August 2025 | SECaaS Platform AIONCLOUD

[2025.07] Web Attack Trend Report

[July 2025 Web Attack Trend Analysis] 1. Weekly Web Attack Trend Analysis Through weekly web attack trend analysis, it is possible to identify specific periods when web attacks were concentrated. Based on this, it can be utilized to establish proactive prevention and response strategies for periods with frequent attacks. The graph below visualizes the number of web attacks detected by AIWAF on a weekly basis during July 2025. An analysis of data detected by AIWAF during July 2025 revealed that an average of over 270,000 web attacks per day were detected. This figure shows a slight upward trend compared to the previous month, indicating that threats targeting web servers are continuously evolving. In addition, the frequency of attacks was higher on weekends (Saturday and Sunday) than on weekdays, which can be interpreted as a strategic approach aimed at exploiting reduced web server usage during non-business hours. In particular, July 9 recorded the highest concentration of web attacks during the entire period. Among the attack types detected on that day, SQL Injection accounted for the largest proportion. SQL Injection is a representative attack technique that manipulates databases to steal system privileges or leak internal information. Attackers typically use this method to bypass user authentication processes or to identify database structures. Due to these characteristics, special attention is required to protect sensitive corporate information. In fact, within AIWAF, SQL Injection is classified as a high-risk attack type with the largest number of detection patterns configured. These findings highlight the need for continuous attention and precise response strategies against major web attack types, including SQL Injection. They will also serve as important reference data for establishing future detection and prevention policies. 2. Web Attack Trends by Attack Type By analyzing web attack trends by attack type based on detection logs, it is possible to systematically identify which types of attacks occurred most frequently during the month. Such analysis goes beyond simple statistics and serves as a key foundation for establishing organizational security policies and concretizing response frameworks. An analysis of detection logs collected by AIWAF during July 2025 revealed that various types of web attacks were detected. Among them, some attack types showed distinct patterns, such as concentrated occurrences during specific periods or accounting for a significant proportion of the total number of attacks. In particular, classic yet still highly threatening attack types—such as SQL Injection and System File Access—ranked among the top. These attacks tend to be repeatedly executed, primarily through automated attack tools or botnets. The graph below visualizes the distribution of web attack types detected by AIWAF in July 2025.     The Web Attack Trend Report provides the latest web vulnerability analyses, industry-specific attack patterns, and key CVE-based vulnerability information, all based on processed data from the AI/ML-powered threat Read more about [2025.07] Web Attack Trend Report[…]

[2025.08 Vulnerability Report] Microsoft SharePoint RCE Chain: ToolShell

This vulnerability is an authentication bypass and insecure deserialization flaw in Microsoft SharePoint Server. An attacker could bypass authentication and execute malicious code by sending a crafted Referer header and serialized XML data to the ToolPane.aspx page. This issue was patched in the July security update for Microsoft SharePoint Server, and our AIWAF product will Read more about [2025.08 Vulnerability Report] Microsoft SharePoint RCE Chain: ToolShell[…]

[2025.08 Vulnerability Report] Gong Da & CKVIP Exploit Kit: toGMTString() Abuse Analysis

Gong Da and CKVIP Exploit Kits were web-based attack tools active in East Asia between 2015 and 2018, exploiting browser vulnerabilities and cookie manipulation based on toGMTString() to enable reinfection and data theft when users revisited compromised websites. Malicious landing pages contained the code snippet expires=” + expires.toGMTString(), which was designed to evade detection by mimicking legitimate code, but later became a well-known indicator of compromise (IoC) identified by various security solutions. 1. Overview The Gong Da and CKVIP Exploit Kits were web-based attack Read more about [2025.08 Vulnerability Report] Gong Da & CKVIP Exploit Kit: toGMTString() Abuse Analysis[…]

[2025.08 Vulnerability Report] Kimsuky Group’s Use of GitHub C2 in Targeted Attacks Against Foreign Embassies in South Korea

North Korean-linked hackers conducted espionage operations for several months this spring, targeting diplomatic missions and abusing GitHub to distribute malware and covertly control infected systems. Another North Korean-run organization was also found to have infiltrated more than 320 companies worldwide by impersonating remote IT staff. Spear-phishing emails were sent to diplomatic missions and Ministry of Read more about [2025.08 Vulnerability Report] Kimsuky Group’s Use of GitHub C2 in Targeted Attacks Against Foreign Embassies in South Korea[…]

[2025.08 Vulnerability Report] Pterodactyl Panel Unauthenticated Remote Code Execution (CVE-2025-49132)

CVE-2025-49132 is a critical RCE vulnerability that allows information disclosure or code execution within the Pterodactyl Panel server without authentication. Attackers can steal configurations or take control of the server, making prompt patching extremely important. Our AIWAF product is developing detection patterns to address vulnerabilities identified within Pterodactyl and will continue to respond quickly to newly discovered vulnerabilities. 1. Overview Pterodactyl Panel is an open-source game server management panel designed to allow users to easily deploy and manage various game servers in a web-based environment. The panel leverages Docker and container-based architecture to ensure scalability and stability, while providing intuitive UI and fine-grained access control in multi-user environments. In both enterprise and community contexts, it is widely used for multi-game server operations, hosting automation, user management, and resource monitoring. This report summarizes the analysis of the recently identified unauthenticated Remote Code Execution (RCE) vulnerability (CVE-2025-49132), discovered in versions prior to Pterodactyl Panel v1.11.11. Source : https://pterodactyl.io/ 2. Attack Type CVE-2025-49132 is a Remote Code Execution (RCE) vulnerability discovered in versions of Pterodactyl Panel prior to v1.11.11. The root cause of this vulnerability lies in authentication bypass and insufficient Read more about [2025.08 Vulnerability Report] Pterodactyl Panel Unauthenticated Remote Code Execution (CVE-2025-49132)[…]

Scroll Up