August 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

LNK Malware Strategies: Surge in Shortcut File Attacks 

Unit 42 has detected a significant uptick in malicious use of Windows shortcut (LNK) files, with infections rising from approximately 21,100 in 2023 to over 68,400 in 2024. Their in-depth analysis of 30,000 samples highlights how attackers exploit the flexibility of LNK files to execute malware via four main techniques: exploit execution, file-on-disk execution, in-argument scripts, and overlay content. 

Key Insights: 

• Exploit Delivery: Malicious LNK files leverage OS vulnerabilities to trigger payload execution directly when folders are opened. 

• File Execution: Attackers use LNK shortcuts to launch hidden executables or scripts residing on disk. 

• In-Argument Scripts: LNK files embed commands within their arguments, often invoking PowerShell or cmd.exe with encoded scripts for stealthy execution. 

• Overlay Payloads: Hidden payloads are appended to LNK files, with execution triggered via utilities like findstr, mshta, or PowerShell to extract and run embedded code. 

Between March and April 2025, the rapid expansion in campaigns underscores the need for caution around downloading or opening unknown LNK files, especially those received via email or untrusted sources. 

Further Reading: Unit 42 

BERT Ransomware Hits Asia & Europe Across Multiple Platforms 

Trend Micro researchers have identified BERT, a newly emerged ransomware group targeting organizations in Asia, Europe, and the U.S.—notably within healthcare, technology, and event services sectors. First observed in April 2025, BERT operates across both Windows and Linux environments and stands out for its streamlined execution and powerful impact despite a relatively simple codebase. 

Key Insights: 

• Multi‑Platform Reach: BERT deploys across Windows and Linux systems. Windows attacks disable security tools and escalate privileges via PowerShell, while Linux variants operate with high parallelization—encrypting up to 50 threads and forcibly shutting down ESXi virtual machines to maximize impact. 

• Efficient Encryption Tactics: The ransomware halts critical processes, encrypts files quickly using AES, appends a .encrypted_by_bert extension, and drops ransom notes immediately. 

• Active Development & Russian Code Artifacts: Multiple variants have been identified, with code including Russian-language comments and hosted on Russian infrastructure—raising potential attribution links to Russia-aligned threat actors. 

• REvil Code Lineage: Analysts note similarities to the Linux variant of the now-dismantled REvil ransomware, suggesting BERT may be built using its leaked codebase. 

Further Reading: Trend Micro Research 

NordDragonScan: A Stealthy Data‑Harvester Targeting Windows 

FortiGuard Labs recently uncovered NordDragonScan, a covert Windows infostealer silently dropped via HTA scripts. Once executed, the malware harvests documents, full browser profiles, screenshots, system details, and even network inventory before exfiltrating everything to a command-and-control server. Installation begins through deceptive RAR archives and LNK files that trigger mshta.exe, concealing activity behind a decoy Ukrainian-language document. 

Key Insights: 

• Begins with a weaponized HTA dropped by a malicious LNK shortcut, leading to an invisible PowerShell installation of the payload. 

• NordDragonScan performs deep data collection, including documents (.docx, .pdf, .xls), screenshots, Chrome and Firefox history, system and network details. 

• Persistence is established via a Run-key registry entry; C2 communication occurs over TLS using custom headers (e.g. MAC-based user-agent). 

• Targets local network hosts for broader reconnaissance and evades static detection through string obfuscation and hidden executable tactics. 

Further Reading: Fortinet 

June 2025 Malware Spotlight: Discord Exploits Rise 

Check Point Research’s June 2025 malware spotlight reveals an escalating threat vector: hijacked Discord invite links. Attackers are exploiting expired or deleted invite codes—especially vanity URLs—to redirect users into malicious servers. Over 1,300 victims globally have been impacted, with malware like AsyncRAT and Skuld Stealer delivered via trusted platforms such as GitHub, Pastebin, and Bitbucket. 

Key Insights: 

• Hijacking Trusted Links: Threat actors reclaim expired or custom Discord invite links to lure users into malicious servers. 

• ClickFix Social Engineering: Victims encounter fake verification bots that execute clipboard injections and PowerShell commands. 

• Stealthy Delivery Chain: Malware is deployed in multiple stages using trusted cloud services to evade detection. 

• Widespread Impact: The campaign has affected users in the U.S., Vietnam, Germany, France, and the U.K., primarily targeting cryptocurrency users. 

Further Reading: Check Point Research 

Jasper Sleet: North Korean Remote IT Workers Use AI to Infiltrate Organizations 

Microsoft Threat Intelligence has identified a surge in activity from the North Korea-linked threat actor Jasper Sleet, formerly tracked as Storm‑0287. These operatives are exploiting remote work arrangements to embed themselves within organizations worldwide. Using AI tools to enhance fake identities, they are securing employment, gaining access to sensitive systems, and exfiltrating data to support North Korea’s strategic and financial objectives. 

Key Insights: 

• Jasper Sleet operatives use AI for facial and voice modification to impersonate real job seekers. 

• Fake identities are supported by fabricated credentials, doctored online profiles, and complicit facilitators. 

• The campaign targets a wide range of industries across North America, Europe, and Asia. 

• Over 3,000 accounts have been suspended due to links to this operation. 

• Common tactics include the use of residential IPs, remote access software, and resume laundering. 

Further Reading: Microsoft Security Blog 

Preventing ClickFix Attacks: A Critical Playbook 

Unit 42 outlines the growing prevalence of ClickFix social-engineering attacks—where users are duped into copying and executing malicious commands from deceptive web prompts. Given these attacks' reliance on clipboard manipulation and prompt hijacking (especially via PowerShell), defenders must adopt both technical and educational countermeasures. 

Key Insights: 

• Clipboard Monitoring Defenses: Alerts should trigger when suspicious commands are copied, especially PowerShell scripts; clipboard activity monitoring complements traditional endpoint detection measures. 

• Restricting Shell Execution: Limit or disable mshta.exe, PowerShell, and cmd.exe execution unless explicitly required—and particularly from web-origin contexts—to reduce attack success rates. 

• Harden User Prompts: Implement policies to disable or neuter clipboard/paste functionality in browser environments vulnerable to web-based injection prompts. 

• User Education is Key: Train users to recognize fake CAPTCHAs and unusual ‘copy-and-paste’ prompts. Clear guidance—such as “never paste commands into system prompts”—can disrupt the attack lifecycle. 

Further Reading: Unit 42 

RenderShock: Weaponizing Trust in File Rendering Pipelines 

Cybersecurity researchers at Cyfirma (with corroboration from IBM X-Force) have revealed a stealthy, zero-click attack strategy dubbed RenderShock. This sophisticated technique exploits passive file-rendering systems—like preview panes, metadata indexing, and sync clients—to discreetly trigger malicious activity without any user action. 

Key Insights: 

• Zero-Click Payloads: Attackers embed malicious logic into document metadata, file previews, or automation workflows that execute when files are merely indexed or previewed—not opened. 

• Multi-Vector Exploits: The framework targets diverse surfaces like Windows Explorer preview panes, macOS Quick Look, email client renderers, cloud sync tools, and antivirus scanners to activate payloads. 

• Stealth & Modularity: RenderShock uses simple evasion tactics—like executing reverse-shell macros or NTLM beaconing via UNC paths—and also advanced payloads such as dual-format polyglots, remote Office templates, and poisoned EXIF metadata. 

• Wide Impact Potential: Capabilities range from reconnaissance and credential harvesting to remote execution and lateral movement, all without requiring user interaction. 

• Defense Strategies: Mitigation relies on disabling preview/indexing features, sandboxing file handling, blocking SMB egress, monitoring unusual network activity from renderer processes, and simulating RenderShock techniques in red team exercises. 

Further Reading: Cyfirma 

Gemini Email Summary Phishing: Invisible Prompt Injection Risk 

A newly discovered vulnerability in Google’s Gemini for Workspace demonstrates how attackers can embed hidden instructions in emails—styled with invisible text—so that clicking “Summarize this email” invokes the malicious prompt. This can result in fake security alerts, phishing links, or fraudulent phone numbers appearing in AI-generated summaries. 

Key Insights: 

• Attackers hide directives using invisible HTML/CSS that Gemini parses but users can’t see. 

• Summarized messages may falsely warn of compromised accounts and urge recipients to click links or call numbers. 

• Because there are no obvious phishing signals (like attachments or visible links), these emails bypass typical threat detection. 

• Security teams should flag summaries containing urgent calls to action and train users to verify full email content. 

Further Reading: Bleeping Computer 

Deepfake It ‘til You Make It: The New AI Criminal Toolset 

Cybercriminals are increasingly exploiting deepfake technology to conduct fraud, extortion, and manipulation campaigns. Originally built for creative or entertainment purposes, AI-driven tools for generating fake audio, video, and images are now widely available and being misused to impersonate individuals and mislead organizations. 

Key Insights: 

• Democratized Deepfake Creation: Tools for generating synthetic media are now easy to use, enabling low-skilled actors to produce realistic forgeries. 

• CEO Fraud & Recruitment Exploits: Deepfake audio and video are being used to impersonate executives during meetings or to create fake candidate profiles in hiring scams. 

• KYC & Identity Fraud Risks: Attackers use deepfakes to bypass identity verification processes at banks and fintech platforms, facilitating account fraud. 

• Plug-and-Play Underground: Criminal communities are sharing deepfake tools, tutorials, and services, lowering the barrier to entry for would-be attackers. 

Further Reading: Trend Micro 

PoisonSeed Bypasses FIDO Keys Using Cross‑Device Sign‑In Trick 

Expel researchers uncovered a clever social engineering tactic used by the PoisonSeed campaign to neutralize FIDO hardware key protections. Instead of exploiting a technical flaw, attackers employ phishing pages and QR codes in a man-in-the-middle scenario that targets FIDO’s cross-device sign-in feature, fooling victims into granting access without physical key interaction. 

Key Insights: 

• A phishing website mimicking Okta captures login credentials and forwards them to the legitimate portal. 

• It then prompts a cross-device sign-in, displaying a QR code that, when scanned by the user, inadvertently authenticates the attacker. 

• No vulnerability in FIDO itself is exploited; attackers manipulate design workflows to bypass multi-factor authentication. 

• Although FIDO keys remain strong, this tactic bypasses them in real time without user awareness. 

• Organizations should monitor for unexpected cross-device login requests and consider options like requiring Bluetooth proximity or restricted registration policies. 

Further Reading: Expel 

SLOW#TEMPEST Malware Spotlight: Advanced Obfuscation Techniques Unveiled 

Unit 42 has analyzed a recent variant of the SLOW#TEMPEST malware campaign, revealing sophisticated obfuscation—such as dynamic jumps and indirect function calls—used by threat actors to hinder both static and dynamic analysis. 

Key Insights: 

• Control-Flow Obfuscation: The loader DLL uses runtime-calculated jumps (JMP RAX) to scramble execution paths, making conventional CFG analysis unreliable. 

• Indirect Calls: Instead of direct API calls, SLOW#TEMPEST employs dynamically resolved function pointers (CALL RAX), complicating detection of malicious functionality. 

• Emulation-Based Deobfuscation: Researchers successfully reversed obfuscation by emulating dynamic jumps and calls in IDA Pro, restoring visibility into the control flow and API usage. 

• Evasion of Sandboxes: These techniques prevent decompilers and automated sandboxes from recognizing malicious behavior, allowing the malware to remain hidden and active. 

• Detection Takeaway: Security teams should enhance defenses with emulation, behavioral telemetry, and control-flow integrity mechanisms to detect threats that evade traditional signature-based analysis. 

Further Reading: Unit 42 

Matanbuchus Malware Delivered via Microsoft Teams Calls 

Security researchers have alerted to a targeted campaign where attackers exploit Microsoft Teams voice calls—impersonating IT support—to remotely deploy Matanbuchus 3.0 malware. Victims are persuaded to use Windows Quick Assist, opening remote access doors. A PowerShell script then deploys a malicious ZIP package containing a side-loaded DLL loader, which initiates memory-resident infection without leaving obvious traces. 

Key Insights: 

• Social Engineering via Teams: Callers pose as IT personnel to earn trust and initiate remote-control sessions. 

• Quick Assist Abuse: Remote assistance tools are misused to bypass controls and execute malicious scripts. 

• In-Memory Loader: The malware uses PowerShell to unpack a DLL loader that sideloads the final payload without disk artifacts. 

• Advanced Evasion: Version 3.0 introduces Salsa20-based encryption, syscall usage to evade EDR hooks, and anti-sandbox mechanisms. 

• High-Risk Payload: Matanbuchus 3.0 can deploy additional threat tools like Cobalt Strike and ransomware, providing full system control. 

Further Reading: Bleeping Computer 

FileFix: A Social Engineering Evolution of ClickFix 

Check Point Research has uncovered FileFix, a new social engineering attack that refines the ClickFix method to trick users into executing malicious commands. Delivered through compromised or typo-squatted websites, FileFix prompts victims with a fake download link or “Fix” button—copying harmful PowerShell scripts to the clipboard. When users paste and run these snippets, the attacker gains system access through a stealthy, multi-stage infection chain. 

Key Insights: 

• FileFix uses clipboard hijacking to push malicious payloads via user-initiated paste actions. 

• Fake prompts mimic legitimate "fix" or software update buttons to build trust. 

• Infection unfolds in stages—from initial PowerShell downloaders to final payloads like AsyncRAT or remote access trojans. 

• This variation simplifies and accelerates command execution compared to previous ClickFix variants. 

• Detection requires user awareness and endpoint policies that block shell execution from clipboard content. 

Further Reading: Check Point Research 

Linkable Token Identifiers Now GA for Enhanced Identity Threat Detection 

Microsoft Entra ID has launched linkable token identifiers—a new capability that allows security teams to trace a user session across Microsoft 365 services (including Teams, SharePoint, Exchange Online, and Graph). Each session is now tagged with a Session ID (SID) and Unique Token Identifier (UTI), enabling precise correlation of all actions originating from a single authentication event across multiple workloads. 

Key Insights: 

• SID enables linkage of all access tokens and session activity from one login, while UTI uniquely identifies each issued token. 

• Security analysts can now trace attacker movements—such as lateral access, API usage, or mailbox actions—across services using unified session tracking. 

• This simplifies investigation workflows, reducing reliance on fragmented logs or inconsistent identifiers like IP addresses and device IDs. 

• SOCs using Defender XDR and Entra ID Protection can now map anomalous activity with greater accuracy and speed. 

Further Reading: Microsoft Entra Blog 

FBI & CISA Update on Tactics & Threats for Scattered Spider 

Critical infrastructure and commercial entities are urged to review CISA's updated joint advisory AA23‑320A (last revised July 29, 2025), detailing evolving tactics used by the Scattered Spider cybercriminal group. Known for preying on IT and help desk personnel, this financially motivated threat actor now combines social engineering, ransomware, and data extortion with sophisticated new techniques. 

Key Insights: 

• Scattered Spider continues targeting IT support channels using voice phishing (vishing), SMS phishing (smishing), and MFA fatigue attacks alongside SIM swapping to obtain access credentials. 

• Once inside, attackers repurpose legitimate remote-access and tunneling tools (e.g. TeamViewer, AnyDesk, Ngrok) instead of relying on malware, enabling stealthy and persistent access. 

• New variants like DragonForce ransomware are now being deployed as part of combined extortion operations (data theft + encryption). 

• In recent operations, actors have refined social engineering methods while rotating TTPs to evade detection and extend dwell time. 

• Updated mitigations emphasize phishing-resistant MFA, verifying helpdesk contacts out-of-band, limiting remote access tool use, and continuous validation of security controls against evolving attack behaviors. 

Further Reading: CISA Advisory AA23‑320A (Scattered Spider) 

Phishing Trends Q2 2025: Microsoft at the Helm, Spotify Rejoins the Spotlight 

Check Point Research’s latest Brand Phishing report reveals that in the second quarter of 2025, cybercriminals continued to impersonate high-trust brands to trick users into revealing credentials or financial data. Microsoft remained the most spoofed brand—used in 25% of phishing attempts—followed by Google (11%), Apple (9%), and Spotify (6%), marking Spotify’s first reappearance in the charts since late 2019. 

Key Insights: 

• Microsoft led phishing campaigns, accounting for a quarter of all spoofed brands. 

• Spotify saw a surprising resurgence in impersonation attempts after a long absence, used in campaigns involving fake credential and payment pages. 

• Booking.com–themed domains surged by over 700 in Q2, many embedding personal user data to deceive targets convincingly. 

• Tech remained the top spoofed sector, with social networks, travel, and retail brands also seeing elevated impersonation activity. 

• Seasonal alignment played a key role: the rise in travel scams coincided with summer holiday planning, amplifying phishing success. 

Further Reading: Check Point Research 

Microsoft OAuth Phishing Campaign: MFA Bypass via App Impersonation 

Proofpoint has exposed a sophisticated phishing campaign where attackers used malicious Microsoft OAuth applications—disguised as trusted brands like Adobe, DocuSign, and SharePoint—to trick users into granting access to their Microsoft 365 accounts. These apps operated within legitimate authorization flows, enabling attackers to bypass multi-factor authentication (MFA) with minimal-risk consent requests. 

Key Insights: 

• The fake OAuth apps mimicked trusted publishers to obtain permissions for profile, email, and openid scopes—enough to capture credentials and session tokens without raising suspicion. 

• Once approved, users were redirected to phishing pages that intercepted login credentials and session tokens using AiTM (attacker-in-the-middle) kits like Tycoon or EvilProxy. 

• Attackers were able to maintain access via stolen tokens even after password resets, remaining linked to accounts until consent was manually revoked. 

• The campaign compromised multiple sectors—including finance, healthcare, and retail—targeting executives and high-privilege users. 

• Standard security controls such as DMARC or domain reputation were largely ineffective since the phishing originated from within Microsoft's system. 

• Microsoft is rolling out updated defaults that require administrative approval for third-party app permissions, aiming to limit similar attacks going forward. 

Further Reading: Proofpoint Threat Insight 

GreyNoise: Early Warning Signals Reveal Emerging Vulnerabilities Before Public Disclosure 

GreyNoise’s latest research, “Early Warning Signals: When Attacker Behavior Precedes New Vulnerabilities”, demonstrates that spikes in malicious activity—such as scanning or brute force attempts—often occur weeks before a corresponding CVE is officially disclosed. This pattern is most pronounced in edge technologies like VPNs, firewalls, and remote access tools. Of 216 observed spikes since September 2024, 80% were followed by a CVE within six weeks, and 50% within just three weeks. 

Key Insights: 

• Attacker reconnaissance frequently precedes public identification of the vulnerability they are probing. 

• Spikes in exploit activity offer a critical 6-week window for defenders to prepare before official disclosure. 

• This trend is particularly prevalent in enterprise perimeter devices—typical initial access points for adversaries. 

• Relying solely on EPSS or KEV can miss these pre-disclosure threats and delay defensive response. 

Further Reading: GreyNoise Early Warning Signals Report 

August 2025 - ExploreSec Cybersecurity Security Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Task Scams: Why You Should Never Pay to Get Paid 

ESET warns of a growing wave of “task scams” where victims are enticed by offers of quick money for simple online tasks, such as liking content or clicking buttons. While early steps appear legitimate and even show fake earnings, the scheme ultimately demands an upfront payment to “unlock” these earnings—after which victims receive nothing. Reports of task scams have quadrupled, with millions lost to this tactic. 

Key Insights: 

• Scams typically begin through unsolicited messages on WhatsApp, Telegram, or social media. 

• Fake earnings dashboards give victims a false sense of progress and legitimacy. 

• Victims are often pressured to pay a fee in cryptocurrency to claim their supposed rewards. 

• Scammers may use cloned websites and group chats filled with fake success stories to boost credibility. 

• Other forms of employment fraud include fake job ads, phishing through CV submissions, and impersonated recruiters. 

Further Reading: WeLiveSecurity 

Jasper Sleet: North Korean Remote IT Workers Use AI to Infiltrate Organizations 

Microsoft Threat Intelligence has identified a surge in activity from the North Korea-linked threat actor Jasper Sleet, formerly tracked as Storm‑0287. These operatives are exploiting remote work arrangements to embed themselves within organizations worldwide. Using AI tools to enhance fake identities, they are securing employment, gaining access to sensitive systems, and exfiltrating data to support North Korea’s strategic and financial objectives. 

