Category: Cybersecurity

By 2025, Zero Trust has evolved from a conceptual framework into an essential pillar of modern security. No longer merely theoretical, it’s now a requirement that organizations must adopt. A robust, defensible architecture built on Zero Trust principles does more than satisfy baseline regulatory mandates. It underpins cyber resilience, secures third-party partnerships, and ensures uninterrupted business operations. In turn, more than 80% of organizations plan to implement Zero Trust strategies by 2026, according to a recent Zscaler report.

In the context of Zero Trust, artificial intelligence (AI) can assist greatly as a tool for implementing automation around adaptive trust and continuous risk evaluation. In a Zero Trust architecture, access decisions must adapt continuously to changing factors such as device posture, user behavior, location, workload sensitivity, and more. This constant evaluation generates massive volumes of data, far beyond what human teams can process alone.

AI is key to managing that scale, playing a critical role across all five of CISA’s Zero Trust pillars—identity, devices, networks, applications, and data. By filtering signal from noise, AI can help detect intrusions, identify malware, and apply behavioral analytics to flag anomalies that would be nearly impossible to catch manually. For example, if a user suddenly downloads sensitive files at 2 a.m. from an unusual location, AI models trained on behavioral baselines can flag the event, assess the risk, and trigger actions like reauthentication or session termination. This enables adaptive trust: access that adjusts in real time based on risk, supported by automation so the system can respond immediately without waiting on human intervention.

Predictive vs. Generative AI: Different Tools, Different Purposes

There are two primary categories of AI relevant to Zero Trust: predictive models and generative models. Predictive AI, including machine learning and deep learning, is trained on historical data to identify patterns, behaviors, and early indicators of compromise. These models power detection and prevention systems—such as EDRs, intrusion detection platforms, and behavioral analytics engines—that help catch threats early in the attack chain. When it comes to Zero Trust, predictive AI supports the control plane by feeding real-time signals into dynamic policy enforcement. It enables continuous evaluation of access requests by scoring context: is the device compliant? Is the login location unusual? Is the behavior consistent with baseline activity?

Generative AI, such as large language models like ChatGPT and Gemini, serves a different purpose. These systems are not predictive and don’t enforce controls. Instead, they support human operators by summarizing information, generating queries, accelerating scripting, and providing faster access to relevant context. In high-tempo security environments, this functionality helps reduce friction and allows analysts to triage and investigate more efficiently.

Agentic AI takes large language models beyond support roles into active participants in security workflows. By wrapping an LLM in a lightweight “agent” that can call APIs, execute scripts, and adapt its behavior based on real-time feedback, you gain a self-driving automation layer that orchestrates complex Zero Trust tasks end to end. For example, an agentic AI could automatically gather identity context, adjust network micro-segmentation policies, spin up temporary access workflows, and then revoke privileges once a risk threshold is cleared, all without manual intervention. This evolution not only accelerates response times, but also ensures consistency and scalability, letting your team focus on strategic threat hunting while routine enforcement and remediation happen reliably in the background.

These approaches all have a place in a Zero Trust model. Predictive AI enhances automated enforcement by driving real-time risk scoring. Generative AI enables defenders to move faster and make better-informed decisions, especially in time-sensitive or high-volume scenarios. Agentic AI brings orchestration and end-to-end automation into the mix, letting you automatically adjust policies, remediate risks, and revoke privileges without manual intervention. The strength of a Zero Trust architecture lies in applying it where it fits best.

Human-Machine Teaming: Working in Tandem

Despite their growing roles, AI models alone can’t serve as the sole “brain” of a Zero Trust architecture. Predictive AI, generative AI, and agentic AI each act more like specialized co-pilot analysts—surfacing patterns, summarizing context, or orchestrating workflows based on real-time signals. True Zero Trust still relies on human-defined policy logic, rigorous system-level design, and ongoing oversight to ensure that automated actions align with your security objectives.

That’s especially important because AI is not immune to manipulation. The SANS Critical AI Security Guidelines outline risks, including model poisoning, inference tampering, and vector database manipulation—all of which can be used to subvert Zero Trust enforcement if the AI system is blindly trusted. This is why our SANS SEC530 Defensible Security Architecture & Engineering: Implementing Zero Trust for the Hybrid Enterprise course emphasizes the concept of human-machine teaming. AI automates data analysis and response recommendations, but humans must set boundaries and validate those outputs within the broader security architecture. Whether that means writing tighter enforcement rules or segmenting access to model outputs, the control stays with the operator.

This model of collaboration is increasingly being recognized as the most sustainable way forward. Machines can outpace humans when it comes to processing volume, but they may lack certain business context, creativity, and ethical reasoning that only humans bring. Practitioners – “all-around defenders”, as I like to call them – remain essential not just for incident response, but for designing resilient enforcement strategies, interpreting ambiguous scenarios, and making the judgment calls that machines can’t. The future of Zero Trust isn’t AI replacing human. It’s AI amplifying the human, surfacing actionable insight, accelerating investigation, and scaling enforcement decisions without removing human control.

Ready for More Insight?

For a deeper dive on AI’s role in Zero Trust, SANS Certified Instructor Josh Johnson will be teaching SEC530 at our SANS DC Metro Fall 2025 live training event (Sept. 29-Oct. 4, 2025) in Rockville, MD. The event cultivates a dynamic learning environment that features industry-leading hands-on labs, simulations, and exercises, all geared towards practical application.

Register for SANS DC Metro Fall 2025 here.

Note: This article was written and contributed by Ismael Valenzuela, SANS Senior Instructor and Vice President of Threat Research and Intelligence at Arctic Wolf.

Even in well-secured environments, attackers are getting in—not with flashy exploits, but by quietly taking advantage of weak settings, outdated encryption, and trusted tools left unprotected.

These attacks don’t depend on zero-days. They work by staying unnoticed—slipping through the cracks in what we monitor and what we assume is safe. What once looked suspicious now blends in, thanks to modular techniques and automation that copy normal behavior.

The real concern? Control isn’t just being challenged—it’s being quietly taken. This week’s updates highlight how default settings, blurred trust boundaries, and exposed infrastructure are turning everyday systems into entry points.

⚡ Threat of the Week

Critical SharePoint Zero-Day Actively Exploited (Patch Released Today) — Microsoft has released fixes to address two security flaws in SharePoint Server that have come under active exploitation in the wild to breach dozens of organizations across the world. Details of exploitation emerged over the weekend, prompting Microsoft to issue an advisory for CVE-2025-53770 and CVE-2025-53771, which are now assessed to be patch bypasses for two other SharePoint flaws tracked as CVE-2025-49704 and CVE-2025-49706, an exploit chain dubbed ToolShell that could be leveraged to achieve remote code execution on on-premises SharePoint servers. The two vulnerabilities were addressed by Microsoft earlier this month as part of its Patch Tuesday update. It’s currently not known who is behind the mass-exploitation activity.

