esafenet

ESAFENET's CDG showed up in our data before. The company focused on secure document management and data leakage prevention solutions. The "CDG" stands for "Content Data Guard", and the product appears to be mostly targeting the Chinese market [1]. Sadly, like so many security products, it suffers from basic security vulnerabilities like SQL Injection, XSS, and default passwords. We have seen scanning for ESAFENET CDG before, in particular after the cross-site scripting vulnerability was made public. The scans we are seeing right now are going after the well-known default passwords that ESAFENET CDG ships with. Exploit scripts listing these passwords are, for example, included in a nulei template published in 2023 [2]. POST /CDGServer3/SystemConfig Host: [redacted] User-Agent: Mozilla/5.0 (Ubuntu; Linux i686; rv:124.0) Gecko/20100101 Firefox/124.0 Content-Length: 73 Accept: */* Accept-Language: en Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip Connection: close command=Login&help=null&verifyCodeDigit=dfd&name=secadmin&pass=Est@Spc820 This is a typical case of a password that will likely pass many standard security checks (10 characters, upper/lower case, special characters, and numbers), but it is still terribly insecure as it is a well-known default password. [1] https://esafenet.com [2] https://github.com/projectdiscovery/nuclei-templates/issues/7094 -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter|

SecurityWeek’s weekly cybersecurity news roundup offers a concise overview of important developments that may not receive full standalone coverage but remain relevant to the broader threat landscape. This curated summary highlights key stories across vulnerability disclosures, emerging attack methods, policy updates, industry reports, and other noteworthy events to help readers maintain a well-rounded awareness of the evolving cybersecurity environment. Here are this week’s highlights: Sears Home Services AI chatbot databases left unprotected Cybersecurity researcher Jeremiah Fowler discovered three unprotected, unencrypted databases exposing nearly 3.7 million customer service records tied to Sears Home Services, including logs from its AI chatbot Samantha. The leaked data included over 54,000 complete chat logs, nearly 1.4 million audio recordings of customer calls, and more than 200,000 spreadsheet logs, along with personal details like names, addresses, phone numbers, and service appointment information. Fowler notified Transformco, the parent company of Sears, and the databases were secured shortly after. Nine vulnerabilities found in KVM devices Eclypsium researchers uncovered nine vulnerabilities across four budget IP-KVM vendors: GL-iNet, Angeet/Yeeso, Sipeed, and JetKVM. The most severe flaw, found in the Angeet/Yeeso ES3, allows an attacker to remotely write arbitrary files and execute OS commands without any credentials. Because KVM devices provide keyboard, video, and mouse control at the BIOS level, a successful attacker could inject keystrokes, boot from removable media, disable Secure Boot, and bypass any OS-level security tool. JetKVM and Sipeed have issued patches, but GL-iNet has no planned fix for two of its flaws, and Angeet/Yeeso has yet to commit to a timeline. Scammers use fake GitHub accounts to steal crypto from OpenClaw developers Attackers created fake GitHub accounts, opened issue threads in attacker-controlled repositories, and tagged dozens of developers, claiming they had won $5,000 worth of CLAW tokens redeemable through a linked site, which turned out to be a near-identical clone of openclaw.ai rigged with a wallet-draining ‘Connect your wallet’ button. The fake accounts were created just days before the campaign launched and deleted within hours of going live, and no confirmed victims have been reported so far, according to Ox Security. Claudy Day Claude vulnerabilities Oasis Security discovered three vulnerabilities in Claude that, when chained together in an attack they dubbed Claudy Day, allow an attacker to silently hijack a user’s chat session and exfiltrate sensitive data with a single click. The attack works by embedding hidden instructions in a crafted claude.ai URL, wrapping it in an open redirect on claude.com to make it appear legitimate, and then running it as a Google ad — meaning a victim only needs to click what looks like a normal search result. Anthropic has patched the prompt injection flaw following responsible disclosure, but fixes for the remaining two vulnerabilities are still in progress. Malware uses security software as cover to hunt for missile documents Symantec and Carbon Black researchers have uncovered a stealthy new infostealer called Speagle that piggybacks on Cobra DocGuard (a document encryption platform made by Chinese firm EsafeNet). The malware only activates on machines with Cobra DocGuard installed, collecting browser history, autofill data, and system information, and at least one variant specifically searches for files that reference Chinese ballistic missiles. Researchers have attributed the campaign to a previously unknown threat actor they’re calling Runningcrab, and believe it is likely the work of either a state-sponsored group or a hired contractor, though the exact infection method remains unknown. Ransomware group The Gentlemen Group-IB published a detailed breakdown of The Gentlemen, a roughly 20-member ransomware-as-a-service group that came to light after one of its operators publicly accused the Qilin ransomware group of withholding $48,000 in unpaid affiliate commissions. The group primarily gains access through CVE-2024-55591, a critical FortiOS/FortiProxy authentication bypass flaw, and maintains a database of around 14,700 already-compromised FortiGate devices. Once inside a network, they use the bring-your-own-vulnerable-driver (BYOVD) technique to kill security tools at the kernel level before encrypting and exfiltrating victim data. UK financial regulator sets new rules for reporting cyber incidents The FCA has finalised new rules requiring financial firms to report serious cyber incidents within 24 hours of determining they meet reporting thresholds, with payment service providers facing an even tighter four-hour deadline. The regulator cited growing concern over the frequency and sophistication of attacks on the financial sector, noting that in 2025 over 40% of cyber incidents reported to the FCA involved a third party, prompting new requirements for firms to maintain and annually submit a register of their material third-party arrangements. The rules take effect in March 2027. Operation Alice takes down 373,000 dark web domains A 10-day international operation led by German authorities and supported by Europol shut down more than 373,000 dark web domains run by a 35-year-old man based in China, who had been operating a sprawling network of fraudulent platforms since at least 2021. The sites advertised child abuse material and cybercrime-as-a-service offerings, but delivered nothing after victims paid, netting the operator an estimated €345,000 from around 10,000 people. Authorities from 23 countries participated in the operation, and have since identified 440 customers whose purchases are now under active investigation. Google adds scam-resistant safeguards to Android sideloading process Google has detailed a new ‘advanced flow’ for Android that allows users to install apps from unverified developers while building in deliberate friction to protect against social engineering scams. The process requires enabling developer mode, confirming no one is coaching the user, restarting the device to cut off any active remote access, and waiting a full day before completing biometric or PIN verification — steps specifically designed to break the manufactured urgency that scammers rely on. The feature will roll out in August. Related: In Other News: N8n Flaw Exploited, Slopoly Malware, Interpol Cybercrime Crackdown