Key Insights: 

• Jasper Sleet operatives use AI for facial and voice modification to impersonate real job seekers. 

• Fake identities are supported by fabricated credentials, doctored online profiles, and complicit facilitators. 

• The campaign targets a wide range of industries across North America, Europe, and Asia. 

• Over 3,000 accounts have been suspended due to links to this operation. 

• Common tactics include the use of residential IPs, remote access software, and resume laundering. 

Further Reading: Microsoft Security Blog 

AI Hiring Bot Breach: McDonald’s Chatbot Exposes Data of Millions 

Security researchers Ian Carroll and Sam Curry discovered a critical vulnerability in Olivia, the AI hiring assistant via Paradox.ai's McHire platform, used by McDonald’s. With just the default password 123456, the duo accessed an admin account and discovered a critical API flaw. In under an hour, they viewed personal details—including names, emails, phone numbers, and chat logs—for approximately 64 million job applicants spanning years of data. 

Key Insights: 

• A dormant admin panel was secured by default credentials, lacking any multifactor authentication. 

• An insecure direct object reference (IDOR) allowed researchers to enumerate applicant records by simply changing numeric IDs. 

• Data exposed included conversation content and personal identifiers—though not financial or sensitive health info. 

• McDonald’s and Paradox.ai responded swiftly, disabling the account and patching the API within a day. 

• Despite the quick fix, the breach underscores the risks of weak third-party oversight and insecure AI-driven recruitment tools. 

Further Reading: Wired 

Gemini Email Summary Phishing: Invisible Prompt Injection Risk 

A newly discovered vulnerability in Google’s Gemini for Workspace demonstrates how attackers can embed hidden instructions in emails—styled with invisible text—so that clicking “Summarize this email” invokes the malicious prompt. This can result in fake security alerts, phishing links, or fraudulent phone numbers appearing in AI-generated summaries. 

Key Insights: 

• Attackers hide directives using invisible HTML/CSS that Gemini parses but users can’t see. 

• Summarized messages may falsely warn of compromised accounts and urge recipients to click links or call numbers. 

• Because there are no obvious phishing signals (like attachments or visible links), these emails bypass typical threat detection. 

• Security teams should flag summaries containing urgent calls to action and train users to verify full email content. 

Further Reading: Bleeping Computer 

Deepfake It ‘til You Make It: The New AI Criminal Toolset 

Cybercriminals are increasingly exploiting deepfake technology to conduct fraud, extortion, and manipulation campaigns. Originally built for creative or entertainment purposes, AI-driven tools for generating fake audio, video, and images are now widely available and being misused to impersonate individuals and mislead organizations. 

Key Insights: 

• Democratized Deepfake Creation: Tools for generating synthetic media are now easy to use, enabling low-skilled actors to produce realistic forgeries. 

• CEO Fraud & Recruitment Exploits: Deepfake audio and video are being used to impersonate executives during meetings or to create fake candidate profiles in hiring scams. 

• KYC & Identity Fraud Risks: Attackers use deepfakes to bypass identity verification processes at banks and fintech platforms, facilitating account fraud. 

• Plug-and-Play Underground: Criminal communities are sharing deepfake tools, tutorials, and services, lowering the barrier to entry for would-be attackers. 

Further Reading: Trend Micro 

FileFix: A Social Engineering Evolution of ClickFix 

Check Point Research has uncovered FileFix, a new social engineering attack that refines the ClickFix method to trick users into executing malicious commands. Delivered through compromised or typo-squatted websites, FileFix prompts victims with a fake download link or “Fix” button—copying harmful PowerShell scripts to the clipboard. When users paste and run these snippets, the attacker gains system access through a stealthy, multi-stage infection chain. 

Key Insights: 

• FileFix uses clipboard hijacking to push malicious payloads via user-initiated paste actions. 

• Fake prompts mimic legitimate "fix" or software update buttons to build trust. 

• Infection unfolds in stages—from initial PowerShell downloaders to final payloads like AsyncRAT or remote access trojans. 

• This variation simplifies and accelerates command execution compared to previous ClickFix variants. 

• Detection requires user awareness and endpoint policies that block shell execution from clipboard content. 

Further Reading: Check Point Research 

FBI Warns of Youth-Driven Cybercrime and Violence Networks 

The FBI has issued a series of alerts warning about “The Com,” a decentralized network of youth-led cybercriminal groups responsible for a surge in digital fraud, harassment, and real-world violence. Subgroups like Hacker Com focus on cryptocurrency theft, SIM swapping, and ransomware, while IRL Com offers violence-for-hire services such as swatting, assault, and kidnapping. These groups exploit gaming platforms and social media to recruit minors, using threats, doxing, and financial incentives to escalate involvement. 

Key Insights: 

• Youth-focused groups are driving cybercrime and monetizing their skills via extortion, malware, and fraud. 

• Cryptocurrency enables both virtual and physical attacks, including pay-for-assault services. 

• Recruitment often starts on gaming and social platforms, escalating into serious criminal activity. 

• Swatting and doxing are common intimidation tactics tied to digital theft or status-building. 

Further Reading: IC3.gov PSA 1   | ICS3.gov PSA 2 | ICS3.gov PSA 3 

North Korean IT Worker Schemes: Emerging Threat to U.S. Businesses 

The FBI has issued a critical alert (PSA>I‑072325‑4) highlighting how North Korean IT workers and their domestic facilitators are infiltrating U.S. businesses. These workers use deceptive employment setups—often via U.S.-based intermediaries—to bypass sanctions and gain unauthorized access to sensitive systems, generating illicit revenue to support the DPRK regime. 

Key Insights: 

• These schemes rely on unwitting or complicit U.S. individuals who receive, configure, and then forward company assets (like laptops and accounts) to operatives in North Korea. 

• Facilitators may manage shipping, remote access setup, account creation on job platforms, and even handle proceeds in shared financial accounts. 

• Tactics exploit front companies and virtual interviews to mask identities and evade detection, with remote desktop tools like TeamViewer used covertly. 

• There are significant risks of sanction violations, data theft, and unauthorized system control when businesses hire third-party or international IT contractors. 

• The FBI recommends organizations conduct in-person or video identity verifications, validate employment credentials, monitor shipping/payment methods, and restrict unauthorized remote-access tools. 

Further Reading: IC3.gov PSA I‑072325‑4 

Targeted Social Engineering Drives Ransom Payments Skyward in Q2 2025 

Coveware’s Q2 2025 ransomware spotlight reveals a dramatic shift in attack economics: the average ransom payment jumped to $1,130,070—a staggering 104% increase from Q1—while the median payment doubled to $400,000, indicating high-value extortion is on the rise. 

Key Insights: 

• Ransomware actors are shifting from broad targeting to highly targeted social-engineering campaigns, exploiting trusted communications and tailored deception to pressure specific high-profile victims. 

• While the payment amounts surged, the overall ransom payment rate remained low at ~26%, suggesting many organizations continue to successfully resist paying demands. 

• Mid-sized and larger enterprises are now disproportionately affected, as attackers focus on fewer but more lucrative targets rather than bulk low-value victims. 

Further Reading: Coveware Blog 

Privacy Alert: Tea App Data Breach Exposes Millions of Sensitive Chats 

The women-focused “Tea” app, designed for anonymous reviews and dating safety, has suffered a catastrophic data breach impacting users prior to February 2024. Initial reports of exposed selfies and ID documents (around 72,000 images) have now escalated: researchers uncovered a second compromised database containing 1.1 million private messages on deeply personal topics—spanning infidelity, abortion, and abuse. 

Key Insights: 

• Legacy storage misconfiguration in Firebase led to unauthorized data exposure, including chat logs and user IDs. 

• Messaging functionality has been disabled while Tea investigates and coordinates with cybersecurity experts and the FBI. 

• Victims face potential risks of identity theft, harassment, and blackmail through leaked information involving personal phone numbers and real‑world identifiers. 

Further Reading: WebProNews  

Scattered Spider Alert: FBI & CISA Update on Tactics & Threats 

Critical infrastructure and commercial entities are urged to review CISA's updated joint advisory AA23‑320A (last revised July 29, 2025), detailing evolving tactics used by the Scattered Spider cybercriminal group. Known for preying on IT and help desk personnel, this financially motivated threat actor now combines social engineering, ransomware, and data extortion with sophisticated new techniques. 

Key Insights: 

• Scattered Spider continues targeting IT support channels using voice phishing (vishing), SMS phishing (smishing), and MFA fatigue attacks alongside SIM swapping to obtain access credentials. 

• Once inside, attackers repurpose legitimate remote-access and tunneling tools (e.g. TeamViewer, AnyDesk, Ngrok) instead of relying on malware, enabling stealthy and persistent access. 

• New variants like DragonForce ransomware are now being deployed as part of combined extortion operations (data theft + encryption). 

• In recent operations, actors have refined social engineering methods while rotating TTPs to evade detection and extend dwell time. 

• Updated mitigations emphasize phishing-resistant MFA, verifying helpdesk contacts out-of-band, limiting remote access tool use, and continuous validation of security controls against evolving attack behaviors. 

Further Reading: CISA Advisory AA23‑320A (Scattered Spider) 

Scam Alert: Gaming Sites Flooded with Fake Platforms and Phishing Traps 

Threat actors have launched a large-scale social engineering campaign using polished, fraudulent gaming and wagering websites—promoted via Discord and social media ads. These platforms lure users with claims of partnerships with influencers like “Mr. Beast,” and offer fake promo codes for in-game credits. Once victims deposit funds or connect crypto wallets, the sites disappear—often taking user data and assets with them. 

Key Insights: 

• Hundreds of scam sites—often over 1,200 domains—are promoted via sponsored ads and influencer tie-ins to appear legitimate. 

• These platforms impersonate giveaways or wagering systems, incentivizing sign-ups with fake bonus credits and “verified” endorsements. 

• After registration or payment, users often lose access to funds and face account theft or credential compromise. 

• Scams are heavily directed toward younger users on Discord and gaming communities, exploiting trust in influencer culture. 

• In addition to phishing domains, attackers distribute malware via fake mods or “game cheats,” particularly targeting titles like Minecraft and Roblox. 

Further Reading: KrebsOnSecurity 

Phishing Trends Q2 2025: Microsoft at the Helm, Spotify Rejoins the Spotlight 

Check Point Research’s latest Brand Phishing report reveals that in the second quarter of 2025, cybercriminals continued to impersonate high-trust brands to trick users into revealing credentials or financial data. Microsoft remained the most spoofed brand—used in 25% of phishing attempts—followed by Google (11%), Apple (9%), and Spotify (6%), marking Spotify’s first reappearance in the charts since late 2019. 

Key Insights: 

• Microsoft led phishing campaigns, accounting for a quarter of all spoofed brands. 

• Spotify saw a surprising resurgence in impersonation attempts after a long absence, used in campaigns involving fake credential and payment pages. 

• Booking.com–themed domains surged by over 700 in Q2, many embedding personal user data to deceive targets convincingly. 

• Tech remained the top spoofed sector, with social networks, travel, and retail brands also seeing elevated impersonation activity. 

• Seasonal alignment played a key role: the rise in travel scams coincided with summer holiday planning, amplifying phishing success. 

Further Reading: Check Point Research 

Microsoft OAuth Phishing Campaign: MFA Bypass via App Impersonation 

Proofpoint has exposed a sophisticated phishing campaign where attackers used malicious Microsoft OAuth applications—disguised as trusted brands like Adobe, DocuSign, and SharePoint—to trick users into granting access to their Microsoft 365 accounts. These apps operated within legitimate authorization flows, enabling attackers to bypass multi-factor authentication (MFA) with minimal-risk consent requests. 

Key Insights: 

• The fake OAuth apps mimicked trusted publishers to obtain permissions for profile, email, and openid scopes—enough to capture credentials and session tokens without raising suspicion. 

• Once approved, users were redirected to phishing pages that intercepted login credentials and session tokens using AiTM (attacker-in-the-middle) kits like Tycoon or EvilProxy. 

• Attackers were able to maintain access via stolen tokens even after password resets, remaining linked to accounts until consent was manually revoked. 

• The campaign compromised multiple sectors—including finance, healthcare, and retail—targeting executives and high-privilege users. 

• Standard security controls such as DMARC or domain reputation were largely ineffective since the phishing originated from within Microsoft's system. 

• Microsoft is rolling out updated defaults that require administrative approval for third-party app permissions, aiming to limit similar attacks going forward. 

Further Reading: Proofpoint Threat Insight 

FBI Alert: QR Code Packages Used in Emerging Fraud Scheme 

The FBI has issued a Public Service Announcement (PSA I‑073125) warning about a new twist on the classic "brushing scam": unsolicited packages sent to recipients containing QR codes that, when scanned, prompt the victim to share personal or financial information or inadvertently download malware. These packages often arrive without sender details, making recipients more likely to investigate the code out of curiosity. 

Key Insights: 

• Mail includes no sender information, tempting recipients to scan QR codes in order to identify the sender. 

• Scanning the code can lead to phishing forms requesting sensitive data or installation of smartphone malware. 

• The tactic is a modification of brushing scams, repurposed for fraud by exploiting user curiosity and trust. 

• Fraudsters may ask victims to grant permissions or download apps that compromise device security. 

Protective Measures: 

• Don’t scan QR codes from unexpected or unknown packages. 

• Avoid granting app or account access triggered via unsolicited QR links. 

• If suspicious, report the package to your local authorities or the FBI’s Internet Crime Complaint Center (IC3). 

Further Reading: IC3.gov PSA I‑073125 

Unraveling the Critical Zero-Day SharePoint Vulnerability CVE-2025-53770

ExploreSec will be doing a live podcast recording on August 19. Details can be found at Meetup.com and will be available on the ExploreSec YouTube channel after the date.

Executive Summary

This overview provides a critical overview of CVE-2025-53770, a severe zero-day Remote Code Execution (RCE) vulnerability actively being exploited in on-premises Microsoft SharePoint servers. With a CVSS 3.1 score of 9.8 (Critical), this flaw allows unauthenticated attackers to execute arbitrary code and gain full system control without user interaction. The exploit, known as "ToolShell," is particularly dangerous as it not only achieves initial compromise but also steals cryptographic machine keys, enabling persistent access even after patching or reboots.

The urgency is amplified by its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog and widespread active exploitation campaigns targeting government, software, and telecommunications sectors globally. Organizations with internet-facing on-premises SharePoint servers should assume compromise and take immediate action.

Key actions include:

• Immediate Patching: Apply Microsoft's latest security updates for SharePoint Server Subscription Edition (KB5002768) and SharePoint Server 2019 (KB5002754) on an emergency basis. Unsupported versions (2010, 2013) must be isolated or upgraded.

• Crucial Post-Patching Step: Rotate ASP.NET Machine Keys (ValidationKey and DecryptionKey) to invalidate stolen cryptographic material and prevent persistent re-entry by attackers.

• Interim Mitigations: If immediate patching is not possible, enable AMSI integration, deploy Microsoft Defender AV, and consider disconnecting public-facing servers from the internet.

• Detection & Response: Actively hunt for Indicators of Compromise (IoCs) like suspicious process chains (w3wp.exe spawning cmd.exe then powershell.exe) and unexpected .aspx web shells. Initiate a rapid incident response if compromise is detected or assumed.

This incident underscores the critical need for continuous vulnerability management, proactive threat hunting, and a strong focus on securing fundamental IT infrastructure to defend against sophisticated, persistent threats.

The Looming Threat to On-Premises SharePoint

Organizations globally are facing an immediate and severe threat from CVE-2025-53770, a critical zero-day Remote Code Execution (RCE) vulnerability actively being exploited in the wild. This flaw specifically targets on-premises Microsoft SharePoint servers, posing a direct danger to collaborative environments and the sensitive data they hold. With a CVSS 3.1 base score of 9.8 (Critical), this vulnerability signifies the highest level of severity, indicating potential for complete system compromise without authentication or user interaction.

The confirmed active exploitation of CVE-2025-53770 underscores that this is not a theoretical risk but a present and ongoing attack. Threat actors were leveraging this vulnerability as a zero-day even before Microsoft's public disclosure, giving them a significant head start.

Unpacking the Vulnerability: What is CVE-2025-53770?

The technical root cause of CVE-2025-53770 is rooted in the "improper deserialization of untrusted data". Deserialization is the process by which an application converts data from a stored or transmitted format back into a usable object. When SharePoint attempts to deserialize specially crafted, malicious data from an attacker without sufficient validation, it can lead to the execution of arbitrary code on the server. This specific type of flaw is categorized as CWE-502 (Deserialization of Untrusted Data), a well-known and high-impact vulnerability class. The persistence of such fundamental flaws, even in widely used enterprise software, indicates a systemic challenge in secure software development and configuration.

This critical flaw impacts several on-premises Microsoft SharePoint Server versions: SharePoint Server 2016, SharePoint Server 2019, and the Subscription Edition. It is crucial to note that older, unsupported versions such as SharePoint Server 2010 and 2013 are also affected and are particularly vulnerable due to the absence of official security updates. It is important to clarify that SharePoint Online (Microsoft 365) is not affected by this vulnerability. However, organizations running self-managed SharePoint Server instances in cloud environments, such as Azure, AWS, or GCP, are indeed vulnerable, as the underlying software remains the same. Data indicates that approximately 9% of cloud environments currently host resources running these vulnerable self-managed SharePoint versions. This distinction highlights that simply moving infrastructure to the cloud does not automatically absolve organizations of their security responsibilities; the deployment model (SaaS vs. self-managed IaaS/PaaS) dictates the shared security burden.

The CVSS 3.1 base score of 9.8 assigned to CVE-2025-53770 underscores its severe implications. This score reflects an attack vector over the network, low attack complexity, no privileges required, and no user interaction needed, leading to high impacts on confidentiality, integrity, and availability. This combination makes the vulnerability exceptionally easy for attackers to exploit and achieve full system compromise, reinforcing the urgent need for action.

The "ToolShell" Exploit Chain: A Persistent Threat

The exploit chain leveraging CVE-2025-53770, publicly known as "ToolShell," first emerged into the spotlight during the Pwn2Own hacking competition in May 2025. During this event, Viettel Cyber Security demonstrated how to chain an authentication bypass (CVE-2025-49706) with a deserialization vulnerability (CVE-2025-49704) to achieve unauthenticated RCE on SharePoint. What makes the current situation particularly concerning is that CVE-2025-53770 is not an entirely new vulnerability, but rather a direct "patch bypass" for the previously addressed CVE-2025-49704. Similarly, CVE-2025-53771 acts as a patch bypass for CVE-2025-49706. This rapid cycle of exploit, patch, and bypass demonstrates a high level of sophistication among threat actors, who are actively reverse-engineering vendor patches to discover and exploit weaknesses, thereby significantly reducing the window for defenders to implement effective countermeasures.

The ToolShell exploit chain operates in a calculated, multi-stage process designed for initial compromise and long-term persistence:

1. Stage 1: Authentication Bypass (leveraging CVE-2025-53771): The attack initiates with a crafted POST request targeting the /_layouts/15/ToolPane.aspx endpoint, a legacy component within SharePoint. The core of this authentication bypass relies on manipulating the Referer header, setting it to /_layouts/SignOut.aspx. This clever trick deceives the SharePoint server into treating the attacker's request as legitimate and authenticated, effectively bypassing initial security checks and granting privileged access.

2. Stage 2: Remote Code Execution via Deserialization (CVE-2025-53770): Once authenticated access is established, the attacker proceeds to interact with the ToolPane.aspx endpoint. A carefully constructed malicious payload is then submitted within the body of the POST request. This payload triggers the insecure deserialization vulnerability (CVE-2025-53770), causing the SharePoint application to convert the attacker-controlled data into executable code on the server. This typically results in the deployment of a stealthy ASPX web shell, often named something like spinstall0.aspx, into a SharePoint directory. This web shell then provides persistent remote access to the compromised server.

3. Stage 3: The Long-Game – Possessing Cryptographic Keys: This final stage is what distinguishes ToolShell as an exceptionally dangerous and persistent threat. Immediately after establishing the web shell, attackers utilize it to extract critical cryptographic material from the SharePoint server's machineKey configuration: specifically, the ValidationKey and DecryptionKey. The possession of these keys grants threat actors the ability to independently forge valid authentication tokens and __VIEWSTATE payloads. This means that even if the initial web shell is discovered and removed, or if the server is rebooted, the attackers can re-establish control and execute new malicious payloads on the compromised server at will. This capability transforms a temporary breach into a deep, cryptographic-level compromise, fundamentally altering the scope of remediation required.

