Author: Mark

Jul 23, 2025Ravie LakshmananMalware / Cryptocurrency

The threat actor behind the exploitation of vulnerable Craft Content Management System (CMS) instances has shifted its tactics to target Magento CMS and misconfigured Docker instances.

The activity has been attributed to a threat actor tracked as Mimo (aka Hezb), which has a long history of leveraging N-day security flaws in various web applications to deploy cryptocurrency miners.

“Although Mimo’s primary motivation remains financial, through cryptocurrency mining and bandwidth monetization, the sophistication of their recent operations suggests potential preparation for more lucrative criminal activities,” Datadog Security Labs said in a report published this week.

Mimo’s exploitation of CVE-2025-32432, a critical security flaw in Craft CMS, for cryptojacking and proxyjacking was documented by Sekoia in May 2025.

Newly observed attack chains associated with the threat actor involve the abuse of undetermined PHP-FPM vulnerabilities in Magento e-commerce installations to obtain initial access, and then using it to drop GSocket, a legitimate open-source penetration testing tool, to establish persistent access to the host by means of a reverse shell.

“The initial access vector is PHP-FPM command injection via a Magento CMS plugin, indicating that Mimo possesses multiple exploit capabilities beyond previously observed adversarial tradecraft,” researchers Ryan Simon, Greg Foss, and Matt Muir said.

In an attempt to sidestep detection, the GSocket binary masquerades as a legitimate or kernel-managed thread so that it blends in with other processes that may be running on the system.

Another notable technique employed by the attackers is the use of in-memory payloads using memfd_create() so as to launch an ELF binary loader called “4l4md4r” without leaving any trace on disk. The loader is then responsible for deploying the IPRoyal proxyware and the XMRig miner on the compromised machine but not before modifying the “/etc/ld.so.preload” file to inject a rootkit to conceal the presence of these artifacts.

The distribution of a miner and proxyware underscores a two-pronged approach adopted by Mimo to maximize financial gain. The distinct revenue generation streams ensure that compromised machines’ CPU resources are hijacked to mine cryptocurrency, while the victims’ unused internet bandwidth is monetized for illicit residential proxy services.

“Furthermore, the use of proxyware, which typically consumes minimal CPU, enables stealthy operation that prevents detection of the additional monetization even if the crypto miner’s resource usage is throttled,” the researchers said. “This multi-layered monetization also enhances resilience: even if the crypto miner is detected and removed, the proxy component may remain unnoticed, ensuring continued revenue for the threat actor.”

Datadog said it also observed the threat actors abusing misconfigured Docker instances that are publicly accessible to spawn a new container, within which a malicious command is executed to fetch an additional payload from an external server and execute it.

Written in Go, the modular malware comes fitted with capabilities to achieve persistence, conduct file system I/O operations, terminate processes, perform in-memory execution. It also serves as a dropper for GSocket and IPRoyal, and attempts to propagate to other systems via SSH brute-force attacks.

“This demonstrates the threat actor’s willingness to compromise a diverse range of services – not just CMS providers – to achieve their objectives,” Datadog said.

Jul 23, 2025Ravie LakshmananWindows Security / Cryptocurrency

The Windows banking trojan known as Coyote has become the first known malware strain to exploit the Windows accessibility framework called UI Automation (UIA) to harvest sensitive information.

“The new Coyote variant is targeting Brazilian users, and uses UIA to extract credentials linked to 75 banking institutes’ web addresses and cryptocurrency exchanges,” Akamai security researcher Tomer Peled said in an analysis.

Coyote, first revealed by Kaspersky in 2024, is known for targeting Brazilian users. It comes with capabilities to log keystrokes, capture screenshots, and serve overlays on top of login pages associated with financial enterprises.

Part of the Microsoft .NET Framework, UIA is a legitimate feature offered by Microsoft to allow screen readers and other assistive technology products to programmatically access user interface (UI) elements on a desktop.

That UIA can be a potential pathway for abuse, including data theft, was previously demonstrated as a proof-of-concept (PoC) by Akamai in December 2024, with the web infrastructure company noting that it could be used to steal credentials or execute code.