• Google Ships Patch for Actively Exploited Chrome Flaw — Google out patches to resolve a high-severity vulnerability in Chrome browser (CVE-2025-6558) that has come under active exploitation in the wild, making it the fifth zero-day to be either actively abused or demonstrated as a proof-of-concept (PoC) since the start of the year. The vulnerability is an incorrect validation of untrusted input in the browser’s ANGLE and GPU components that could allow an attacker to potentially perform a sandbox escape via a crafted HTML page. The issue has been addressed in versions 138.0.7204.157/.158 for Windows and Apple macOS, and 138.0.7204.157 for Linux.
• Critical NVIDIA Container Toolkit Flaw Disclosed — A critical vulnerability in NVIDIA Container Toolkit (CVE-2025-23266) could be exploited to achieve code execution with elevated permissions. “A successful exploit of this vulnerability might lead to escalation of privileges, data tampering, information disclosure, and denial-of-service,” the GPU maker said. Wiz, which disclosed the flaw, said the shortcoming could be trivially exploited to access, steal, or manipulate the sensitive data and proprietary models of all other customers running on the same shared hardware by means of a three-line exploit.
• New CrushFTP Bug Comes Under Attack — CrushFTP revealed that a critical flaw in its file transfer software (CVE-2025-54309) has been exploited in the wild, with unknown threat actors reverse engineering its source code to discover the bug and target devices that are yet to be updated to the latest versions. The issue affects all versions of CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23. “The attack vector was HTTP(S) for how they could exploit the server,” CrushFTP said. “We had fixed a different issue related to AS2 in HTTP(S) not realizing that a prior bug could be used like this exploit was. Hackers apparently saw our code change, and figured out a way to exploit the prior bug.”
• Golden dMSA Attack in Windows Server 2025 Enables Cross-Domain Attacks — Cybersecurity researchers disclosed a “critical design flaw” in delegated Managed Service Accounts (dMSAs) introduced in Windows Server 2025 that could enable cross-domain lateral movement and persistent access to all managed service accounts and their resources across Active Directory indefinitely. “The attack leverages a critical design flaw: A structure that’s used for the password-generation computation contains predictable time-based components with only 1,024 possible combinations, making brute-force password generation computationally trivial,” Semperis researcher Adi Malyanker said.
• Google Big Sleep AI Agent Flags Critical SQLite Flaw Before Exploitation — Big Sleep, an artificial intelligence (AI) agent launched by Google last year as a collaboration between DeepMind and Google Project Zero, facilitated the discovery of a critical security flaw in SQLite (CVE-2025-6965) that was previously only known to attackers as a zero-day and was on the verge of exploitation. Google described it as the first time an AI agent has been used to “directly foil efforts to exploit a vulnerability in the wild.”
• Threat Actors Target EoL SonicWall SMA 100 Devices — Unknown intruders codenamed UNC6148 are targeting fully patched end-of-life SonicWall Secure Mobile Access (SMA) 100 series appliances and deploying a novel, persistent backdoor and rootkit called OVERWATCH. Many key details about the campaign are currently unknown. For starters, Google said it does not have enough data to determine where the threat actors are based, or what their motives are. Second, the attacks are exploiting leaked local administrator credentials on the targeted devices for initial access. But it has been unable to pinpoint how the attackers managed to obtain the credentials used in the attack. While it’s possible that they were sourced from infostealer logs or credential marketplaces, the company noted it’s more likely that the attackers leveraged a known vulnerability. It’s also unclear precisely what the attackers are trying to accomplish after they take control of a device. The lack of information largely stems from how OVERWATCH functions, which allows the attackers to selectively remove log entries to hinder forensic investigation. The investigation also found that UNC6148 also managed to deploy a reverse shell on infected devices, something that should not normally be possible, leading to speculations that a zero-day might have been in play. The findings once again show network appliances are popular attacker targets, as they offer a way to gain access to high-value networks.

‎️‍🔥 Trending CVEs

Hackers are quick to jump on newly discovered software flaws – sometimes within hours. Whether it’s a missed update or a hidden bug, even one unpatched CVE can open the door to serious damage. Below are this week’s high-risk vulnerabilities making waves. Review the list, patch fast, and stay a step ahead.

This week’s list includes — CVE-2025-53770, CVE-2025-53771 (Microsoft SharePoint Server), CVE-2025-37103 (HPE Instant On Access Points), CVE-2025-54309 (CrushFTP), CVE-2025-23266, CVE-2025-23267 (NVIDIA Container Toolkit), CVE-2025-20337 (Cisco Identity Services Engine and ISE Passive Identity Connector), CVE-2025-6558 (Google Chrome), CVE-2025-6965 (SQLite), CVE-2025-5333 (Broadcom Symantec Endpoint Management Suite), CVE-2025-6965 (SQLite), CVE-2025-48384 (Git CLI), CVE-2025-4919 (Mozilla Firefox), CVE-2025-53833 (LaRecipe), CVE-2025-53506 (Apache Tomcat), CVE-2025-41236 (Broadcom VMware ESXi, Workstation, and Fusion), CVE-2025-27210, CVE-2025-27209 (Node.js), CVE-2025-53906 (Vim), CVE-2025-50067 (Oracle Application Express), CVE-2025-30751 (Oracle Database), CVE-2025-6230, CVE-2025-6231, CVE-2025-6232 (Lenovo Vantage), CVE-2024-13972, CVE-2025-7433, CVE-2025-7472 (Sophos Intercept X for Windows), CVE-2025-27212 (Ubiquiti UniFi Access), CVE-2025-4657 (Lenovo Protection Driver), CVE-2025-2500 (Hitachi Energy Asset Suite), CVE-2025-6023, CVE-2025-6197 (Grafana), CVE-2025-40776, CVE-2025-40777 (BIND 9), CVE-2025-33043, CVE-2025-2884, CVE-2025-3052 (Gigabyte), and CVE-2025-31019 (Password Policy Manager plugin).