Why This Vulnerability Demands Immediate Attention

The urgency surrounding CVE-2025-53770 is underscored by several critical factors, signaling a severe and active threat to organizations globally.

First, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-53770 to its Known Exploited Vulnerabilities (KEV) catalog on July 20, 2025, just one day after Microsoft's disclosure. The KEV catalog is a curated list of vulnerabilities that are confirmed to be actively exploited by malicious cyber actors and pose significant risks. While CISA's Binding Operational Directive (BOD) 22-01 mandates remediation for federal agencies, CISA strongly urges all organizations, regardless of sector, to prioritize timely remediation of KEV vulnerabilities. This swift inclusion serves as a universal warning that the vulnerability is not only critical but is being actively weaponized and poses a proven, immediate threat to all sectors.

• High Volume of Attacks: Cloudflare's WAF Managed Rules observed a significant peak of approximately 300,000 HTTP request matches for the vulnerability around 11 AM UTC on July 22. This immense volume indicates a large-scale, automated scanning and exploitation effort, targeting any exposed SharePoint server.

• Confirmed Compromises: Reports confirm that the vulnerability has led to the compromise of at least 75 company servers, including major corporations and US government agencies. This demonstrates tangible, real-world impact across diverse targets.

• Opportunistic Global Campaigns: Bitdefender's analysis confirms "active, widespread exploitation" globally, noting that these attacks are "typically opportunistic rather than highly targeted". This pattern indicates that while initial attacks might target high-value entities, once a zero-day is weaponized, it quickly transitions into automated scanning and exploitation campaigns, making every internet-facing, unpatched SharePoint server a potential target, regardless of the organization's size or perceived value.

• Targeted Initial Attacks: Check Point Research identified the first exploitation attempts as early as July 7th, targeting a major Western government, with attacks intensifying on July 18th and 19th from specific IP addresses: 104.238.159.149, 107.191.58.76, and 96.9.125.147. These attacks have targeted sectors including government, software, and telecommunications in North America and Western Europe.

• Behavioral Detections: Rapid7 has observed active exploitation in customer environments through specific behavioral indicators, such as w3wp.exe (IIS worker process) spawning cmd.exe, which then spawns powershell.exe -EncodedCommand. These process chains serve as high-confidence detections of successful exploitation.

• Cloud Exposure: Even in cloud environments, Wiz data highlights that 9% of self-managed SharePoint instances are running vulnerable versions, extending the attack surface beyond traditional on-premises deployments and emphasizing that cloud hosting does not inherently guarantee security for self-managed applications.

Given the zero-day nature, confirmed active exploitation, and the sophisticated persistence mechanism (cryptographic key theft), the cybersecurity community's consensus is clear: "any organization with an on-premise SharePoint server on the Internet should assume it has been compromised and take immediate action to fully address this vulnerability". This proactive stance is critical because detection might come too late, and the focus must immediately shift to containment and comprehensive remediation. Furthermore, while initial compromise may occur rapidly, the most damaging follow-up attacks, such as ransomware deployment or data exfiltration, often occur days or even weeks later. This creates a crucial, albeit limited, window of opportunity for defenders to act and prevent further damage, emphasizing that a lack of immediate, obvious signs of compromise does not equate to safety.

Action Plan: Comprehensive Mitigation and Defense

Addressing CVE-2025-53770 requires a multi-faceted and urgent approach, encompassing immediate patching, crucial post-patching steps, and interim mitigations.

Prioritize Patching on an Emergency Basis:

The most critical and immediate step is to apply the latest security updates released by Microsoft. This must be done on an emergency basis, without waiting for regular patch cycles, as the vulnerability is actively exploited in the wild.

• For SharePoint Server Subscription Edition, apply security update KB5002768.

• For SharePoint Server 2019, apply security update KB5002754.

• For SharePoint Server 2016, organizations should closely monitor Microsoft's official channels for the release of the patch.

• Unsupported Versions (2010, 2013): These versions have reached end-of-life and will not receive official patches. They are considered highly exposed and should be immediately isolated from the network or upgraded to a supported version.

Crucial Post-Patching Step: Rotate ASP.NET Machine Keys:

This step is paramount and often overlooked. Attackers exploiting CVE-2025-53770 steal the SharePoint server's ValidationKey and DecryptionKey for persistent access, which can survive patches, server reboots, or the removal of web shells. Rotating these keys invalidates any cryptographic material potentially stolen by attackers, thereby severing their persistent foothold and preventing re-entry. This action is not merely a best practice but an absolutely essential component of full remediation for any potentially compromised system.

• How to Perform: This can be done via PowerShell using the Update-SPMachineKey cmdlet or through SharePoint Central Administration (navigate to Monitoring > Review job definition, then locate and run the "Machine Key Rotation Job").

• Final Step: Following key rotation, it is essential to execute iisreset.exe on all SharePoint servers to ensure the new keys are fully loaded and in effect.

Interim Mitigations (If Immediate Patching is Not Possible):

If security updates cannot be applied immediately, Microsoft and CISA strongly recommend implementing the following interim mitigations to reduce exposure:

• Enable AMSI Integration & Deploy Defender AV: Configure Antimalware Scan Interface (AMSI) integration in SharePoint and ensure an antivirus solution, such as Microsoft Defender AV, is actively deployed on all SharePoint servers. This provides a crucial layer of defense against unauthenticated attacks and helps detect post-exploit activities. This demonstrates the importance of a layered security approach, providing protection when primary defenses like a direct patch are unavailable.

• Disconnect Public-Facing Servers from the Internet: As a last resort, if AMSI cannot be enabled or patches cannot be applied immediately, it is strongly recommended to disconnect any affected public-facing SharePoint servers from the internet until official mitigations are fully in place. While this will disrupt services, it will prevent external exploitation and contain potential spread.

The necessity of both patching and key rotation for true remediation highlights a critical nuance in incident response for sophisticated attacks. Simply applying the patch closes the initial vulnerability, but it does not remove the attacker's ability to re-enter if they have already stolen the cryptographic keys. Therefore, security teams must understand the attacker's full kill chain, including persistence mechanisms, and implement corresponding countermeasures. Failure to perform key rotation means that even a patched system remains vulnerable to re-compromise by the same attacker, rendering significant remediation efforts ineffective. This underscores the importance of meticulously following detailed, vendor-specific guidance.

Detecting and Responding to Potential Compromise

Given the confirmed active exploitation as a zero-day and the nature of the persistence mechanism (cryptographic key theft), it is prudent for any organization with an internet-facing on-premises SharePoint server to "assume compromise". This proactive mindset is crucial for initiating a thorough and effective incident response, acknowledging that detection might already be too late for some systems.

Organizations must actively hunt for the following specific Indicators of Compromise (IoCs) within their environments:

• Suspicious Process Chains: Monitor for unusual process execution, particularly w3wp.exe (the IIS worker process) spawning cmd.exe, which then spawns powershell.exe -EncodedCommand. This specific sequence is considered a high-confidence detection for this exploitation and is a prime example of why behavioral detection is crucial for zero-day threats where traditional signatures may not exist.

• Suspicious File Creation: Look for the presence of unexpected or suspicious .aspx files, especially spinstall0.aspx, in SharePoint directories such as C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\TEMPLATE\LAYOUTS\. These files often serve as web shells for persistent access.

• Network Activity Patterns: Monitor for POST requests directed to /_layouts/15/ToolPane.aspx?DisplayMode=Edit, which is the endpoint exploited by the ToolShell chain. Additionally, conduct scanning for connections to known attacker IP addresses, particularly those observed between July 18-19, 2025: 107.191.58.76, 104.238.159.149, and 96.9.125.147.

• Security Rule Updates: Ensure that intrusion prevention system (IPS) and web application firewall (WAF) rules are updated to block known exploit patterns and anomalous behavior associated with this vulnerability.

If compromise is assumed or detected, a rapid and comprehensive incident response must be initiated:

• Isolate and Shut Down: Immediately isolate or shut down affected servers to prevent further compromise and lateral movement within the network.

• Revoke and Rotate Credentials: Revoke any potentially compromised user accounts or service accounts, and rotate all associated secrets and credentials.

• Audit and Minimize Privileges: Conduct a thorough audit of SharePoint layout and administrative privileges, minimizing access to only what is strictly necessary.

• Engage Incident Response Teams: Engage your internal Security Operations Center (SOC) or external incident response specialists for a deep forensic investigation, eradication, and recovery.

• Comprehensive Logging: Ensure comprehensive logging is enabled and reviewed regularly to identify exploitation activity and aid in forensic analysis.

The observation that initial compromise often serves as a "beachhead," with the most damaging follow-up attacks (e.g., ransomware, data exfiltration) occurring days or weeks later, highlights a critical "window of opportunity" for defenders. This implies that rapid detection and a well-rehearsed incident response plan are paramount. The focus shifts from merely preventing initial access to minimizing the blast radius and preventing subsequent, more damaging attack phases. This reinforces the need for strong internal communication, clear escalation paths, and pre-defined playbooks for critical incidents that prioritize containment and eradication before the attacker can achieve their ultimate objectives.

Conclusion

CVE-2025-53770 represents a critical and actively exploited zero-day threat to on-premises Microsoft SharePoint servers. Its high severity, coupled with the sophisticated "ToolShell" exploit chain's ability to achieve persistent access through cryptographic key theft, demands immediate and decisive action from all affected organizations.

The imperative is clear: apply the latest security updates without delay, and crucially, rotate your ASP.NET Machine Keys to invalidate any potentially stolen cryptographic material. Implement interim mitigations like enabling AMSI and deploying robust antivirus solutions, and be prepared to disconnect public-facing servers if patching is not immediately feasible. Beyond these urgent steps, cultivate a proactive security posture by investing in continuous vulnerability management, proactive threat hunting, and a strong focus on foundational infrastructure security.

Links and Contributions

• https://msrc.microsoft.com/blog/categories/msrc/

• Contribution: This Microsoft Security Response Center (MSRC) blog served as a primary source for confirming Microsoft's awareness of the active attacks targeting on-premises SharePoint servers and the assignment of CVE-2025-53770. It also provided initial guidance on mitigations and detections.

• https://blog.cloudflare.com/cloudflare-protects-against-critical-sharepoint-vulnerability-cve-2025-53770/

  • Contribution: This article was crucial for detailing the "ToolShell" exploit chain, including its origin at the Pwn2Own competition and its nature as a patch bypass for previous vulnerabilities. It provided a breakdown of the three attack stages (authentication bypass, RCE via deserialization, and cryptographic key theft for persistence). It also offered insights into the widespread nature of the attacks, citing Cloudflare's WAF Managed Rules observations of high HTTP request matches.

• https://blog.checkpoint.com/research/sharepoint-zero-day-cve-2025-53770-actively-exploited-what-security-teams-need-to-know/

  • Contribution: This Check Point Research blog provided specific details on the active exploitation, including the earliest observed attack dates (July 7th), the intensification of attacks from specific IP addresses, and the targeted sectors (government, software, telecommunications) and geographies (North America, Western Europe). It also highlighted the chaining of CVE-2025-53770 with other vulnerabilities like Ivanti EPMM flaws.

• https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-microsoft-sharepoint-servers-cve-2025-53770/

  • Contribution: This Rapid7 blog confirmed the zero-day exploitation of CVE-2025-53770 and its classification as a patch bypass. It detailed the sophisticated nature of the campaign, emphasizing the goal of establishing persistent access through cryptographic key extraction. It also provided high-confidence behavioral detection indicators, such as specific process chains (w3wp.exe spawning cmd.exe then powershell.exe).

• https://www.indusface.com/blog/key-cybersecurity-statistics/

  • Contribution: This resource provided valuable statistics on the increasing volume of Common Vulnerabilities and Exposures (CVEs) reported annually and daily. It also offered data on the surge in vulnerability-based attacks, linking it to the growing accessibility of Large Language Model (LLM) tools, and statistics on breaches related to application vulnerabilities and stolen credentials.

• https://www.cvedetails.com/cve/CVE-2025-53770/

  • Contribution: This site provided core technical details about CVE-2025-53770, including its CVSS 3.1 base score of 9.8 (Critical), its classification as CWE-502 (Deserialization of Untrusted Data), and confirmation of its addition to the CISA Known Exploited Vulnerabilities (KEV) catalog. It also outlined CISA's recommended interim mitigation actions.

• https://www.axonius.com/blog/cve-2025-53770

  • Contribution: This blog post was used to confirm the critical nature of the vulnerability, the affected SharePoint Server versions (2016, 2019, Subscription Edition), and Microsoft's recommended remediation steps, including the crucial process of rotating ASP.NET machine keys and restarting IIS. It also reiterated interim mitigations like AMSI integration and disconnecting public-facing servers.

• https://www.wiz.io/blog/sharepoint-vulnerabilities-cve-2025-53770-cve-2025-53771-everything-you-need-to-k

  • Contribution: This article offered a comprehensive overview of both CVE-2025-53770 and CVE-2025-53771, detailing their roles in the "ToolShell" exploit chain. It provided specific affected SharePoint versions, clarified that SharePoint Online is not affected, but self-managed cloud instances are. It also outlined the exploit's stages, including the specific endpoint and the theft of cryptographic keys, and provided detailed patching and mitigation instructions.

• https://tech.co/news/data-breaches-updated-list

  • Contribution: This resource provided recent real-world examples of significant data breaches, such as those affecting Anne Arundel Dermatology, Compumedics USA, and McLaren Health Care. These examples were used to illustrate the severe financial, reputational, and compliance risks associated with successful cyberattacks.

• https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-rce-vulnerability-microsoft-sharepoint-server-cve-2025-53770ce

  • Contribution: Bitdefender's analysis confirmed widespread, opportunistic exploitation globally and highlighted that initial compromise often serves as a "beachhead" for more damaging follow-up attacks days or weeks later, emphasizing a crucial window of opportunity for defenders. It also provided specific patching instructions and reinforced the importance of rotating ASP.NET Machine Keys.

• https://www.cisa.gov/news-events/alerts/2025/07/20/microsoft-releases-guidance-exploitation-sharepoint-vulnerability-cve-2025-53770

  • Contribution: This CISA alert confirmed the agency's awareness of active exploitation and the addition of CVE-2025-53770 to the KEV catalog. It provided specific Indicators of Compromise (IoCs) for monitoring, including suspicious POST requests and attacker IP addresses, and recommended updating intrusion prevention system (IPS) and web application firewall (WAF) rules.

• https://www.cisa.gov/news-events/alerts/2025/07/20/cisa-adds-one-known-exploited-vulnerability-cve-2025-53770-toolshell-catalog

  • Contribution: This CISA announcement explicitly stated the addition of CVE-2025-53770 "ToolShell" to the Known Exploited Vulnerabilities (KEV) catalog, underscoring its confirmed active exploitation and the agency's strong recommendation for all organizations to prioritize its remediation.

• https://timesofindia.indiatimes.com/technology/tech-news/microsoft-sharepoint-zero-day-breach-hits-75-servers-heres-what-the-company-said/articleshow/122805393.cms

  • Contribution: This news article confirmed the active exploitation of the zero-day vulnerability, reporting that it had led to the compromise of at least 75 company servers, including major corporations and US government agencies. It reiterated the CVSS score, the deserialization root cause, and the theft of cryptographic keys for persistent access.

June 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Ransomware Ecosystem in Flux 

Coveware's latest analysis reveals a significant transformation in the ransomware threat landscape as of Q1 2025. The once-dominant Ransomware-as-a-Service (RaaS) model is unraveling due to intensified law enforcement actions, internal discord, and operational setbacks. 

Key Insights: 

• Disintegration of Major RaaS Groups: Prominent groups like LockBit, BlackCat/ALPHV, and Black Basta have collapsed, plagued by internal conflicts and increased scrutiny. Leaked communications from Black Basta highlight challenges in targeting, risk assessment, and evasion of sanctions. 

• Emergence of New Threat Actors: The void left by these groups is being filled by unaffiliated extortionists, nascent ransomware brands with ties to espionage and hacktivism, and a few remnants of traditional ransomware operations. 

• Operational Missteps: Recent incidents, such as Clop's underwhelming Cleo campaign and a poorly executed Oracle Cloud SSO breach by a BreachForums actor, indicate a decline in the sophistication and monetization strategies of threat actors. 

• Rise of Phantom Scams: The appearance of fraudulent ransom notes, like those falsely attributed to BianLian, underscores a trend toward deceptive tactics as traditional extortion methods wane. 

• Increased Exposure and Arrests: Enhanced operational security measures and international cooperation have led to the identification and apprehension of several threat actors, diminishing the perceived anonymity that once shielded cybercriminals. 

Further Reading: Coveware 

Stealthy .NET Malware: Hiding Malicious Payloads as Bitmap Resources 

Unit 42 researchers have identified a novel obfuscation technique employed by threat actors, wherein malicious payloads are concealed within bitmap resources embedded in seemingly benign 32-bit .NET applications. This method leverages steganography to initiate a multi-stage execution chain, ultimately deploying final payloads such as Agent Tesla, RemcosRAT, or XLoader. 

Key Insights: 

• Steganographic Embedding: Malware is hidden within bitmap resources of .NET executables, allowing it to evade traditional detection mechanisms. 

• Malspam Distribution: Campaigns have been observed targeting sectors like finance in Türkiye and logistics in Asia, using localized email subjects and attachments to increase credibility. 

• Multi-Stage Execution: Upon execution, the infected application extracts and deobfuscates embedded payloads, loading them as dynamic-link libraries before executing the final malicious code. 

• Advanced Obfuscation Techniques: Additional methods such as metadata obfuscation, opcode replacement, and control flow manipulation are used to hinder static analysis and reverse engineering. 

Further Reading: Unit 42 

New Tool Can Trick Windows into Disabling Microsoft Defender 

Security researchers have discovered a new, publicly available tool called "DefendNot" that can manipulate Windows systems into effectively disabling Microsoft Defender, the built-in antivirus software. This tool doesn't exploit vulnerabilities but instead uses legitimate system administration features in unintended ways. 

Key Insights for Security Teams: 

• Abuse of Admin Privileges: Highlights the critical importance of least privilege principles and monitoring privileged accounts. 

• Bypasses Traditional Defenses: May evade detection by traditional security solutions that primarily look for malware signatures or exploit activity. 

• Focus on Tamper Protection: Underscores the importance of enabling and closely monitoring tamper protection features within Microsoft Defender. 

• Need for Behavioral Monitoring: Organizations should emphasize behavioral monitoring and anomaly detection to identify suspicious activity. 

• Tool is Publicly Available: Means threat actors could potentially incorporate it into their attack chains. 

Further Reading: BleepingComputer 

NIST Proposes Metric to Identify Likely Exploited Vulnerabilities 

The National Institute of Standards and Technology (NIST), in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA), has introduced a proposed metric aimed at determining the likelihood that a given vulnerability has been exploited in the wild. This initiative seeks to enhance the efficiency and cost-effectiveness of enterprise vulnerability remediation efforts. 

Key Insights: 

• Addressing Limitations of Existing Systems: Current remediation strategies often rely on the Exploit Prediction Scoring System (EPSS) and Known Exploited Vulnerabilities (KEV) lists. However, EPSS has been noted for inaccuracies, and KEV lists may not be comprehensive. The proposed metric aims to augment these tools by providing a more accurate assessment of exploitation likelihood. 

• Enhancing Vulnerability Prioritization: By estimating the probability of exploitation, organizations can better prioritize vulnerabilities, focusing resources on those most likely to be targeted. 

• Collaborative Approach: The success of this metric depends on collaboration with industry partners to provide necessary performance measurements and validate the effectiveness of the approach. 

Further Reading: NIST CSWP 41 

New Best Practices Guide for Securing AI Data Released 

CISA, NSA, FBI, and international partners have jointly released a new Cybersecurity Information Sheet focused on AI Data Security: Best Practices for Securing Data Used to Train & Operate AI Systems. This guide emphasizes that robust data security is fundamental for ensuring the accuracy, integrity, and trustworthiness of AI outcomes throughout its entire lifecycle. 

Key Insights: 

• Holistic Risk Management: The guide outlines risks stemming from data security and integrity issues across all phases of AI, from development to operation. 

