CyberDudeBivash

Executive Summary (What matters now)

HTTP/2 “MadeYouReset” DoS (CVE-2025-8671 + vendor CVEs) is driving large-scale L7 outages across multiple stacks (Tomcat/Netty/F5 and others). Patch & rate-limit now. CERT Coordination Center Apache Tomcat NVD myF5
N-able N-central (RMM) 2 vulns under active exploitation were added to CISA KEV; MSPs are a prime cascade target. Patch deadlines are in force. CISA+1
Xerox FreeFlow Core: two vulns (XXE → SSRF and Path Traversal → RCE) with public research + vendor bulletin; upgrade to 8.0.5. Horizon3.ai Xerox Security Content
ERMAC v3.0 Android banking trojan – full source leak → expect copycats, rapid payload churn. The Hacker News hunt.io
Elastic EDR 0-day claim circulating (driver abuse/BSOD). Treat as developing; monitor vendor comms & apply stable updates. Cyber Security News Elastic

1) Protocol-level DoS: HTTP/2 “MadeYouReset”

What’s new: A protocol flaw lets attackers spam resets and trick implementations into exceeding max concurrent streams, exhausting memory/CPU (successor to 2023 Rapid Reset). Vendors are shipping fixes; product-specific CVEs (e.g., Tomcat CVE-2025-48989, Netty CVE-2025-55163; F5 advisory). CERT Coordination Center Apache Tomcat NVD myF5

Likely impact: Public-facing APIs, CDNs, load balancers, service meshes, app servers.

Immediate actions

Patch: Tomcat ≥ 9.0.108 / 10.1.44 / 11.0.10; Netty ≥ 4.1.124.Final / 4.2.4.Final; follow F5/BIG-IP guidance. Apache Tomcat NVD myF5
Mitigate: enforce per-IP/connection rate limits, cap RST_STREAM bursts, and enable DoS protections on edge/WAF. Guidance & analysis from Akamai/Imperva is solid. Akamai Imperva

Detect (ideas)

Alert on spikes in server-initiated resets / protocol errors and sudden heap growth on HTTP/2 services. SOC radar notes mapping & dashboards help. socradar.io

MITRE ATT&CK: T1498 (Network DoS), T1499 (Endpoint DoS).

2) Actively Exploited: N-able N-central (CVE-2025-8875, CVE-2025-8876)

What’s new: CISA added both to KEV with evidence of active exploitation; agencies have patch deadlines. Vulnerabilities include insecure deserialization leading to code execution and command injection; patches released (2025.3.1 / 2024.6 HF2). CISA BleepingComputer fieldeffect.com

Why it matters: RMM platforms are high-privilege blast multipliers across MSP estates.

Immediate actions

Patch all on-prem N-central to 2025.3.1 (or 2024.6 HF2) and enforce MFA for admin accounts. The Hacker News
Hunt for anomalous task/script pushes from N-central to endpoints around first exploit sightings.
Restrict N-central admin exposure (VPN/privileged access gateways only).

Detect (ideas)

SIEM: look for new or unusual N-central job executions and web logs with deserialization exceptions or suspicious command parameters post-auth. (Map to ATT&CK T1190/T1059.)
EDR: alert on shells or interpreters spawned by N-central services.

3) Xerox FreeFlow Core — Trivial-to-Exploit RCE Path

What’s new: Researchers disclosed XXE (CVE-2025-8355) and Path Traversal → RCE (CVE-2025-8356); vendor bulletin urges upgrade to 8.0.5; exploitation pathways include unauth RCE chains. Horizon3.ai Xerox Security Content

Who’s exposed: Print orchestration servers in enterprise/manufacturing/government workflows.

Immediate actions

Patch to 8.0.5 immediately; isolate the service from the internet. Xerox Security Content
Review logs for suspicious file access and outbound SSRF targets (e.g., metadata/IPMI/internal APIs).

Detect (ideas)

Look for HTTP requests with ..%2f / ..\/ patterns to FreeFlow endpoints and unexpected child processes spawned by the web service.

ATT&CK: T1190, T1210, T1059.

