Loading story…
LevelBlue disclosed RAVEN, an offensive security framework built to test how exposed or compromised Kibana and Elasticsearch environments can be abused for full-spectrum intrusion activity. The tool demonstrates Kibana reconnaissance through the /api/status endpoint, extraction of dashboards and saved objects, and exploitation of known flaws including CVE-2018-17246 and CVE-2019-7609, the latter using a Timelion prototype-pollution chain that can lead to remote code execution. The reporting also highlights that Kibana access alone can reveal embedded credentials and operational intelligence even without a successful exploit.
The same framework shows how attackers could move from access to impact inside Elasticsearch by exporting individual or all non-system indices, using Point-in-Time or Scroll APIs for bulk collection, and performing stealthier snapshot-based exfiltration from the server side. It also demonstrates persistence through API keys, rogue superuser accounts, and Watcher jobs that can recreate deleted backdoors, allowing access to survive password rotation unless every artifact is removed. In its final phase, RAVEN simulates destructive actions including index deletion, document wiping, mapping corruption, Meow-style tampering, and multiple denial-of-service modes, underscoring the risk posed by exposed management interfaces and incomplete remediation.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Cyber Security News summarized LevelBlue's RAVEN research, highlighting Elasticsearch data exfiltration, snapshot abuse, API key persistence after password rotation, and Watcher-based restoration of attacker access. The article emphasized that the work described controlled penetration-testing research rather than an active criminal campaign.
LevelBlue published Part 5 of its RAVEN series covering destructive operations such as index deletion, delete-by-query wiping, mapping corruption, Meow-style simulation, and five denial-of-service modes. The post also described RAVEN's triple-gated safety controls and cleanup logging for reversible actions.
LevelBlue released a follow-on post describing post-compromise use of RAVEN against Elasticsearch and Kibana, including bulk index exfiltration, snapshot-based theft, API key abuse, and persistence via rogue users, long-lived API keys, and Watcher jobs. The demonstrations were conducted in Docker-based lab environments.
LevelBlue published research showing RAVEN modules for Kibana reconnaissance, CVE detection, exploitation, and saved-object intelligence extraction in lab environments. The post demonstrated exploitation paths for CVE-2018-17246 and CVE-2019-7609 against vulnerable Kibana targets.
The LevelBlue article states that the real Meow Attack in 2020 wiped documents from exposed Elasticsearch databases and replaced them with random alphanumeric strings ending in "-meow." It says more than 12,000 Elasticsearch databases were corrupted.
CVE-2019-7609 was disclosed as a prototype pollution flaw in Kibana's Timelion visualizer affecting versions before 5.6.15 and 6.0.0 through 6.6.0. The bug could lead to remote code execution when Kibana later forked a new Node.js child process.
CVE-2018-17246 affected Kibana versions before 6.4.3 and allowed arbitrary file reads via the Console plugin's file inclusion mechanism. The flaw could disclose file contents indirectly through Kibana application logs.
The LevelBlue research references CVE-2015-5531 as a vulnerability that enables file-read capability through the Elasticsearch snapshot API, providing historical context for snapshot-related abuse.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcelevelblue.com
Open sourcelevelblue.com
Open sourcelevelblue.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security teams reported rapid, opportunistic exploitation of newly disclosed **unauthenticated remote code execution (RCE)** flaws, with attackers moving quickly from scanning to compromise. JPCERT/CC documented active compromise following disclosure of **React2Shell** in React Server Components (**CVE-2025-55182**), where multiple threat actors exploited the same exposed environment within days—initially dropping coin miners (e.g., `xmrig`), then deploying additional payloads including the **HISONIC** backdoor, **SNOWLIGHT** downloader, and **CrossC2**, and culminating in actions like cron-based persistence and website defacement. Separately, GreyNoise telemetry cited by BleepingComputer indicated that exploitation of two critical Ivanti Endpoint Manager Mobile (EPMM) RCEs (**CVE-2026-21962**, **CVE-2026-24061**) was heavily concentrated, with a single bulletproof-hosted source IP (193[.]24[.]123[.]42, PROSPERO OOO/AS200593) responsible for **83%** of observed activity and widespread use of OAST-style DNS callbacks consistent with initial-access validation. Several other items in the set were not tied to a single, specific exploitation event. A Help Net Security “week in review” roundup mixed interviews and assorted security items (including mention of an exploited BeyondTrust RCE) without providing a cohesive, single-incident account, while an NCSC-themed weekly highlights post primarily summarized guidance and calls for participation rather than detailing a discrete compromise. A CloudATG “insights” page contained unrelated, older recap and generic security content, and a Risky Business bulletin focused on law-enforcement developments around **IcedID** operators (including an alleged developer faking his death) rather than vulnerability exploitation activity.
Jun 29, 2026
Active exploitation is targeting **Ivanti Endpoint Manager Mobile (EPMM)** via two critical vulnerabilities—`CVE-2026-1281` (authentication bypass) and `CVE-2026-1340` (remote code execution)—with activity consistent with **initial access broker (IAB)** tradecraft rather than immediate ransomware-style monetization. Reporting indicates attackers are using exploitation to establish footholds and validate access at scale, then disengaging, suggesting the objective is to inventory and package working access for later activation or resale. Post-exploitation behavior described in research includes deployment of a **dormant, in-memory Java class loader** backdoor that is left inactive until a specific trigger is received, with an observed web-accessible artifact at `/mifs/403.jsp`. Separately, GreyNoise telemetry attributes **83% of observed Ivanti exploitation** to a single IP hosted on **bulletproof infrastructure** (PROSPERO OOO, `AS200593`) that is missing from widely circulated IOC lists, while several heavily shared “IOCs” appear to be unrelated (e.g., Windscribe VPN exit nodes primarily scanning **Oracle WebLogic** on port `7001`). GreyNoise also observed prevalent “blind” RCE verification using **OAST DNS callbacks** (rather than immediate payload deployment), reinforcing the assessment that operators are confirming exploitability and staging for follow-on access rather than executing overt actions immediately.
Jun 29, 2026
Multiple reports describe ways attackers or testers can **abuse trusted enterprise features** to evade controls. Researchers reported that *Palo Alto Networks Cortex XDR* **Live Terminal** can be repurposed as a stealthy **command-and-control (C2)** channel because its WebSocket-based protocol lacks command signing; an attacker who can intercept the initial WebSocket message can redirect an endpoint to an attacker-controlled server/tenant, leveraging the trusted `cortex-xdr-payload.exe` component to execute commands in a “living off the land” manner. Separately, a tutorial showed *Microsoft Defender for Cloud Apps* (reverse-proxy `*.mcas.ms`) download restrictions for unmanaged devices can be **bypassed by spoofing specific browser user-agent strings**, allowing direct access to services like Outlook/SharePoint and enabling successful downloads that would otherwise be blocked. Other material in the set covers adjacent but distinct execution and delivery risks rather than the same product-specific bypasses. **CVE-2026-27615** affects *ADB-Explorer* on Windows: allowing `ManualAdbPath` to be set to a **UNC path** in a settings file can lead to **remote code execution** by pointing the app to an attacker-controlled network share, fixed in Beta `0.9.26022`. Cofense also documented ongoing campaigns abusing **Windows File Explorer WebDAV** handling to deliver malware without a browser download flow, including use of `trycloudflare[.]com` tunnels to host WebDAV servers and multi-stage script chains to deliver RATs—highlighting a persistent social-engineering and delivery vector that can bypass some browser-centric controls.
Jun 29, 2026