In some ways, Coyote’s latest modus operandi mirrors the various Android banking trojans that have been spotted in the wild, which often weaponize the operating system’s accessibility services to obtain valuable data.

Akamai’s analysis found that the malware invokes the GetForegroundWindow() Windows API in order to extract the active window’s title and compare it against a hard-coded list of web addresses belonging to targeted banks and cryptocurrency exchanges.

“If no match is found Coyote will then use UIA to parse through the UI child elements of the window in an attempt to identify browser tabs or address bars,” Peled explained. “The content of these UI elements will then be cross-referenced with the same list of addresses from the first comparison.”

As many as 75 different financial institutions are targeted by the latest version of the malware, up from 73 documented by Fortinet FortiGuard Labs earlier this January.

“Without UIA, parsing the sub-elements of another application is a nontrivial task,” Akamai added. “To be able to effectively read the contents of sub-elements within another application, a developer would need to have a very good understanding of how the specific target application is structured.”

“Coyote can perform checks, regardless of whether the malware is online or operating in an offline mode. This increases the chances of successfully identifying a victim’s bank or crypto exchange and stealing their credentials.”

Jul 20, 2025Ravie LakshmananDevOps / Threat Intelligence

Cybersecurity researchers have alerted to a supply chain attack that has targeted popular npm packages via a phishing campaign designed to steal the project maintainers’ npm tokens.

The captured tokens were then used to publish malicious versions of the packages directly to the registry without any source code commits or pull requests on their respective GitHub repositories.

The list of affected packages and their rogue versions, according to Socket, is listed below –

• eslint-config-prettier (versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7)
• eslint-plugin-prettier (versions 4.2.2 and 4.2.3)
• synckit (version 0.11.9)
• @pkgr/core (version 0.2.8)
• napi-postinstall (version 0.3.1)
• got-fetch (versions 5.1.11 and 5.1.12)
• is (versions 3.3.1 and 5.0.0)

“The injected code attempted to execute a DLL on Windows machines, potentially allowing remote code execution,” the software supply chain security firm said.

The development comes in the aftermath of a phishing campaign that has been found to send email messages impersonating npm in order to trick project maintainers into clicking on a typosquatted link (“npnjs[.]com,” as opposed to “npmjs[.]com”) that harvested their credentials.

The digital missives, with the subject line “Please verify your email address,” spoofed a legitimate email address associated with npm (“support@npmjs[.]org”), urging recipients to validate their email address by clicking on the embedded link.

The bogus landing page to which the victims are redirected to, per Socket, is a clone of the legitimate npm login page that’s designed to capture their login information.

Further analysis of the malware embedded within these packages has uncovered that the DLL, dubbed Scavenger Loader, is designed to bypass detection and deliver from an external server a stealer component codenamed Scavenger Stealer that’s capable of gathering sensitive data from web browsers, per researchers Cedric Brisson and Josh Reynolds.

But what makes the attack targeting “is” significant is that, unlike the Scavenger malware that only affects Windows systems, the payload fitted within it is wholly written in JavaScript, meaning it can run on Windows, Linux, and macOS machines. The malicious module captures system information and environment variables, and exfiltrate the details over a WebSocket connection.

“The campaign is deploying multiple payload families to maximize reach,” Socket said. “The ‘is’ variant drops no DLL; instead, it remains entirely in JavaScript, and maintains a live command-and-control (C2) channel.”

“Every message received over the socket is treated as executable JavaScript, giving the threat actor an instant, interactive remote shell. The payload executes with the same privileges as the host process, allowing unrestricted file system and network access.”

Developers who use the affected packages are advised to cross-check the versions installed and rollback to a safe version. Project maintainers are recommended to turn on two-factor authentication to secure their accounts, and use scoped tokens instead of passwords for publishing packages.

“This incident shows how quickly phishing attacks on maintainers can escalate into ecosystem-wide threats,” Socket said.

The findings coincide with an unrelated campaign that has flooded npm with 28 packages containing protestware functionality that can disable mouse-based interaction on websites with a Russian or Belarusian domain. They are also engineered to play the Ukrainian national anthem on a loop.

