The democratisation of business email compromise fraud
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55182 | Unauthenticated RCE in React Server Components (React2Shell) | 10.0 | 100% | KEVRansomwarePoC ×13 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 2915b3f8b703eb744fc54c81f4a9c67f | d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 41444d7018601b599beac0c60ed1bf83 | dceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55 MD5: 41444d7018601b599beac0c60ed1bf83 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | 48a4f5fb6dc4633a41e6fe0aa65b4fa6 | 378382830fc6a0b5a9574eca415d14d9282e2b4aced725db9cfbc5 MD5: 48a4f5fb6dc4633a41e6fe0aa65b4fa6 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | a2cf85d22a54e26794cbc7be16840bb1 | 8114cb7b412260870efd1dc05979454bd907d8750c669ae6fcbcfe MD5: a2cf85d22a54e26794cbc7be16840bb1 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | aac3165ece2959f39ff98334618d10d9 | 670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974 MD5: aac3165ece2959f39ff98334618d10d9 Talos Rep: https://talosintelligence.com/talos_file_reputat |
| md5 | c2efb2dcacba6d3ccc175b6ce1b7ed0a | e6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://talosintelligence.com/talos_file_reputat |
| sha256 | 38d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55 | APQ9305.dll Detection Name: Auto.90B145.282358.in02 SHA256: 38d053135ddceaef0abb8296f3b0bf6114b25e10e6fa1bb8050aeecec4ba8f55 MD5: 41444d7018601b599beac0c60ed1bf83 Talos Rep: https://ta |
| sha256 | 5e6060df7e8114cb7b412260870efd1dc05979454bd907d8750c669ae6fcbcfe | content.js Detection Name: W32.38D053135D-95.SBX.TG SHA256: 5e6060df7e8114cb7b412260870efd1dc05979454bd907d8750c669ae6fcbcfe MD5: a2cf85d22a54e26794cbc7be16840bb1 Talos Rep: https://ta |
| sha256 | 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 | fcc507.exe Detection Name: Win.Worm.Coinminer::1201 SHA256: 90b1456cdbe6bc2779ea0b4736ed9a998a71ae37390331b6ba87e389a49d3d59 MD5: c2efb2dcacba6d3ccc175b6ce1b7ed0a Talos Rep: https://ta |
| sha256 | 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974 | lware files from Talos telemetry over the past week SHA256: 96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974 MD5: aac3165ece2959f39ff98334618d10d9 Talos Rep: https://ta |
| sha256 | 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 | _Exe.exe Detection Name: W32.Injector:Gen.21ie.1201 SHA256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 MD5: 2915b3f8b703eb744fc54c81f4a9c67f Talos Rep: https://ta |
| sha256 | e303ac1a9b378382830fc6a0b5a9574eca415d14d9282e2b4aced725db9cfbc5 | 40bb1.exe Detection Name: W32.5E6060DF7E-100.SBX.TG SHA256: e303ac1a9b378382830fc6a0b5a9574eca415d14d9282e2b4aced725db9cfbc5 MD5: 48a4f5fb6dc4633a41e6fe0aa65b4fa6 Talos Rep: https://ta |
From the original article
5 min read at blog.talosintelligence.com
Welcome to this week’s edition of the Threat Source newsletter. Last weekend, I witnessed a crime. Not a notable crime that you might read about in the press, but an unremarkable fraud attempt that nevertheless illustrates how new threat actor capabilities are emerging.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.