[Security News] CISA Lists Serv-U Flaw as Botnets and Vishing Rise (6.7)

CISA's KEV listing for SolarWinds Serv-U, active exploitation against Everest Forms Pro, a DD-WRT botnet campaign and Silent Ransom Group's helpdesk…

Table of contents

1. Overview
2. CISA Adds SolarWinds Serv-U Flaw to KEV After Exploitation
3. Everest Forms Pro Exploitation Targets WordPress Admin Access
4. C0XMO Botnet Uses DD-WRT Flaw to Expand Router Footholds
5. Silent Ransom Group Leans on Helpdesk Trust Instead of Malware First
6. At a glance
7. FAQ
8. Sources

CISA Lists Serv-U Flaw as Botnets and Vishing Rise (6.7)

Overview

• CISA added SolarWinds Serv-U CVE-2026-28318 to its KEV catalog after reported active exploitation against file-transfer infrastructure.
• threat-modeling.com reported active Everest Forms Pro exploitation involving unauthenticated PHP code injection and rogue WordPress administrator creation.
• BleepingComputer reported Fortinet's findings on C0XMO, a Gafgyt variant exploiting a DD-WRT buffer overflow for botnet spread.
• BleepingComputer also covered Mandiant's report on Silent Ransom Group campaigns using fake IT support calls against US organizations.

CISA Adds SolarWinds Serv-U Flaw to KEV After Exploitation

CISA added SolarWinds Serv-U CVE-2026-28318 to its KEV catalog on June 5, according to www.probablypwned.com. The flaw affects SolarWinds Serv-U file-transfer infrastructure and can be triggered without authentication through crafted POST requests using Content-Encoding: deflate.

The same report said SolarWinds first published its advisory on June 3. CISA set a June 19 remediation deadline for US federal civilian executive branch agencies, which turns the issue from a vendor patch item into a mandated federal response.

The operational concern is direct exposure. Serv-U systems often sit near sensitive file-transfer workflows, so a denial-of-service flaw can still disrupt business operations even when it does not provide remote code execution. The available source evidence identifies active exploitation but does not provide a CVSS score or affected-version matrix beyond the need to confirm Serv-U 15.5.4 HF1 or later.

▸ Serv-U KEV listing deep dive

The KEV listing matters because CISA uses that catalog for vulnerabilities with known exploitation, not merely theoretical risk. For defenders, that changes prioritization. A normal denial-of-service vulnerability may sit behind more severe remote code execution items. Once CISA adds it to KEV, exposed systems deserve a faster inventory and patch cycle.

The timeline is compressed. SolarWinds published its advisory on June 3, CISA added the issue to KEV on June 5, and federal civilian agencies received a June 19 deadline. That gives administrators roughly two weeks from KEV addition to complete remediation in covered environments. Private-sector teams are not bound by the federal deadline, but the same exposure logic applies to internet-facing file-transfer systems.

The attack path described in the source does not require authentication. That is the key practical detail. If an attacker can reach the Serv-U web interface, a crafted request can trigger service disruption. The report does not provide exploit code, and it should not be treated as a payload guide. The useful takeaway is narrower: reduce reachability, update to 15.5.4 HF1 or later, and watch for abnormal POST traffic patterns against exposed Serv-U endpoints.

CVE-2026-28318 also shows why availability bugs can be high-priority in file-transfer products. These systems often support payroll, legal exchange, customer onboarding or managed file transfer between partners. Even when confidentiality is not directly compromised, downtime can break deadlines and create recovery pressure. That makes patch timing and service monitoring central to the response.

Everest Forms Pro Exploitation Targets WordPress Admin Access

threat-modeling.com reported active exploitation of Everest Forms Pro in its June 7 vulnerability intelligence report. The report cited NVD's description of unauthenticated PHP code injection through the Calculation Addon's process_filter() function.

The weakness centers on submitted form values being concatenated into PHP code before eval() execution. In practical terms, an unauthenticated attacker can abuse form-processing logic rather than needing an existing WordPress account.

Wordfence telemetry reported exploitation that created rogue WordPress administrator accounts. That outcome moves the incident beyond application breakage. A new administrator account can give an attacker durable control over content, plugins, themes and user data.

The provided evidence does not name a CVE identifier or CVSS score for this Everest Forms Pro issue. Site owners should still treat the account-creation outcome as urgent, especially where the Calculation Addon is enabled.

▸ Everest Forms Pro exploitation deep dive

This case is a familiar WordPress security pattern with a dangerous twist. Plugins extend business workflows quickly, but form builders process untrusted user input by design. When calculation logic evaluates submitted values too directly, a convenience feature can become an execution path.

