SecPod Labs
Security Research
In-depth CVE write-ups, vulnerability analysis, and security intelligence from the SecPod Research team.
Showing filtered results from Strapi content.
CVE Research
Silent Lynx Hits CIS Governments With WinRAR Flaw
Silent Lynx (UAT-6275 / TAG-193) is a cyber-espionage actor targeting government organizations across the Commonwealth of Independent States. From June 2025 through August 2026, the group used four infection chains, including macro-enabled documents, PS2EXE downloaders, LNK-based PowerShell loaders, and WinRAR archives that exploit CVE-2025-8088, to deploy custom reverse shells such as FoalShell, Chvost, Laplas, and PickleShell. Activity spans nine countries and focuses on diplomacy, economic development, environmental management, water resources, and energy. This article summarizes the campaign’s delivery methods, infrastructure exposure, indicators of compromise, and practical mitigations for defenders.
CVE Research
The In-Memory Route to Root: Inside The Ivanti Connect Secure Chain
UTA0576 combined an authentication bypass, a short-lived file-write primitive and a separate privilege-escalation flaw to turn unauthenticated HTTPS requests into root commands on a fully patched Ivanti Connect Secure appliance.
CVE Research
CyberXero: AI-Augmented Initial Access Broker Behind Theft of 628,000 Ukrainian Records
CyberXero is a Russian-speaking initial access broker that combines Cobalt Strike and custom WordPress exploitation with an AI layer of Claude Code agents and PentAGI. Dual pipelines target global WordPress and e-commerce sites and Ukrainian energy infrastructure, with more than 628,000 Ukrainian records confirmed stolen. An exposed open directory revealed the operation. This article covers the attack stages, indicators of compromise, and defensive guidance.
