hxxp://127.0.0[.]1:8080/footprints/servicedeskURL
Reported by 1 independent source · first reported by watchTowr Labs · last reported
Last reported 7 months ago
What the reports say
1 report, newest first · the exact sentence from each-
The Most Organized Threat Actors Use Your ITSM (BMC FootPrints Pre-Auth Remote Code Execution Chains)“Upon first installation, a browser is launched to the main application entry point located at hxxp://127.0.0[.]1:8080/footprints/servicedesk .”
Indicators reported together
named in the same reports- 9cad4ca3d09e640b4ae3dcdce2116b47in 1 report
- 4cc85b0b94e801ada5c5dafc865244a7in 1 report
- system.web.ui[.]pagein 1 report
- e014bb23bfb56540dc2fdfe9c0eb3778in 1 report
- f3bcbf9067a19b61e3afd0b1ada18d1din 1 report
Copy these 5 indicators · defanged
Also named with it: CVE-2025-24813, CVE-2025-71257, CVE-2025-71258, CVE-2025-71259, CVE-2025-71260
Thanks — we review every report.