Notices by The Shadowserver Foundation (shadowserver@infosec.exchange)

We added a feed of IPs/websites with ClickFix/ClearFake injected code in our Compromised Website reporting, tagged as 'clickfix'. Visitors of the website get tricked to install malware when injected JavaScript executes. If you receive an alert review for root cause of compromise!

657 instances shared for 2026-03-14. We expect to increase the volume of the feed in the future!

We would like to thank our Alliance partners and Validin for the collaboration making this possible!

Background on investigating ClickFix/ClearFake: https://www.atea.no/siste-nytt/it-sikkerhet/investigating-a-clearfake-clickfix-etherhide-campaign/

Compromised Website Report: https://www.shadowserver.org/what-we-do/network-reporting/compromised-website-report/

Dashboard World Map view of infected IPs:
https://dashboard.shadowserver.org/statistics/combined/map/?date_range=1&map_type=std&source=compromised_iot&source=compromised_website&source=compromised_website6&tag=clickfix&data_set=count&scale=log&auto_update=on

Dashboard Tree Map view of infected IPs:
https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=1&source=compromised_iot&source=compromised_website&source=compromised_website6&tag=clickfix&data_set=count&scale=log&auto_update=on

#CyberCivilDefense

MongoBleed update: We added MongoDB CVE-2025-14847 tagging today that is version based. This results in 74,854 possibly unpatched versions (out of 78,725 exposed today). IP data on vulnerable instances shared in our Open MongoDB Report: https://www.shadowserver.org/what-we-do/network-reporting/open-mongodb-report/

Note FPs on CVE-2025-14847 tagging may be possible due to backporting patches without bumping versions.

IP data on exposed instances is shared daily since Feb 2015!

To view exposed info on Dashboard select source 'scan' 'scan6' & tag 'mongodb' https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=30&source=scan&source=scan6&tag=mongodb&dataset=unique_ips&limit=100&group_by=geo&stacking=stacked&auto_update=on

Advisory & patch details on CVE-2025-14847 can be found at https://jira.mongodb.org/browse/SERVER-115508

If you receive an alert from us, check for compromise!

Upgrade to 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30.

Proud to once again support our LE partners in Operation Endgame Season 3

86M stolen data items from 525K victim IPs across 226 countries included in our new Rhadamanthys Historic Bot Victims Special Report, run overnight 2025-11-12

More details:
https://shadowserver.org/news/rhadamanthys-historical-bot-infections-special-report/

Latest Operation Endgame S03E01 video "STICKY FINGERS":
https://operation-endgame.com

Europol Press Release:
https://europol.europa.eu/media-press/newsroom/news/end-of-game-for-cybercrime-infrastructure-1025-servers-taken-down

Rhadamanthys Historic Bot Victims Special Report technical details:
https://shadowserver.org/what-we-do/network-reporting/rhadamanthys-historical-bot-infections-special-report/

Attention!

Cisco ASA/FTD CVE-2025-20333 & CVE-2025-20362 incidents: we are now sharing daily vulnerable Cisco ASA/FTD instances in our Vulnerable HTTP reporting: https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/

Over 48.8K unpatched IPs found on 2025-09-29. Top affected: US

World map view of unpatched IPs: https://dashboard.shadowserver.org/statistics/combined/map/?date_range=1&map_type=std&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-20333%2B&tag=cve-2025-20362%2B&data_set=count&scale=log&auto_update=on

Tree map view of unpatched IPs:

https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=1&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-20333%2B&tag=cve-2025-20362%2B&data_set=count&scale=log&auto_update=on

Advisory from Cisco:

CVE-2025-20333: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-z5xP8EUB

CVE-2025-20362: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-webvpn-YROOTUW

More info: US CISA Emergency Directive Identify and Mitigate Potential Compromise of Cisco Devices: https://www.cisa.gov/news-events/directives/ed-25-03-identify-and-mitigate-potential-compromise-cisco-devices

#CyberCivilDefense

(thanks also to @GossiTheDog for confirmation of the detection methodology!)

Citrix NetScaler CVE-2025-7775 patch rate as seen in our scans:

https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-7775%2B&dataset=unique_ips&limit=100&group_by=geo&stacking=stacked&auto_update=on

https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-7775%2B&dataset=unique_ips&limit=100&group_by=geo&stacking=overlap&auto_update=on

Now down from 28.2K to 12.4K. Europe patching at a faster rate than North America ...

(you can toggle overlapping/stacked time series on our Dashboard to compare)

ALERT: On 2025-08-26 over 28K Citrix NetScaler instances were unpatched to CVE-2025-7775 RCE. There is exploitation in the wild confirmed by US CISA KEV list addition.

Patch info from Citrix: https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX694938

Top affected: US, Germany

Dashboard geo breakdown: https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=1&source=exchange&source=exchange6&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-7775%2B&data_set=count&scale=log&auto_update=on

IP data is being shared in our Vulnerable HTTP reporting https://www.shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/ (tagged 'cve-2025-7775')

If you receive an alert from us investigate for compromise

You can track CVE-2025-7775 patching progress on our Dashboard at: https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-7775%2B&dataset=unique_ips&limit=100&group_by=geo&stacking=stacked&auto_update=on

We are also scanning for Ivanti EPMM instances likely vulnerable (unpatched) to CVE-2025-4427 which can be chained with CVE-2025-4428 for RCE.

First scans found 940 instances (2025-05-15), down to 798 (2025-05-18).

Geo breakdown: https://dashboard.shadowserver.org/statistics/combined/tree/?date_range=1&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-4427%2B&data_set=count&scale=log&auto_update=on

IP data in https://shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/ tagged as 'cve-2025-4427'.

Detection is based on non-intrusive check provided by @watchtowrcyber

CVE-2025-4427 tracker: https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=30&source=exchange&source=exchange6&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-4427%2B&dataset=unique_ips&limit=100&group_by=geo&stacking=stacked&auto_update=on

If you receive an alert, please make sure to review for any compromise - CVE-2025-4427/CVE-2025-4428 are exploited in the wild.

Patch info from Ivanti: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM?language=en_US&_gl=1*1ylgtgu*_gcl_au*MTg5MTk4MDIzMC4xNzQ3MTU3OTQ1

Background on vulnerabilities:
https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/

We are sharing daily results of Fortinet CVE-2024-55591 (auth bypass) vulnerable instances in our Vulnerable HTTP report - https://shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/

CVE-2024-55591 is known to be exploited in the wild & on @cisacyber KEV.

Around 50K found vulnerable: Around 50K found vulnerable: https://dashboard.shadowserver.org/statistics/combined/map/?map_type=std&day=2025-01-19&source=http_vulnerable&source=http_vulnerable6&tag=cve-2024-55591%2B&geo=all&data_set=count&scale=log

Our test is based on the methodology published by
@watchtowrcyber
https://github.com/watchtowrlabs/fortios-auth-bypass-check-CVE-2024-55591/blob/main/CVE-2024-55591-check.py - thank you!

CVE-2024-55591 vulnerability tracker: https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2024-55591%2B&dataset=unique_ips&group_by=geo&style=stacked

Fortinet advisory: https://fortiguard.com/psirt/FG-IR-24-535

Make sure to check for signs of compromise!

Additional background: https://arcticwolf.com/resources/blog/console-chaos-targets-fortinet-fortigate-firewalls/

Current Ivanti Connect Secure CVE-2025-0282 scanning results: around 800 exposed unpatched devices (IPs) seen as of 2025-01-12 (drop from around 2000 seen 2025-01-09)

CVE-2025-0282 vulnerability tracker: https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-0282%2B&dataset=unique_ips&style=stacked

We have started reporting unpatched Ivanti Connect Secure instances likely vulnerable to the new known to be exploited in the wild CVE-2025-0282.

We see 2048 likely vulnerable instances worldwide on 2025-01-09. Top: US

Dashboard overview by country: https://dashboard.shadowserver.org/statistics/combined/tree/?day=2025-01-09&source=exchange&source=exchange6&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-0282%2B&geo=all&data_set=count&scale=log

Vulnerable IP data is shared daily for your network/constituency in our https://shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/ tagged 'cve-2025-0282'

If you receive an alert from us, make sure to follow @cisacyber mitigation instructions: https://cisa.gov/cisa-mitigation-instructions-cve-2025-0282

Ivanti patch info: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US

Thank you to @watchtowrcyber for the insights and collaboration!

Palo Alto Networks has now updated their advisory https://security.paloaltonetworks.com/PAN-SA-2024-0015 saying they have "observed threat activity exploiting an unauthenticated remote command execution vulnerability against a limited number of firewall management interfaces which are exposed to the Internet."

We see a drop in exposed PAN-OS Management Interfaces (down by around 2K from previously shared observations), currently at 8726 IPs

Get these Interfaces off public Internet access NOW!

PAN-OS Management Interface tracker: https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=7&vendor=palo+alto+networks&model=pan-os+management+interface&dataset=count&limit=1000&group_by=geo&style=stacked

Palo Alto Networks published an advisory on 2024-11-08 warning of a claim of an RCE via the PAN-OS management interface. While no exploitation activity has yet been observed, we added fingerprinting for exposed PAN-OS mgmt interfaces in our Device ID report to warn recipients of potential attack surface exposure.

We see around 11K IPs exposed (2024-11-10 scan).

You can view exposure on our Dashboard selecting "IoT device statistics" in the top nav bar and setting vendor to "Palo Alto Networks" and model to "PAN-OS Management Interface"

World map view: https://dashboard.shadowserver.org/statistics/iot-devices/map/?day=2024-11-10&vendor=palo+alto+networks&model=pan-os+management+interface&geo=all&data_set=count&scale=log

PAN-OS mgmt exposure tracker:
https://dashboard.shadowserver.org/statistics/iot-devices/time-series/?date_range=7&vendor=palo+alto+networks&model=pan-os+management+interface&dataset=count&limit=1000&group_by=geo&style=stacked

IP data is now shared daily in our Device ID report https://shadowserver.org/what-we-do/network-reporting/device-identification-report/

Palo Alto Networks security alert advisory https://security.paloaltonetworks.com/PAN-SA-2024-0015

