Introduction: Learning Linux Without a Safety Net

“Identity theft is not a JOKE, Jim!!!! Millions of families suffer every year.” — Dwight Kurt Schrute (The Office U.S.)

I survived the OSI model wars, so you don’t have to. Here’s what actually matters.

About this lab

Atlassian patched a Critical (CVSS 8.7) Path Traversal flaw (CVE-2025-22167) in Jira Software/Service Management that allows attackers to perform arbitrary file writes. Immediate update is urged.

Symantec exposed a complex Chinese APT network (Glowworm/UNC5221) deploying Zingdoor and ShadowPad across US/South American targets. The groups abuse DLL sideloading and PetitPotam for credential theft.

A NuGet typosquat named Netherеum.All used a Cyrillic homoglyph to fool 11M+ downloads. The malicious package injected an XOR-decoded backdoor to steal crypto wallet and private key data.

A Critical RCE flaw (CVE-2025-59287, CVSS 9.8) in WSUS allows unauthenticated attackers SYSTEM access via AuthorizationCookie deserialization. The issue was patched in the October update.

Elastic exposed Chinese threat actors exploiting public ASP.NET machine keys to deploy TOLLBOOTH IIS backdoor and HIDDENDRIVER kernel rootkit. The malware performs stealthy SEO cloaking.

Group-IB exposed MuddyWater using NordVPN to send phishing emails that deliver the Phoenix v4 backdoor. The malware steals credentials via a custom Chromium stealer disguised as a calculator.

SUSE patched a Critical RCE flaw (CVE-2025-54469, CVSS 10.0) in NeuVector Enforcer that allows attackers to inject commands via unsanitized environment variables, risking container root shell access.

Vidar 2.0, fully rewritten in C, is a multithreaded infostealer that bypasses Chrome's AppBound encryption via memory injection to steal crypto wallets and credentials. Its adoption spikes as Lumma declines.

CISA issued an alert for a Critical (CVSS 9.8) Auth Bypass flaw (CVE-2025-11534) in Raisecom RAX701-GC routers, allowing unauthenticated root shell via SSH. The vendor has not yet responded with a patch.

A sophisticated Lumma Infostealer MaaS campaign targets users with pirated software installers. It uses NSIS/AutoIt scripts, Process Hollowing, and MEGA cloud to steal credentials from browsers and crypto wallets.

First, I spent two days understanding the target and taking notes on things like:

This entity exposed an unsecured server containing certified documents, passports, ID cards, and debit cards belonging to 63,564 customers.

Cisco Packet Tracer

Un deep dive en Next.js, Drizzle ORM y Docker para crear una experiencia de usuario inmersiva, segura y de alto rendimiento. Esta es la…

I am looking forward to a stellar discussion about ransomware!

Phase Labs Team
22nd October 2025

Haii! Ini cuma sekedar dokumentasi agar writer tidak lupa dengan fungsi Attack Type yang ada di Burp Intruder. Bassicaly ada 4, yaitu…