📰 Around the Cyber World

• Russian Sentenced to 3 Years in Prison in the Netherlands for Sharing Data — A Rotterdam court sentenced a 43-year-old Russian to three years in prison for breaching international sanctions by sharing sensitive ASML information from Dutch semiconductor chip machine maker ASML and NXP with a person in Russia. At his trial on June 26, the suspect admitted to copying files last year and sending them to a person in Russia using the Signal messaging app. While the name of the defendant was not disclosed, Reuters reported in February 2025 that the perpetrator was German Aksenov, and that he had contact with Russia’s FSB intelligence service. He was charged with IP theft and sanctions violations in December 2024.
• U.K. NCSC Launches Vulnerability Research Initiative — The U.K. National Cyber Security Centre (NCSC) announced a new Vulnerability Research Initiative (VRI) that aims to strengthen relations with external cybersecurity experts. “The VRI’s mission is to strengthen the UK’s ability to carry out VR,” the NCSC said. “We work with the best external vulnerability researchers to deliver a deep understanding of security on a wide range of  technologies we care about.​ The external VRI community also supports us in having tools and tradecraft for vulnerability discovery.”
• Storm-1516 Spreads Disinformation in Europe — A Kremlin-linked disinformation group tracked as Storm-1516 has been masquerading as real journalists and publishing fake articles on spoofed news websites to spread false narratives in France, Armenia, Germany, Moldova, and Norway. The threat actors used the names and photos of legitimate reporters to lend credibility to the bogus articles, per the Gnida Project. Another pro-Russia disinformation campaign known as Operation Overload (aka Matryoshka or Storm-1679) has been observed leveraging consumer-grade artificial intelligence tools to fuel a “content explosion” focused around exacerbating existing tensions around global elections, Ukraine, and immigration, among other controversial issues. The activity, operating since 2023, has a track record of disseminating false narratives by impersonating media outlets with the apparent aim of sowing discord in democratic countries. “This marks a shift toward more scalable, multilingual, and increasingly sophisticated propaganda tactics,” Reset Tech and Check First said. “The campaign has substantially amped up the production of new content in the past eight months, signalling a shift toward faster, more scalable content creation methods.” Some of the images used in the campaign are believed to have been generated using Flux AI, a text-to-image generator developed by Black Forest Labs. The company told WIRED that it has built “multiple layers of safeguards” to prevent abuse and that it’s committed to working with social media platforms and authorities to ward off unlawful misuse.
• SLOW#TEMPEST Campaign’s Evolving Techniques Detailed — The threat actors behind a malware campaign called SLOW#TEMPEST have been observed using DLL-sideloading techniques to launch a malicious DLL, while relying on Control Flow Graph (CFG) obfuscation and dynamic function calls to conceal the code in the loader DLL. The primary goal of the DLL is to unpack and launch an embedded payload directly in memory only if the target machine has at least 6 GB of RAM. “The SLOW#TEMPEST campaign’s evolution highlights malware obfuscation techniques, specifically dynamic jumps and obfuscated function calls,” Palo Alto Networks Unit 42 said. “The success of the SLOW#TEMPEST campaign using these techniques demonstrates the potential impact of advanced obfuscation on organizations, making detection and mitigation significantly more challenging.”
• Abacus Market Shutters After Likely Exit Scam — The darknet marketplace known as Abacus Market has suddenly closed its operations, rendering all its infrastructure, including its clearnet mirror, inaccessible. The development comes after Abacus Market users began reporting withdrawal issues in late June 2025. Blockchain intelligence firm TRM Labs said the marketplace’s creators may have possibly pulled off an exit scam and disappeared with users’ funds, although the possibility of a law enforcement seizure hasn’t been ruled out. Abacus’s exit follows the June 16, 2025, seizure of Archetyp Market by Europol. Abacus Market launched in September 2021 as Alphabet Market, before it rebranded to its current name two months later. The marketplace is estimated to have generated anywhere between $300 million and $400 million in cryptocurrency sales, spanning illicit drugs, counterfeit items, and stolen cards. ​​According to data from Chainlysis, Abacus Market’s revenue has increased significantly, growing by 183.2% YoY in 2024.
• MITRE Announces AADAPT for Cryptocurrency Security — The MITRE Corporation launched Adversarial Actions in Digital Asset Payment Technologies, aka AADAPT, a cybersecurity framework for addressing vulnerabilities in digital financial systems such as cryptocurrency. It’s modeled after the MITRE ATT&CK framework. “AADAPT provides developers, policymakers, and financial organizations with a structured methodology for identifying, analyzing, and mitigating potential risks associated with digital asset payments,” MITRE said. “By using insights derived from real-world attacks as cited by more than 150 sources from government, industry, and academia, the AADAPT framework identifies adversarial tactics, techniques, and procedures linked to digital asset payment technologies, including consensus algorithms and smart contracts.”
• U.S. Ex-Army soldier Pleads Guilty to Hacking 10 Telcos — Former U.S. Army soldier Cameron John Wagenius (aka kiberphant0m and cyb3rph4nt0m) pleaded guilty to hacking and extorting at least 10 telecommunications companies between April 2023 and December 2024. The 21-year-old “conspired with others to defraud at least 10 victim organizations by obtaining login credentials for the organizations’ protected computer networks,” the U.S. Department of Justice (DoJ) said. “The conspirators obtained these credentials using a hacking tool that they called SSH Brute, among other means. They used Telegram group chats to transfer stolen credentials and discuss gaining unauthorized access to victim companies’ networks.” The threat actors behind the scheme then extorted the victim organizations both privately and on cybercrime forums such as BreachForums and XSS.is by offering to sell the stolen data for thousands of dollars. Some of the data was eventually sold and used to perpetuate other frauds, including SIM-swapping. Wagenius et al are said to have attempted to extort at least $1 million from victim data owners. The attacks took place while Wagenius was on active duty, the DoJ said. Court documents show that the defendant Googled for phrases like “can hacking be treason” and “U.S. military personnel defecting to Russia.” In February 2025, Wagenius pleaded guilty to conspiracy to commit wire fraud, extortion in relation to computer fraud, aggravated identity theft, and unlawful transfer of confidential phone records information. He is scheduled for sentencing on October 6, 2025. His alleged co-conspirators, Connor Moucka and John Binns, were indicted in November 2024.
• Signed Drivers in Malicious Campaigns — Since 2020, no less than 620 signed drivers, 80 certificates, and 60 Windows Hardware Compatibility Program (WHCP) accounts have been associated with threat actor campaigns. The majority of drivers have been signed by 131 Chinese companies. In 2022 alone, over 250 drivers and roughly 34 certificates and WHCP accounts were identified as potentially compromised. The findings show that “kernel-level attacks remain highly attractive to threat actors despite Microsoft’s improved defenses, due to the highest level of privileges on the compromised system and control they offer to attackers,” Group-IB said, adding it found overlap in the signing infrastructure across different malware campaigns, such as those using POORTRY and RedDriver. Some of the notable malware strains using kernel loaders for added stealth include Festi, FiveSys, FK_Undead, and BlackMoon. “Attackers leverage many signing certificates and WHCP accounts by exploiting legitimate processes like the WHCP and Extended Validation (EV) certificates. This includes those belonging to compromised or fraudulently registered organizations, signing malicious drivers, bypassing established security measures, and exploiting the trust model inherent in signed kernel drivers,” the company noted.
• TeleMessage SGNL Flaw Seeing Exploitation Activity — Threat actors are actively attempting to exploit a security flaw in TeleMessage SGNL, an enterprise messaging system modeled after Signal, used by government agencies and enterprises alike to achieve secure communications. The vulnerability, CVE-2025-48927, can be used to leak sensitive information, including plaintext usernames, passwords, and other data. According to GreyNoise, exploitation efforts are coming from 25 IP addresses over the past 30 days. The majority of the IP addresses are from France, followed by Singapore, Germany, Hong Kong, and India. The attacks target the United States, Singapore, India, Mexico, and Brazil.
• Microsoft Stops Relying on Chinese Engineers for Defense Cloud Support — Microsoft changed its practices to ensure that engineers in China no longer provide technical support to U.S. defense clients using the company’s Azure cloud services. The revamps came after a ProPublica investigation revealed that Microsoft has been using Chinese engineers to help maintain U.S. Department of Defense systems, potentially exposing sensitive data to the Chinese government. “In response to concerns raised earlier this week about US-supervised foreign engineers, Microsoft has made changes to our support for US Government customers to assure that no China-based engineering teams are providing technical assistance for DoD Government cloud and related services,” the company said.
• Japan Authorities Release Free Phobos and 8Base Decryptor — Japan’s National Police Agency published a free decryption tool and a guide in English for organizations impacted by the Phobos and 8Base ransomware attacks. Earlier this February, two Russian nationals accused of using the Phobos ransomware to attack more than 1,000 entities were charged as part of a global law enforcement takedown. Phobos launched in December 2018, with a modified version called 8Base gaining prominence in 2023.
• Android Allows Gemini Access Third-Party Apps — Google has implemented a change that will allow its Gemini artificial intelligence (AI) chatbot to interact with other apps installed on Android devices, such as Phone, Messages, and others, even if users have turned off “Gemini Apps Activity.” According to a support document from the company, “Even when Gemini Apps Activity is off, your conversations will be saved with your account for up to 72 hours. This lets Google provide the service and process any feedback. This activity won’t appear in your Gemini Apps Activity.” The update went into effect this month.
• EvilPanel Phishing Toolkit Detailed — Cybersecurity researchers have discovered a new phishing toolkit called EvilPanel that’s built on Evilginx and provides a web interface for launching multi-factor authentication (MFA)-bypassing attacks. “EvilPanel wraps all of Evilginx’s powerful AiTM capabilities into a sleek, user-friendly web interface, eliminating the need for manual configuration and lowering the barrier to entry for would-be attackers,” Abnormal AI said. “EvilPanel’s core phishing functionality follows the Evilginx model – i.e., it maintains the login flow by acting as a transparent proxy.”
• Katz Stealer and Octalyn Stealer Detailed — Cybersecurity company SentinelOne is warning that threat actors are increasingly adopting an information stealer called Katz Stealer owing to its “robust credential and data discovery with theft capabilities as well as modern evasion and anti-analysis features.” It described the stealer as a “combination of credential theft and modern malware design.” Offered under a Malware-as-a-Service (MaaS) model for a mere $50 per month (or $360 for a whole year), stealers such as Katz are turnkey tools that lower the barrier to entry for pulling off malicious attacks. A notable feature of Katz Stealer is its ability to defeat Chromium’s app-bound encryption to gain access to and extract credentials and cookies. “Katz Stealer is not a ‘one shot’ infostealer; it is designed to continually exfiltrate the victim’s data,” SentinelOne said. “The malware not only extracts data found on a targeted system at the point of infection but also as data updated, changed, or freshly introduced.” Another new stealer masquerades as an educational tool called Octalyn Forensic Toolkit, but acts as a credential stealer, harvesting browser data, Discord and Telegram tokens, VPN configurations, gaming accounts, and cryptocurrency wallet artifacts. “Its modular C++ payload, Delphi-based builder, Telegram-based C2, and secondary payload delivery capability make it a potent tool for threat actors,” CYFIRMA said. “The use of obfuscation, Windows persistence techniques, and structured data theft highlights a deliberate effort to evade detection and maximize impact.”
• Armenia Passes Use of Facial Recognition Technology by Police — Armenia’s parliament has passed controversial amendments to the country’s Law on Police, granting the Ministry of Internal Affairs access to a nationwide network of real-time surveillance cameras that are equipped with facial recognition technology. The cameras will operate across state and municipal buildings, public transport, airports, and parking areas. The law is set to take effect on August 9, 2025. The CSO Meter said the law “lacks clear legal safeguards, public oversight, and proper regulation of artificial intelligence (AI) technologies,” posing a risk to citizens’ privacy.
• Scammers Using MaisonReceipts to Create Fake Receipts — Fraudsters are using tools like MaisonReceipts to generate counterfeit receipts for over 21 well-known retail brands in multiple currencies (USD, EUR, GBP). They are used by groups that resell counterfeit or stolen items, presenting them as authentic using bogus receipts. “The service is marketed through subscription-based websites, social media accounts, and encrypted messaging platforms, with features that make the fraudulent receipts appear convincing enough to deceive consumers and online marketplaces,” Group-IB said.
• PyPI Blocks inbox.ru Email Domain — A recent spam campaign against PyPI has prompted the maintainers of the Python Package Index (PyPI) repository to ban the use of the “inbox.ru” email domain during new registrations as well as adding extra email addresses. “The campaign created over 250 new user accounts, publishing over 1,500 new projects on PyPI, leading to end-user confusion, abuse of resources, and potential security issues,” PyPI said. “All relevant projects have been removed from PyPI, and accounts have been disabled.”
• Silver Fox Actor Creates Fake Websites for Malware Delivery — The threat actor known as Silver Fox, which is known for targeting Chinese-speaking individuals and entities, has created over 2,800 domains since June 2023, with 266 of the over 850 identified domains since December 2024 actively distributing malware. These fake websites act as a delivery vector for Windows-specific malware and masquerade as application download sites and software update prompts. “The consistent operational timing across all hours with high influxes during Chinese working hours, in addition to other factors, suggests a combination of automated and likely human-driven approach to their activities,” DomainTools said.
• Arrested Scattered Spider Members Released on Bail — A British court has released four members of the Scattered Spider group on bail. They were arrested last week on suspicion of Computer Misuse Act offenses, blackmail, money laundering, and participating in the activities of an organized crime group. They’ve been charged with hacking U.K. retailers Marks & Spencer, Co-op, and Harrods.
• Armenian National Charged with Ryuk Ransomware Attacks — An Armenian man extradited from Ukraine to the United States has been charged over his alleged role in Ryuk ransomware attacks between March 2019 and September 2020. Karen Serobovich Vardanyan was arrested in Kyiv in April, and was extradited to the United States on June 18. Vardanyan has been charged with conspiracy, fraud in connection with computers, and extortion in connection with computers. He has been charged alongside Levon Georgiyovych Avetisyan, 45, who is also an Armenian national facing the same charges. He is currently detained in France and is expected to be extradited as well. Vardanyan and his accomplices received about 1,610 bitcoins from victims, valued at more than $15 million at the time of payment. Two Ukrainians — 53-year-olds Oleg Nikolayevich Lyulyava and Andrii Leonydovich Prykhodchenko — were also charged in connection with Ryuk activity but remain at large.
• $2.17B Stolen from Crypto Services in 2025 — Hackers and scammers have stolen over $2.17 billion in crypto assets in the first half of this year, with North Korea’s $1.5 billion hack of Bybit accounting for the majority of the assets. Data from TRM Labs shows that $2.1 billion was stolen across at least 75 distinct hacks and exploits. A total of $801,315,669 was lost across 144 incidents in Q2 2025, per CertiK. Wallet compromise emerged as the most costly attack vector in H1 2025, with $1,706,937,700 stolen across 34 incidents. “So far in 2025, significant concentrations of stolen fund victims have emerged in the U.S., Germany, Russia, Canada, Japan, Indonesia, and South Korea,” Chainalysis said. “Personal wallet compromises make up a growing share of total ecosystem value stolen over time.”

