Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
SmarterMail Version Enumeration: Threat Actors Building Target Lists Post-CVE-2025-52691
Excerpt
CVE-2025-52691 (an unauthenticated arbitrary file upload weakness enabling remote code execution on SmarterTools SmarterMail Email Gateways) landed on December 28, 2025, carrying a CVSS score of 10.0. The vulnerability affects SmarterMail Build 9406 and earlier, allowing unauthenticated attackers to upload arbitrary files to any location on the server. No user interaction is required, and the path from file upload to remote code execution is short. Given that attackers adore…
Read the original report →Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-52691 | Medium | Score 57/100 | First seen |
IOC Relationship Graph
Building graph…