Dive Brief:

• Researchers discovered two active exploits of zero-day vulnerabilities in warehouse management software platform VeraCore.
• The zero-day flaws were used in cyberattacks by a cybercriminal gang known as XE Group, which was first observed in 2013 and has previously focused on credit card-skimming and password-stealing malware, according to researchers at Intezer and Solis Security, who spotted the attacks.
• XE Group used the VeraCore vulnerabilities -- which were first exploited as far back as 2020 -- to compromise manufacturing and distribution sector supply chains.

Dive Insight:

The VeraCore zero-day vulnerabilities include CVE-2024-57968, which is a critical upload validation flaw with a CVSS score of 9.9, and CVE-2025-25181, a medium-severity SQL injection flaw with a CVSS score of 5.8. The flaws were discovered after an XE Group attack was identified on Nov. 5, according to a joint blog post from Intezer and Solis.

Threat actors compromised a Microsoft Internet Information Services (IIS) server hosting VeraCore's warehouse management system software, according to the report. Further analysis of the incident revealed the IIS server was first breached in January 2020 through the then-unknown SQL injection zero-day flaw.

XE Group deployed customized webshells, which the researchers described as "highly versatile" tools for maintaining persistent access to victim environments as well as SQL queries. In the case of the compromised IIS server, XE Group had re-used a webshell that had been planted four years earlier.

The cybersecurity vendors warned that XE Group is targeting supply chains in the manufacturing and distribution industries. While XE Group was known for its prolific credit card-skimming operation, the researchers said the gang has increased its capabilities.

"XE Group's evolution from credit card skimming operations to exploiting zero-day vulnerabilities underscores their adaptability and growing sophistication," the blog post said. "Their ability to maintain persistent access to systems, as seen with the reactivation of a webshell years after initial deployment, highlights the group's commitment to long-term objectives."

The researchers noted that Advantive released a temporary fix for CVE-2024-57968, which removed the upload feature from VeraCore. It's unclear, however, if CVE-2025-25181 has been patched. 

In response to a Cybersecurity Dive inquiry, an Advantive spokesperson provided this statement: "At this time, there are no known active threats to VeraCore software. Advantive continuously evaluates and enhances security measures to prevent unauthorized access and ensure the highest cybersecurity standards."