However, the attack only works when the site visitor has their browser language settings set to Russian and, in some cases, the same website is visited a second time, thereby ensuring that only repeat visitors are targeted. The activity marks an expansion of a campaign that was first flagged last month.

“This protestware underscores that actions taken by developers can propagate unnoticed in nested dependencies and may take days or weeks to manifest,” security researcher Olivia Brown said.

Arch Linux Removes 3 AUR Packages that Installed Chaos RAT Malware

It also comes as the Arch Linux team said it has pulled three malicious AUR packages that were uploaded to the Arch User Repository (AUR) and harbored hidden functionality to install a remote access trojan called Chaos RAT from a now-removed GitHub repository.

The affected packages are: “librewolf-fix-bin,” “firefox-patch-bin,” and “zen-browser-patched-bin.” They were published by a user named “danikpapas” on July 16, 2025.

“These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT),” the maintainers said. “We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.”

(The story was updated after publication on July 23, 2025, to include more information about the npm supply chain attack.)

Security experts have been talking about Kerberoasting for over a decade, yet this attack continues to evade typical defense methods. Why? It’s because existing detections rely on brittle heuristics and static rules, which don’t hold up for detecting potential attack patterns in highly variable Kerberos traffic. They frequently generate false positives or miss “low-and-slow” attacks altogether.

Is there a better and more accurate way for modern organizations to detect subtle anomalies within irregular Kerberos traffic? The BeyondTrust research team sought to answer this question by combining security research insights with advanced statistics. This article offers a high-level look into the driving forces behind our research and our process of developing and testing a new statistical framework for improving Kerberos anomaly detection accuracy and reducing false positives.

An Introduction to Kerberoasting Attacks

Kerberoasting attacks take advantage of the Kerberos network authentication protocol within Windows Active Directory environments. The Kerberos authentication process works as follows:

1. AS-REQ: A user logs in and requests a Ticket Granting Ticket (TGT).

2. AS-REP: The Authentication Server verifies the user’s credentials and issues a TGT.

3. TGS-REQ: When the user wants to request access to a service, they request a Ticket Granting Service Ticket (TGS) using the previously received TGT. This action is recorded as Windows Event 4769^[1] on the domain controller.

4. TGS-REP: The TGS verifies the request and issues a TGS, which is encrypted using the password hash of the service account associated with the requested service.

5. KRB-AP-REQ: For the user to authenticate against a service using the TGS ticket, they send it to the application server, which then takes various actions to verify the user’s legitimacy and allow access to the requested service.

Attackers aim to exploit this process because Kerberos service tickets are encrypted with the hash of the service account’s password. To take advantage of Kerberos tickets, attackers first leverage LDAP (Lightweight Directory Access Protocol) to query the directory for any AD accounts that have Service Principal Names (SPNs) associated with them. An attacker will then request Ticket Granting Service (TGS) tickets for these accounts, which can be done without any administrative rights. Once they have requested these service tickets, they can crack the hash offline to uncover the credentials of the service account. Access to a service account can then enable the attacker to move laterally, escalate privileges, or exfiltrate data.

Many organizations have heuristic-based detection methods in place to flag irregular Kerberos behavior. One common method is volume-based detection, which can flag a spike in TGS request activity from a single account. If an attacker requests TGS tickets for all service principal names they can find using LDAP, this detection method will likely identify this spike as suspicious activity. Another method, encryption-type analysis, can detect if an attacker attempts to downgrade the encryption of the requested TGS tickets from the default AES to a weaker type, such as RC4 or DES, in hopes of making their own job easier when they start to crack the hash.

While both of these static rule-based methods can work in some cases, they produce a notorious number of false positives. Additionally, they don’t factor in the user’s behaviors and irregularities unique to each organization’s domain configurations.

A Statistical Model for Detecting Kerberoasting Attacks

With these limitations in mind, the BeyondTrust research team sought to find a method that would both improve anomaly detection capabilities and reduce false positives. We found statistical modeling to be the best method, in which a model would be created that could estimate probability distribution based on contextual data patterns. The ability to predict normal user behavior would be key to flagging any abnormalities.

