Threat video1:00
CVE-2025-54068 Livewire Synthesizer RCE: Detection & IOCs
MuddyWater exploits this unauthenticated Livewire RCE in Laravel apps. 9 detection rules, 27 IOCs, 23 ATT&CK techniques and a free Splunk SPL rule.
Read the full threat intel for CVE-2025-54068 Livewire Synthesizer RCE: Detection & IOCs →
Chapters
- 0:00The hook9.8: critical code injection.
- 0:04The storyDisclosed July 2025, exploited by MuddyWater February 2026.
- 0:11Attack pathScanned, exploited CVE-2025-54068 via synthesizer smuggling.
- 0:29AttributionAttributed to MuddyWater.
- 0:33Indicators of compromise19 indicators to hunt: 7 IPs, 2 domains and 1 URL, and more.
- 0:40MITRE ATT&CK techniques23 ATT&CK techniques, from reconnaissance to impact.
- 0:44Remediation4 steps now: Upgrade Laravel Livewire to version.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:009.8: critical code injection.
0:05Disclosed July 2025, exploited by MuddyWater February 2026.
0:11Scanned, exploited CVE-2025-54068 via synthesizer smuggling.
0:19Executed PHP code, deployed persistence.
0:22Established C2, moved laterally.
0:25Collected and exfiltrated sensitive data.
0:29Attributed to MuddyWater. Confidence: high.
0:3419 indicators to hunt: 7 IPs, 2 domains and 1 URL, and more.
0:4023 ATT&CK techniques, from reconnaissance to impact.
0:444 steps now: Upgrade Laravel Livewire to version.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.