• Japan Targeted by North Korea and China in 2024 — Japanese organizations have been targeted by North Korean threat actors to distribute malware families like BeaverTail, InvisibleFerret, and RokRAT, as well as by Chinese hacking groups such as Mustang Panda, Stone Panda, MirrorFace, Teleboyi, and UNC5221. The China-linked attacks led to the deployment of backdoors and trojans like ANEL and PlugX, Macnica said.
• Rainbow Hyena Goes After Russian Firms — The threat actor known as Rainbow Hyena targeted Russian healthcare and IT organizations using phishing emails containing malicious attachments to distribute a C++-based custom backdoor called PhantomRemote. “The backdoor collects information about the compromised system, loads other executables from the C2 server, and runs commands via the cmd.exe interpreter,” BI.ZONE said.
• Migration to Post-Quantum Cryptography is Uneven — About 6% of all 186 million SSH servers on the internet already use quantum-safe encryption, according to a new report from Forescout Research – Vedere Labs. “Three quarters of OpenSSH versions on the internet still run versions released between 2015 and 2022 that do not support quantum-safe encryption,” the company said. “If regulators mandate quantum-safe encryption in the near future, organizations will face serious gaps. Outdated infrastructure will become a compliance and security risk.”
• Brazilian Police Arrest IT Worker for $100 Million Cyber Theft — Authorities in Brazil arrested a suspect in connection with a cyber attack that diverted more than $100 million from the country’s banking systems. Per a report from Associated Press, the suspect has been identified as João Roque, an IT employee of a software company named C&M and he allegedly helped unknown threat actors gain unauthorized access to Brazil’s instant payment system, known as PIX, by selling his credentials to them earlier this year for about $2,700 in two separate cash payments. Once the cybercriminals breached the company’s network, they carried out fraudulent PIX transactions. It’s believed that the losses could go up further, as the loss refers to just one financial institution that contracted with C&M.
• Italian Police Arrest Diskstation Ransomware Gang — Italian police have arrested a 44-year-old Romanian for carrying out cyber attacks against Italian companies as part of a law enforcement effort called Operation Elicius. The unidentified man is alleged to be the leader of the DiskStation Security ransomware group, which has targeted Synology network-attached storage (NAS) devices since 2021. He faces charges of unauthorized access to computer systems and extortion.
• Samsung Announces KEEP to Store Sensitive Data — Samsung announced a number of security and privacy updates to its Galaxy smartphones with One UI 8, including support for quantum-resistant Wi-Fi connections using ML‑KEM and a new architecture called Knox Enhanced Encrypted Protection (KEEP) that creates encrypted, app-specific storage environments for storing data. KEEP also integrates with Samsung’s Personal Data Engine (PDE) and Knox Vault, the company’s hardware security environment, to enable personalized artificial intelligence (AI) features by analyzing users’ data on-device.
• Cambodia Arrests Over 1,000 Amid Crackdown on Online Scams — Cambodian authorities have arrested more than 1,000 suspects linked to online scams in an effort to crack down on cybercrime operations in the country. Those detained included over 200 Vietnamese, 27 Chinese, and 75 suspects from Taiwan and 85 Cambodians in the capital Phnom Penh and the southern city of Sihanoukville. About 270 Indonesians, including 45 women, were arrested in Poipet. In a related development, Thai officials raided properties connected to a Cambodian senator and business tycoon, Kok An, in relation to a local network of cyber scam call centers.