Our team laid out four constraints for our prospective statistical model, based on existing Kerberoasting research^{[2, 3]}:

1. Explainability: The ability to interpret the output with respect to a recognized, normalized, and easy to explain and track measure.
2. Uncertainty: The ability to reflect sample size and confidence in estimates, as opposed to the output being a simple binary indicator.
3. Scalability: The ability to limit the amount of cloud computing and data storage needed for updating model parameters per run.
4. Nonstationarity: The capacity to adapt to trends or other data changes over time, and incorporating these shifts into how anomalies are defined

The BeyondTrust research team worked to build out a model that aligned with the above constraints, eventually developing a model that groups similar ticket-request patterns into distinct clusters and then uses histogram bins to track the frequency of certain activity levels over time. The goal: to learn what ‘normal’ looks like for each cluster. We aimed to reduce false positives by grouping these like data patterns together, as events that could look suspicious in isolation would become normal when compared to similar data patterns.

Kerberoasting Statistical Model: Results

The team then tested the model across 50 days of data or roughly 1,200 hourly evaluation periods. The model’s results are as follows:

• Consistently achieved processing times under 30 seconds, including histogram updates, clustering operations, score calculations, percentile ranking, and result storage.
• Identified six anomalies with notable temporal patterns, such as uncorrelated spikes in narrow time windows, increased variance, and significant temporary shifts. Two were identified as penetration tests, one was the team’s simulated Kerberoasting attack, and three were related to large changes in Active Directory infrastructure that caused inadvertent spikes in Kerberos service ticket requests.
• Handled extreme variability in heavy-tailed accounts exceptionally well, appropriately down-weighting anomaly scores after observing just two consecutive spikes through dynamic sliding window updates and real-time percentile ranking. This level of adaptability is notably faster than standard anomaly detection methods

After conducting this research, the BeyondTrust research team was able to report early success by combining security expertise with advanced statistical techniques. Because there are inherent limitations of pure anomaly detection methodologies, collaboration between experts in security and data science was necessary for this success. While statisticians can create an adaptive model that takes variable behaviors into consideration, security researchers can offer needed context for identifying notable features within flagged events.

Conclusion

Altogether, this research proves that, even when considering decade-old attack patterns like Kerberoasting, there are clear paths forward in iterating and evolving on detection and response capabilities. Alongside considering the possibilities of novel detection capabilities, such as the ones described in this research, teams should also evaluate proactive identity security measures that reduce Kerberoasting risks before they ever occur.

Some solutions with identity threat detection and response (ITDR) capabilities, such as BeyondTrust Identity Security Insights, can help teams proactively identify accounts that are vulnerable to Kerberoasting due to improper use of service principals and the use of weak ciphers.

Precise, proactive measures, combined with smarter, more context-aware detection models, are essential as security teams continuously work to cut through noise and stay ahead of growing complexity and scale.

About the Authors:

Christopher Calvani, Associate Security Researcher, BeyondTrust

Christopher Calvani is a Security Researcher on BeyondTrust’s research team, where he blends vulnerability research with detection engineering to help customers stay ahead of emerging threats. A recent graduate of the Rochester Institute of Technology with a B.S. in Cybersecurity, Christopher previously supported large‑scale infrastructure at Fidelity Investments as a Systems Engineer intern and advanced DevSecOps practices at Stavvy.

Cole Sodja, Principal Data Scientist, BeyondTrust

Cole Sodja is a Principal Data Scientist at BeyondTrust with over 20 years of applied statistics experience across major technology companies including Amazon and Microsoft. He specializes in time series analysis, bringing deep expertise in forecasting, changepoint detection, and behavioral monitoring to complex business challenges.

Jul 23, 2025Ravie LakshmananSoftware Integrity / DevSecOps

Google has announced the launch of a new initiative called OSS Rebuild to bolster the security of the open-source package ecosystems and prevent software supply chain attacks.

“As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to avoid compromise without burden on upstream maintainers,” Matthew Suozzo, Google Open Source Security Team (GOSST), said in a blog post this week.

The project aims to provide build provenance for packages across the Python Package Index (Python), npm (JS/TS), and Crates.io (Rust) package registries, with plans to extend it to other open-source software development platforms.

