Loading story…
Threat actors are actively exploiting a critical unauthenticated remote template-injection vulnerability in XWiki (CVE-2025-24893), enabling arbitrary remote code execution via the /bin/get/Main/SolrSearch endpoint. VulnCheck and other security researchers observed a two-stage attack chain: the first stage downloads a payload to the target system, and the second stage executes it, ultimately deploying a cryptocurrency miner. Exploit attempts have been traced to attackers geolocated in Vietnam, and the vulnerability has been weaponized in real-world attacks since at least March 2025, according to reports from VulnCheck, CrowdSec, and Cyble.
Despite the active exploitation, CVE-2025-24893 was not initially included in the CISA Known Exploited Vulnerabilities (KEV) catalog, highlighting a lag between real-world attacks and official recognition. Technical details reveal that attackers use a crafted request to inject Groovy code, which executes a wget command to download a malicious file to /tmp/11909. Security teams are advised to monitor for exploit attempts targeting the vulnerable endpoint and to apply available patches to mitigate the risk of compromise and subsequent cryptomining activity.
See which actors are running it and whether you're in range.
4 events from the most recent confirmed update back to the earliest known activity.
Reporting on the XWiki attacks revealed exploitation attempts against VulnCheck canaries from infrastructure geolocated to Vietnam. The activity used wget to fetch a staged payload from 193.32.208[.]24:8080 before deploying additional components for cryptomining.
CISA added the exploited vulnerabilities affecting Dassault Systèmes DELMIA Apriso and XWiki to its Known Exploited Vulnerabilities catalog, confirming they were under active attack. For the DELMIA Apriso issues, U.S. federal civilian agencies were ordered to remediate by November 18, 2025.
VulnCheck reported active exploitation of CVE-2025-24893 in XWiki, an unauthenticated remote code execution flaw in the /bin/get/Main/SolrSearch endpoint. The attacks used a two-stage chain to download and execute payloads that installed a cryptocurrency miner and killed competing miners.
Dassault Systèmes issued patches in early August 2025 for CVE-2025-6204 and CVE-2025-6205, two DELMIA Apriso vulnerabilities that can be chained for elevated privileges and full application compromise. The flaws affect releases 2020 through 2025.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The RondoDox botnet has been actively exploiting a critical vulnerability in unpatched XWiki servers, identified as CVE-2025-24893, which allows arbitrary remote code execution via the `/bin/get/Main/SolrSearch` endpoint. This flaw, rated with a CVSS score of 9.8, was patched in XWiki versions 15.10.11, 16.4.1, and 16.5.0RC1, but many instances remain exposed. Since late October 2025, there has been a significant increase in exploitation attempts, with attackers leveraging the vulnerability to deploy cryptocurrency miners, establish reverse shells, and conscript devices into the RondoDox botnet for distributed denial-of-service (DDoS) attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-24893 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply mitigations by November 20. VulnCheck reports that multiple independent threat actors, including RondoDox, are targeting this vulnerability using custom tooling, bespoke scanners, and well-documented payload servers. The first RondoDox exploit was observed on November 3, 2025, and activity has continued to escalate, with clear attribution based on unique HTTP User-Agent strings and payload naming conventions. The surge in attacks underscores the urgent need for organizations to patch affected XWiki instances and implement early detection measures to prevent compromise and further botnet expansion.
Jun 29, 2026
Attackers actively exploited **Oracle WebLogic Server** flaw `CVE-2020-14882` to achieve unauthenticated remote code execution, with intrusions quickly progressing from opportunistic scanning to malware deployment. Incident reporting showed one campaign using obfuscated PowerShell to fetch a **Cobalt Strike** payload from `185[.]205.210.179`, while another used a malicious `wbw.xml` file and follow-on scripts to install **XMRig**, rename it to `sysupdate`, and establish persistence with a scheduled task, driving victim CPU usage to 100%. Researchers warned the same access pattern could be readily adopted by ransomware operators because Cobalt Strike is commonly used in hands-on-keyboard attacks. Technical analysis tied the exploitation to improper access control and path traversal in WebLogic console resources, where double URL decoding and abuse of `console.portal` and the `handle` parameter enabled code execution through **MVEL** and reflection. Oracle’s initial fix was found to be incomplete because blacklist-based URL filtering could be bypassed with trivial changes, leading to the related patch-bypass issue `CVE-2020-14750`. Defenders were urged to apply Oracle’s latest patches and hunt for indicators linked to `console.portal`, malicious PowerShell downloaders, miner artifacts, and published **YARA**, **Sigma**, and **Suricata** detections.
Aug 15, 2026
Attackers actively exploited **CVE-2020-25213** in the WordPress **File Manager** plugin, a remote code execution flaw caused by an exposed and executable `elFinder` connector that allowed unauthenticated file uploads. The intrusion chain began with the upload of a simple PHP webshell to vulnerable servers, giving attackers remote access without valid credentials. After establishing access, the attackers used the webshell to fetch and run a shell script that installed **Kinsing** malware, which then deployed a malicious cryptominer from the **H2miner** family. The campaign was aimed at **cryptojacking**, with particular relevance to containerized environments, and reporting reconstructed the attack from web server logs while documenting the webshell, shell script, and malware samples used in the compromise.
Aug 14, 2026