Vulnerabilityhigh

Mimo Hackers Exploit CVE-2025-32432 in Craft CMS to Deploy Cryptominer and Proxyware

The Hacker Newsby @TheHackersNewsJun 2, 2025 · 10:07 UTC (Jun 2, 2025)3 min read1 · 1 read

Read at thehackernews.com

Analyze CVE-2025-32432 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2025-32432 CVE-2021-44228 CVE-2022-26134 CVE-2023-46604

Tags: cve-2025-32432 cve-2021-44228 cve-2022-26134 cve-2023-46604 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-44228	JNDI Injection Remote Code Execution in Apache Log4j2 (Log4Shell)	10.0	100%	KEVRansomwarePoC ×9	Dec 10, 2021 KEV Dec 10, 2021
CVE-2022-26134	Unauthenticated OGNL Injection RCE in Atlassian Confluence Server/Data Center	9.8	100%	KEVRansomwarePoC ×2	Jun 3, 2022 KEV Jun 2, 2022
CVE-2023-46604	Unauthenticated RCE in Apache ActiveMQ via OpenWire Deserialization	9.8	100%	KEVRansomwarePoC	Oct 27, 2023 KEV Nov 2, 2023
CVE-2025-32432	Code Injection Enables Remote Code Execution in Craft CMS	10.0	100%	KEVPoC ×3	Apr 25, 2025 KEV Mar 20, 2026

From the original article

3 min read at thehackernews.com

 Ravie Lakshmanan  May 28, 2025 Cryptojacking / Vulnerability A financially motivated threat actor has been observed exploiting a recently disclosed remote code execution flaw affecting the Craft Content Management System (CMS) to deploy multiple payloads, including a cryptocurrency miner, a loader dubbed Mimo Loader, and residential proxyware.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.