CVE
CVE-2025-1974
ingress-nginx admission controller RCE escalation
Exploitation IoCs 9
Filename wget.sh
GitHub Repo ingress-nginx
GitHub User andresriancho
GitHub User hillai
GitHub User nirohfeld
GitHub User ronenshh
GitHub User sagitz_
IP 91[.]92[.]40[.]118
Registry User wiz_io
MITRE ATT&CK TTPs 19
T1003 T1018 T1021.004 T1027 T1048 T1055 T1057 T1059.001 T1059.004 T1068 T1071.001 T1078 T1083 T1133 T1190 T1210 T1212 T1484 T1496
OS Credential Dumping
Credential Access
Remote System Discovery
Discovery
SSH
Lateral Movement
Obfuscated Files or Information
Defense Evasion
Exfiltration Over Alternative Protocol
Exfiltration
Process Injection
Defense Evasion
Process Discovery
Discovery
PowerShell
Execution
Unix Shell
Execution
Exploitation for Privilege Escalation
Privilege Escalation
Web Protocols
Command And Control
Valid Accounts
Defense Evasion
File and Directory Discovery
Discovery
External Remote Services
Persistence
Exploit Public-Facing Application
Initial Access
Exploitation of Remote Services
Lateral Movement
Exploitation for Credential Access
Credential Access
Domain or Tenant Policy Modification
Defense Evasion
Resource Hijacking
Impact
Source Articles
Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies
Evooo1Bot is a newly identified Linux botnet derived from Mirai source code that targets internet-facing edge devices by exploiting known vulnerabilities. It installs a SOCKS5 proxy on compromised systems, enabling threat actors to route traffic through infected devices for evasion and anonymity. The malware includes an exploit toolkit targeting multiple CVEs, performs anti-analysis checks, and communicates with C2 servers over encrypted channels on port 443. It supports various post-compromise actions including DDoS attacks, credential sniffing, SSH brute-forcing, and lateral movement.
hacker-news Aug 17, 2026
CVE-2025-1974: The IngressNightmare in Kubernetes | Wiz Blog
Wiz Research discovered a series of critical unauthenticated Remote Code Execution (RCE) vulnerabilities in Ingress NGINX Controller for Kubernetes, collectively dubbed IngressNightmare. These vulnerabilities (CVE-2025-1097, CVE-2025-1098, CVE-2025-24514, and CVE-2025-1974) allow attackers to inject malicious NGINX configurations and achieve remote code execution on the ingress controller pod, leading to full cluster compromise. The admission controller, which is exposed without authentication by default, enables exploitation by processing untrusted admission review requests. Over 43% of cloud environments are estimated to be vulnerable, with more than 6,500 clusters already exposed to the public internet.
wiz