With OSS Rebuild, the idea is to leverage a combination of declarative build definitions, build instrumentation, and network monitoring capabilities to produce trustworthy security metadata, which can then be used to validate the package’s origin and ensure it has not been tampered with.

“Through automation and heuristics, we determine a prospective build definition for a target package and rebuild it,” Google said. “We semantically compare the result with the existing upstream artifact, normalizing each one to remove instabilities that cause bit-for-bit comparisons to fail (e.g., archive compression).”

Once the package is reproduced, the build definition and outcome is published via SLSA Provenance as an attestation mechanism that allows users to reliably verify its origin, repeat the build process, and even customize the build from a known-functional baseline.

In scenarios where automation isn’t able to fully reproduce the package, OSS Rebuild offers a manual build specification that can be used instead.

OSS Rebuild, the tech giant noted, can help detect different categories of supply chain compromises, including –

• Published packages that contain code not present in the public source repository (e.g., @solana/web3.js)
• Suspicious build activity (e.g., tj-actions/changed-files)
• Unusual execution paths or suspicious operations embedded within a package that are challenging to identify through manual review (e.g., XZ Utils)

Besides securing the software supply chain, the solution can improve Software Bills of Materials (SBOMs), speed up vulnerability response, strengthen package trust, and eliminate the need for CI/CD platforms to be in charge of an organization’s package security.

“Rebuilds are derived by analyzing the published metadata and artifacts and are evaluated against the upstream package versions,” Google said. “When successful, build attestations are published for the upstream artifacts, verifying the integrity of the upstream artifact and eliminating many possible sources of compromise.”

Jul 23, 2025Ravie LakshmananVulnerability / Software Security

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two security flaws impacting SysAid IT support software to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

The vulnerabilities in question are listed below –

• CVE-2025-2775 (CVSS score: 9.3) – An improper restriction of XML external entity (XXE) reference vulnerability in the Checkin processing functionality, allowing for administrator account takeover and file read primitives
• CVE-2025-2776 (CVSS score: 9.3) – An improper restriction of XML external entity (XXE) reference vulnerability in the Server URL processing functionality, allowing for administrator account takeover and file read primitives

Both shortcomings were disclosed by watchTowr Labs researchers Sina Kheirkhah and Jake Knott back in May, alongside CVE-2025-2777 (CVSS score: 9.3), a pre-authenticated XXE within the /lshw endpoint.

The three vulnerabilities were addressed by SysAid in the on-premise version 24.4.60 build 16 released in early March 2025.

The cybersecurity firm noted that the vulnerabilities could allow attackers to inject unsafe XML entities into the web application, resulting in a Server-Side Request Forgery (SSRF) attack, and in some cases, remote code execution when chained with CVE-2024-36394, a command injection flaw revealed by CyberArk last June.

It’s currently not known how CVE-2025-2775 and CVE-2025-2776 are being exploited in real-world attacks. Nor is any information available regarding the identity of the threat actors, their end goals, or the scale of these efforts.

To safeguard against the active threat, Federal Civilian Executive Branch (FCEB) agencies are required to apply the necessary fixes by August 12, 2025.

Jul 23, 2025Ravie LakshmananVulnerability / Threat Intelligence

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on July 22, 2025, added two Microsoft SharePoint flaws, CVE-2025-49704 and CVE-2025-49706, to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

To that end, Federal Civilian Executive Branch (FCEB) agencies are required to remediate identified vulnerabilities by July 23, 2025.

“CISA is aware of active exploitation of a spoofing and RCE vulnerability chain involving CVE-2025-49706 and CVE-2025-49704, enabling unauthorized access to on-premise SharePoint servers,” the agency said in an updated advisory.

The inclusion of the two shortcomings, a spoofing vulnerability and a remote code execution vulnerability collectively tracked as ToolShell, to the KEV catalog comes after Microsoft revealed that Chinese hacking groups like Linen Typhoon and Violet Typhoon leveraged these flaws to breach on-premises SharePoint servers since July 7, 2025.

