VulnHub

Amazon has alerted users that Sandworm, a group associated with Russia's military intelligence, has changed its approach to cyberattacks. Instead of exploiting software vulnerabilities, the group is now targeting poorly configured network edge devices to maintain access to their targets. This shift raises concerns for organizations that may not have secured their network configurations adequately. The focus on these devices suggests attackers are adapting their strategies to exploit weaknesses in network management rather than relying on traditional software flaws. This change could lead to increased risks for various industries, especially those with critical infrastructure that may be vulnerable due to lax network settings.

AWS Security has reported that multiple China-linked threat actors began exploiting the React2Shell vulnerability (CVE-2025-55182) within hours of its disclosure. Although this flaw does not affect AWS services, the rapid exploitation highlights the urgency for organizations to address this vulnerability to prevent potential breaches.