The reference to eval() is important because it explains the severity without publishing exploit steps. eval() executes code represented as data. If user-controlled form fields enter that path without proper validation and isolation, attackers can turn a submitted form into a control surface. The source evidence says NVD described that condition in the Calculation Addon's process_filter() function.

The reported creation of rogue administrator accounts gives defenders a concrete investigation target. Patching alone may not remove an existing unauthorized account. Administrators should review admin users, recent plugin changes, suspicious theme edits and unexpected scheduled tasks. Logs around form submissions can help narrow timing, but cleanup should assume that a successful admin account creation may have allowed broader site modification.

The report also illustrates why WordPress exposure is rarely isolated to one plugin. A compromised administrator can install additional plugins, upload files, alter SEO templates, redirect visitors or add backdoor users. For organizations using WordPress as a marketing front end, the business risk may include brand abuse and visitor redirection rather than theft from a core production database.

Because the supplied source data does not include the CVE number, affected version range or CVSS score, the safest wording is bounded. The confirmed facts here are active exploitation, unauthenticated PHP code injection, the Calculation Addon processing path and rogue administrator creation observed by Wordfence telemetry.

C0XMO Botnet Uses DD-WRT Flaw to Expand Router Footholds

BleepingComputer reported Fortinet's analysis of C0XMO, a new Gafgyt variant exploiting a DD-WRT buffer overflow. The campaign uses a separate Python scanner to find targets across architectures and device types.

The malware's behavior goes beyond initial compromise. BleepingComputer said the botnet uses hidden filesystem paths, a cron job that relaunches every 15 minutes, competitor malware removal and 19 distributed denial-of-service methods.

That combination points to a campaign designed for persistence and resource control. Routers and embedded devices often receive less routine maintenance than servers, which gives botnet operators a durable base when vulnerable firmware remains exposed.

No CVE identifier or CVSS score was included in the supplied source data for the DD-WRT buffer overflow. The practical mitigation is to update DD-WRT where fixes are available, restrict management exposure and remove devices that cannot receive maintained firmware.

▸ C0XMO botnet deep dive

C0XMO fits a long-running pattern in router botnets. Operators search for exposed network devices, exploit known weaknesses, then use the devices for distributed denial-of-service capacity. The value of the device is not its stored data. It is bandwidth, uptime and its position on residential or small-business networks.

Fortinet's finding that the malware uses a Python scanner matters because scanning separates target discovery from the payload. That design can help operators move across device types and architectures without relying on a single monolithic binary. It also makes the campaign more adaptable when one set of devices becomes less useful.

The competitor-removal behavior is another sign of resource competition. Botnet operators want exclusive control over CPU, memory and network capacity. Removing rival malware reduces instability and preserves the device for the current operator's DDoS activity. The 19 DDoS methods reported by BleepingComputer show that the malware was built for varied traffic-generation tasks, not one narrow attack mode.

The cron relaunch every 15 minutes is a persistence clue defenders can use without needing payload details. If a cleanup removes only the running process, scheduled relaunch can bring it back. A proper response should inspect startup scripts, scheduled tasks, hidden paths and firmware integrity. For many consumer or small-office routers, factory reset plus firmware update may be more reliable than manual cleanup.

The larger lesson is asset ownership. Many organizations track laptops and servers but overlook routers running customized firmware. DD-WRT can be useful, but it still needs patch governance. Unsupported devices should not expose management interfaces to the internet, and remote administration should be disabled unless there is a documented need.

Silent Ransom Group Leans on Helpdesk Trust Instead of Malware First

BleepingComputer covered Mandiant's report that UNC3753, also known as Luna Moth, Chatty Spider and Silent Ransom Group, targeted dozens of US organizations from January through May 2026. The campaign focused on law firms and other organizations where trusted communication carries operational weight.

The group used invoice-themed lures, voice phishing and fake IT helpdesk calls. BleepingComputer said the workflow also involved screen-sharing, remote monitoring and management tools, WinSCP or Rclone exfiltration, and suspected physical office access in some cases.

This is not a classic patch-only problem. The intrusion path depends on social engineering, helpdesk process abuse and legitimate remote-access tooling. Controls therefore need to cover identity checks, RMM approval, file-transfer monitoring and employee reporting paths.

Mandiant's attribution gives defenders several names to connect: UNC3753, Luna Moth, Chatty Spider and Silent Ransom Group. That naming matters because different security products and reports may use different labels for the same activity set.