• Target Audience: It's particularly relevant for Defense Industrial Bases, National Security Systems owners, federal agencies, and Critical Infrastructure owners/operators. 

• Core Recommendations: Key practices include adopting strong data protection measures, proactively managing AI-related risks, and enhancing monitoring, threat detection, and network defense capabilities. 

• Vigilance is Key: As AI integration grows, organizations must take deliberate steps to secure the underlying data. 

Further Reading: CISA 

DDoS Attack "Street Prices": What You Need to Know 

Recent analysis of the underground market reveals that the "street prices" for DDoS (Distributed Denial-of-Service) attacks have remained remarkably stable over the past few years, with some new trends in service delivery. While web-based booters are still available, Telegram-based booter services are becoming a new norm, offering readily accessible attack capabilities. 

Key Insights: 

• Stable Pricing: DDoS attack costs have remained consistent, making them a relatively affordable option for malicious actors. 

• Layer 3/4 Attacks (Volume-based):  

• 1 GB/Day (Booter-Service): ~$1/day 

• 100 GB/Day: ~$25/day 

• 1000 GB/Day (DDoS for Hire): ~$150/day 

• Layer 7 Attacks (Application-layer):  

• 10,000 RPS/Day (Booter-Service): ~$1/day 

• 50,000 RPS/Day (DDoS for Hire): ~$20/day 

• 100,000 RPS + Protected Services (DDoS for Hire): ~$50/day 

• Max monthly cost for DDoS for Hire: ~$10,000/month 

• DDoS-as-a-Service (DDoSaaS) Dominance: This business model continues to thrive, with attackers charging hourly or monthly fees to sustain attacks, often with extra charges for targeting protected services. 

• Emergence of Telegram Booters: Threat actors are increasingly leveraging Telegram for offering and managing DDoS services, simplifying access for potential customers. 

Further Reading: KyberVandals Blog 

Deceptive CAPTCHA "ClickFix" Campaign Uses Clipboard Injection to Deliver Malware 

Threat actors are employing a new social engineering campaign, dubbed "ClickFix," that utilizes fake CAPTCHA prompts on compromised or cloned websites. This sophisticated technique tricks users into launching malware by combining clipboard injection with abuse of the Windows Run dialog, leading to the delivery of payloads like Lumma Stealer and NetSupport RAT. 

Key Insights: 

• Social Engineering Focus: The campaign heavily relies on user fatigue with CAPTCHA mechanisms, guiding victims through seemingly familiar steps to execute malicious code. 

• Clipboard Injection & Run Dialog Abuse: The core of the attack involves copying a malicious PowerShell or mshta command to the clipboard, which users are then instructed to paste and execute in the Windows Run dialog. 

• Living Off the Land Binaries (LOLBins): Attackers extensively use trusted system binaries like PowerShell, mshta.exe, and certutil.exe to bypass traditional security defenses, making detection challenging. 

• Payloads: Frequently observed payloads include infostealers (e.g., Lumma Stealer targeting browser data, credentials, and crypto wallets) and remote access tools (e.g., NetSupport RAT for full system access). 

• Simplicity and Effectiveness: The campaign's success stems from its simplicity, avoiding zero-day exploits or complex hidden mechanisms, relying instead on user interaction. 

• Proactive Defense: This campaign underscores the need for robust endpoint detection and response (EDR) solutions capable of behavioral analysis and detection of LOLBin abuse, alongside user education on suspicious CAPTCHA prompts and the dangers of pasting unknown commands. 

Further Reading: SecurityOnline.info 

Cybercriminals Exploit AI Hype to Spread Malware 

Cybercriminals are increasingly exploiting the public's interest in artificial intelligence by creating fake AI-themed websites and advertisements to distribute malware. A recent campaign identified by Mandiant Threat Defense involves the threat group UNC6032 using deceptive ads on platforms like Facebook and LinkedIn to lure users into downloading malicious software disguised as AI video generation tools. 

Key Insights: 

• Deceptive Advertising: Thousands of malicious ads have been disseminated, impersonating legitimate AI tools such as Luma AI and Canva Dream Lab. These ads direct users to fraudulent websites designed to mimic authentic AI services. 

• Malware Deployment: Upon interacting with these fake sites, users are prompted to download a ZIP file containing the STARKVEIL malware dropper. This dropper installs multiple malware components, including GRIMPULL, XWORM, and FROSTRIFT, which are designed to steal sensitive information and establish persistent access to the victim's system. 

• Information Theft: The deployed malware targets a range of data, including login credentials, cookies, credit card information, and digital wallet contents. Some components, like XWORM, also perform keylogging and screen capture, further compromising user privacy. 

• Evasion Techniques: The malware employs sophisticated methods to avoid detection, such as using Braille pattern blank characters to obscure file extensions and leveraging legitimate processes for malicious activities. 

This campaign underscores the importance of vigilance when engaging with online advertisements, especially those offering AI-related services. Users should be cautious of unsolicited offers and verify the legitimacy of websites before downloading any software. 

Further Reading: Google Cloud Blog 

Beyond the Kill Chain: How Cybercriminals Invest Their Profits 

Sophos X-Ops' five-part series, Beyond the Kill Chain, explores what happens after a successful cyberattack. The series reveals how financially motivated threat actors invest their illicit earnings—often blending legitimate business with ethically questionable and outright criminal ventures. 

Key Insights: 

• Legitimate Business Ventures: Cybercriminals are investing in seemingly lawful enterprises such as restaurants, real estate, and e-commerce platforms. These ventures help launder money while also creating additional income streams. 

• Ethically Dubious Activities: Some threat actors operate in legal gray zones, selling spyware, monetizing vulnerability research under the guise of security services, or manipulating online traffic for advertising profits. 

• Criminal Enterprises: Illicit gains are also funneled into traditional criminal operations like counterfeit goods, drug trafficking, and underground gambling, showing how cybercrime supports broader organized crime ecosystems. 

• Implications for Cybersecurity: Mapping how threat actors reinvest their profits helps threat intelligence teams understand evolving risk models and disrupt the infrastructure supporting ongoing cybercriminal activity. 

Further Reading: Sophos News 

Lumma Infostealer: Disrupted but Not Defeated 

A recent global law enforcement operation disrupted parts of the Lumma Infostealer malware-as-a-service platform, seizing over 2,500 domains. However, key infrastructure—particularly servers hosted in Russia—remains intact, allowing Lumma’s core operations to continue. 

Key Insights: 

• Partial Takedown: While many domains were seized, Lumma’s main server remains online, enabling continued malware activity. 

• Resilience and Recovery: The developer claimed services resumed quickly with no arrests made, signaling strong operational recovery. 

• Ongoing Threat: Stolen credentials and sensitive data tied to Lumma are still appearing on dark web markets. 

• Psychological Tactics: Authorities planted disruptive messages in Lumma’s Telegram channels and admin panels to undermine trust in the service. 

• Mixed Reactions: Some cybercriminals are distancing themselves from Lumma, while others remain loyal and active. 

Further Reading: Check Point Blog 

CFOs Targeted in Sophisticated Spear-Phishing Campaign 

A recent spear-phishing campaign is targeting Chief Financial Officers (CFOs) and finance executives across banking, energy, insurance, and investment sectors in regions including Europe, Africa, Canada, the Middle East, and South Asia. The attackers use a multi-stage approach to deploy NetBird, a legitimate WireGuard-based remote access tool, onto compromised systems. 

Key Insights: 

• Deceptive Recruitment Emails: The campaign begins with emails impersonating a Rothschild & Co recruiter offering a “strategic opportunity.” Victims are directed to a Firebase-hosted page featuring a custom CAPTCHA to access a malicious file. 

• Malicious Payload Delivery: After solving the CAPTCHA, users download a ZIP file containing a VBS script. When executed, it installs NetBird and OpenSSH, creates a hidden local admin account, and enables Remote Desktop Protocol (RDP) for persistent attacker access. 

• Evasion Techniques: The use of custom CAPTCHAs and trusted hosting services helps the attackers bypass traditional security defenses and increases credibility. 

• Attribution: Some infrastructure overlaps with known nation-state campaigns, but the specific threat actor remains unidentified. 

Further Reading: Trellix Blog 

Threat Actors Exploit Google Apps Script for Evasive Phishing Attacks 

Threat actors are leveraging Google's Apps Script platform to host phishing pages that appear legitimate, allowing them to steal login credentials. These campaigns often begin with emails posing as invoice notifications, linking to webpages hosted using Google Apps Script. By operating within Google's trusted environment, attackers make their phishing pages seem more authentic, increasing the chances of success. 

Key Insights: 

• Abuse of Trusted Services: Google Apps Script, a JavaScript-based platform used for automating Google Workspace tasks, is being exploited to host fake login pages that capture user credentials and send them to attacker-controlled servers. 

• Evasion of Security Measures: Because the scripts are hosted on Google's own domain, they can bypass traditional email and web filters that typically block suspicious domains. 

• Sophisticated Phishing Techniques: The phishing emails and login prompts are convincingly designed to mimic legitimate services, making it more likely that targets will engage and provide sensitive information. 

Further Reading: BleepingComputer 

HuluCAPTCHA – An Evolving Fake CAPTCHA Framework 

Security researchers have identified "HuluCAPTCHA," a sophisticated fake CAPTCHA framework actively compromising websites. This advanced system tricks users into running malicious commands via fake CAPTCHA prompts and the Windows Run dialog, leading to infections with infostealers and remote access tools. 

Key Insights: 

• Deceptive Execution: Users are redirected from compromised sites to fake CAPTCHA pages, then instructed to copy/paste malicious PowerShell or mshta commands into Windows Run. 

• Advanced Tracking & Stealth: The framework meticulously tracks user interactions and potential command execution. It leverages Living Off the Land Binaries (LOLBins) to evade traditional defenses. 

• Payload Versatility: Delivers various infostealers (e.g., Lumma, Aurotun) and remote access tools (e.g., Donut Injector). 

• Persistent Backdoors: Compromised WordPress sites show sophisticated hidden admin backdoors, designed for stealth and persistence. 

• High-Value Targets: Attackers are targeting organizations that could hold sensitive data, highlighting the potential for significant impact. 

Further Reading: HuluCaptcha — An example of a FakeCaptcha framework 

Phishing Campaign Exploits Google.com Open Redirects 

A recent phishing campaign has been observed exploiting an open redirect vulnerability within Google's google.com/travel/clk endpoint. Threat actors are leveraging this legitimate Google Travel click-tracking mechanism to redirect users from a trusted google.com domain to malicious phishing sites. This technique adds an air of legitimacy to phishing links, making them harder for users to identify as fraudulent. 

Key Insights: 

• Trusted Domain Abuse: Attackers are using google.com/travel/clk?pc=[token]&pcurl=[target_URL] to redirect users. The presence of google.com in the initial link provides a deceptive sense of security. 

• Persistent Tokens: The pc token, which controls the redirect, lacks a clear expiration mechanism and can remain valid for months or even years. This allows attackers to reuse tokens across multiple campaigns. 

• Ease of Exploitation: Obtaining a valid token is trivial, requiring only a visit to Google's hotel search page to copy one from a legitimate link. 

• Google's Stance: Google's official position classifies open redirects as "very little practical risk," claiming they invest in phishing detection rather than preventing the redirects themselves. This stance is debated given the observed abuse. 

• Detection Challenge: The initial legitimate google.com domain in the link makes it difficult for users and some security systems to immediately flag it as malicious. 

Mitigation Recommendation for Internal Security Teams: 

• Flag or sandbox any google.com/travel/clk links that appear in email and other messages until Google clarifies its redirect validation mechanisms. 

Further Reading: Another day, another phishing campaign abusing google.com open redirects 

Cybercriminals Use Fake Booking Sites to Spread AsyncRAT Malware 

Cybercriminals are exploiting fake Booking.com websites to infect users with AsyncRAT, a remote access trojan. Victims are lured through deceptive ads and social media links to counterfeit booking sites, where they are tricked into running a malicious PowerShell script. The attack results in full remote control of the infected system, putting sensitive personal information at risk. 

Key Insights: 

• Attackers use fake CAPTCHA prompts to manipulate users into executing malware. 

• The AsyncRAT payload allows for full system access, including surveillance and data theft. 

• Domains rotate every few days, making detection and blocking more difficult. 

Further Reading: Malwarebytes Blog 

UNC6040 – Voice Phishing to Salesforce Data Extortion 

Google Threat Intelligence Group (GTIG) is tracking UNC6040, a financially motivated threat cluster specializing in voice phishing (vishing) campaigns. This group is successfully impersonating IT support to gain access to organizations' Salesforce instances, primarily to steal large volumes of data for subsequent extortion. Their tactics rely heavily on manipulating end users rather than exploiting software vulnerabilities. 

Key Insights: 

• Vishing is Key: UNC6040 uses convincing phone calls, often targeting English-speaking employees, to socially engineer access. 

• Salesforce Data Loader Abuse: They trick victims into authorizing malicious versions of Salesforce Data Loader, gaining broad access to exfiltrate sensitive data. 

• Lateral Movement: After Salesforce, they use stolen credentials for lateral movement into other cloud platforms like Okta and Microsoft 365. 

• No Platform Vulnerability: Attacks exploit user trust and process gaps, not inherent Salesforce flaws. 

• Persistent Threat: Extortion can occur months after the initial intrusion, indicating a patient and persistent threat. 

Further Reading: The Cost of a Call: From Voice Phishing to Data Extortion 

June 2025 - ExploreSec Cybersecurity Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Be Cautious of Government Emails About Unpaid Tolls and Other Urgent Matters 

Have you recently received an email from a government agency about an unpaid toll or another urgent issue? It's important to be extra careful, as cybercriminals are now exploiting official government email systems to send out scam messages. 

Key Insights: 

• Scammers are using official-looking emails that appear to come from legitimate government departments. 

• A common scam involves emails claiming unpaid tolls and urging you to click a link to pay. 

• Be wary of urgent requests for information or payment designed to pressure you. 

• Always check the actual web address of a link by hovering over it without clicking. Suspicious or non-official links should be avoided. 

• Never share personal or financial information through links in suspicious emails. 

• Independently verify any questionable government emails by contacting the agency directly through their official website or phone number. 

Further Reading: TechCrunch 

Beware of Crypto Scams Promoted Through Hacked Social Media 

The Internet Crime Complaint Center (IC3) has issued a public service announcement warning about a growing trend: scammers are taking over social media accounts and using them to trick people into investing in fake cryptocurrency schemes. These scams can look very convincing because they appear to come from accounts you or your friends might already follow. 

Key Insights to Protect Yourself: 

• Be suspicious of investment opportunities shared via social media: Even if a post comes from a friend's account, be very cautious about any cryptocurrency investment being promoted. Their account may have been hacked. 

• Look for red flags in investment promises: Be wary of claims of guaranteed high returns with little to no risk. Legitimate investments always carry some level of risk. 

• Don't rush into investment decisions: Scammers often create a sense of urgency to pressure you into investing quickly before you have time to think it over or do your research. 

• Verify the information through official sources: Before investing in any cryptocurrency opportunity, independently research the platform or opportunity through trusted financial news outlets and official cryptocurrency websites. Don't rely solely on what you see on social media. 

• Be cautious of direct messages about investments: If you receive unsolicited direct messages on social media encouraging you to invest in cryptocurrency, treat them with extreme caution, even if they appear to be from someone you know. 

• Report suspicious activity: If you see suspicious cryptocurrency promotions on social media, report them to the platform. If you have been a victim of such a scam, file a complaint with the IC3 at ic3.gov. 

Remember: If an investment opportunity sounds too good to be true, it probably is. 

Further Reading: IC3 

Hacked TikTok Videos Push Fake Apps and Steal Your Info! 

Trend Micro researchers have uncovered a concerning new trend: videos on TikTok are promoting what appear to be pirated apps, but are actually designed to trick you into downloading dangerous "infostealer" malware like Vidar and StealC. These videos use clever social engineering, providing step-by-step instructions that lead users to compromise their own systems. 

Key Insights: 

• Be Skeptical of "Free" Pirated Apps: If an offer seems too good to be true, especially for paid software offered for free, it's very likely a scam. 

• Avoid Unsolicited Technical Instructions: Never follow commands or instructions from untrusted sources, particularly if they tell you to disable security features or run unusual software. 

• Verify Video Sources: Just because a video is popular doesn't mean it's legitimate. Be cautious of content that pushes you to download files or visit external sites. 

• Recognize Social Engineering: Scammers use convincing visuals and instructions to make their malicious content seem harmless and easy to follow. Always pause and think before acting. 

Further Reading: Trend Micro 

Watch Out for Payroll Scams and Fake Login Pages! 

Cybercriminals are getting sneakier, using new tricks to steal your paycheck. A recent alert highlights how attackers are using "SEO poisoning" to create fake payroll login pages that show up at the top of search results. If you fall for it and enter your login details, they can change your direct deposit information and reroute your pay! 

Key Insights: 

• Access Payroll Directly: Don't rely on search engines. Always go to your payroll portal by typing the official website address directly into your browser or using a trusted bookmark. 

• Enable Multi-Factor Authentication (MFA): If your payroll portal offers MFA (like a code sent to your phone), enable it! This adds an extra layer of security. 

• Be Wary of Suspicious Changes: Set up alerts in your payroll software to notify you of any changes to your direct deposit information. If you get an unexpected alert, investigate immediately. 

• Report Unauthorized Changes: Know how to report any unauthorized changes or suspicious activity to your HR or IT department right away. 

• Update Your Devices: Keep your home office routers and mobile devices updated with the latest software and use strong, unique passwords. Attackers can exploit weaknesses in outdated systems to hide their activities. 

Further Reading: ReliaQuest 

Deceptive CAPTCHA "ClickFix" Campaign Uses Clipboard Injection to Deliver Malware 

Threat actors are employing a new social engineering campaign, dubbed "ClickFix," that utilizes fake CAPTCHA prompts on compromised or cloned websites. This sophisticated technique tricks users into launching malware by combining clipboard injection with abuse of the Windows Run dialog, leading to the delivery of payloads like Lumma Stealer and NetSupport RAT. 

Key Insights: 

• Social Engineering Focus: The campaign heavily relies on user fatigue with CAPTCHA mechanisms, guiding victims through seemingly familiar steps to execute malicious code. 

• Clipboard Injection & Run Dialog Abuse: The core of the attack involves copying a malicious PowerShell or mshta command to the clipboard, which users are then instructed to paste and execute in the Windows Run dialog. 

• Living Off the Land Binaries (LOLBins): Attackers extensively use trusted system binaries like PowerShell, mshta.exe, and certutil.exe to bypass traditional security defenses, making detection challenging. 

• Payloads: Frequently observed payloads include infostealers (e.g., Lumma Stealer targeting browser data, credentials, and crypto wallets) and remote access tools (e.g., NetSupport RAT for full system access). 

• Simplicity and Effectiveness: The campaign's success stems from its simplicity, avoiding zero-day exploits or complex hidden mechanisms, relying instead on user interaction. 

• Proactive Defense: This campaign underscores the need for robust endpoint detection and response (EDR) solutions capable of behavioral analysis and detection of LOLBin abuse, alongside user education on suspicious CAPTCHA prompts and the dangers of pasting unknown commands. 

Further Reading: SecurityOnline.info 

Cybercriminals Exploit AI Hype to Spread Malware 

Cybercriminals are increasingly exploiting the public's interest in artificial intelligence by creating fake AI-themed websites and advertisements to distribute malware. A recent campaign identified by Mandiant Threat Defense involves the threat group UNC6032 using deceptive ads on platforms like Facebook and LinkedIn to lure users into downloading malicious software disguised as AI video generation tools. 

Key Insights: 

• Deceptive Advertising: Thousands of malicious ads have been disseminated, impersonating legitimate AI tools such as Luma AI and Canva Dream Lab. These ads direct users to fraudulent websites designed to mimic authentic AI services. 

• Malware Deployment: Upon interacting with these fake sites, users are prompted to download a ZIP file containing the STARKVEIL malware dropper. This dropper installs multiple malware components, including GRIMPULL, XWORM, and FROSTRIFT, which are designed to steal sensitive information and establish persistent access to the victim's system. 

• Information Theft: The deployed malware targets a range of data, including login credentials, cookies, credit card information, and digital wallet contents. Some components, like XWORM, also perform keylogging and screen capture, further compromising user privacy. 

