000/sex.shin 1 report
- 46.36.37[.]85in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.