UnclassifiedUnknown

FusionCore

FusionCore is a threat actor group, tracked by Brandefense. It targets organisations in Sweden.

Request IOC feed Request ATT&CK export

Techniques: 0
Exploited CVEs: No CVE data
First seen: Jan 1, 2022
Last seen: Mar 1, 2023
Record updated: Oct 19, 2026

Who They Target.

Countries · 1

SESweden

Vulnerabilities Linked To Their Tools.

Browse Vulnerability Intelligence →

CVE-2025-32432Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond.Exploitedcritical CVE-2026-10520Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote…Exploitedcritical CVE-2021-40870Unrestricted upload of a file with a dangerous type is possible, which allows an unauthenticated user to execute arbitrary code via directory traversal.Exploitedcritical CVE-2024-50603Aviatrix Controllers contain an OS command injection vulnerability that could allow an unauthenticated attacker to execute arbitrary code.Exploitedcritical CVE-2025-3248Langflow contains a missing authentication vulnerability in the /api/v1/validate/code endpoint that allows a remote, unauthenticated attacker to execute arbitrary code via crafted…Exploitedcritical CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.Exploitedcritical CVE-2026-42271BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary…Exploitedhigh CVE-2026-105134A flaw has been found in Ahsay AhsayCBS up to 10.3.2.critical CVE-2018-21027Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-memory (OOM) condition because malloc is mishandled.critical CVE-2024-46483Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap overflow with attacker-controlled content.critical CVE-2018-21028Boa through 0.94.14rc21 allows remote attackers to trigger a memory leak because of missing calls to the free function.high CVE-2026-105133A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.high CVE-2026-96656Plex Media Server before allows an admin user to write arbitrary files that may be executed on load.high CVE-2025-0283A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version…high CVE-2026-96654Plex Media Server before does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.medium CVE-2026-96652Plex Media Server before allows SSRF via '/player/timeline'.medium CVE-2026-96655Plex Media Server before allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.medium

Arsenal · Malware And Tools.

XMRigmalware
ConfuserExtool
Obfuscartool

About FusionCore.

The CYFIRMA research team has identified a new up-and-coming European threat actor group known as FusionCore. Running Malware-as-a-service, along with the hacker-for- hire operation, they have a wide variety of tools and services that are being offered on their website, making it a one-stop-shop for threat actors looking to purchase cost- effective yet customizable malware. The operators have started a ransomware affiliate program that equips the attackers with the ransomware and affiliate software to manage victims. FusionCore typically provides sellers with a detailed set of instructions for any service or product being sold, enabling individuals with minimal experience to carry out complex attacks.

Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.