• Evasion Techniques: The malware employs sophisticated methods to avoid detection, such as using Braille pattern blank characters to obscure file extensions and leveraging legitimate processes for malicious activities. 

This campaign underscores the importance of vigilance when engaging with online advertisements, especially those offering AI-related services. Users should be cautious of unsolicited offers and verify the legitimacy of websites before downloading any software. 

Further Reading: Google Cloud Blog 

Beyond the Kill Chain: How Cybercriminals Invest Their Profits 

Sophos X-Ops' five-part series, Beyond the Kill Chain, explores what happens after a successful cyberattack. The series reveals how financially motivated threat actors invest their illicit earnings—often blending legitimate business with ethically questionable and outright criminal ventures. 

Key Insights: 

• Legitimate Business Ventures: Cybercriminals are investing in seemingly lawful enterprises such as restaurants, real estate, and e-commerce platforms. These ventures help launder money while also creating additional income streams. 

• Ethically Dubious Activities: Some threat actors operate in legal gray zones, selling spyware, monetizing vulnerability research under the guise of security services, or manipulating online traffic for advertising profits. 

• Criminal Enterprises: Illicit gains are also funneled into traditional criminal operations like counterfeit goods, drug trafficking, and underground gambling, showing how cybercrime supports broader organized crime ecosystems. 

• Implications for Cybersecurity: Mapping how threat actors reinvest their profits helps threat intelligence teams understand evolving risk models and disrupt the infrastructure supporting ongoing cybercriminal activity. 

Further Reading: Sophos News 

CFOs Targeted in Sophisticated Spear-Phishing Campaign 

A recent spear-phishing campaign is targeting Chief Financial Officers (CFOs) and finance executives across banking, energy, insurance, and investment sectors in regions including Europe, Africa, Canada, the Middle East, and South Asia. The attackers use a multi-stage approach to deploy NetBird, a legitimate WireGuard-based remote access tool, onto compromised systems. 

Key Insights: 

• Deceptive Recruitment Emails: The campaign begins with emails impersonating a Rothschild & Co recruiter offering a “strategic opportunity.” Victims are directed to a Firebase-hosted page featuring a custom CAPTCHA to access a malicious file. 

• Malicious Payload Delivery: After solving the CAPTCHA, users download a ZIP file containing a VBS script. When executed, it installs NetBird and OpenSSH, creates a hidden local admin account, and enables Remote Desktop Protocol (RDP) for persistent attacker access. 

• Evasion Techniques: The use of custom CAPTCHAs and trusted hosting services helps the attackers bypass traditional security defenses and increases credibility. 

• Attribution: Some infrastructure overlaps with known nation-state campaigns, but the specific threat actor remains unidentified. 

Further Reading: Trellix Blog 

Threat Actors Exploit Google Apps Script for Evasive Phishing Attacks 

Threat actors are leveraging Google's Apps Script platform to host phishing pages that appear legitimate, allowing them to steal login credentials. These campaigns often begin with emails posing as invoice notifications, linking to webpages hosted using Google Apps Script. By operating within Google's trusted environment, attackers make their phishing pages seem more authentic, increasing the chances of success. 

Key Insights: 

• Abuse of Trusted Services: Google Apps Script, a JavaScript-based platform used for automating Google Workspace tasks, is being exploited to host fake login pages that capture user credentials and send them to attacker-controlled servers. 

• Evasion of Security Measures: Because the scripts are hosted on Google's own domain, they can bypass traditional email and web filters that typically block suspicious domains. 

• Sophisticated Phishing Techniques: The phishing emails and login prompts are convincingly designed to mimic legitimate services, making it more likely that targets will engage and provide sensitive information. 

Further Reading: BleepingComputer 

Cybercriminals Use Fake Booking Sites to Spread AsyncRAT Malware 

Cybercriminals are exploiting fake Booking.com websites to infect users with AsyncRAT, a remote access trojan. Victims are lured through deceptive ads and social media links to counterfeit booking sites, where they are tricked into running a malicious PowerShell script. The attack results in full remote control of the infected system, putting sensitive personal information at risk. 

Key Insights: 

• Attackers use fake CAPTCHA prompts to manipulate users into executing malware. 

• The AsyncRAT payload allows for full system access, including surveillance and data theft. 

• Domains rotate every few days, making detection and blocking more difficult. 

Further Reading: Malwarebytes Blog 

UNC6040 – Voice Phishing to Salesforce Data Extortion 

Google Threat Intelligence Group (GTIG) is tracking UNC6040, a financially motivated threat cluster specializing in voice phishing (vishing) campaigns. This group is successfully impersonating IT support to gain access to organizations' Salesforce instances, primarily to steal large volumes of data for subsequent extortion. Their tactics rely heavily on manipulating end users rather than exploiting software vulnerabilities. 

Key Insights: 

• Vishing is Key: UNC6040 uses convincing phone calls, often targeting English-speaking employees, to socially engineer access. 

• Salesforce Data Loader Abuse: They trick victims into authorizing malicious versions of Salesforce Data Loader, gaining broad access to exfiltrate sensitive data. 

• Lateral Movement: After Salesforce, they use stolen credentials for lateral movement into other cloud platforms like Okta and Microsoft 365. 

• No Platform Vulnerability: Attacks exploit user trust and process gaps, not inherent Salesforce flaws. 

• Persistent Threat: Extortion can occur months after the initial intrusion, indicating a patient and persistent threat. 

Further Reading: The Cost of a Call: From Voice Phishing to Data Extortion 

April 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

This is a newsletter I create and share with my internal security team. Feel free to grab and do the same.

Camera Off: Akira Deploys Ransomware via Webcam 

Akira, a notorious ransomware group, has demonstrated a novel technique by bypassing Endpoint Detection and Response (EDR) tools through the compromise of unsecured webcams. After facing detection while attempting to deploy ransomware on a Windows server, Akira pivoted to target a vulnerable webcam on the victim's network. This device, running a lightweight Linux OS and lacking EDR, allowed the group to deploy Linux-based ransomware successfully. This incident emphasizes the importance of securing IoT devices and enhancing patch management strategies. 

Key Insights: 

• IoT devices, such as webcams, can be used as pivot points for attackers to bypass traditional security tools like EDR. 

• Akira's adaptability highlights how ransomware groups are evolving and using multiple platforms for attacks. 

• Organizations should prioritize securing all devices, including IoT, and ensuring comprehensive patch management. 

Further Reading: S-RM 

Not Just for Developers: How Product and Security Teams Can Use GitHub Copilot 

GitHub Copilot is transforming not just development teams but also product and security teams. With its AI-powered code generation, it can assist security teams in identifying vulnerabilities faster and help product teams in generating feature specifications or optimizing documentation. Copilot's integration into the workflow allows these teams to accelerate their tasks and focus more on strategy rather than repetitive tasks, improving efficiency and productivity across the board. 

Key Insights: 

• GitHub Copilot isn't just for coders; it’s valuable for security and product teams too. 

• It accelerates vulnerability identification and aids in documentation and feature specification. 

• Teams can leverage AI to improve efficiency and focus on high-impact work. 

Further Reading: GitHub Blog 

Blink and They're In: How Rapid Phishing Attacks Exploit Weaknesses 

Phishing attacks are accelerating, with attackers exploiting weaknesses in systems faster than security teams can respond. In one notable case, attackers gained control of a network in just 48 minutes using social engineering and a flood of spam emails, followed by convincing employees to give remote access. These attacks leverage low-tech tactics, such as using legitimate tools like Microsoft Teams and Quick Assist, to bypass security defenses. 

Key Insights: 

• Attackers are exploiting basic social engineering tactics, such as impersonating IT help desks, to gain control of devices. 

• Rapid response times (48 minutes in this case) highlight the need for automated security measures. 

• Preventative measures include verifying help-desk staff interactions and locking down remote access tools like Quick Assist. 

Further Reading: ReliaQuest 

ACRStealer Infostealer Exploiting Google Docs as C2 

ACRStealer, a new type of infostealer, is taking a unique approach by using Google Docs as an intermediary command-and-control (C2) server. Threat actors hide malicious commands within Google Docs files, leveraging Base64 encoding to keep the communication with the C2 server hidden. The infostealer targets a wide range of sensitive information, including browser data, cryptocurrency wallet files, FTP credentials, and even chat program data. This shift in tactics highlights the evolving nature of cybercrime and the need for robust monitoring and secure data handling practices to detect and prevent such attacks. 

Key Insights: 

• ACRStealer uses Google Docs, telegra.ph, and Steam as intermediary C2 servers, making it harder to detect the malware's activity. 

• The malware targets sensitive data like browser history, cryptocurrency wallet files, and FTP credentials. 

• It continues to evolve by hiding its communication strings within different services to evade detection. 

Further Reading: AhnLab 

SecTopRAT Bundled in Chrome Installer Distributed via Google Ads 

A new phishing attack is leveraging Google Ads to distribute a fake Google Chrome installer bundled with SecTopRAT, a remote access Trojan (RAT) with stealer capabilities. Users searching for the legitimate Google Chrome installer are led to a malicious Google Sites page, where they unknowingly download the malware disguised as Chrome. The attack bypasses Windows Defender by dynamically retrieving and decrypting the malicious payload, allowing attackers to inject the malware into a legitimate process, giving them control of the victim's system. 

Key Insights: 

• The malware is hidden in a fake Chrome installer, which is distributed through Google Ads and Google Sites. 

• Once installed, SecTopRAT is deployed, giving attackers remote access and the ability to steal sensitive data. 

• The attack evades detection by dynamically downloading the malware and using anti-virus evasion techniques. 

Further Reading: Malwarebytes 

Abusing CSS for Evasion and Tracking: A New Threat 

Cybercriminals are increasingly abusing Cascading Style Sheets (CSS) to evade detection and track users. By using techniques like hidden text salting, attackers can insert irrelevant, invisible content into emails to bypass spam filters and email parsers. This method can also be used to track user actions and preferences, even when email clients restrict dynamic content like JavaScript. 

These tactics include setting text to invisible properties, manipulating opacity, and hiding content off-screen. Attackers can exploit this for phishing emails and even to fingerprint users based on their system configurations. 

Key Insights: 

• CSS properties like text-indent and opacity are used to conceal malicious content and bypass security measures. 

• CSS can also be abused for tracking user actions and preferences, allowing for advanced targeting in phishing campaigns. 

• Security teams should educate employees about these new evasion tactics and strengthen email defenses. 

Further Reading: Talos Intelligence 

Remote Monitoring and Management (RMM) Tools: Attackers’ First Choice 

Cybercriminals are increasingly turning to legitimate Remote Monitoring and Management (RMM) tools as their first-stage payloads in email campaigns. These tools, typically used by IT teams for managing multiple systems remotely, are now being exploited to collect data, steal finances, and deploy additional malware, including ransomware. In 2024, there was a marked shift, with RMM tools like ScreenConnect, Fleetdeck, and Atera replacing traditional loaders and botnets. This trend emphasizes the need for organizations to monitor remote management tools carefully and ensure they are not abused by attackers. 

Key Insights: 

• RMM tools are being used to facilitate cyberattacks by granting attackers remote access to systems. 

• The use of RMM tools as a first-stage payload is increasing, replacing older attack methods. 

• Organizations must secure their RMM tools and ensure they are used appropriately. 

Further Reading: Proofpoint Blog 

ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims 

The ClickFix technique has gained significant traction among cybercriminals due to its ability to manipulate users into executing malicious actions. By using a clever mix of human psychology and obfuscation, attackers deploy this technique to bypass security systems and install malware. The attack typically involves fake CAPTCHA-like elements, tricking victims into clicking on links or downloading malicious files. This technique has become increasingly popular due to its effectiveness in evading traditional detection methods. 

Key Insights: 

• ClickFix uses obfuscation to bypass security measures and execute malicious actions. 

• Attackers exploit human psychology to trick users into performing actions that compromise security. 

• Organizations should educate employees on recognizing manipulative tactics like ClickFix and improve multi-layered defenses. 

Further Reading: Group-IB Blog 

ESET Discovers Zero-Day Exploit in Windows Kernel (CVE-2025-24983) 

ESET Research has uncovered a zero-day exploit leveraging the CVE-2025-24983 vulnerability in the Windows Kernel, allowing attackers to elevate their privileges. First observed in the wild in March 2023, this exploit was used in conjunction with the PipeMagic backdoor, compromising targeted systems. The discovery highlights the continued use of kernel vulnerabilities in advanced attacks and the importance of regular patching and security monitoring to protect against zero-day threats. 

Key Insights: 

• The exploit targets a critical Windows Kernel vulnerability (CVE-2025-24983), enabling privilege escalation. 

• The attack was first observed in March 2023 and delivered through the PipeMagic backdoor. 

• Organizations must prioritize timely updates and monitoring for signs of this and similar vulnerabilities. 

Further Reading: ESET Research on Bluesky 

From Data to Defense: Insights from ReliaQuest’s 2025 Annual Threat Report 

The 2025 Annual Threat Report from ReliaQuest reveals the rapidly increasing speed of cyberattacks, with attackers moving from initial access to lateral movement in just 48 minutes. AI and automation are now key tools for both attackers and defenders, with organizations needing to integrate AI-driven solutions to keep pace. Phishing remains the primary method of attack, but ransomware tactics are evolving, with more emphasis on data exfiltration rather than encryption. The report offers actionable recommendations, including the need for automated responses, securing remote services, and enhancing logging practices to better track and prevent breaches. 

Key Insights: 

• Attackers now complete lateral movement in 48 minutes, stressing the importance of rapid detection and response. 

• AI and automation are critical to addressing the evolving cyberthreat landscape. 

• Ransomware is shifting towards exfiltration and data extortion. 

Further Reading: ReliaQuest 

Microsoft 365 Targeted in New Phishing, Account Takeover Attacks 

New phishing campaigns are leveraging Microsoft 365's infrastructure to conduct account takeover (ATO) attacks, exploiting tenant misconfigurations and using OAuth redirection. One campaign involves attackers sending phishing emails using Microsoft’s own infrastructure, making detection difficult. These emails, masquerading as legitimate Microsoft notifications, direct victims to call centers, bypassing security controls. Another attack uses OAuth apps pretending to be Adobe and DocuSign to steal credentials and deploy malware. Security teams must be vigilant in securing OAuth applications and scrutinizing internal communications. 

Key Insights: 

• Phishing attacks are exploiting Microsoft 365’s infrastructure for ATO attacks. 

• Attackers use fake support contacts and legitimate-looking emails to trick victims. 

• OAuth applications masquerading as trusted brands are used for stealing credentials and deploying malware. 

Further Reading: SecurityWeek 

AI Agent Attacks: A New Threat with Serious Implications 

AI agents, like OpenAI's Operator, are being used by attackers to automate cyberattacks such as phishing, malware creation, and setting up attack infrastructure. As these AI tools become more accessible, they lower the entry barrier for cybercriminals, increasing the risk of widespread and damaging attacks. 

Key Insights: 

• AI agents automate complex attacks, including phishing and malware creation. 

• These tools reduce the effort required for attacks, making them more accessible to cybercriminals. 

• Organizations should strengthen detection systems and control access to mitigate AI-driven threats. 

Further Reading: Symantec Blog 

JavaGhost’s Persistent Phishing Attacks From the Cloud 

JavaGhost, an active cybercriminal group, has evolved from website defacement to launching sophisticated phishing attacks. They exploit misconfigurations in Amazon Web Services (AWS) environments, leveraging services like Amazon Simple Email Service (SES) to send phishing emails using the infrastructure of compromised organizations. These attacks are particularly insidious, bypassing traditional email protections due to the legitimacy of the sending source. JavaGhost has adapted advanced evasion techniques to obscure their activities, making detection harder for defenders. 

Key Insights: 

• JavaGhost exploits AWS misconfigurations to send phishing emails, bypassing email protections. 

• They use advanced evasion techniques to obscure their presence in cloud logs. 

• Organizations must secure AWS environments, restrict IAM permissions, and implement enhanced detection methods. 

Further Reading: Unit42 Blog 

Buying Browser Extensions: A Dangerous Security Risk 

In a recent investigation, it was revealed how attackers are buying up popular browser extensions and using them for malicious purposes. Extensions that started as helpful tools can easily be sold to the highest bidder, transforming into spyware or data harvesters without the original developers or users being notified. This risky practice allows new owners to repurpose permissions, such as tracking browsing behavior or stealing sensitive data, all without any visible changes to the extension’s appearance. 

Key Insights: 

• Extensions can be sold and repurposed for malicious use, including tracking user data or even stealing login credentials. 

• The process of transferring ownership of extensions is relatively easy, with few security checks from platforms like Google Chrome. 

• Organizations should actively monitor the extensions in use and verify the legitimacy of any new updates or ownership changes to prevent security risks. 

Further Reading: Secure Annex Blog 

Menlo Security Report: 130% Increase in Zero-Hour Phishing Attacks and Nearly 600 Incidents of GenAI Fraud 

Menlo Security's 2025 State of Browser Security Report reveals a 130% increase in zero-hour phishing attacks and highlights nearly 600 incidents of GenAI fraud. Attackers are using generative AI to impersonate legitimate platforms and manipulate users into disclosing personal information. Additionally, cybercriminals are leveraging sophisticated evasion techniques to bypass traditional security systems. With phishing sites growing by nearly 700% since 2020, organizations must prioritize browser security to mitigate these evolving threats. 

Key Insights: 

• A surge in generative AI-based fraud, with cybercriminals impersonating platforms to steal personal data. 

• Nearly 1M new phishing sites are created monthly, reflecting a 700% increase since 2020. 

• Attackers are increasingly exploiting cloud services like AWS and CloudFlare for malicious content hosting. 

Further Reading: Menlo Security 

Is Firebase Phishing a Threat to Your Organization? 

Firebase, a platform commonly used for app development, has been exploited in phishing attacks targeting organizations. Attackers can hijack Firebase’s authentication services to launch phishing campaigns, tricking users into divulging sensitive information. These attacks can be used to steal credentials, and in some cases, manipulate cloud-based services that organizations rely on. With Firebase being a trusted service, users may not immediately recognize these phishing attempts, making it a potent tool for attackers. 

Key Insights: 

• Firebase is being exploited for phishing attacks, often targeting organizations’ authentication systems. 

• Users may unknowingly fall victim due to Firebase’s trusted reputation. 

• Organizations need to be aware of how Firebase can be misused and take proactive measures to secure their systems. 

Further Reading: Check Point Blog 

RansomHub's EDRKillShifter: Unveiling Evolving Ransomware Tactics 

ESET's recent research delves into RansomHub, a prominent ransomware-as-a-service (RaaS) group that emerged in early 2024. The study uncovers RansomHub's connections to established gangs like Play, Medusa, and BianLian, highlighting the dynamic nature of ransomware operations. A focal point of the research is EDRKillShifter, a custom tool developed by RansomHub to disable endpoint detection and response (EDR) systems, enhancing the effectiveness of their attacks. This tool exemplifies the evolving sophistication of ransomware tactics, emphasizing the need for advanced security measures to counteract such threats.  

Key Insights: 

• RansomHub's Emergence: Rapidly rose to prominence in 2024, surpassing established ransomware groups in activity.  

• EDRKillShifter Tool: A custom-developed EDR killer that targets various security solutions to facilitate attacks.  

• Affiliate Connections: Links between RansomHub and other ransomware gangs, suggesting a fluid and interconnected threat landscape.  

Further Reading: ESET Research 

Google Announces Sec-Gemini v1: An Experimental AI Model for Cybersecurity 

Google has introduced Sec-Gemini v1, an experimental AI model designed to enhance cybersecurity operations. By integrating advanced reasoning capabilities with near real-time cybersecurity knowledge, Sec-Gemini v1 aims to improve tasks such as incident root cause analysis, threat analysis, and understanding vulnerability impacts. The model combines Gemini's AI capabilities with data from sources like Google Threat Intelligence (GTI) and the Open Source Vulnerabilities (OSV) database, resulting in superior performance on key cybersecurity benchmarks. Google is offering Sec-Gemini v1 to select organizations, institutions, professionals, and NGOs for research purposes to foster collaboration in advancing AI-driven cybersecurity solutions.  

Key Insights: 

• Sec-Gemini v1 integrates AI with real-time cybersecurity data to enhance security operations.  

