Security Posture Report - October 2025

Default defense level of the cloud platform

Default defense is the baseline protection that Alibaba Cloud provides for all customers. It leverages extensive cloud security threat intelligence to block large-scale attacks from malicious groups. This provides customers with out-of-the-box security protection without requiring manual configuration.

In October 2025, the daily average for customers on the cloud platform

• Blocking 6.245 billion attacks, a 10.7% decrease from September.

• Blocking 27,500 malicious IP addresses, a 1.1% increase from September.

Recently, ransomware groups have been active in cloud environments, launching scanning attacks and extortion attempts. Alibaba Cloud has enhanced its default defense policies to strengthen its ability to block ransomware attacks.

As of October 2025, Alibaba Cloud has blocked a total of 21.44 million scans and attacks from ransomware groups targeting cloud users.

DDoS attack interceptions

In October, the Alibaba Cloud platform monitored and blocked:

• 102,800 DDoS attacks, an 11.5% increase from September.

• A peak DDoS attack of 2100 Gbps, an 8.7% decrease from September.

Beware of new Outlaw botnet variants

The Alibaba Cloud security team recently detected multiple attacks involving the Outlaw mining botnet. First discovered in 2018, this botnet has been targeting Elastic Compute Service (ECS) instances to illegally mine cryptocurrencies, such as Monero, and remains highly active. Recent analysis shows that the samples used in current attacks are a significant upgrade from the third-generation version. They include more feature modules, are significantly more stealthy, and are much harder to remove, posing a persistent threat to cloud security.

1. Attack methods

Attackers primarily use SSH brute-force attacks to access target systems. After a successful intrusion, they implant an SSH public key to establish persistent, passwordless remote control. The attackers then download and execute a back door program from a remote server and deploy a mining trojan.

To ensure persistence, the malicious program uses the following methods to start automatically and operate stealthily:

• Uses `crontab` to create scheduled tasks that periodically pull and execute malicious scripts.

• Uses `bash` command injection to implant back door logic into system initialization scripts or user configuration files.

• Uses the `tar` command to decompress and release the malicious payload. This avoids writing identifiable binary files directly to the disk and helps evade detection.

• Integrates internal network scanning and SSH brute-force attack tools to move laterally to other reachable hosts in the same CIDR block and expand the scope of the infection.

The entire attack chain is highly automated and has strong propagation and persistence capabilities.

2. Indicators of Compromise (IOCs)

• 1d306f8526098519cb196d490a351591

• 30ef03743378cf5208615c9d6a395260

3. Security recommendations

To effectively prevent botnet intrusion and propagation, Alibaba Cloud recommends that you take the following measures:

• Minimize the attack surface: Avoid exposing management ports, such as SSH (port 22), to the public network. If you must expose these ports, use security groups or firewalls to restrict access to specific source IP addresses. You can also use Bastionhost or Cloud Firewall for access control.

• Strengthen identity authentication: Disable weak passwords and enforce a strong password policy that requires regular rotation. We strongly recommend that you disable SSH password logon and use key-based authentication instead.

• Respond to risks quickly: If you detect an infection, immediately isolate the host and purge all malicious scheduled tasks and back door files.

Alibaba Cloud will continue to monitor the evolution of the Outlaw botnet and send real-time alerts by email, text message, and internal message. Respond to these alerts immediately to prevent threats from spreading and affecting your business.

New critical vulnerabilities

1. Windows Server Update Services (WSUS) remote code execution vulnerability (CVE-2025-59287)

When processing an AuthorizationCookie, Windows Server Update Services (WSUS) does not properly validate deserialized data. An attacker can exploit the .NET BinaryFormatter mechanism to bypass identity authentication through SimpleAuth.asmx and send a malicious SOAP request to ReportingWebService.asmx. This allows the attacker to execute arbitrary code with SYSTEM privileges without authentication.

Because WSUS is typically deployed in a core area of a corporate intranet and runs with high system privileges, a compromised WSUS server can be used as a pivot for lateral movement, to distribute malicious updates, or to establish persistence. This can lead to security risks at the supply chain level.

View vulnerability details

Exploit code for this vulnerability is now public, and in-the-wild attacks have been observed. Alibaba Cloud recommends that you take the following actions:

• Use the security assessment tool to perform a free vulnerability scan. If the vulnerability is detected, immediately install the official Microsoft patch as recommended.

• For systems that cannot be upgraded immediately, disable the WSUS server role or configure a security group to restrict the source IP addresses that can access the WSUS service.

2. U8 Cloud pubsmsservlet deserialization vulnerability

pubsmsservlet is a public servlet interface in Yonyou U8 Cloud. This interface does not properly validate input data when processing user requests, which results in a deserialization vulnerability. An attacker can craft a malicious request to exploit this vulnerability and execute arbitrary code on the target server. This can lead to an attacker obtaining system permissions, causing a data breach, interrupting business, or compromising the server.

View vulnerability details

Alibaba Cloud has detected in-the-wild exploitation of this vulnerability. If you use U8 Cloud, take the following actions immediately:

• Upgrade immediately: Use the U8 Cloud patching tool to upgrade to the latest security patch.

• Mitigation (if you cannot patch immediately):

  • Deploy U8 Cloud in a private network and use a security group to restrict access to only trusted IP addresses.

  • You can use WAF to block external requests to the /u8cloud/pubssuservlet path.

Other vulnerabilities

Free detection is available for some vulnerabilities. You can go to the Alibaba Cloud Security Center console and enable the free security assessment to quickly identify related critical vulnerabilities. For more comprehensive detection, you can use Security Center Enterprise Edition to perform in-depth scanning and continuous monitoring for the application vulnerabilities listed below.