Threat actors are exploiting multiple security vulnerabilities in software products such as Progress Telerik UI for ASP.NET AJAX and Advantive VeraCore to deploy web shells and maintain persistent access to compromised systems. The XE Group, a Vietnamese cybercrime entity active since at least 2010, has been attributed to the zero-day exploitation of VeraCore vulnerabilities, shifting its focus from credit card skimming to targeted information theft in manufacturing and distribution supply chains. The attackers are leveraging vulnerabilities like CVE-2024-57968 and CVE-2025-25181 to deploy ASPXSpy web shells and Meterpreter payloads for reconnaissance and data exfiltration. This marks a significant escalation in XE Group’s tactics, as they now exploit zero-day vulnerabilities alongside older flaws in Telerik UI. Concurrently, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five (5) security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating all Federal Civilian Executive Branch (FCEB) agencies to patch systems by February 27, 2025. Other cybercriminals, including Russian and Chinese threat actors, are also actively exploiting these weaknesses for malware distribution and espionage campaigns, emphasizing the ongoing need for timely security updates. CTIX analysts recommend that organizations leveraging these products follow the guidance in the CISA advisory linked below.