Experience Can't-Miss Sessions

Table of Contents

Cyberthreat Analysis

• CVE-2025-54309: CrushFTP Zero-Day Exploited in the Wild
• Sygnia Uncovers Active Chinese-Nexus Threat Actor Targeting Critical Infrastructure
  
• Wing FTP Server Remote Code Execution (CVE-2025-47812) Exploited in the Wild
• LummaC2 Stealer: Everything You Need to Know

Industry News

#NMFTACyber On Demand

CVE-2025-54309: CrushFTP Zero-Day Exploited in the Wild

On Friday, July 18, 2025, managed file transfer vendor CrushFTP released information to a private mailing list on a new critical vulnerability, tracked as CVE-2025-54309, affecting versions below 10.8.5 and 11.3.4_23 across all platforms. According to the public-facing vendor advisory, this vulnerability in the CrushFTP managed file transfer software web interface is being exploited in the wild. Based on the Indicators of Compromise provided in the advisory, a “last_logins” value set for the internal ‘default’ user account is indicative of exploitation.

Mitigation guidance

According to the advisory, CrushFTP versions below 11.3.4_23 and 10.8.5 are vulnerable to CVE-2025-54309. The latest available patched versions of CrushFTP, as of July 18, 2025, are:

CrushFTP 11.3.4_26
CrushFTP 10.8.5_12

The vendor advisory emphasizes the importance of updating to a fixed version of CrushFTP on an urgent basis. Rapid7 echoes this guidance and urges organizations to apply the vendor-supplied patch on an emergency basis, without waiting for a typical patch cycle to occur.

While the vendor guidance, as of July 18, states “We don't believe people with a DMZ CrushFTP in front of their main are affected by this,” it’s unclear whether this is actually an effective barrier to exploitation. Out of an abundance of caution, Rapid7 advises against relying on a demilitarized zone (DMZ) as a mitigation strategy. The vendor also notes that targeted installations should restore affected user account data from older backups.

Sygnia Uncovers Active Chinese-Nexus Threat Actor Targeting Critical Infrastructure

Sygnia, the foremost global cyber readiness and response team, revealed the findings of their investigation into a prolonged espionage campaign by a China-nexus threat actor, targeting critical infrastructure. Named ‘Fire Ant’ by Sygnia, the adversary is actively leveraging advanced methods to gain access to virtualization and networking environments by creating multi-layer attack kill chains to infiltrate restricted and segmented network assets that were considered to be within isolated environments.

Since early 2025, Sygnia has tracked and responded to Fire Ant incidents, primarily targeting VMware ESXi and vCenter environments, as well as network appliances, to establish a foothold for initial access and long-term advanced persistence. Notably, Fire Ant displays high levels of resilience, actively and stealthily adapting to eradication and containment efforts, replacing toolsets, deploying redundant persistence backdoors and manipulating network configurations to re-establish access to compromised devices.

“Fire Ant shows incredible advanced capabilities to infiltrate and conduct espionage campaigns, avoiding detection and multi-layered traditional security measures by targeting infrastructure blind spots. This highlights the level of resilience and danger posed by nation-state threat actors to global critical infrastructure organizations,” said Yoav Mazor, Head of Incident Response, APJ at Sygnia. “By gaining control over the virtualization management layer, the threat actor was able to extract service account credentials and deploy persistent backdoors on both ESXi hosts and the vCenter to maintain access across reboots.”

Fire Ant’s activities are characterized by infrastructure-centric tactics, techniques and procedures (TTPs) enabling activity beneath the detection threshold of traditional endpoint controls, emphasizing critical blind spots of conventional security stacks. The threat actor establishes control over a victim’s VMware ESXi hosts and vCenter servers to move laterally across an organization. Additionally, Fire Ant consistently bypassed network segmentation by compromising network appliances and tunneling across segments, enabling the threat actor to bridge and move deeper within an organization’s infrastructure through legitimate, approved paths.

Mazor adds, “Fire Ant’s method of infiltration places heightened pressure on the cybersecurity community and underscores the importance of visibility and detection within the hypervisor and infrastructure layer where traditional endpoint security tools often struggle to identify malicious activity. Organizations will need to adopt proactive cyber resilience with an advanced multi-layered security approach.”

As part of Sygnia’s investigation into Fire Ant, the company found the tooling and techniques closely align with prior espionage campaigns conducted by nation-state threat actor, UNC3886, currently active in Singapore. Fire Ant’s overlap with UNC3886 includes specific binaries and exploitation of vCenter and ESXi vulnerabilities, as well as similar targeting of critical infrastructure across regions.

Wing FTP Server Remote Code Execution (CVE-2025-47812) Exploited in the Wild

Huntress saw active exploitation of Wing FTP Server remote code execution (CVE-2025-47812) on a customer on July 1, 2025. Organizations running Wing FTP Server should update to the fixed version, version 7.4.4, as soon as possible.

CVE-2025-47812 is a null byte and Lua injection flaw that can lead to root/SYSTEM-level remote code execution if exploited. The vulnerability was first publicly disclosed on June 30 by Julien Ahrens in versions prior to 7.4.4 of the Wing FTP Server, its file transfer protocol software for Windows, Linux, and macOS.

At a high level, CVE-2025-47812 stems from how null bytes are handled in the username parameter (specifically related to the loginok.html file, which handles the authentication process). This can allow remote attackers to perform Lua injection after using the null byte in the username parameter. 

Huntress first observed exploitation on a customer on July 1, 2025, just a day after the initial write-up was published.

LummaC2 Stealer: Everything You Need to Know

Outpost24’s KrakenLabs team have taken a deep dive into the malware classified as LummaC2, an information stealer written in C language that has been sold in underground forums since December 2022. The Outpost24’s KrakenLabs team assessed LummaC2’s primary workflow, its different obfuscation techniques (like Windows API hashing and encoded strings) and how to overcome them to effectively analyze the malware with ease. The Outpost24’s KrakenLabs team also analyzed how networking communications with the C2 work and summarizes LummaC2’s MITRE Adversarial Tactics, Techniques and Common Knowledge.

What’s new with LummaC2 in 2025?

• Anti-sandbox technique: KrakenLabs researched looked into a new Anti-Sandbox technique LummaC2 v4.0 stealer is using to avoid detonation if no human mouse activity is detected.
• Enhanced evasion techniques: Attackers have upgraded LummaC2 with more sophisticated obfuscation methods and stealth capabilities. The malware now employs advanced memory injection and fileless execution techniques, making it harder for traditional antivirus tools to detect its presence.
• Modular and adaptive architecture: The newer iterations of LummaC2 have embraced a modular design that allows attackers to swiftly add or modify capabilities. This flexibility means the malware can be tailored for specific targets or integrated as part of more complex, multi-stage attack campaigns.
• Exploitation of recent vulnerabilities: New variants are taking advantage of vulnerabilities in up-to-date software systems. Cybercriminals are specifically targeting areas where recent patches might have been overlooked, emphasizing the critical need for timely updates and robust patch management.
• Integration with broader attack ecosystems: In the evolving threat landscape, LummaC2 is increasingly being used in conjunction with other malware and ransomware campaigns. This synergy not only enhances the overall impact of attacks but also complicates detection and remediation efforts.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!