4) ERMAC v3.0 Android Banking Trojan — Full Source Leak

What’s new: Researchers obtained and analyzed the entire ERMAC 3.0 source, exposing infra and weaknesses. Leak increases operator diversity and speed of variants (overlay forms, accessibility abuse, credential theft). The Hacker News hunt.io

Risk: Surge of copycat builds and phishing overlays for banking/crypto apps across regions.

Defend now

Mobile fleet: enforce Google Play Protect, block sideloading, require device attestation, and deploy mobile EDR with accessibility-abuse detections.
Banking apps: strengthen overlay detection, in-app device binding, and push out-of-band step-up for risky flows.

ATT&CK for Mobile: T1409, T1411, T1444.

5) Developing: Elastic EDR 0-day (driver abuse/BSOD)

What’s circulating: Posts claim a 0-day lets attackers weaponize a Microsoft-signed Elastic EDR driver to bypass/disable and trigger BSOD; coverage attributes the finding to Ashes Cybersecurity. Elastic’s notes mention a BSOD bugcheck fix in Elastic Defend (not a confirmation of the claim). Treat as unconfirmed but noteworthy. Cyber Security News Reddit Elastic

Practical stance

Track Elastic advisories; stay on supported agent versions.
Harden kernel-mode driver loading policies (WDAC), and monitor for unexpected driver updates or service restarts on endpoints.

Quick Hits (watchlist)

Tomcat HTTP/2 fixes for MadeYouReset landed across branches—validate you’re on fixed builds. Apache Tomcat
Vendor ecosystem round-ups (Akamai/Imperva/SUSE/Wiz/US-CERT KB) provide ongoing patch matrices—use to chase stragglers (LBs, gateways, proxies, meshes). Akamai Imperva suse.com wiz.io CERT Coordination Center

IOC & Hunting Starters (copy/paste ideas)

HTTP/2 DoS:
- Web/Proxy logs: alert on abnormally high RST_STREAM counts per client IP and bursty protocol errors in short windows (e.g., >200 resets/30s). (Map to T1498/T1499.)
N-central exploitation:
- Correlate login from new admin source IP ⇒ config/task creation ⇒ endpoint script exec within minutes. Flag non-standard interpreters (powershell -enc, bash -c, cmd /c) launched by N-central services. BleepingComputer
Xerox FreeFlow Core:
- Block/alert on SSRF egress from the app to cloud metadata IPs and on file reads of /etc/passwd, web.config, or temp upload dirs shortly before child-process creation. Horizon3.ai
ERMAC v3.0:
- Mobile EDR: watch for accessibility service abuse, overlay windows over banking apps, and requests to known ERMAC C2 patterns from recent research. The Hacker News

Recommended Patch / Mitigation Queue (today → next 72h)

HTTP/2 MadeYouReset: Patch Tomcat/Netty/F5 & enable edge rate controls. Apache Tomcat NVD myF5
N-able N-central: Upgrade to 2025.3.1 / 2024.6 HF2; restrict admin plane; review logs since Aug 13. CISA
Xerox FreeFlow Core: Upgrade to 8.0.5; isolate from internet; scan for exploitation artifacts. Xerox Security Content
Android fleet: Push MDM controls; warn users about banking overlays; monitor for ERMAC TTPs. The Hacker News
Elastic EDR claim: Monitor vendor guidance; verify agent stability; tighten WDAC. Elastic

Notes on Sources

MadeYouReset technical + vendor coverage: US-CERT KB, Tomcat, NVD (Netty), F5, Akamai/Imperva explainers. CERT Coordination Center Apache Tomcat NVD myF5 Akamai Imperva
N-able exploitation: CISA alert + KEV, BleepingComputer/SecurityWeek confirmations. CISA+1 BleepingComputer SecurityWeek
Xerox FreeFlow Core: Horizon3.ai research + Xerox security bulletin. Horizon3.ai Xerox Security Content
ERMAC v3.0: The Hacker News + Hunt.io blog. The Hacker News hunt.io
Elastic EDR: initial media coverage; vendor notes show a BSOD fix (not confirmation of a 0-day). Cyber Security News Elastic