Cybersecurity researchers have flagged a new malware dubbed Speagle that hijacks the functionality and infrastructure of a legitimate program called Cobra DocGuard. "Speagle is designed to surreptitiously harvest sensitive information from infected computers and transmit it to a Cobra DocGuard server that has been compromised by the attackers, masking the data exfiltration process as legitimate communications between client and server," Symantec and Carbon Black researchers said in a report published today. Cobra DocGuard is a document security and encryption platform developed by EsafeNet. The abuse of this software in real-world attacks has been publicly recorded twice to date. In January 2023, ESET documented an intrusion where a gambling company in Hong Kong was compromised in September 2022 via a malicious update pushed by the software. Later that August, Symantec highlighted the activity of a new threat cluster codenamed Carderbee, which was found using a trojanized version of the program to deploy PlugX, a backdoor widely used by Chinese hacking groups like Mustang Panda. The attacks targeted multiple organizations in Hong Kong and other Asian countries. Speagle remains unattributed to date. But what makes the malware noteworthy is that it's designed to gather and exfiltrate data from only those systems that have the Cobra DocGuard data protection software installed. The activity is being tracked under the moniker Runningcrab. "This indicates deliberate targeting, possibly to facilitate intelligence collection or industrial espionage," the Broadcom-owned threat hunting teams said. "At present, we believe the most likely hypotheses are that it is either the work of a state-sponsored actor or the work of a private contractor available for hire." Exactly how the malware is delivered to victims is unknown, although it's suspected that it may have been done via a supply chain attack, as evidenced by the two aforementioned cases. In addition, the central role played by the security software and its infrastructure deserves a mention. Not only does Speagle use a legitimate Cobra DocGuard server for command-and-control (C2) and as a data exfiltration point, it also invokes a driver associated with the program to delete itself from the compromised host. The 32-bit .NET executable, once launched, first checks the installation folder of Cobra DocGuard and then proceeds to harvest and transmit data from the infected machine in phases. This includes details about the system and files located in specific folders, such as those that contain web browser history and autofill data. What's more, one variant of Speagle has been found to incorporate additional functionality to turn on/off certain types of data collection, as well as search for files related to Chinese ballistic missiles like Dongfeng-27 (aka DF-27). "Speagle is a novel, parasitic threat that cleverly makes use of Cobra DocGuard's client to mask its malicious activity and its infrastructure to hide exfiltration traffic," researchers said. "Its developer no doubt took notice of previous supply chain attacks using the software and may have selected it both for its perceived vulnerability and its high rate of use among targeted organizations."

In January, a possible XSS vulnerability was found in the electronic document security management system ESAFENET CDG. This was the latest (as far as I can tell) in a long list of vulnerabilities in the product. Prior vulnerabilities included SQL injection issues and weaknesses in the encryption used to safeguard documents. In other words: A typical "secure" document management system. The product appears to be targeting the Chinese market, and with a website all in Chinese, I doubt it is used much, if at all, outside China. The scans we are seeing are directed at "/CDGServer3/SystemConfig". The one vulnerability I was able to find was CVE-2025-0785, which mentions a possible XSS vulnerability in SystemConfig.jsp. Sadly, not all of our sensors report POST data (working on fixing that), so I am not sure if this is the issue they are trying to exploit. The GitHub repo with details about the vulnerability is no longer available, and the NVD entries are not really complete and do not link to any pages within the manufacturer's website with possible patches. A quick scan of the manufacturer's website did not reveal any obvious patches or references to this bug. [1] https://nvd.nist.gov/vuln/detail/CVE-2025-0785 [2] https://www.esafenet.com -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter|