Turkey-Aligned Hackers Targeted Iraq-Based Kurds with Zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-27920+1 related CVE | Directory Traversal in Srimax Output Messenger Before 2.0.63 | 8.8 group max | 2% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | wordinfos.com | en, OMServerService.exe connects to a hardcoded domain (api.wordinfos[.]com) for data exfiltration. On the client side, the malware e |
From the original article
3 min read at infosecurity-magazine.com
A cyber threat actor believed to align with Turkish government interests has been observed exploiting user accounts that have not applied fixes to a vulnerability ( CVE-2025-27920 ) in Output Messenger, a multiplatform chat solution. The campaign was detected by Microsoft Threat Intelligence and has been ongoing since at least April 2024.
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.