🎥 Cybersecurity Webinars

• From Autofill to Alarm Bells: Securing Identity in the Age of AI — Logins got easier—but trust got harder. As AI reshapes digital identity, users are questioning how their data is used and who’s really behind the screen. In this session, discover how top brands are tackling AI-driven identity risks while rebuilding trust with smarter, privacy-first authentication strategies.
• How Attackers Hijack Your Dependencies—and What DevSecOps Teams Must Do Now — Your Python environment is under attack—quietly, and from within. In 2025, repo hijacks, poisoned packages, and typosquatting aren’t rare edge cases—they’re part of the threat landscape. This webinar shows developers and DevSecOps leaders how to lock down the Python supply chain before compromised dependencies take down your systems.
• Your AI Copilot May Be Letting Attackers In — Learn How to Lock Down the Identity Layer — AI copilots are boosting productivity—and attackers are using the same power to break your identity perimeter. From API abuse to synthetic logins, the identity layer is under siege. Join Okta to learn how to secure AI-powered workflows, detect AI-driven threats, and make identity your strongest line of defense in 2025.

🔧 Cybersecurity Tools

• OSINTMap — It is a lightweight tool that helps you quickly find and use popular OSINT resources. It organizes hundreds of investigation links—like people search, domain lookups, and breach checkers—into one easy-to-browse local dashboard. Ideal for anyone doing OSINT work, it saves time by keeping everything in one place.
• NortixMail — It is an open-source, self‑hosted disposable email server that makes burner addresses easy—without the usual email server headache. You can spin it up with Docker or manually, generate temporary email addresses on demand, and view messages via a clean web interface. Since it keeps messages locally and doesn’t rely on third-party services, it’s a great tool for testing, avoiding spam, or protecting your inbox during risky sign‑ups.

Disclaimer: These newly released tools are for educational use only and haven’t been fully audited. Use at your own risk—review the code, test safely, and apply proper safeguards.

🔒 Tip of the Week

Map Known Vulnerabilities Automatically Across Your Stack — Attackers often use Windows Scheduled Tasks to stay hidden on systems. Some go a step further by removing key registry values like SD (Security Descriptor) or Index, making their tasks invisible to common tools like Task Scheduler, schtasks, or even Autoruns. These hidden tasks still run in the background and can be used for persistence or malware delivery.

To check for visible tasks, tools like Autoruns (by Sysinternals) and TaskSchedulerView (by NirSoft) are great starting points. They show active tasks and let you spot unusual ones. But hidden tasks require deeper digging. You can use PowerShell to scan the registry path HKLMSOFTWAREMicrosoftWindows NTCurrentVersionScheduleTaskCacheTree and look for tasks with missing SD values.

For more advanced checks, use Sysmon to track changes in the TaskCache registry and ProcMon to monitor registry activity in real time. Look for suspicious task names, missing values, or tasks with an Index of 0. Also, set alerts for Event ID 4698, which logs new scheduled task creation.

In short: use both visual tools and registry checks to uncover hidden scheduled tasks. Regular scans, baseline comparisons, and basic alerting can help catch threats early—before they do damage.

Conclusion

What’s becoming clearer each week is that attacker sophistication isn’t the exception—it’s the baseline. AI-driven reconnaissance, credential abuse, and signal mimicry are no longer advanced—they’re routine.

And as coordination gaps persist across security teams, the boundary between low-level noise and high-impact intrusions continues to blur. The result isn’t just a faster compromise—it’s a deeper erosion of trust. If trust was once a strength, it’s now a surface that attackers exploit.

Jul 21, 2025Ravie LakshmananThreat Intelligence / Authentication

Cybersecurity researchers have disclosed a novel attack technique that allows threat actors to bypass Fast IDentity Online (FIDO) key protections by deceiving users into approving authentication requests from spoofed company login portals.

The activity, observed by Expel as part of a phishing campaign in the wild, has been attributed to a threat actor named PoisonSeed, which was recently flagged as leveraging compromised credentials associated with customer relationship management (CRM) tools and bulk email providers to send spam messages containing cryptocurrency seed phrases and drain victims’ digital wallets.

“The attacker does this by taking advantage of cross-device sign-in features available with FIDO keys,” researchers Ben Nahorney and Brandon Overstreet said. “However, the bad actors in this case are using this feature in adversary-in-the-middle (AitM) attacks.”

Cross-device sign-in allows users to sign-in on a device that does not have a passkey using a second device that does hold the cryptographic key, such as a mobile phone.

The attack chain documented by Expel commences with a phishing email that lures recipients to log into a fake sign-in page mimicking the enterprise’s Okta portal. Once the victims enter their credentials, the sign-in information is stealthily relayed by the bogus site to the real login page.

The phishing site then instructs the legitimate login page to use the hybrid transport method for authentication, which causes the page to serve a QR code that’s subsequently sent back to the phishing site and presented to the victim.

Should the user scan the QR code with the authenticator app on their mobile device, it allows the attackers to gain unauthorized access to the victim’s account.

“In the case of this attack, the bad actors have entered the correct username and password and requested cross-device sign-in,” Expel said.

“The login portal displays a QR code, which the phishing site immediately captures and relays back to the user on the fake site. The user scans it with their MFA authenticator, the login portal and the MFA authenticator communicate, and the attackers are in.”

What makes the attack noteworthy is that it bypasses protections offered by FIDO keys and enables threat actors to obtain access to users’ accounts. The compromise method does not exploit any flaw in the FIDO implementation. Rather, it abuses a legitimate feature to downgrade the authentication process.

While FIDO2 is designed to resist phishing, its cross-device login flow—known as hybrid transport—can be misused if proximity verification like Bluetooth is not enforced. In this flow, users can log in on a desktop by scanning a QR code with a mobile device that holds their passkey.

However, attackers can intercept and relay that QR code in real time via a phishing site, tricking users into approving the authentication on a spoofed domain. This turns a secure feature into a phishing loophole—not due to a protocol flaw, but due to its flexible implementation.

Expel also said it observed a separate incident where a threat actor enrolled their own FIDO key after compromising an account through a phishing email and resetting the user’s password.

