https://cve.circl.lu/comments/feedMost recent comments.2025-10-31T02:45:48.442908+00:00Vulnerability-Lookupinfo@circl.lupython-feedgenContains only the most 10 recent comments.https://cve.circl.lu/comment/19771c30-1865-418d-8329-9b74748acb52Indicators of Compromise (IOCs)2025-10-31T02:45:48.448625+00:00Cédric Bonhommehttp://cve.circl.lu/user/cedricCheck SoftwareDistribution.log for:
* SoapUtilities.CreateException ThrowException: actor = https://host:8531/ClientWebService/client.asmx -> Error thrown in SoftwareDistribution.log after exploitation
* AAEAAAD/////AQAAAAAAAAAEAQAAAH9 -> Part of the serialized payload, found in SoftwareDistribution.log
* 207.180.254[.]242 – VPS from which the exploit was sent
* ac7351b617f85863905ba8a30e46a112a9083f4d388fd708ccfe6ed33b5cf91d – SHA256 hash of embedded MZ payload2025-10-26T07:32:48.252235+00:00