Guidance on "How to Secure the Management Access of Your Palo Alto Networks Device" by Palo Alto Networks: https://live.paloaltonetworks.com/t5/community-blogs/tips-amp-tricks-how-to-secure-the-management-access-of-your-palo/ba-p/464431

PAN-OS Management Exposure by US state:
https://dashboard.shadowserver.org/statistics/iot-devices/map/?day=2024-11-10&vendor=palo+alto+networks&model=pan-os+management+interface&geo=all&data_set=count&scale=log

We started seeing some Progress WhatsUp Gold CVE-2024-6670 (CVSS 9.8) SQLi exploit attempts against our honeypot sensors that match recently published PoC (/NmConsole/Platform/PerformanceMonitorErrors/HasErrors endpoint)

Progress advisory & patch info: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024

Running GitLab? We are sharing instances vulnerable to CVE-2023-7028 (Account Takeover via Password Reset without user interactions) - 5379 instances found worldwide (on 2024-01-23). Top: US (964) & Germany (730)

Check for signs of compromise and patch: https://about.gitlab.com/releases/2024/01/11/critical-security-release-gitlab-16-7-2-released/

IP Data shared in our Vulnerable HTTP Report (filtered by your network/constituency): https://shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/

Dashboard World Map: https://dashboard.shadowserver.org/statistics/combined/map/?map_type=std&day=2024-01-23&source=http_vulnerable&source=http_vulnerable6&tag=cve-2023-7028%2B&geo=all&data_set=count&scale=log

Additional IPs compromised with credential stealers injected into vulnerable Ivanti Connect Secure VPN devices now shared daily in our Compromised Website report https://shadowserver.org/what-we-do/network-reporting/compromised-website-report/

168 compromised IPs found in our scans on 2023-01-19: https://dashboard.shadowserver.org/statistics/combined/tree/?day=2024-01-19&source=compromised_website&source=compromised_website6&tag=credential-stealer%3Binjected-code%3Bivanti-connect-secure%3Bssl&geo=all&data_set=count&scale=log

Total for 2023-01-19: 550 IPs still compromised (includes GIFTEDVISITOR variant webshells) - https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=compromised_website&source=compromised_website6&tag=ivanti-connect-secure%2B&group_by=geo&style=stacked

Recovery guidance from Ivanti - https://forums.ivanti.com/s/article/Recovery-Steps-Related-to-CVE-2023-46805-and-CVE-2024-21887?language=en_US

Scanning for vulnerable Ivanti Connect Secure (CVE-2023-46805 & CVE-2024-21887) instances has been added to our daily scan list. 6809 found vulnerable for 2024-01-15 scans using methodology from
@watchtowrcyber
- https://labs.watchtowr.com/welcome-to-2024-the-sslvpn-chaos-continues-ivanti-cve-2023-46805-cve-2024-21887/

More details: https://shadowserver.org/what-we-do/network-reporting/vulnerable-http-report/

These are instances that we believe have NOT applied the mitigation provided by Ivanti: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

IP data will start being reported out tomorrow (2024-01-16) along with Dashboard stats updates.

Subscribe for free vulnerability data (and more) for your network: https://shadowserver.org/what-we-do/network-reporting/get-reports/

Data on vulnerable Ivanti Connect Secure devices now available on our Dashboard, for example

World map: https://dashboard.shadowserver.org/statistics/combined/map/?map_type=std&day=2024-01-15&source=http_vulnerable&source=http_vulnerable6&tag=cve-2023-46805%2B&geo=all&data_set=count&scale=log

Tree map:
https://dashboard.shadowserver.org/statistics/combined/tree/?day=2024-01-15&source=http_vulnerable&source=http_vulnerable6&tag=cve-2023-46805%2B&geo=all&data_set=count&scale=log

Tracker:
https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2023-46805%2B&group_by=geo&style=stacked

In collaboration with @volexity we have added daily scans & reports of compromised Ivanti Connect Secure VPN instances. Data shared in our Compromised Website report, tagged "ivanti-connect-secure".

609 IPs found on 2023-01-16: https://shadowserver.org/what-we-do/network-reporting/compromised-website-report/

https://dashboard.shadowserver.org/statistics/combined/tree/?day=2024-01-16&source=compromised_website&tag=ivanti-connect-secure%2B&geo=all&data_set=count&scale=log

Background: https://www.volexity.com/blog/2024/01/15/ivanti-connect-secure-vpn-exploitation-goes-global/

Lots of exploitation of Ivanti Connect Secure VPN CVE-2023-46805 & CVE-2024-21887 seen by our sensors. Assume compromise on exposed endpoints if you have not applied the mitigation. You can track Ivanti CVE exploitation attempts on our Dashboard:

https://dashboard.shadowserver.org/statistics/honeypot/time-series/?date_range=7&host_type=src&vendor=ivanti&group_by=vulnerability&style=stacked

Note you can track latest trends in CVE exploitation on our Dashboard at https://dashboard.shadowserver.org/statistics/honeypot/monitoring/vulnerability/?category=anomaly&statistic=unique_ips&limit=100