Loading vulnerability…
CVE-2025-61303 affects the Windows behavioral analysis engine in Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021 (2025-08-14). A submitted sample can evade behavioral detection by recursively spawning a large number of child processes, causing excessive log generation and uncontrolled consumption of system resources. This resource exhaustion degrades or disrupts the sandbox’s ability to capture and report subsequent malicious activity. Reported consequences include failure to record or surface behaviors such as PowerShell execution and reverse shell activity, resulting in incomplete or misleading analysis output and a denial-of-analysis condition.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository demonstrates a denial-of-analysis (DoA) exploit (CVE-2025-61303) against the RecordedFuture Triage sandbox's Windows behavioral analysis engine. The exploit consists of a C program (poc/onion.c) that recursively spawns child processes, each time decrypting a layer of an embedded, multi-round XOR-encrypted PowerShell reverse shell payload. The recursion depth is tracked via the RECURSIVE_DEPTH environment variable. Once the maximum depth is reached, the decrypted PowerShell command is executed, attempting to establish a reverse shell to an attacker-specified IP and port. The Python script (poc/encrypt.py) is used to generate the encrypted payload and keys as C headers. The README.md provides detailed vulnerability analysis, PoC usage instructions, and references to public sandbox reports. The exploit's main capability is to overwhelm the sandbox's process tracking, causing it to miss or truncate behavioral telemetry, thus allowing malicious activity to evade detection. No hardcoded network endpoints are present; the reverse shell target is supplied at runtime. The repository is structured with clear separation between documentation, build instructions, payload generation, and the main exploit code.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.