As of writing, the tech giant’s own advisories only list CVE-2025-53770 as being exploited in the wild. What’s more, it describes the four flaws as below –

• CVE-2025-49704 – SharePoint Remote Code Execution
• CVE-2025-49706 – SharePoint Post-auth Remote Code Execution
• CVE-2025-53770 – SharePoint ToolShell Authentication Bypass and Remote Code Execution
• CVE-2025-53771 – SharePoint ToolShell Path Traversal

The fact that CVE-2025-53770 is both an authentication bypass and a remote code execution bug indicates that CVE-2025-53771 is not necessary to build the exploit chain. CVE-2025-53770 and CVE-2025-53771 are assessed to be patch bypasses for CVE-2025-49704 and CVE-2025-49706, respectively.

“The root cause [of CVE-2025-53770] is a combination of two bugs: An authentication bypass (CVE-2025-49706) and an insecure deserialization vulnerability (CVE-2025-49704),” the Akamai Security Intelligence Group said.

When reached for comment regarding the exploitation status of CVE-2025-53771 and other flaws, a Microsoft spokesperson told The Hacker News that the information published in its advisories is correct “at the time of original publication” and that it does not typically update post-release.

“Microsoft also assists CISA with the Known Exploited Vulnerabilities Catalog which provides regularly updated information on exploited vulnerabilities,” the spokesperson added.

The development comes as watchTowr Labs told the publication that it has internally devised a method exploiting CVE-2025-53770 such that it bypasses Antimalware Scan Interface (AMSI), a mitigation step outlined by Microsoft to prevent unauthenticated attacks.

“This has allowed us to continue identifying vulnerable systems even after mitigations like AMSI have been applied,” watchTowr CEO Benjamin Harris said. “AMSI was never a silver bullet, and this outcome was inevitable. But we’re concerned to hear that some organizations are choosing to ‘enable AMSI’ instead of patching. This is a very bad idea.”

“Now that exploitation has been linked to nation-state actors, it would be naive to think they could leverage a SharePoint zero-day but somehow not bypass AMSI. Organizations must patch. Should go without saying – all the public PoCs will trigger AMSI, and mislead organizations into believing the mitigations are comprehensive/the host is no longer vulnerable. This would be incorrect.”

Jul 22, 2025Ravie LakshmananVulnerability / Threat Intelligence

Microsoft has formally tied the exploitation of security flaws in internet-facing SharePoint Server instances to two Chinese hacking groups called Linen Typhoon and Violet Typhoon as early as July 7, 2025, corroborating earlier reports.

The tech giant said it also observed a third China-based threat actor, which it tracks as Storm-2603, weaponizing the flaws as well to obtain initial access to target organizations.

“With the rapid adoption of these exploits, Microsoft assesses with high confidence that threat actors will continue to integrate them into their attacks against unpatched on-premises SharePoint systems,” the tech giant said in a report published today.

A brief description of the threat activity clusters is below –

• Linen Typhoon (aka APT27, Bronze Union, Emissary Panda, Iodine, Lucky Mouse, Red Phoenix, and UNC215), which is active since 2012 and has been previously attributed to malware families like SysUpdate, HyperBro, and PlugX
• Violet Typhoon (aka APT31, Bronze Vinewood, Judgement Panda, Red Keres, and Zirconium), which is active since 2015 and has been previously attributed attacks targeting the United States, Finland, and Czechia
• Storm-2603, a suspected China-based threat actor that has deployed Warlock and LockBit ransomware in the past

The vulnerabilities, which affect on-premises SharePoint servers, have been found to leverage incomplete fixes for CVE-2025-49706, a spoofing flaw, and CVE-2025-49704, a remote code execution bug. The bypasses have been assigned the CVE identifiers CVE-2025-53771 and CVE-2025-53770, respectively.

In the attacks observed by Microsoft, the threat actors have been found exploiting on-premises SharePoint servers through a POST request to the ToolPane endpoint, resulting in an authentication bypass and remote code execution.

As disclosed by other cybersecurity vendors, the infection chains pave the way for the deployment of a web shell named “spinstall0.aspx” (aka spinstall.aspx, spinstall1.aspx, or spinstall2.aspx) that allows the adversaries to retrieve and steal MachineKey data.

