CloudSEK TRIAD

CloudSEK Threat Research and Information Analytics Division

Blogs & Articles

Read all Blogs from this Author

Threat Actors Lure Victims Into Downloading .HTA Files Using ClickFix To Spread Epsilon Red Ransomware

CloudSEK discovered a new Epsilon Red ransomware campaign targeting users globally via fake ClickFix verification pages. Active since July 2025, threat actors use social engineering and impersonate platforms like Discord, Twitch, and OnlyFans to trick users into executing malicious .HTA files through ActiveX. This leads to silent payload downloads and ransomware deployment. Users are urged to disable ActiveX, block attacker IPs, and train against such lures.

Cisco Unified Communications Manager CVSS 10 Vulnerability: 1K+ Assets Exposed to the Internet

A critical flaw (CVE-2025-20309, CVSS 10.0) in Cisco Unified Communications Manager lets attackers gain root access via hard-coded credentials in versions 15.0.1.13010-1 to 13017-1. Over 1,000 internet-exposed assets are at risk globally, especially in the US and Asia. Likely targets include VoIP and government networks. Immediate patching, access restrictions, and log monitoring are strongly advised to prevent system compromise.

Whitepapers and Reports

Read all Whitepapers and reports from this Author

Threat Landscape Report for Middle East 2024

Beyond the Storefront: E-commerce and Retail Threat Insights

The report "Beyond the Storefront: E-commerce and Retail Threat Insights" highlights the growing cyber threats to the e-commerce and retail sectors, including a surge in ransomware attacks, hacktivist activities, and data breaches. It emphasizes the need for enhanced security measures as these industries face increasing risks from financially motivated attacks and politically driven hacktivism.

MichaMichaBot: Unveiling the Exploitation of Missing "X-Frame-Options" HTTP Headers in Phishing Attacks

The report "MichaMichaBot: Unmasking the Threats Exploiting Missing 'X-Frame-Options' Headers" reveals how cybercriminals exploit this vulnerability to launch phishing attacks by embedding legitimate websites in iframes with fake login panels. It provides insights into these attack methods and practical strategies to secure digital assets against such threats.

Unveiling Maorrisbot: The Inner Workings of an Android Trojan Malware

Our whitepaper, "Unveiling Maorrisbot: The Inner Workings of an Android Trojan Malware," explores the sophisticated methods and impacts of Maorrisbot malware, offering insights and strategies to protect your devices. Download it to learn how to safeguard against this significant Android threat.

Knowledge Base

Read all knowledge base articles from this Author

No Knowledge base articles found.