If anything, the findings underscore the need for adopting phishing-resistant authentication at all steps in an account lifecycle, including during recovery phases, as using an authentication method that’s susceptible to phishing can undermine the entire identity infrastructure.

“AitM attacks against FIDO keys and attacker-controlled FIDO keys are just the latest in a long line of examples where bad actors and defenders up the ante in the fight to compromise/protect user accounts,” the researchers added.

Jul 21, 2025Ravie LakshmananWeb Security / Cryptocurrency

A new attack campaign has compromised more than 3,500 websites worldwide with JavaScript cryptocurrency miners, marking the return of browser-based cryptojacking attacks once popularized by the likes of CoinHive.

Although the service has since shuttered after browser makers took steps to ban miner-related apps and add-ons, researchers from the c/side said they found evidence of a stealthy miner packed within obfuscated JavaScript that assesses the computational power of a device and spawns background Web Workers to execute mining tasks in parallel without raising any alarm.

More importantly, the activity has been found to leverage WebSockets to fetch mining tasks from an external server, so as to dynamically adjust the mining intensity based on the device capabilities and accordingly throttle resource consumption to maintain stealth.

“This was a stealth miner, designed to avoid detection by staying below the radar of both users and security tools,” security researcher Himanshu Anand said.

The net result of this approach is that users would unknowingly mine cryptocurrency while browsing the compromised website, turning their computers into covert crypto generation machines without their knowledge or consent. Exactly how the websites are breached to facilitate in-browser mining is currently not known.

Further dissection has determined that over 3,500 websites have been ensnared in the sprawling illicit crypto mining effort, with the domain hosting the JavaScript miner also linked to Magecart credit card skimmers in the past, indicating attempts on the part of the attackers to diversify their payloads and revenue streams.

The use of the same domains to deliver both miner and credit/debit card exfiltration scripts indicates the ability of the threat actors to weaponize JavaScript and stage opportunistic attacks aimed at unsuspecting site visitors.

“Attackers now prioritize stealth over brute-force resource theft, using obfuscation, WebSockets, and infrastructure reuse to stay hidden,” c/side said. “The goal isn’t to drain devices instantly, it is to persistently siphon resources over time, like a digital vampire.”

The findings coincide with a Magecart skimming campaign targeting East Asian e-commerce websites using the OpenCart content management system (CMS) to inject a fake payment form during checkout and collect financial information, including bank details, from victims. The captured information is then exfiltrated to the attacker’s server.

In recent weeks, client-side and website-oriented attacks have been found to take different forms –

• Utilizing JavaScript embeds that abuse the callback parameter associated with a legitimate Google OAuth endpoint (“accounts.google[.]com/o/oauth2/revoke”) to redirect to an obfuscated JavaScript payload that creates a malicious WebSocket connection to an attacker-controlled domain
• Using Google Tag Manager (GTM) script directly injected into the WordPress database (i.e., wp_options and wp_posts tables) in order to load remote JavaScript that redirects visitors to over 200 sites to spam domains
• Compromising a WordPress site’s wp-settings.php file to include a malicious PHP script directly from a ZIP archive that connects to a command-and-control (C2) server and ultimately leverages the site’s search engine rankings to inject spammy content and boost their sketchy sites in search results
• Injecting malicious code into a WordPress site theme’s footer PHP script to server browser redirects
• Using a fake WordPress plugin named after the infected domain to evade detection and spring into action only when search engine crawlers are detected in order to serve spam content designed to manipulate search engine results
• Distributing backdoored versions of the WordPress plugin Gravity Forms (affecting only versions 2.9.11.1 and 2.9.12) through the official download page in a supply chain attack that contacts an external server to fetch additional payloads and adds an admin account that gives the attacker complete control of the website

“If installed, the malicious code modifications will block attempts to update the package and attempt to reach an external server to download additional payload,” RocketGenius, the team behind Gravity Forms, said.

“If it succeeds in executing this payload, it will then attempt to add an administrative account. That opens a back door to a range of other possible malicious actions, such as expanding remote access, additional unauthorized arbitrary code injections, manipulation of existing admin accounts, and access to stored WordPress data.”

Microsoft on Sunday released security patches for an actively exploited security flaw in SharePoint and also released details of another vulnerability that it said has been addressed with “more robust protections.”

The tech giant acknowledged it’s “aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update.”

CVE-2025-53770 (CVSS score: 9.8), as the exploited Vulnerability is tracked, concerns a case of remote code execution that arises due to the deserialization of untrusted data in on-premise versions of Microsoft SharePoint Server.

The newly disclosed shortcoming is a spoofing flaw in SharePoint (CVE-2025-53771, CVSS score: 6.3). An anonymous researcher has been credited with discovering and reporting the bug.

“Improper limitation of a pathname to a restricted directory (‘path traversal’) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network,” Microsoft said in an advisory released on July 20, 2025.

Microsoft also noted that CVE-2025-53770 and CVE-2025-53771 are related to two other SharePoint vulnerabilities documented by CVE-2025-49704 and CVE-2025-49706, which could be chained to achieve remote code execution. The exploit chain, referred to as ToolShell, was patched as part of the company’s July 2025 Patch Tuesday update.

“The update for CVE-2025-53770 includes more robust protections than the update for CVE-2025-49704,” the Windows maker said. “The update for CVE-2025-53771 includes more robust protections than the update for CVE-2025-49706.”

It’s worth noting that Microsoft previously characterized CVE-2025-53770 as a variant of CVE-2025-49706. When reached for comment about this discrepancy, a Microsoft spokesperson told The Hacker News that “it is prioritizing getting updates out to customers while also correcting any content inaccuracies as necessary.”

The company also said that the current published content is correct and that the previous inconsistency does not impact the company’s guidance for customers.

Both the identified flaws apply to on-premises SharePoint Servers only, and do not impact SharePoint Online in Microsoft 365. The issues have been addressed in the versions below (for now) –

To mitigate potential attacks, customers are recommended to –

• Use supported versions of on-premises SharePoint Server (SharePoint Server 2016, 2019, and SharePoint Subscription Edition)
• Apply the latest security updates
• Ensure the Antimalware Scan Interface (AMSI) is turned on and enable Full Mode for optimal protection, along with an appropriate antivirus solution such as Defender Antivirus
• Deploy Microsoft Defender for Endpoint protection, or equivalent threat solutions
• Rotate SharePoint Server ASP.NET machine keys

“After applying the latest security updates above or enabling AMSI, it is critical that customers rotate SharePoint server ASP.NET machine keys and restart IIS on all SharePoint servers,” Microsoft said. “If you cannot enable AMSI, you will need to rotate your keys after you install the new security update.”

The development comes as Eye Security told The Hacker News that at least 54 organizations have been compromised, including banks, universities, and government entities. Active exploitation is said to have commenced around July 18, according to the company.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), for its part, added CVE-2025-53770 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by July 21, 2025.

Palo Alto Networks Unit 42, which is also tracking what it described as a “high-impact, ongoing threat campaign,” said government, schools, healthcare, including hospitals, and large enterprise companies—are at immediate risk.

“Attackers are bypassing identity controls, including MFA and SSO, to gain privileged access,” Michael Sikorski, CTO and Head of Threat Intelligence for Unit 42 at Palo Alto Networks, told The Hacker News. “Once inside, they’re exfiltrating sensitive data, deploying persistent backdoors, and stealing cryptographic keys. The attackers have leveraged this vulnerability to get into systems and are already establishing their foothold.

“If you have SharePoint on-prem exposed to the internet, you should assume that you have been compromised at this point. Patching alone is insufficient to fully evict the threat. What makes this especially concerning is SharePoint’s deep integration with Microsoft’s platform, including their services like Office, Teams, OneDrive and Outlook, which have all the information valuable to an attacker. A compromise doesn’t stay contained—it opens the door to the entire network.”