• The model outperforms others on benchmarks like CTI-MCQ and CTI-Root Cause Mapping.  

• Google is providing access to Sec-Gemini v1 for research collaborations to advance AI in cybersecurity.  

Further Reading: Google Security Blog 

Off the Beaten Path: Recent Unusual Malware 

Unit 42 researchers have identified several distinctive malware samples exhibiting uncommon characteristics and techniques: 

• C++/CLI IIS Backdoor: A passive backdoor for Internet Information Services (IIS) developed using C++/CLI—a rarely used programming language in malware development. It employs evasive techniques to facilitate unauthorized access. 

• Dixie-Playing Bootkit: This bootkit leverages an unsecured kernel driver to install a GRUB 2 bootloader in a highly unconventional way, showing a creative approach to persistence and system control. 

• ProjectGeass Post-Exploitation Framework: A Windows-based implant of a cross-platform post-exploitation framework written in C++. While not groundbreaking in technique, its atypical structure distinguishes it from mainstream frameworks. 

These samples demonstrate the evolving nature of malware and the increasing variety of methods attackers are using to bypass defenses. 

Further Reading: Unit 42 Blog 

ClickFix: A Deceptive Malware Deployment Technique 

Cybercriminals are employing a tactic known as "ClickFix," which masquerades as a CAPTCHA verification to trick users into executing commands that download malware. This scheme prompts users to press a series of keyboard shortcuts—Windows + R, Ctrl + V, and Enter—that open the Run dialog, paste malicious code, and execute it via mshta.exe, a legitimate Windows utility. This method has been used to deliver various malware families, including XWorm, Lumma Stealer, and AsyncRAT. 

Key Insights: 

• ClickFix attacks exploit user actions to bypass security measures, leading to the installation of credential-stealing malware. 

• Industries such as hospitality and healthcare have been targeted, with attackers impersonating trusted entities like Booking.com. 

• The attack leverages legitimate Windows functionalities (mshta.exe) to execute malicious code, complicating detection efforts. 

Further Reading: Krebs on Security 

PoisonSeed Phishing Campaign Targets Email and CRM Providers 

The PoisonSeed phishing campaign has been identified targeting email and CRM providers, including Mailchimp, Mailgun, and Zoho, to gain unauthorized access to high-value accounts. Attackers create convincing phishing pages that closely resemble legitimate login portals to harvest user credentials. Once access is obtained, they download email lists for use in cryptocurrency-related spam operations. Notably, security expert Troy Hunt fell victim to such an attack, highlighting the sophistication of these phishing attempts. 

Key Insights: 

• PoisonSeed employs highly convincing phishing pages to compromise accounts of email and CRM service providers. 

• Compromised accounts are used to disseminate cryptocurrency-related spam, potentially leading to further financial fraud. 

• Even cybersecurity professionals have been deceived by these tactics, underscoring the need for heightened awareness. 

Further Reading: CSO Online 

98% Increase in Phishing Campaigns Using Russian (.ru) Domains 

Recent analyses have revealed a 98% surge in phishing campaigns hosted on Russian (.ru) top-level domains (TLDs) between December 2024 and January 2025. These campaigns primarily aim to harvest user credentials by employing tactics such as QR codes, auto-redirects, and multi-layered attachments to direct victims to phishing websites. Notably, many of these phishing emails have bypassed security products, including Exchange Online Protection and Barracuda Email Security Gateway. 

Key Findings: 

• 1,500 unique .ru domains identified in the campaign. 

• 377 new domains registered with the "bulletproof" registrar R01-RU. 

• Over 13,000 malicious emails reported. 

• 2.2% of observed emails from .ru domains were phishing attempts. 

• Average age of a .ru domain used in these attacks is 7.4 days. 

Industries Targeted: 

• Business and Economy (36.09%) 

• Financial Services (12.44%) 

• News & Media (8.27%) 

• Health and Medicine (5.6%) 

• Government (4.51%) 

Further Reading: KnowBe4 Blog 

Pharmacist Allegedly Used Keyloggers to Spy on Coworkers at Maryland Hospital 

A former pharmacist at the University of Maryland Medical Center is accused of secretly installing keylogging software on nearly 400 hospital computers over a decade. The class-action lawsuit claims he accessed coworkers’ login credentials, personal files, and even activated webcams in patient exam rooms. The hospital is also being sued for allegedly failing to detect or respond to the breach in a timely manner. 

Key Insights: 

• Keyloggers were reportedly used to steal credentials and access private communications. 

• The software was allegedly installed across hundreds of hospital systems without detection. 

• The incident underscores the importance of monitoring for insider threats and unauthorized software. 

Further Reading: The Record 

April 2025 - ExploreSec Cybersecurity Awareness Newsletter

This is a monthly newsletter I put together for an internal security awareness program. Feel Free to grab and use for your own program.

Macs Targeted by Infostealers in New Era of Cyberthreats 

A new wave of cyberattacks is targeting Mac users with infostealers, malicious programs designed to steal sensitive data like passwords and credit card details. Infostealers have traditionally targeted Windows devices, but in recent years, cybercriminals have turned their attention to Macs. One such threat, Poseidon, is the most active infostealer on Mac today, stealing data from over 160 cryptocurrency wallets, web browsers, and password managers. Cybercriminals use malvertising to deliver these threats, making it crucial for Mac users to be cautious when downloading software and visiting unfamiliar websites. 

Key Insights: 

• Poseidon and other infostealers are now targeting Macs, stealing sensitive data such as passwords and cryptocurrency wallet info. 

• Malicious advertising (malvertising) is being used to trick users into downloading infostealers instead of desired software. 

• Macs are becoming a key target for cybercriminals, and users must exercise caution and implement strong security measures. 

Further Reading: Malwarebytes 

Google Now Allows Digital Fingerprinting of Its Users 

In a shift from its earlier stance, Google has started allowing digital fingerprinting of its users, a practice that could raise significant privacy concerns. This method collects various pieces of data—such as operating system, browser type, IP address, and plugins—to create a unique identifier for users, even when cookies are cleared. While this allows advertisers to track users across sites, it also bypasses the limitations of cookie-blocking tools. 

Key Insights: 

• Digital fingerprinting creates a unique ID for users based on their browser and device characteristics. 

• This technique enables tracking even after cookies are cleared, circumventing privacy protections. 

• Users can take steps to counteract fingerprinting by using privacy-focused browsers, VPNs, and browser extensions. 

Further Reading: Malwarebytes Blog 

FTC Reports $12.5 Billion in Fraud Losses in 2024 

The Federal Trade Commission (FTC) has revealed a staggering increase in fraud-related losses, with reported damages reaching $12.5 billion in 2024. This surge is driven by a combination of online scams, phishing, and identity theft, with a notable increase in fraud targeting older adults and specific industries. As scammers continue to refine their techniques, organizations must remain vigilant and proactive in educating employees and customers on how to recognize and avoid these threats. 

Key Insights: 

• Fraud losses in 2024 hit $12.5 billion, with a significant increase in online scams and identity theft. 

• Older adults and certain sectors are being disproportionately targeted. 

• Organizations must enhance education efforts and improve customer protection measures to mitigate the growing threat. 

Further Reading: FTC Press Release 

DeepSeek Found to Be Sharing User Data with TikTok Parent Company ByteDance 

DeepSeek, an AI app, has been caught secretly sharing user data with ByteDance, the parent company of TikTok. The South Korean Personal Information Protection Commission (PIPC) uncovered that DeepSeek automatically transmitted user data every time the app was accessed, doing so without user consent. This data-sharing practice raises serious concerns about privacy, particularly in light of the ongoing scrutiny surrounding ByteDance’s handling of user data. South Korea has removed DeepSeek from app stores and is considering stronger regulations on foreign companies in the country. 

Key Insights: 

• DeepSeek was found transmitting user data to ByteDance servers without user consent. 

• This app highlights growing concerns about data privacy in AI technologies. 

• South Korea has taken action by removing the app and considering stronger regulations on foreign tech companies. 

Further Reading: Malwarebytes 

Beware of DeepSeek Hype: It's a Breeding Ground for Scammers 

As DeepSeek, an AI language model from China, gains popularity, cybercriminals are capitalizing on its rise with various scams targeting unsuspecting users. Fake websites, malicious developer tools, phishing on social media, and fraudulent investment schemes are being used to trick individuals into disclosing sensitive data or making financial losses. Scammers are even leveraging DeepSeek's name to promote fake cryptocurrency tokens and fake pre-IPO shares. 

Key Insights: 

• Scammers are using fake websites and social media accounts to impersonate DeepSeek and steal user data. 

• Malicious Python packages were uploaded to PyPI, disguised as DeepSeek developer tools, to steal sensitive information. 

• Individuals and businesses must be cautious when downloading tools, verify sources, and implement strong security practices. 

Further Reading: SecurityWeek 

Predatory App Downloaded 100,000 Times from Google Play Store Steals Data, Uses It for Blackmail 

A malicious financial app, "Finance Simplified," has been downloaded over 100,000 times from the Google Play Store. This app, which belongs to the SpyLoan family, promises attractive loan terms but steals sensitive data such as contacts, call logs, and photos. Once the data is collected, the app uses it for blackmail, especially targeting users who fail to make loan payments. Although the app has been removed from the store, it continues to run on affected devices, collecting sensitive data in the background. Users are advised to change passwords, enable two-factor authentication, and monitor their identity for any misuse. 

Key Insights: 

• The app, masquerading as a loan provider, collects personal data for blackmail purposes. 

• Although removed from the Google Play Store, the app still runs on affected devices. 

• Users should take immediate steps to secure their data by changing passwords and enabling two-factor authentication. 

Further Reading: Malwarebytes 

Microsoft 365 Targeted in New Phishing, Account Takeover Attacks 

New phishing campaigns are leveraging Microsoft 365's infrastructure to conduct account takeover (ATO) attacks, exploiting tenant misconfigurations and using OAuth redirection. One campaign involves attackers sending phishing emails using Microsoft’s own infrastructure, making detection difficult. These emails, masquerading as legitimate Microsoft notifications, direct victims to call centers, bypassing security controls. Another attack uses OAuth apps pretending to be Adobe and DocuSign to steal credentials and deploy malware. Security teams must be vigilant in securing OAuth applications and scrutinizing internal communications. 

Key Insights: 

• Phishing attacks are exploiting Microsoft 365’s infrastructure for ATO attacks. 

• Attackers use fake support contacts and legitimate-looking emails to trick victims. 

• OAuth applications masquerading as trusted brands are used for stealing credentials and deploying malware. 

Further Reading: SecurityWeek 

The Epochalypse Project: Addressing the 2038 Bug 

The Epochalypse Project is raising awareness about the 2038 bug, a critical vulnerability in 32-bit timestamp systems that will impact billions of devices worldwide starting January 19, 2038. The bug could cause major disruptions across industries, from healthcare to energy management, due to systems misinterpreting dates and malfunctioning. As the 2038 deadline approaches, the project aims to bring attention to this issue and develop solutions before it becomes a widespread problem. 

Key Insights: 

• The bug affects embedded devices and systems like medical equipment, IoT devices, and transportation infrastructure. 

• If unaddressed, it could cause critical system failures, including banking and security disruptions. 

• The project encourages global collaboration to identify and fix vulnerable systems before 2038. 

Further Reading: Epochalypse Project 

Is Firebase Phishing a Threat to Your Organization? 

Firebase, a platform commonly used for app development, has been exploited in phishing attacks targeting organizations. Attackers can hijack Firebase’s authentication services to launch phishing campaigns, tricking users into divulging sensitive information. These attacks can be used to steal credentials, and in some cases, manipulate cloud-based services that organizations rely on. With Firebase being a trusted service, users may not immediately recognize these phishing attempts, making it a potent tool for attackers. 

Key Insights: 

• Firebase is being exploited for phishing attacks, often targeting organizations’ authentication systems. 

• Users may unknowingly fall victim due to Firebase’s trusted reputation. 

• Organizations need to be aware of how Firebase can be misused and take proactive measures to secure their systems. 

Further Reading: Check Point Blog 

Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon 

Unit 42 researchers have observed a surge in phishing attacks leveraging QR codes, a tactic known as "quishing." Attackers embed malicious URLs within QR codes in documents that mimic legitimate services like DocuSign or Adobe Acrobat Sign. When scanned, these QR codes direct users to phishing sites designed to harvest credentials. Notably, some campaigns employ legitimate website redirection mechanisms and Cloudflare Turnstile for user verification, enhancing their credibility and evading security detection. These attacks have been widespread across the U.S. and Europe, impacting industries such as medical, automotive, education, energy, and finance. Unit 42 

Key Insights: 

• Quishing Tactics: Embedding phishing URLs in QR codes increases the likelihood of users accessing malicious sites, especially when personal devices with potentially weaker security are used.  

• Advanced Evasion Techniques: Utilizing legitimate redirection mechanisms and services like Cloudflare Turnstile allows attackers to bypass traditional security measures. Unit 42 

• Targeted Industries: A broad range of sectors, including medical, automotive, education, energy, and finance, have been affected, indicating the widespread applicability of this tactic. Unit 42 

Further Reading: Unit 42 Blog 

Tax-Themed Phishing Campaigns Surge Ahead of U.S. Tax Day 

As the April 15 tax deadline nears, Microsoft Threat Intelligence has observed a rise in phishing campaigns exploiting tax-related themes to steal credentials and deploy malware. These attacks use social engineering to impersonate IRS notices or tax document requests and incorporate tactics like QR codes, URL shorteners, and cloud-based file sharing to evade detection. Legitimate services, including Microsoft infrastructure, are being abused to enhance credibility and avoid filters. 

Key Insights: 

• Attackers are using tax season as a lure for phishing, often impersonating tax authorities or financial institutions. 

• Tactics include QR codes, shortened URLs, and links to legitimate cloud storage to bypass security tools. 

• Abuse of trusted platforms increases the likelihood of successful compromise. 

Further Reading: Microsoft Security Blog 

ClickFix: A Deceptive Malware Deployment Technique 

Cybercriminals are employing a tactic known as "ClickFix," which masquerades as a CAPTCHA verification to trick users into executing commands that download malware. This scheme prompts users to press a series of keyboard shortcuts—Windows + R, Ctrl + V, and Enter—that open the Run dialog, paste malicious code, and execute it via mshta.exe, a legitimate Windows utility. This method has been used to deliver various malware families, including XWorm, Lumma Stealer, and AsyncRAT. 

Key Insights: 

• ClickFix attacks exploit user actions to bypass security measures, leading to the installation of credential-stealing malware. 

• Industries such as hospitality and healthcare have been targeted, with attackers impersonating trusted entities like Booking.com. 

• The attack leverages legitimate Windows functionalities (mshta.exe) to execute malicious code, complicating detection efforts. 

Further Reading: Krebs on Security 

Pharmacist Allegedly Used Keyloggers to Spy on Coworkers at Maryland Hospital 

A former pharmacist at the University of Maryland Medical Center is accused of secretly installing keylogging software on nearly 400 hospital computers over a decade. The class-action lawsuit claims he accessed coworkers’ login credentials, personal files, and even activated webcams in patient exam rooms. The hospital is also being sued for allegedly failing to detect or respond to the breach in a timely manner. 

Key Insights: 

• Keyloggers were reportedly used to steal credentials and access private communications. 

• The software was allegedly installed across hundreds of hospital systems without detection. 

• The incident underscores the importance of monitoring for insider threats and unauthorized software. 

Further Reading: The Record 

Too Good to Be True? Text-Based Job Scam are Spiking

Feel free to take this blog post and use it for your own internal security awareness program.

Have you ever received a text message offering a part-time job with incredibly high pay and flexible hours? It might sound like the perfect opportunity—until you look a little closer. Over the weekend I received the text below.

At first glance, it seems like a dream gig: no experience needed, immediate pay, and high earnings. But this is a classic job scam designed to lure you in and exploit your trust. Scammers are aware of the current state of the U.S. economy and they are looking to exploit it for their own financial gain.

How These Scams Work:

• Initial Hook: They send a message with flattery and a compelling offer.

• Urgency or Exclusivity: They claim they found your profile and that it’s a unique opportunity.

• Off-Platform Contact: You’re asked to message them on WhatsApp or Telegram—a red flag.

• Fake Training or Tasks: You may be asked to complete “trial” work or even pay a fee up front.

• Financial Risk: Scammers might ask for personal sensitive information, send fake checks, or trick you into forwarding money.

Red Flags to Watch For:

• Vague company info (DSL? TEMU merchants?).

• Unrealistic pay for minimal effort.

• Requests to communicate on encrypted apps like WhatsApp.

• Spelling and grammar issues or overly generic language.

• No official email or website.

What You Can Do:

• Don’t respond to the message.

• Don’t click any links or share personal info.

• Report the message to your mobile provider (forward to 7726).

• Block the number and delete the message.

Stay alert. If a job offer seems too good to be true—it probably is.

Double-Check Before You Hit Send: A Real-World Reminder with Lessons for Healthcare

I created this blog post to share internally as part of security awareness. It’s focused on healthcare but feel free to grab and adjust based on your organization.

We often remind staff to double-check before sharing sensitive information—but a recent national security incident shows just how critical that habit really is. If top government officials can make this kind of mistake, so can we—and in healthcare, the consequences can be just as severe.

What Happened?

Recently, a Signal group chat meant for senior U.S. national security officials mistakenly included Jeffrey Goldberg, editor-in-chief of The Atlantic. The chat included operational details about military actions and involved key figures like the Secretary of Defense and CIA Director. The worst part? No one noticed Goldberg was there. He even left the group on his own, without anyone asking who he was or why he left.

The entire exchange happened on personal devices, outside of secure government systems—an environment where sensitive discussions have no business taking place.

Why This Matters in Healthcare

This story should strike a chord in healthcare. We work in an industry where confidentiality isn’t just a best practice—it’s the law. Whether it’s a patient’s diagnosis, treatment plan, or billing information, sharing sensitive data with the wrong person can lead to HIPAA violations, fines, reputational damage, and—most importantly—a loss of patient trust.

And here’s something we can’t overlook: internal mishaps cause more security incidents than external attacks. It’s not always hackers or ransomware actors—it’s misdirected emails, accidental disclosures, and staff using unapproved tools for convenience. These are preventable mistakes, but only if we stay mindful of how we handle sensitive information.

Best Practices for Handling Sensitive Information

• Verify recipients: Before sharing anything patient-related, make sure you’re communicating with the right colleague—especially in group chats or email threads.

• Use approved platforms: Consumer apps like Signal or iMessage are not secure for handling protected health information (PHI). Stick to tools your organization has approved for sensitive communication.

• Be aware of who's listening: Just because someone is in a conversation doesn’t mean they should be. If you don’t recognize a name, say something.

• Treat names and dates as sensitive too: Even something as simple as a patient’s name and appointment time can be considered PHI under HIPAA.

Security culture in healthcare means asking the hard questions, slowing down when it matters most, and protecting every patient’s privacy—one message at a time. Because it’s not just about following rules. It’s about earning the trust our patients place in us every single day.

March 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

Exploring Q4 2024 Brand Phishing Trends: Microsoft Remains the Top Target as LinkedIn Makes a Comeback 

In the final quarter of 2024, Microsoft continued to be the most targeted brand in phishing campaigns, but LinkedIn made a significant comeback, appearing as a top target for the first time in years. Phishing actors are increasingly leveraging trusted brands to deceive users, with attacks designed to steal sensitive credentials and install malware. Organizations must continue to strengthen defenses against these brand impersonation attacks to protect their users and data. 

Key Insights: 

• Microsoft remains the primary target in brand phishing campaigns, with attackers frequently using its name to trick users into disclosing credentials. 

• LinkedIn’s resurgence as a phishing target highlights the shifting tactics of cybercriminals, who are capitalizing on platforms that users trust. 

• Organizations need to implement strong anti-phishing measures, including employee training and advanced detection tools, to defend against these evolving threats. 

Further Reading: Checkpoint Blog 

Threat Actors Still Leveraging Legit RMM Tool ScreenConnect for Persistence in Cyberattacks 

Cybercriminals are continuing to exploit the legitimate remote monitoring and management (RMM) tool, ScreenConnect, to maintain persistence in cyberattacks. Threat actors are using social engineering to lure victims into installing altered versions of ScreenConnect, which gives them control over victims’ systems. This tool is particularly used to target sensitive data, with specific campaigns focused on Social Security recipients. The attacks are facilitated through bulletproof hosting providers, making it challenging to trace and mitigate these threats. 

