--- title: MSP cybersecurity news digest, November 17, 2025 description: DanaBot resurfaces, resumes Windows infections after six-month shutdown, Mass phishing campaign targets hotel bookings with 4,300 fake sites, and more. These are the latest threats to MSP security. canonical_url: https://www.acronis.com/en/tru/posts/msp-cybersecurity-news-digest-november-17-2025/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 08 December 2025 # MSP cybersecurity news digest, November 17, 2025 DanaBot resurfaces, resumes Windows infections after six-month shutdown, Mass phishing campaign targets hotel bookings with 4,300 fake sites, and more. These are the latest threats to MSP security. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** ### Critical ImunifyAV flaw exposes millions of Linux-hosted sites to RCE The ImunifyAV malware scanner (part of Imunify360) used on shared Linux hosting environments contains [a critical remote-code-execution vulnerability](https://www.bleepingcomputer.com/news/security/rce-flaw-in-imunifyav-puts-millions-of-linux-hosted-sites-at-risk/) in its AI-Bolit deobfuscation component, allowing execution of dangerous PHP functions. The issue affects versions prior to 32.7.4.0, and CloudLinux has released patches; older versions of ImunifyAV, ImunifyAV+, and Imunify360 are all impacted. Because ImunifyAV is deployed by hosting providers at the server level (not just per website), a successful exploit could lead to full server compromise, especially if the scanner is running with elevated privileges. ### DanaBot resurfaces, resumes Windows infections after six-month shutdown The DanaBot banking trojan [has resurfaced in the wild](https://www.bleepingcomputer.com/news/security/danabot-malware-is-back-to-infecting-windows-after-6-month-break/) with a new version 669, roughly six months after law enforcement’s “Operation Endgame” had disrupted its infrastructure. The rebuilt command-and-control infrastructure now includes both Tor (.onion) domains and back-connect nodes, making it more resilient and harder to block. Threat actors are using the updated DanaBot to steal browser-stored credentials, perform form-grabs, and potentially facilitate remote access; new cryptocurrency wallets (BTC, ETH, LTC, TRX) have been identified for stolen funds. ### Attackers exploit Triofox antivirus feature to deploy remote access tools Security researchers discovered that [attackers exploited a critical vulnerability](https://www.bleepingcomputer.com/news/security/hackers-abuse-triofox-antivirus-feature-to-deploy-remote-access-tools/) (CVE-2025-12480) in Triofox’s administrative interface, bypassing authentication by spoofing “localhost” in HTTP Host headers. By abusing Triofox’s built-in antivirus feature, attackers uploaded a malicious script that runs with SYSTEM-level privileges as the AV scanner, enabling remote-code execution. In their post-exploitation chain, the attackers deployed Zoho UEMS, Zoho Assist and AnyDesk; they also used Plink and PuTTY to tunnel SSH traffic and enable lateral movement. Use Acronis EDR process-behavior monitoring to detect and block unexpected SYSTEM-level AV-scanner launches, especially when paired with network tunneling tools like PuTTY or SSH. ### Microsoft patches zero day and 63 vulnerabilities in November Patch Tuesday update Microsoft released its [November 2025 security update](https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2025-patch-tuesday-fixes-1-zero-day-63-flaws/), patching 63 vulnerabilities, including one actively exploited zero-day (CVE-2025-62215) in the Windows Kernel. The update also addresses 16 remote-code-execution (RCE) flaws, four “Critical” vulnerabilities, 29 elevation-of-privilege issues, information disclosure bugs, and more. The zero-day (CVE-2025-62215) is linked to a race-condition in the Windows Kernel, allowing local attackers with limited privileges to escalate to SYSTEM-level access. ### Mass phishing campaign targets hotel bookings with 4,300 fake sites A sophisticated phishing campaign by a Russian-speaking threat actor [created over 4,300 fake travel booking websites](https://thehackernews.com/2025/11/russian-hackers-create-4300-fake-travel.html), impersonating brands like Booking.com, Expedia, Agoda, Airbnb and more. The [phishing](https://www.acronis.com/en/blog/tags/phishing/) kit customizes the fraudulent site appearance based on unique URL parameters, presenting a realistic hotel booking flow to victims, complete with fake CAPTCHA and Cloudflare-like loading screens. When victims enter credit card details, the site processes the data, then shows a 3-D Secure “verification” widget to capture expiration dates and CVV, all while exfiltrating their payment information. Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)