The cybersecurity vendor has also classified it as a high-severity, high-urgency threat, urging organizations running on-premises Microsoft SharePoint servers to apply the necessary patches with immediate effect, rotate all cryptographic material, and engage in incident response efforts.

“An immediate, band-aid fix would be to unplug your Microsoft SharePoint from the internet until a patch is available,” Sikorski added. “A false sense of security could result in prolonged exposure and widespread compromise.”

(This is a developing story. Please check back for more details.)

Jul 21, 2025Ravie LakshmananNetwork Security / Vulnerability

Hewlett-Packard Enterprise (HPE) has released security updates to address a critical security flaw affecting Instant On Access Points that could allow an attacker to bypass authentication and gain administrative access to susceptible systems.

The vulnerability, tracked as CVE-2025-37103, carries a CVSS score of 9.8 out of a maximum of 10.0.

“Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authentication,” the company said in an advisory.

“Successful exploitation could allow a remote attacker to gain administrative access to the system.”

Also patched by HPE is an authenticated command injection flaw in the command-line interface of the HPE Networking Instant On Access Points (CVE-2025-37102, CVSS score: 7.2) that a remote attacker could exploit with elevated permissions to run arbitrary commands on the underlying operating system as a privileged user.

This also means that an attacker could fashion CVE-2025-37103 and CVE-2025-37102 into an exploit chain, allowing them to obtain administrative access and inject malicious commands into the command-line interface for follow-on activity.

The company credited ZZ from Ubisectech Sirius Team for discovering and reporting the two issues. Both vulnerabilities have been resolved in HPE Networking Instant On software version 3.2.1.0 and above.

HPE also noted in its advisory that other devices, such as HPE Networking Instant On Switches, are not affected.

While there is no evidence that either of the flaws has come under active exploitation, users are advised to apply the updates as soon as possible to mitigate potential threats.

Jul 20, 2025Ravie LakshmananAI Security / Infostealers

The financially motivated threat actor known as EncryptHub (aka LARVA-208 and Water Gamayun) has been attributed to a new campaign that’s targeting Web3 developers to infect them with information stealer malware.

“LARVA-208 has evolved its tactics, using fake AI platforms (e.g., Norlax AI, mimicking Teampilot) to lure victims with job offers or portfolio review requests,” Swiss cybersecurity company PRODAFT said in a statement shared with The Hacker News.

While the group has a history of deploying ransomware, the latest findings demonstrate an evolution of its tactics and a diversification of its monetization methods by using stealer malware to harvest data from cryptocurrency wallets.

EncryptHub’s focus on Web3 developers isn’t random—these individuals often manage crypto wallets, access to smart contract repositories, or sensitive test environments. Many operate as freelancers or work across multiple decentralized projects, making them harder to protect with traditional enterprise security controls. This decentralized, high-value developer community presents an ideal target for attackers looking to monetize quickly without triggering centralized defenses.

The attack chains entail directing prospective targets to deceptive artificial intelligence (AI) platforms and tricking them into clicking on purported meeting links within these sites.

Meeting links to these sites are sent to developers who follow Web3 and Blockchain-related content via platforms like X and Telegram under the pretext of a job interview or portfolio discussion. The threat actors have also been found sending the meeting links to people who applied for positions posted by them on a Web3 job board called Remote3.

What’s interesting is the approach used by the attackers to sidestep security warnings issued by Remote3 on their site. Given that the service explicitly warns job seekers against downloading unfamiliar video conferencing software, the attackers conduct an initial conversation via Google Meet, during which they instruct the applicant to resume the interview on Norlax AI.

Regardless of the method used, once the victim clicks on the meeting link, they are asked to enter their email address and invitation code, following which they are served a fake error message about outdated or missing audio drivers.

Clicking the message leads to the download of malicious software disguised as a genuine Realtek HD Audio Driver, which executes PowerShell commands to retrieve and deploy the Fickle Stealer. The information gathered by the stealer malware is transmitted to an external server codenamed SilentPrism.

“The threat actors distribute infostealers like Fickle through fake AI applications, successfully harvesting cryptocurrency wallets, development credentials, and sensitive project data,” PRODAFT said.

“This latest operation suggests a shift toward alternative monetization strategies, including the exfiltration of valuable data and credentials for potential resale or exploitation in illicit markets.”

The development comes as Trustwave SpiderLabs detailed a new ransomware called KAWA4096 that “follows the style of the Akira ransomware group, and a ransom note format similar to Qilin’s, likely an attempt to further enrich their visibility and credibility.”

KAWA4096, which first emerged in June 2025, is said to have targeted 11 companies, with the most number of targets located in the United States and Japan. The initial access vector used in the attacks is not known.

A notable feature of KAWA4096 is its ability to encrypt files on shared network drives and the use of multithreading to increase operational efficiency and speed up the scanning and encryption process.

“After identifying valid files, the ransomware adds them to a shared queue,” security researchers Nathaniel Morales and John Basmayor said. “This queue is processed by a pool of worker threads, each responsible for retrieving file paths and passing it on to the encryption routine. A semaphore is used for synchronization among threads, ensuring efficient processing of the file queue.”

Another new entrant to the ransomware landscape is Crux, which claims to be part of the BlackByte group and has been deployed in the wild in three incidents detected on July 4 and 13, 2025, per Huntress.

In one of the incidents, the threat actors have been found to leverage valid credentials via RDP to obtain a foothold in the target network. Common to all the attacks is the use of legitimate Windows tools like svchost.exe and bcdedit.exe to conceal malicious commands and modify boot configuration so as to inhibit system recovery.

“The threat actor also clearly has a preference for legitimate processes like bcdedit.exe and svchost.exe, so continual monitoring for suspicious behavior using these processes via endpoint detection and response (EDR) can help suss out threat actors in your environment,” Huntress said.

Jul 20, 2025Ravie LakshmananDevOps / Threat Intelligence

Cybersecurity researchers have alerted to a supply chain attack that has targeted popular npm packages via a phishing campaign designed to steal the project maintainers’ npm tokens.

The captured tokens were then used to publish malicious versions of the packages directly to the registry without any source code commits or pull requests on their respective GitHub repositories.

The list of affected packages and their rogue versions, according to Socket, is listed below –

• eslint-config-prettier (versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7)
• eslint-plugin-prettier (versions 4.2.2 and 4.2.3)
• synckit (version 0.11.9)
• @pkgr/core (version 0.2.8)
• napi-postinstall (version 0.3.1)

“The injected code attempted to execute a DLL on Windows machines, potentially allowing remote code execution,” the software supply chain security firm said.

The development comes in the aftermath of a phishing campaign that has been found to send email messages impersonating npm in order to trick project maintainers into clicking on a typosquatted link (“npnjs[.]com,” as opposed to “npmjs[.]com”) that harvested their credentials.

The digital missives, with the subject line “Please verify your email address,” spoofed a legitimate email address associated with npm (“support@npmjs[.]org”), urging recipients to validate their email address by clicking on the embedded link.

The bogus landing page to which the victims are redirected to, per Socket, is a clone of the legitimate npm login page that’s designed to capture their login information.

Developers who use the affected packages are advised to cross-check the versions installed and rollback to a safe version. Project maintainers are recommended to turn on two-factor authentication to secure their accounts, and use scoped tokens instead of passwords for publishing packages.

“This incident shows how quickly phishing attacks on maintainers can escalate into ecosystem-wide threats,” Socket said.