▸ Silent Ransom Group campaign deep dive

The campaign shows how attackers can reduce technical noise by persuading people to run the access path for them. A fake helpdesk call can bypass some perimeter controls because the victim installs or launches a legitimate support tool. Security tools may see known software rather than custom malware.

The invoice lure supplies a believable opening. Law firms handle invoices, retainers, client files and time-sensitive communications. A caller posing as IT support can then convert confusion into action, especially if the organization lacks a clear helpdesk verification process. The reported use of screen-sharing and remote monitoring tools fits that sequence.

WinSCP and Rclone are also meaningful choices. Both can support legitimate file movement, so defenders need context rather than simple tool blocking. Large outbound transfers, unusual destinations, after-hours activity or execution from unexpected workstations can carry more signal than the tool name alone.

The suspected physical office access element, where present, widens the defensive scope. Badge procedures, visitor controls and reception training become part of cybersecurity response. That is especially relevant for law firms, which may host clients, vendors and couriers while protecting privileged documents.

The campaign's January-to-May span also argues for retrospective review. Organizations that only look at current alerts may miss earlier access or data staging. Security teams should examine remote-access logs, new tool installations, unusual outbound file movement and helpdesk tickets that involved screen-sharing. The best mitigation is procedural as much as technical: verify callers, require ticket-backed remote sessions and limit who can approve RMM tool use.

▸ More — additional context and sources

Silent Ransom Group targets law firms with fake IT support calls

Reported by www.bleepingcomputer.com. BleepingComputer covered Mandiant’s report that UNC3753, also known as Luna Moth, Chatty Spider, and Silent Ransom Group, targeted dozens o…

At a glance

Fact	Publisher	Source
CISA added SolarWinds Serv-U CVE-2026-28318 to KEV on June 5.	www.probablypwned.com	probablypwned.com
Federal civilian agencies have a June 19 remediation deadline for the Serv-U flaw.	www.probablypwned.com	probablypwned.com
Everest Forms Pro exploitation created rogue WordPress administrator accounts.	threat-modeling.com	threat-modeling.com
NVD described unauthenticated PHP code injection in the Calculation Addon.	threat-modeling.com	threat-modeling.com
Fortinet tied C0XMO to DD-WRT exploitation and Gafgyt botnet activity.	www.bleepingcomputer.com	bleepingcomputer.com
C0XMO uses cron relaunches, hidden paths and 19 DDoS methods.	www.bleepingcomputer.com	bleepingcomputer.com
Mandiant linked UNC3753 activity to dozens of US targets from January through May.	www.bleepingcomputer.com	bleepingcomputer.com

FAQ

Q1. What is the main security issue in CVE-2026-28318?

A. www.probablypwned.com described CVE-2026-28318 as an unauthenticated SolarWinds Serv-U denial-of-service flaw triggered through crafted POST requests. CISA added it to KEV on June 5, which means known exploitation has been recorded.

Q2. Which systems should teams prioritize from this briefing?

A. Priorities are internet-facing Serv-U systems, WordPress sites using Everest Forms Pro with the Calculation Addon, DD-WRT routers and environments where remote support tools can be approved by phone. The reporting names four separate exposure points.

Q3. Why is the Everest Forms Pro issue more than a website bug?

A. threat-modeling.com cited Wordfence telemetry showing rogue WordPress administrator account creation. That means a successful exploit can create persistent control over the site, not only disrupt a form submission workflow.

Q4. How do the C0XMO and Silent Ransom Group stories differ?

A. BleepingComputer's C0XMO report describes device exploitation and botnet persistence, including 19 DDoS methods. Its Silent Ransom Group coverage describes human-led intrusion using fake helpdesk calls, screen-sharing and file-transfer tools.

Q5. What should security teams watch next?

A. Watch for Serv-U patch adoption before the June 19 federal deadline, Everest Forms Pro CVE and version details, DD-WRT firmware guidance, and more Mandiant reporting on UNC3753 activity across US organizations.

Sources

1. C0XMO botnet spreads via DD-WRT router flaw, kills rival malware - www.bleepingcomputer.com
2. Silent Ransom Group targets law firms with fake IT support calls - www.bleepingcomputer.com
3. CISA Adds SolarWinds Serv-U Flaw to KEV After Active Exploitation - www.probablypwned.com
4. Vulnerability Intelligence Report — June 7, 2026: Everest Forms Pro RCE - threat-modeling.com

Last updated: 2026-06-08T10:24:14.001Z