Key Insights: 

• ScreenConnect is being used by threat actors to gain persistent access to victims’ systems. 

• Malicious versions of the software are being disguised as legitimate files, such as eStatements from the Social Security Administration. 

• Social engineering tactics are employed to trick users into installing compromised software. 

• Bulletproof hosting providers are being used to shelter malicious activities, making them harder to disrupt. 

Further Reading: Silent Push 

Hackers Spoof Microsoft ADFS Login Pages to Steal Credentials 

Hackers are spoofing Microsoft Active Directory Federation Services (ADFS) login pages to steal user credentials. This attack leverages the trust users have in Microsoft’s secure login page by creating fake versions that closely resemble the original. Once victims enter their credentials, the attackers steal the information for malicious purposes. This highlights the importance of verifying login pages and using multi-factor authentication to protect against such credential theft. 

Key Insights: 

• Hackers are creating fake versions of Microsoft ADFS login pages to capture user credentials. 

• These attacks rely on users trusting the Microsoft login page, making them difficult to detect. 

• Multi-factor authentication (MFA) and vigilant scrutiny of login pages can help prevent successful credential theft. 

Further Reading: BleepingComputer 

Racing the Clock: Outpacing Accelerating Attacks 

In 2024, cyberattack speeds surged, with the average breakout time dropping to just 48 minutes, a 22% reduction from the previous year. Key factors behind this acceleration include more efficient Ransomware-as-a-Service (RaaS) operations, a rise in infostealers, and the use of AI-powered penetration testing tools. As attacks become faster, organizations must enhance their security measures to match the pace of threat actors, leveraging automation and AI to reduce response times and contain attacks before they spread. 

Key Insights: 

• Breakout time—the time from initial access to lateral movement—has decreased to 48 minutes, making it crucial to respond quickly. 

• Infostealers and IABs (Initial Access Brokers) are driving faster breaches by providing quick access to compromised systems. 

• Automation and AI-driven tools are essential for organizations to respond to attacks more efficiently and minimize damage. 

Further Reading: ReliaQuest 

VidSpam: A New Threat Emerges as Bitcoin Scams Evolve from Images to Video 

Bitcoin scams targeting mobile users are evolving with attackers now using video-based spam (VidSpam) to deceive victims. These scammers are sending small video file attachments to lure individuals into fraudulent schemes. The videos often direct recipients to high-pressure WhatsApp groups where personal information or money is extracted. This evolution from image-based scams to video content marks a troubling trend in mobile security. 

Key Insights: 

• Attackers are using small video files (e.g., 14KB .3gp files) to promote Bitcoin scams through multimedia messages. 

• The video attachments encourage victims to join WhatsApp groups where scammers use pressure tactics to steal money or data. 

• As scammers refine their tactics, VidSpam is expected to increase, targeting unsuspecting mobile users. 

Further Reading: Proofpoint 

January 2025’s Most Wanted Malware: FakeUpdates Continues to Dominate 

FakeUpdates malware remains the top threat in January 2025, continuing its dominance in the malware landscape. This malware is primarily distributed through fake software updates that users are tricked into downloading. Once installed, it can enable attackers to take control of the system and steal sensitive information. The persistence of FakeUpdates emphasizes the need for cautious behavior when downloading updates and a heightened focus on secure software practices. 

Key Insights: 

• FakeUpdates continues to lead as one of the most used malware types, delivered through fake update prompts. 

• This malware is often disguised as legitimate updates, compromising systems and exfiltrating data. 

• Users should avoid downloading updates from unverified sources and ensure they only install software from trusted vendors. 

Further Reading: Checkpoint Blog 

Using Genuine Business Domains and Legitimate Services to Harvest Credentials 

Cybercriminals are increasingly using legitimate business domains and services to conduct credential harvesting attacks. By spoofing well-known companies and mimicking their email communications, attackers deceive users into providing their login information. These tactics often involve using business-looking email addresses and phishing links that lead to fake login pages. This trend underscores the need for businesses and consumers to be cautious when interacting with unsolicited messages. 

Key Insights: 

• Phishing attacks are increasingly using trusted business domains and services to trick users into disclosing credentials. 

• Attackers mimic legitimate emails to create fake login pages that steal sensitive information. 

• Users should be cautious of unsolicited messages and verify the authenticity of any login requests by visiting official websites directly. 

Further Reading: KnowBe4 Blog 

Protect Your Data: Russian Spear-Phishing Targets Microsoft 365 Accounts 

A new spear-phishing campaign linked to Russian threat actors is targeting Microsoft 365 users. The attackers use highly customized phishing emails that appear legitimate, aiming to steal login credentials and gain unauthorized access to sensitive information. With Microsoft 365 being a prime target, organizations should enhance their security by training users to recognize phishing attempts and implementing advanced security measures, including multi-factor authentication. 

Key Insights: 

• Russian threat actors are targeting Microsoft 365 accounts using personalized spear-phishing emails. 

• These attacks aim to steal credentials, putting sensitive data at risk. 

• Organizations should deploy multi-factor authentication and conduct regular security awareness training to protect against these threats. 

Further Reading: KnowBe4 Blog 

New Xerox Printer Flaws Could Let Attackers Capture Windows Active Directory Credentials 

Critical vulnerabilities have been found in Xerox VersaLink printers, allowing attackers to potentially capture Windows Active Directory credentials via pass-back attacks. These flaws, affecting firmware versions 57.69.91 and earlier, enable attackers to manipulate printer configurations and redirect authentication credentials. Successful exploitation could allow lateral movement within an organization's network, compromising servers and file systems. Immediate patching and enhanced security measures, such as strong admin passwords and disabling remote access, are advised. 

Key Insights: 

• Xerox VersaLink printers are vulnerable to attacks that can capture Windows Active Directory credentials. 

• Exploiting these vulnerabilities requires physical or remote access to the printer's control interface. 

• Organizations should patch printers immediately, enforce strong passwords, and limit access to vulnerable settings. 

Further Reading: The Hacker News 

ClickFix vs. Traditional Download in New DarkGate Campaign 

A new malvertising campaign has been observed using two different methods to deliver the DarkGate malware: the ClickFix technique and traditional file downloads. The ClickFix method involves a fake CAPTCHA-like page that tricks users into executing a malicious command, while the traditional approach uses a fake software download disguised as a legitimate app. Both methods ultimately deliver the DarkGate malware, highlighting the adaptability of threat actors in refining delivery techniques. 

Key Insights: 

• The ClickFix method tricks users into running malicious code by mimicking a CAPTCHA process. 

• The traditional download method uses fake installers to distribute malware. 

• Both methods successfully deliver DarkGate, with the ClickFix technique possibly yielding higher success rates. 

Further Reading: Malwarebytes 

Russian Phishing Campaigns Exploit Signal's Device-Linking Feature 

Russian phishing campaigns are exploiting the device-linking feature of the Signal messaging app to compromise user accounts. Attackers use malicious QR codes to trick targets into linking their Signal account to an attacker-controlled device, allowing them to monitor private conversations without fully compromising the target's device. This method has been observed in both large-scale campaigns and targeted attacks, especially against military personnel and high-value targets. 

Key Insights: 

• Attackers use malicious QR codes to link Signal accounts to their devices, enabling undetected access to encrypted communications. 

• These phishing techniques often involve impersonating legitimate resources, such as group invitations or app instructions. 

• Signal users are advised to update the app, check linked devices regularly, and enable two-factor authentication for added protection. 

Further Reading: BleepingComputer 

Phishing Attack Hides JavaScript Using Invisible Unicode Trick 

A new phishing attack technique is using invisible Unicode characters to hide malicious JavaScript. This approach involves obfuscating binary values within JavaScript payloads by replacing them with invisible Hangul characters, making the script appear empty. When executed, a proxy retrieves and reconstructs the original code. The attack is particularly difficult to detect, as it uses anti-debugging techniques and avoids triggering security scanners by exploiting whitespace. The campaign targets affiliates of a political action committee, employing highly personalized tactics. 

Key Insights: 

• The phishing attack uses invisible Unicode characters to obfuscate JavaScript payloads, making detection more challenging. 

• Anti-debugging techniques are employed to avoid analysis and redirect attackers if they detect delays in execution. 

• The attack is highly personalized and can evade security scanners by using empty spaces and encoding methods. 

Further Reading: BleepingComputer 

New Facebook Copyright Infringement Phishing Campaign 

A new phishing campaign has been detected targeting Facebook users with fake copyright infringement notices. The attackers use deceptive emails that appear to come from Facebook, claiming that users have violated copyright laws. The emails contain links to fake Facebook pages that prompt users to enter personal information, including passwords. This campaign highlights the ongoing threat of phishing attacks that impersonate trusted platforms like Facebook. 

Key Insights: 

• The phishing emails mimic Facebook's notifications about copyright violations to trick users into sharing sensitive data. 

• Victims are directed to fake pages designed to capture their credentials. 

• Users should be cautious about unsolicited emails and verify the authenticity of any official communications by visiting Facebook directly. 

Further Reading: Check Point Blog 

University Site Cloned to Evade Ad Detection, Distributes Fake Cisco Installer 

A recent malicious campaign involved cloning a German university website to evade ad detection, distributing a fake Cisco AnyConnect installer. The attackers leveraged a Google ad to direct users to a fraudulent site designed to mimic a legitimate university page, with the goal of deploying the NetSupport RAT. The malware, disguised as a Cisco update, was signed with a valid certificate and allowed attackers to remotely access infected systems. 

Key Insights: 

• Attackers cloned a university website to evade detection, delivering a fake Cisco installer via a Google ad. 

• The malware, NetSupport RAT, was hidden in a digitally signed installer and granted remote access to attackers. 

• Users should exercise caution when downloading software, especially from sponsored ads, and verify the authenticity of the source. 

Further Reading: Malwarebytes 

How Hunting for Vulnerable Drivers Unraveled a Widespread Attack 

An investigation into vulnerable drivers revealed a widespread attack exploiting these weaknesses to gain unauthorized access. Attackers used outdated or unpatched drivers to deploy malware and maintain persistence within compromised systems, bypassing traditional security measures. This emphasizes the need for regular updates and comprehensive vulnerability management to safeguard against such threats. 

Key Insights: 

• Attackers exploited outdated drivers to gain system access and deploy malware. 

• The attack allowed persistent control over systems, evading detection. 

• Regular driver updates and vulnerability assessments are crucial for preventing similar attacks. 

Further Reading: Check Point Blog 

2024 Account Takeover Statistics 

Proofpoint’s latest research highlights the alarming prevalence of account takeover (ATO) attacks, which are now among the most common cyberattack types. These attacks involve threat actors gaining control of legitimate user accounts to execute malicious activities, including data breaches and fraud. The findings underscore the importance of strong authentication and continuous monitoring to prevent unauthorized access and protect sensitive data. 

Key Insights: 

• ATO attacks remain a leading threat, with significant consequences for organizations and users. 

• Gaining access to legitimate accounts allows attackers to bypass security measures and execute more damaging attacks. 

• Organizations should prioritize multi-factor authentication and robust monitoring to mitigate ATO risks. 

Further Reading: Proofpoint 

DeepSeek Lure Used to Spread Malware 

A new DeepSeek campaign uses CAPTCHA-like pages to distribute malware. Attackers use fake CAPTCHA challenges to lure users into executing malicious code, evading detection by appearing harmless. The campaign primarily targets users who are tricked into downloading and running the malware. This attack illustrates how cybercriminals are exploiting popular web features to deliver malicious payloads. 

Key Insights: 

• The malware is delivered through fake CAPTCHA-like pages, making it seem legitimate. 

• Attackers use this method to bypass security filters and trick users into downloading harmful software. 

• Regular security updates and cautious behavior when interacting with unfamiliar websites can help mitigate such threats. 

Further Reading: Zscaler Blog 

Botnet Targets Basic Auth in Microsoft 365 Password Spray Attacks 

A large botnet, consisting of over 130,000 compromised devices, is conducting password-spray attacks against Microsoft 365 accounts. The attackers are using Basic Authentication to evade Multi-Factor Authentication (MFA) protections, exploiting plaintext credentials to access accounts without triggering alerts. This method targets accounts with weak or leaked passwords and bypasses security measures that typically protect interactive sign-ins. Organizations are urged to disable Basic Auth, enforce MFA, and implement Conditional Access Policies (CAP) to protect against these attacks. 

Key Insights: 

• The botnet targets Basic Authentication to bypass MFA and gain unauthorized access. 

• Attackers use stolen credentials to conduct widespread password-spray attacks on Microsoft 365 accounts. 

• Disabling Basic Auth and enabling MFA are critical defenses against this type of attack. 

Further Reading: BleepingComputer 

New Undetectable Batch Script Uses PowerShell and Visual Basic to Install XWorm 

A new undetectable malware campaign uses a highly obfuscated Batch script to deliver the XWorm RAT or AsyncRAT. The script employs PowerShell and Visual Basic Script (VBS) to bypass security tools and download the malware. Once executed, the script establishes persistence and exfiltrates data via Telegram’s API. This campaign marks a significant evolution in fileless attacks, leveraging AI-generated code and cloud-based C2 to evade detection. 

Key Insights: 

• The malware uses a Batch script, PowerShell, and VBS to download XWorm or AsyncRAT. 

• Obfuscation and environmental checks make the attack difficult to detect by security tools. 

• Telegram’s API is used to exfiltrate system data, blending malicious traffic with legitimate communications. 

• AI tools may have assisted in generating the code, increasing sophistication and evasion tactics. 

Further Reading: GBHackers 

Chinese Hackers Target Hospitals by Spoofing Medical Software 

A new phishing campaign has been discovered where Chinese hackers are targeting hospitals by spoofing medical software, including fake updates for health-related applications. The hackers use these fake updates to deliver malware, gaining access to sensitive healthcare data. Hospitals and healthcare organizations are urged to be cautious of unsolicited software updates and to ensure they are obtaining updates from official sources. 

Key Insights: 

• Attackers are spoofing medical software updates to distribute malware in healthcare organizations. 

• The campaign targets sensitive healthcare data, with phishing emails disguised as software updates. 

• Healthcare organizations should verify software updates and ensure they come from trusted sources. 

Further Reading: KnowBe4 Blog 

GreyNoise 2025 Mass Internet Exploitation Report: Attackers Are Moving Faster Than Ever — Are You Ready? 

The 2025 Mass Internet Exploitation Report reveals a dramatic increase in the speed and scale of cyberattacks, with attackers exploiting vulnerabilities faster than security teams can respond. In 2024, automated exploitation of known vulnerabilities was rampant, with legacy flaws from as far back as the 1990s being targeted alongside new threats. The most commonly exploited vulnerabilities were in home routers and IoT devices, which are often overlooked in traditional security strategies. To stay ahead of this rapidly evolving threat, executives must prioritize real-time intelligence and adapt patching and defense strategies to address both old and new vulnerabilities. 

Key Insights: 

• Attackers are automating vulnerability exploitation, surpassing traditional patching strategies. 

• Legacy vulnerabilities are still prime targets, with some dating back decades. 

• Ransomware groups are using mass exploitation to gain access, making real-time threat intelligence a necessity for effective defense. 

Further Reading: GreyNoise 

Threat Spotlight: Inside the World’s Fastest Rising Ransomware Operator — BlackLock 

BlackLock, a rapidly rising ransomware-as-a-service (RaaS) operator, has gained prominence for its custom malware and unique data-leak tactics. By Q4 2024, it had become the seventh most active ransomware group, using double extortion to encrypt data and steal sensitive information. BlackLock’s sophisticated leak site and the rapid expansion of its affiliate network via the Russian-language RAMP forum highlight its threat to organizations globally. Executives should prioritize enhancing defense strategies against evolving ransomware threats, including securing third-party access and increasing employee awareness about spear-phishing tactics. 

Key Insights: 

• Custom malware and bespoke ransomware distinguish BlackLock from competitors, making it harder for security tools to detect and defend against. 

• The data-leak site uses unique tricks to pressure victims into paying ransoms before assessing the full scope of the breach. 

• BlackLock’s growing influence on the RAMP forum indicates a well-established network that supports its global ransomware activities. 

Further Reading: ReliaQuest 

Black Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal 

Black Basta and Cactus ransomware groups have expanded their attack methods by incorporating BackConnect malware. This malware creates an outbound connection, which enables attackers to remotely control compromised systems, bypassing security measures designed to block inbound attacks. By integrating BackConnect into their operations, these groups can maintain access to systems even after initial detection, facilitating long-term exploitation. Organizations must strengthen defenses to detect and block this new tactic and limit the potential damage. 

Key Insights: 

• BackConnect malware allows attackers to maintain persistent access through outbound connections. 

• This technique enables ransomware groups to bypass detection and continue exploiting compromised systems. 

• Organizations should improve detection capabilities to identify and block BackConnect traffic. 

Further Reading: Trend Micro 

Scammers Mailing Ransom Letters While Posing as BianLian Ransomware 

A new scam has emerged where fraudsters are mailing fake ransom letters to businesses, posing as the notorious BianLian ransomware group. The letters, claiming to be from BianLian, demand large Bitcoin ransoms, threatening to release sensitive data if payment is not made within 10 days. However, cybersecurity experts quickly identified multiple red flags: inconsistencies in the language, uncharacteristic delivery via physical mail, and no evidence of data breaches. This scheme aims to exploit the fear and reputation of a known ransomware group for financial gain. 

Key Insights: 

• Scammers are impersonating BianLian ransomware to demand Bitcoin payments via physical mail. 

• The letters use fear tactics, mimicking legitimate ransomware practices, but with numerous inconsistencies. 

• Organizations should educate employees on recognizing such scams and ensure cybersecurity defenses are up to date. 

Further Reading: HackRead 

March 2025 - ExploreSec Cybersecurity Awareness newsletter

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program. Created with help from ChatGPT.

Personal Information Compromised in Grubhub Data Breach 

A recent data breach at Grubhub has compromised personal information of millions of users. The breach exposed sensitive details such as names, email addresses, and passwords, leading to potential risks of identity theft and fraud. Customers are urged to change their passwords and monitor their accounts for any unusual activity. This incident highlights the importance of securing user data and staying vigilant after a breach. 

Key Insights: 

• Grubhub's recent data breach exposed sensitive personal information, including names and email addresses. 

• Customers should change passwords and monitor accounts for suspicious activity to protect against identity theft. 

• This breach underscores the need for stronger data protection measures and proactive security practices in handling consumer information. 

Further Reading: SecurityWeek 

Beware of Lazarus LinkedIn Recruiting Scam 

A new LinkedIn recruiting scam linked to the Lazarus Group is targeting professionals with fake job offers. The scam lures victims into sharing personal information or downloading malicious files, ultimately leading to data theft or malware infections. As the threat actor behind this campaign is known for cyber espionage and financial theft, users must remain cautious when interacting with unsolicited job offers on LinkedIn. 

Key Insights: 

• The Lazarus Group is behind a LinkedIn recruiting scam aimed at stealing personal information and spreading malware. 

• The scam involves fake job offers that seem legitimate, tricking victims into revealing sensitive details. 

• Users should verify job offers before engaging and avoid downloading files or clicking links from unknown sources. 

Further Reading: GBHackers 

Love Gone Phishy: Check Point Research Exposes Valentine’s Day Cyber Threats 

Check Point Research has uncovered a rise in phishing campaigns during the Valentine's season, targeting users with fake promotions, gifts, and love-related messages. These attacks are exploiting the festive period to lure victims into clicking malicious links or sharing sensitive information. This underscores the importance of maintaining cybersecurity practices during high-traffic times like holidays. 

Key Insights: 

• Phishing campaigns around Valentine's Day are using romantic themes to deceive users into revealing personal information. 

• These threats often involve fake websites or links promising deals and gifts, leading to credential theft or malware infection. 

• Consumers should be cautious when clicking on unsolicited links, especially during holiday seasons, and verify offers from trusted sources. 

Further Reading: Check Point Blog 

Fake Etsy Invoice Scam Tricks Sellers into Sharing Credit Card Information 

A new scam targeting Etsy sellers involves fake invoices that appear to come from Etsy's support team. These fraudulent invoices contain links that lead to a phishing page, designed to steal credit card information. Sellers are urged to carefully examine the sender’s email address and to avoid clicking links in suspicious emails. Etsy never requires credit card information for verification purposes, and any such request should be treated as a red flag. 