The findings coincide with an unrelated campaign that has flooded npm with 28 packages containing protestware functionality that can disable mouse-based interaction on websites with a Russian or Belarusian domain. They are also engineered to play the Ukrainian national anthem on a loop.

However, the attack only works when the site visitor has their browser language settings set to Russian and, in some cases, the same website is visited a second time, thereby ensuring that only repeat visitors are targeted. The activity marks an expansion of a campaign that was first flagged last month.

“This protestware underscores that actions taken by developers can propagate unnoticed in nested dependencies and may take days or weeks to manifest,” security researcher Olivia Brown said.

Arch Linux Removes 3 AUR Packages that Installed Chaos RAT Malware

It also comes as the Arch Linux team said it has pulled three malicious AUR packages that were uploaded to the Arch User Repository (AUR) and harbored hidden functionality to install a remote access trojan called Chaos RAT from a now-removed GitHub repository.

The affected packages are: “librewolf-fix-bin,” “firefox-patch-bin,” and “zen-browser-patched-bin.” They were published by a user named “danikpapas” on July 16, 2025.

“These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT),” the maintainers said. “We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.”

Jul 20, 2025Ravie LakshmananZero-Day / Vulnerability

A critical security vulnerability in Microsoft SharePoint Server has been weaponized as part of an “active, large-scale” exploitation campaign.

The zero-day flaw, tracked as CVE-2025-53770 (CVSS score: 9.8), has been described as a variant of CVE-2025-49706 (CVSS score: 6.3), a spoofing bug in Microsoft SharePoint Server that was addressed by the tech giant as part of its July 2025 Patch Tuesday updates.

“Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network,” Microsoft said in an advisory released on July 19, 2025.

The Windows maker further noted that it’s preparing and fully testing a comprehensive update to resolve the issue. It credited Viettel Cyber Security for discovering and reporting the flaw through Trend Micro’s Zero Day Initiative (ZDI).

In a separate alert issued Saturday, Redmond said it’s aware of active attacks targeting on-premises SharePoint Server customers, but emphasized that SharePoint Online in Microsoft 365 is not impacted.

In the absence of an official patch, Microsoft is urging customers to configure Antimalware Scan Interface (AMSI) integration in SharePoint and deploy Defender AV on all SharePoint servers.

It’s worth noting that AMSI integration is enabled by default in the September 2023 security update for SharePoint Server 2016/2019 and the Version 23H2 feature update for SharePoint Server Subscription Edition.

For those who cannot enable AMSI, it’s advised that the SharePoint Server is disconnected from the internet until a security update is available. For added protection, users are recommended to deploy Defender for Endpoint to detect and block post-exploit activity.

The disclosure comes as Eye Security and Palo Alto Networks Unit 42 warned of attacks chaining CVE-2025-49706 and CVE-2025-49704 (CVSS score: 8.8), a code injection flaw in SharePoint, to facilitate arbitrary command execution on susceptible instances. The exploit chain has been codenamed ToolShell.

But given that CVE-2025-53770 is a “variant” of CVE-2025-49706, it’s suspected that these attacks are related.

Eye Security said the wide-scale attacks it identified leverage CVE-2025-49706 to POST a remote code execution payload exploiting CVE-2025-49704. “We believe that the finding that adding “_layouts/SignOut.aspx” as HTTP referer, makes CVE-2025-49706 into CVE-2025-53770,” it said.

It’s worth mentioning here that the ZDI has characterized CVE-2025-49706 as an authentication bypass vulnerability that stems from how the application handles HTTP Referer header provided to the ToolPane endpoint (“/_layouts/15/ToolPane.aspx”).

The malicious activity essentially involves delivering ASPX payloads via PowerShell, which is then used to steal the SharePoint server’s MachineKey configuration, including the ValidationKey and DecryptionKey, to maintain persistent access.

The Dutch cybersecurity company said these keys are crucial for generating valid __VIEWSTATE payloads, and that gaining access to them effectively turns any authenticated SharePoint request into a remote code execution opportunity.

“We are still identifying mass exploit waves,” Eye Security CTO Piet Kerkhofs told The Hacker News in a statement. “This will have a huge impact as adversaries are laterally moving using this remote code execution with speed.”

More than 85 SharePoint servers globally have been identified as compromised with the malicious web shell as of writing. These hacked servers belong to 29 organizations, including multinational firms and government entities.

It’s worth noting that Microsoft has yet to update its advisories for CVE-2025-49706 and CVE-2025-49704 to reflect active exploitation. We have also reached out to the company for further clarification, and we will update the story if we hear back.

(The story is developing. Please check back for more details.)

Jul 20, 2025Ravie LakshmananDevOps / Threat Intelligence

Cybersecurity researchers have alerted to a supply chain attack that has targeted popular npm packages via a phishing campaign designed to steal the project maintainers’ npm tokens.

The captured tokens were then used to publish malicious versions of the packages directly to the registry without any source code commits or pull requests on their respective GitHub repositories.

The list of affected packages and their rogue versions, according to Socket, is listed below –

• eslint-config-prettier (versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7)
• eslint-plugin-prettier (versions 4.2.2 and 4.2.3)
• synckit (version 0.11.9)
• @pkgr/core (version 0.2.8)
• napi-postinstall (version 0.3.1)

“The injected code attempted to execute a DLL on Windows machines, potentially allowing remote code execution,” the software supply chain security firm said.

The development comes in the aftermath of a phishing campaign that has been found to send email messages impersonating npm in order to trick project maintainers into clicking on a typosquatted link (“npnjs[.]com,” as opposed to “npmjs[.]com”) that harvested their credentials.

The digital missives, with the subject line “Please verify your email address,” spoofed a legitimate email address associated with npm (“support@npmjs[.]org”), urging recipients to validate their email address by clicking on the embedded link.

The bogus landing page to which the victims are redirected to, per Socket, is a clone of the legitimate npm login page that’s designed to capture their login information.

Developers who use the affected packages are advised to cross-check the versions installed and rollback to a safe version. Project maintainers are recommended to turn on two-factor authentication to secure their accounts, and use scoped tokens instead of passwords for publishing packages.

“This incident shows how quickly phishing attacks on maintainers can escalate into ecosystem-wide threats,” Socket said.

The findings coincide with an unrelated campaign that has flooded npm with 28 packages containing protestware functionality that can disable mouse-based interaction on websites with a Russian or Belarusian domain. They are also engineered to play the Ukrainian national anthem on a loop.

However, the attack only works when the site visitor has their browser language settings set to Russian and, in some cases, the same website is visited a second time, thereby ensuring that only repeat visitors are targeted. The activity marks an expansion of a campaign that was first flagged last month.

“This protestware underscores that actions taken by developers can propagate unnoticed in nested dependencies and may take days or weeks to manifest,” security researcher Olivia Brown said.

Arch Linux Removes 3 AUR Packages that Installed Chaos RAT Malware

It also comes as the Arch Linux team said it has pulled three malicious AUR packages that were uploaded to the Arch User Repository (AUR) and harbored hidden functionality to install a remote access trojan called Chaos RAT from a now-removed GitHub repository.

The affected packages are: “librewolf-fix-bin,” “firefox-patch-bin,” and “zen-browser-patched-bin.” They were published by a user named “danikpapas” on July 16, 2025.

“These packages were installing a script coming from the same GitHub repository that was identified as a Remote Access Trojan (RAT),” the maintainers said. “We strongly encourage users that may have installed one of these packages to remove them from their system and to take the necessary measures in order to ensure they were not compromised.”