Cybersecurity researcher Rakesh Krishnan said “three distinct Microsoft Edge invocations were identified” during forensic analysis of a SharePoint exploit. This includes Network Utility Process, Crashpad Handler, and GPU Process.

“Each serves a unique function within Chromium’s architecture, yet collectively reveals a strategy of behavioral mimicry and sandbox evasion,” Krishnan noted, while also calling attention to the web shell’s use of Google’s Client Update Protocol (CUP) to “blend malicious traffic with benign update checks.”

To mitigate the risk posed by the threat, it’s essential that users apply the latest update for SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016, rotate SharePoint server ASP.NET machine keys, restart Internet Information Services (IIS), and deploy Microsoft Defender for Endpoint or equivalent solutions.

It’s also recommended to integrate and enable Antimalware Scan Interface (AMSI) and Microsoft Defender Antivirus (or similar solutions) for all on-premises SharePoint deployments and configure AMSI to enable Full Mode.

“Additional actors may use these exploits to target unpatched on-premises SharePoint systems, further emphasizing the need for organizations to implement mitigations and security updates immediately,” Microsoft said.

While the confirmation from Microsoft is the latest hacking campaign linked to China, it is also the second time Beijing-aligned threat actors have targeted the Windows maker. In March 2021, the adversarial collective tracked as Silk Typhoon (aka Hafnium) was tied to a mass-exploitation activity that leveraged multiple then-zero-days in Exchange Server.

Earlier this month, a 33-year-old Chinese national, Xu Zewei, was arrested in Italy and charged with carrying out cyber attacks against American organizations and government agencies by weaponizing the Microsoft Exchange Server flaws, which came to be known as ProxyLogon.

Mexican organizations are still being targeted by threat actors to deliver a modified version of AllaKore RAT and SystemBC as part of a long-running campaign.

The activity has been attributed by Arctic Wolf Labs to a financially motivated hacking group called Greedy Sponge. It’s believed to be active since early 2021, indiscriminately targeting a wide range of sectors, such as retail, agriculture, public sector, entertainment, manufacturing, transportation, commercial services, capital goods, and banking.

“The AllaKore RAT payload has been heavily modified to enable the threat actors to send select banking credentials and unique authentication information back to their command-and-control (C2) server, for the purpose of conducting financial fraud,” the cybersecurity company said in an analysis published last week.

Details of the campaign were first documented by the BlackBerry Research and Intelligence Team (which is now part of Arctic Wolf) in January 2024, with the attacks employing phishing or drive-by compromises to distribute booby-trapped ZIP archives that ultimately facilitate the deployment of AllaKore RAT.

Attack chains analyzed by Arctic Wolf show that the remote access trojan is designed to optionally deliver secondary payloads like SystemBC, a C-based malware that turns compromised Windows hosts into SOCKS5 proxies to allow attackers to communicate with their C2 servers.

Besides dropping potent proxy tools, Greedy Sponge has also refined and updated its tradecraft to incorporate improved geofencing measures as of mid-2024 in an attempt to thwart analysis.

“Historically, geofencing to the Mexican region took place in the first stage, via a .NET downloader included in the trojanized Microsoft software installer (MSI) file,” the company said. “This has now been moved server-side to restrict access to the final payload.”

The latest iteration sticks to the same approach as before, distributing ZIP files (“Actualiza_Policy_v01.zip”) containing a legitimate Chrome proxy executable and a trojanized MSI file that’s engineered to drop AllaKore RAT, a malware with capabilities for keylogging, screenshot capture, file download/upload, and remote control.

The MSI file is configured to deploy a .NET downloader, which is responsible for retrieving and launching the remote access trojan from an external server (“manzisuape[.]com/amw”), and a PowerShell script for cleanup actions.

This is not the first time AllaKore RAT has been used in attacks targeting Latin America. In May 2024, HarfangLab and Cisco Talos revealed that an AllaKore variant known as AllaSenha (aka CarnavalHeist) has been used to single out Brazilian banking institutions by threat actors from the country.

“Having spent those four years-plus actively targeting Mexican entities, we would deem this threat actor persistent, but not particularly advanced,” Arctic Wolf said. “The strictly financial motivation of this actor coupled with their limited geographic targeting is highly distinctive.”

“Additionally, their operational longevity points to probable operational success – meaning they’ve found something that works for them, and they are sticking with it. Greedy Sponge has held the same infrastructure models for the duration of their campaigns.”

Attack Flow of Campaign Using Ghost Crypt

The development comes as eSentire detailed a May 2025 phishing campaign that employed a new crypter-as-a-service offering known as Ghost Crypt to deliver and run PureRAT.

“Initial access was gained through social engineering, where the threat actor impersonated a new client and sent a PDF containing a link to a Zoho WorkDrive folder containing malicious zip files,” the Canadian company noted. “The attacker also created a sense of urgency by calling the victim and requesting that they extract and execute the file immediately.”

Further examination of the attack chain has revealed that the malicious file contains a DLL payload that’s encrypted with Ghost Crypt, which then extracts and injects the trojan (i.e., the DLL) into a legitimate Windows csc.exe process using a technique called process hypnosis injection.

Ghost Crypt, which was first advertised by an eponymous threat actor on cybercrime forums on April 15, 2025, offers the ability to bypass Microsoft Defender Antivirus, and serve several stealers, loaders, and trojans like Lumma, Rhadmanthys, StealC, BlueLoader, PureLoader, DCRat, and XWorm, among others.

The discovery also follows the emergence of a new version of Neptune RAT (aka MasonRAT) that’s distributed via JavaScript file lures, allowing the threat actors to extract sensitive data, take screenshots, log keystrokes, drop clipper malware, and download additional DLL payloads.

In recent months, cyber attacks have employed malicious Inno Setup installers that serve as a conduit for Hijack Loader (aka IDAT Loader), which then delivers the RedLine information stealer.

The attack “leverages Inno Setup’s Pascal scripting capabilities to retrieve and execute the next-stage payload in a compromised or targeted host,” the Splunk Threat Research Team said. “This technique closely resembles the approach used by a well-known malicious Inno Setup loader called D3F@ck Loader, which follows a similar infection pattern.”

Jul 22, 2025Ravie LakshmananNetwork Security / Vulnerability

Cisco on Monday updated its advisory of a set of recently disclosed security flaws in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to acknowledge active exploitation.

“In July 2025, the Cisco PSIRT [Product Security Incident Response Team], became aware of attempted exploitation of some of these vulnerabilities in the wild,” the company said in an alert.

The network equipment vendor did not disclose which vulnerabilities have been weaponized in real-world attacks, the identity of the threat actors exploiting them, or the scale of the activity.

Cisco ISE plays a central role in network access control, managing which users and devices are allowed onto corporate networks and under what conditions. A compromise at this layer could give attackers unrestricted access to internal systems, bypassing authentication controls and logging mechanisms—turning a policy engine into an open door.

The vulnerabilities outlined in the alert are all critical-rated bugs (CVSS scores: 10.0) that could allow an unauthenticated, remote attacker to issue commands on the underlying operating system as the root user –

• CVE-2025-20281 and CVE-2025-20337 – Multiple vulnerabilities in a specific API that could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying operating system as root
• CVE-2025-20282 – A vulnerability in an internal API that could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device and then execute those files on the underlying operating system as root

While the first two flaws are the result of insufficient validation of user-supplied input, the latter stems from a lack of file validation checks that would prevent uploaded files from being placed in privileged directories on an affected system.

As a result, an attacker could leverage these shortcomings by submitting a crafted API request (for CVE-2025-20281 and CVE-2025-20337) or uploading a crafted file to the affected device (for CVE-2025-20282).

In light of active exploitation, it’s essential that customers upgrade to a fixed software release as soon as possible to remediate these vulnerabilities. These flaws are exploitable remotely without authentication, placing unpatched systems at high risk of pre-auth remote code execution—a top-tier concern for defenders managing critical infrastructure or compliance-driven environments.

Security teams should also review system logs for suspicious API activity or unauthorized file uploads, especially in externally exposed deployments.