Key Insights: 

• The scam begins with a fake invoice sent via email, often with a PDF attachment that appears legitimate. 

• Fraudulent websites closely mimic Etsy’s design but ask for sensitive data, including credit card information. 

• Sellers should avoid clicking on email links and should visit Etsy’s official site directly to verify any account requests. 

Further Reading: Malwarebytes 

Using Genuine Business Domains and Legitimate Services to Harvest Credentials 

Cybercriminals are increasingly using legitimate business domains and services to conduct credential harvesting attacks. By spoofing well-known companies and mimicking their email communications, attackers deceive users into providing their login information. These tactics often involve using business-looking email addresses and phishing links that lead to fake login pages. This trend underscores the need for businesses and consumers to be cautious when interacting with unsolicited messages. 

Key Insights: 

• Phishing attacks are increasingly using trusted business domains and services to trick users into disclosing credentials. 

• Attackers mimic legitimate emails to create fake login pages that steal sensitive information. 

• Users should be cautious of unsolicited messages and verify the authenticity of any login requests by visiting official websites directly. 

Further Reading: KnowBe4 Blog 

Phishing for Love: A Sharp Surge in Valentine’s Day-Themed Scams 

As Valentine's Day approaches, scammers are leveraging love-themed phishing attacks to deceive users into clicking malicious links or revealing personal information. These scams often appear as romantic gift offers, fake delivery notices, or enticing deals, tricking individuals into providing sensitive data or making fraudulent payments. This surge in phishing tactics highlights the need for extra caution during the holiday season. 

Key Insights: 

• Valentine’s Day scams are using themed messages to entice victims into sharing personal information or clicking on malicious links. 

• These scams often come in the form of fake gift offers, e-cards, and package delivery notifications. 

• Users should avoid clicking on unsolicited links and verify offers before engaging with any communications. 

Further Reading: KnowBe4 Blog 

Tips for Detecting Real-time Deepfakes: A Guide to Staying One Step Ahead 

As deepfake technology becomes more sophisticated, it’s increasingly important to know how to identify fake videos and images in real-time. These manipulated media files are often used for scams, misinformation, or even social engineering attacks. The blog offers practical tips for detecting deepfakes, such as examining inconsistencies in video and audio quality, checking metadata, and verifying the source of the content. With deepfakes becoming more prevalent, staying informed about these techniques can help protect against digital manipulation. 

Key Insights: 

• Real-time detection of deepfakes is critical as they are being used in a variety of attacks. 

• Signs to look for include mismatched lighting, unnatural facial movements, and inconsistencies in audio. 

• Verifying sources and cross-checking information are essential steps in detecting fake content. 

Further Reading: KnowBe4 Blog 

Protect Your Data: Russian Spear-Phishing Targets Microsoft 365 Accounts 

A new spear-phishing campaign linked to Russian threat actors is targeting Microsoft 365 users. The attackers use highly customized phishing emails that appear legitimate, aiming to steal login credentials and gain unauthorized access to sensitive information. With Microsoft 365 being a prime target, organizations should enhance their security by training users to recognize phishing attempts and implementing advanced security measures, including multi-factor authentication. 

Key Insights: 

• Russian threat actors are targeting Microsoft 365 accounts using personalized spear-phishing emails. 

• These attacks aim to steal credentials, putting sensitive data at risk. 

• Organizations should deploy multi-factor authentication and conduct regular security awareness training to protect against these threats. 

Further Reading: KnowBe4 Blog 

New Facebook Copyright Infringement Phishing Campaign 

A new phishing campaign has been detected targeting Facebook users with fake copyright infringement notices. The attackers use deceptive emails that appear to come from Facebook, claiming that users have violated copyright laws. The emails contain links to fake Facebook pages that prompt users to enter personal information, including passwords. This campaign highlights the ongoing threat of phishing attacks that impersonate trusted platforms like Facebook. 

Key Insights: 

• The phishing emails mimic Facebook's notifications about copyright violations to trick users into sharing sensitive data. 

• Victims are directed to fake pages designed to capture their credentials. 

• Users should be cautious about unsolicited emails and verify the authenticity of any official communications by visiting Facebook directly. 

Further Reading: Check Point Blog 

Phishing Kit Abuses Open Graph to Target Social Media Users 

A new phishing kit takes advantage of the Open Graph protocol, which is commonly used to display rich media on social media platforms, to deceive users. The kit allows attackers to embed phishing links into seemingly harmless social media posts, making it more difficult for users to identify fraudulent content. By manipulating Open Graph data, the scam appears legitimate, drawing users into phishing sites that steal personal information. 

Key Insights: 

• The phishing kit abuses Open Graph to embed malicious links in social media posts, creating fake but convincing content. 

• This tactic makes it harder for users to detect phishing attempts on social media. 

• Users should be cautious about clicking links in social media posts, especially if they appear unfamiliar or too good to be true. 

Further Reading: KnowBe4 Blog 

Phishing Campaign Disguises as ChatGPT Subscription 

A new phishing campaign is using ChatGPT subscriptions as a cover to steal user credentials. The attackers send emails offering a fake ChatGPT subscription, prompting users to enter their personal and payment information. This method exploits the popularity of ChatGPT and preys on users' trust. Security measures, such as verifying subscription details and avoiding unsolicited emails, can help prevent falling victim to this scam. 

Key Insights: 

• Attackers are using fake ChatGPT subscription offers to steal personal and financial information. 

• The phishing emails mimic legitimate communications, making them harder to detect. 

• Users should verify subscription offers directly on trusted platforms and avoid clicking on links in unsolicited emails. 

Further Reading: Broadcom 

DeepSeek Lure Used to Spread Malware 

A new DeepSeek campaign uses CAPTCHA-like pages to distribute malware. Attackers use fake CAPTCHA challenges to lure users into executing malicious code, evading detection by appearing harmless. The campaign primarily targets users who are tricked into downloading and running the malware. This attack illustrates how cybercriminals are exploiting popular web features to deliver malicious payloads. 

Key Insights: 

• The malware is delivered through fake CAPTCHA-like pages, making it seem legitimate. 

• Attackers use this method to bypass security filters and trick users into downloading harmful software. 

• Regular security updates and cautious behavior when interacting with unfamiliar websites can help mitigate such threats. 

Further Reading: Zscaler Blog 

Chinese Hackers Target Hospitals by Spoofing Medical Software 

A new phishing campaign has been discovered where Chinese hackers are targeting hospitals by spoofing medical software, including fake updates for health-related applications. The hackers use these fake updates to deliver malware, gaining access to sensitive healthcare data. Hospitals and healthcare organizations are urged to be cautious of unsolicited software updates and to ensure they are obtaining updates from official sources. 

Key Insights: 

• Attackers are spoofing medical software updates to distribute malware in healthcare organizations. 

• The campaign targets sensitive healthcare data, with phishing emails disguised as software updates. 

• Healthcare organizations should verify software updates and ensure they come from trusted sources. 

Further Reading: KnowBe4 Blog 

Scanning for Trouble: Behind the Scenes of Our QR Code Phishing Demo 

The KnowBe4 team explores the mechanics of QR code phishing in their latest demo, showcasing how attackers are using QR codes to direct victims to phishing sites. The demo reveals the ease with which malicious actors can create seemingly harmless QR codes that lead to fraudulent sites, designed to steal personal information. By understanding the techniques used in these phishing campaigns, organizations can better educate employees and defend against such attacks. 

Key Insights: 

• QR code phishing is becoming more common, with attackers using them to bypass traditional email filtering techniques. 

• Malicious QR codes often lead victims to fake login pages where sensitive data is harvested. 

• Organizations should educate employees on the risks of scanning unsolicited QR codes and implement strong security measures. 

Further Reading: KnowBe4 Blog 

How Phished Data Turns into Apple & Google Wallets 

Phishing campaigns are evolving, with cybercriminals now using phished data to load stolen payment card information directly into Apple and Google Wallets. These scams often involve SMS messages impersonating services like the USPS or toll operators, tricking users into entering payment details. Once victims provide their information and verification codes, their data is linked to mobile wallets controlled by attackers. This advancement in carding techniques highlights the growing risks of mobile payment systems and the need for heightened security measures. 

Key Insights: 

• Cybercriminals use phishing to steal payment information, converting it into mobile wallets for fraud. 

• These phishing schemes often involve spoofed messages and real-time interaction with human operators. 

• Attackers can use "ghost tap" technology to make fraudulent purchases from a distance using NFC technology. 

Further Reading: Krebs on Security 

Beware of Fake Ransom Note Campaigns Coming Via Snail Mail

I put together this blog post together for an internal security awareness program. Feel free to grab and use for your own.

In recent weeks, an alarming scam has been targeting businesses using a tactic we may not expect: physical mail. Criminals looking to take advantage of data breach news are sending fake ransom notes through snail mail according to a new Guidepoint Security report. In this particular scam the criminals are pretending to be from a newer ransomware-group called "BianLian." These letters demand Bitcoin payments, claiming to hold sensitive data hostage and threatening to release it unless paid within a short timeframe, often 10 days.

What Makes This Scam Dangerous?

The key element that makes these scams so effective is fear. Corporate executives or individuals may panic at the thought of sensitive company data being released, which can lead to rash decisions like paying the ransom. This type of scam capitalizes on the urgency and distress of the threat, even though there is no actual data breach.

FBI's Warning: This is a Scam!

The FBI has issued a Public Service Announcement (PSA), clarifying that there is no verified connection between these ransom letters and the BianLian ransomware group. While the attackers are attempting to intimidate victims, they are, in fact, preying on fear without any real access to stolen data.

What You Should Do

As part of our internal security awareness efforts, it’s essential to be aware of this type of scam. Here are a few tips on how to protect yourself and the organization:

• Remain Calm: If you receive a ransom letter (or any unusual communication), do not respond immediately.

• Report Suspicious Incidents: If you receive a suspicious letter or email, report it to the Service Desk or reach out to the Cybersecurity Team directly.

• Stay Informed: Criminals are constantly shifting tactics to try and get people to fall for their scams. Blogs like this can help you stay informed about the latest threats.

The Bigger Picture: Ransomware is Evolving

While this particular scam may seem unusual, it’s part of a broader trend where ransomware groups and other cybercriminals evolve their tactics to bypass traditional security systems. This underscores the importance of staying ahead of the curve, maintaining awareness of new attack vectors, and ensuring that all team members are educated about the latest cybersecurity threats.

How to Participate in a CTF: A Beginner’s Guide to Capture The Flag Competitions

Generated by ChatGPT with some light editing based on a conversation from a live recording of the podcast with Corelight. The live recording is available on YouTube.

Why Should You Participate in a CTF?

CTFs provide an interactive way to develop technical skills, enhance problem-solving abilities, and gain practical security knowledge. Here’s why you should consider joining one:

• Hands-on Learning – Apply security concepts in a real-world setting.

• Team Collaboration – Work with others to solve complex problems.

• Networking Opportunities – Connect with industry experts and fellow security enthusiasts.

• Skill Validation – Test your knowledge against different challenge levels.

• Fun and Competitive – Experience the thrill of hacking in a safe and controlled environment.

Getting Started with CTFs

Choose the Right CTF

If you’re new, start with beginner-friendly CTFs, such as:

• OverTheWire: Bandit (for Linux basics)

• PicoCTF (a beginner-friendly CTF created by Carnegie Mellon University)

• Hack The Box (provides a variety of cybersecurity challenges)

For more advanced competitions, check CTFTime.org, which tracks global CTF events.

Learn Essential Tools

Familiarize yourself with tools commonly used in CTF challenges:

• Wireshark – For network traffic analysis.

• Burp Suite or OWASP ZAP– For web security testing.

• Zeek – Open-source network monitoring.

• John the Ripper – For password cracking.

• Ghidra or IDA – For reverse engineering binaries.

Understand Common CTF Categories

• Cryptography – Solving encrypted messages and ciphers.

• Web Exploitation – Identifying vulnerabilities in web applications.

• Forensics – Investigating and analyzing system data.

• Reverse Engineering – Understanding how compiled programs work.

• Binary Exploitation – Discovering and exploiting vulnerabilities in executable files.

Practice, Practice, Practice

CTFs require a mix of technical knowledge, creativity, and persistence. Some great platforms to practice include:

• TryHackMe

• Hack The Box

• OverTheWire

• CTFTime.org

• SANS Holiday Hack Challenge (for past challenges and write-ups)

Join a Team or Community

Many CTFs allow team participation, which can be a great way to learn from experienced players. Joining security communities, such as local security meetups, Discord groups, or Defcon groups, can help expand your knowledge.

Avoiding Common Mistakes

• Overthinking – Many CTF challenges have simple solutions. Read questions carefully before diving deep.

• Not Taking Breaks – If you get stuck, step away for a few minutes and return with a fresh perspective.

• Skipping Documentation – Reviewing tool documentation can help you understand how to use them effectively.

Conclusion

Participating in a CTF is one of the most effective ways to learn cybersecurity hands-on, improve your problem-solving skills, and engage with a vibrant cybersecurity community. Whether you’re competing for fun, skill-building, or career advancement, CTFs offer an exciting way to test your knowledge and push your limits.

By choosing the right challenges, using the appropriate tools, and learning from others, you’ll develop a strong cybersecurity foundation that will benefit you in your career.

Exploring TEMPEST: Hacking the Future of Space Security

This blog post is based on a podcast I recorded with Tim Fowler back in January. I’ve used ChatGPT to take the episode transcript and turn it into a blog that I have reviewed and edited. Check out the episode: https://www.exploresec.com/eis/219

The Rise of Space Cybersecurity

Cybersecurity has long been a critical focus in terrestrial technology, but as the space industry continues to expand, the need for security in orbit has never been more urgent. One person leading this charge is Tim Fowler, the creator of TEMPEST, a 1U CubeSat educational project designed to bring hands-on security training into the realm of space systems.

In a recent Exploring Information Security podcast episode, I sat down with Fowler to discuss TEMPEST, its impact on cybersecurity education, and why space security needs a shift in focus.

Why Space Security Matters

The rapid expansion of satellite technology means that more devices than ever before are being launched into space—often without robust security measures. Fowler highlighted that traditional approaches to securing IT systems don’t always translate well to space-based infrastructure.

Some of the key concerns include:

• Unsecured Communication Links – Space systems often rely on unencrypted signals, making them susceptible to interception.

• Satellite Hijacking – Attackers could take control of a satellite’s operations and disrupt services or use it for malicious activities.

• Supply Chain Vulnerabilities – Many CubeSats are built from commercial off-the-shelf components, which can introduce security risks.

TEMPEST allows students and professionals to experience these risks firsthand in a controlled environment, making it an essential tool for training the next generation of space cybersecurity experts.

What is TEMPEST?

TEMPEST—an acronym for Tim’s Endeavor into Manically Producing Educational Space Technologies—is a modular, intentionally vulnerable CubeSat that provides cybersecurity professionals, students, and researchers with a hands-on way to test and hack satellite systems.

Fowler, an expert in space cybersecurity, launched the project to address a major gap in the industry: most CubeSat kits focus on functionality, but none include security as a fundamental component. TEMPEST is designed to fill that void by allowing users to simulate attacks, build defenses, and understand real-world space security challenges.

A Hands-On Approach to Learning

TEMPEST was designed to be modular and hackable. Fowler structured the CubeSat with intentionally built-in security flaws to simulate real-world attack scenarios. Users can explore:

• Radio frequency (RF) security and satellite communications.

• Embedded system vulnerabilities within the CubeSat’s flight computer.

• Software-defined radios (SDRs) for signal interception and manipulation.

• Security hardening techniques to counteract common attack vectors.

The first generation of TEMPEST hardware debuted at Wild West Hacking Fest in 2024, where attendees were able to test, break, and improve upon the system in real time. Fowler also runs training sessions where participants assemble and experiment with the CubeSat, learning about space security hands-on.

The Accidental Broadcast Storm

One of the most entertaining moments Fowler shared was an unexpected security lesson during a training session. When a room full of students powered up their TEMPEST CubeSats simultaneously, the devices inadvertently started talking to each other, creating a self-replicating “broadcast storm.”

This unintentional experiment highlighted a crucial lesson in satellite security: small design choices can have major consequences. Even unintended interactions between satellites can create denial-of-service conditions or unexpected network behaviors, reinforcing the importance of secure communication protocols in space systems.

What’s Next for TEMPEST?

While TEMPEST is currently only available through Fowler’s space cybersecurity training courses, plans are underway to release a public version that allows more people to engage with the project.

Upcoming developments include:

• A new defensive security course focused on satellite protection strategies.

• Open-source release of older TEMPEST versions, allowing users to build their own CubeSats.

• Expanded training opportunities at major security conferences in 2025.

Where to Learn More

If you’re interested in learning about space cybersecurity and hacking CubeSats, TEMPEST offers a unique and invaluable resource. Keep an eye out for future training sessions and updates by following:

🌐 EthosLabs.space – Fowler’s main site for TEMPEST training and updates.
🎙️ Exploring Information Security Podcast – Listen to the full episode for an in-depth discussion on TEMPEST.

Final Thoughts

Space cybersecurity is one of the most exciting frontiers in infosec, and projects like TEMPEST are helping shape the future. By providing a hands-on, educational platform for space security, TEMPEST ensures that the next generation of security professionals is ready to defend our critical space infrastructure. 🚀

What are your thoughts on space cybersecurity? Let’s discuss in the comments!

Inside ShowMeCon: Community, Education, and Security with Dave Chronister

Blog post generated by ChatGPT and reviewed and edited by me.

Cybersecurity conferences have become essential hubs for professionals looking to expand their knowledge, connect with industry leaders, and gain hands-on experience in emerging security trends. Among these, ShowMeCon stands out as a premier security event that blends corporate professionalism with hacker culture. Recently, on the Exploring Information Security podcast, I sat down with ShowMeCon founder Dave Chronister and organizer Brooke Deneen to discuss what makes this conference unique and what attendees can expect in 2025.

The Origin and Vision of ShowMeCon

ShowMeCon was founded with a clear mission: to provide high-quality security education in an engaging, community-driven environment. Unlike traditional conferences that often feel like corporate networking events, ShowMeCon fosters an atmosphere where security researchers, IT professionals, and ethical hackers can exchange knowledge in a collaborative setting.

During the podcast, Dave Chronister shared the story behind ShowMeCon’s inception, emphasizing the importance of bridging the gap between technical expertise and real-world security applications. By creating a space where attendees can both learn and engage with top security minds, the conference has grown into a must-attend event for security professionals.

What Sets ShowMeCon Apart?

One of the defining aspects of ShowMeCon is its ability to strike a balance between corporate and hacker culture. As Brooke Deneen explained, the conference offers a professional yet welcoming environment that caters to both seasoned professionals and newcomers to the field.

Key Features That Make ShowMeCon Unique:

• Immersive Venue: Hosted at the Ameristar Casino in St. Louis, the setting provides a comfortable yet dynamic backdrop for networking and learning.

• Engaging Speakers: The event prioritizes bringing in experts who are not only knowledgeable but also passionate and approachable.

• Hands-On Learning: ShowMeCon features training sessions, Capture The Flag (CTF) competitions, and lockpicking villages, offering attendees the chance to apply their skills in real-world scenarios.

• Expanding Reach: The ShowMeCon team is exploring ways to expand the conference to new cities like Nashville, ensuring more professionals have access to top-tier security education.

Highlights of ShowMeCon 2025

The upcoming 2025 edition of ShowMeCon is set to be bigger and better, with new elements designed to enhance the attendee experience. Some of the highlights include:

• The Return of Pre-Conference Training: Attendees can participate in deep-dive workshops led by industry experts.

• Exciting Themed Experiences: This year’s event will feature a Fallout-theme, adding a creative twist to the conference experience.

• Stronger Community Building: Encouraging new speakers and first-time attendees to engage and contribute to the security conversation.

Why You Should Attend ShowMeCon

If you're looking for a conference that goes beyond lectures and sales pitches, ShowMeCon is for you. Whether you're an IT administrator, security analyst, penetration tester, or student, this event offers valuable insights and opportunities to:

✔️ Learn from industry experts in a practical and engaging environment.
✔️ Network with peers and leaders who share a passion for security.
✔️ Gain hands-on experience through CTFs, training sessions, and interactive villages.
✔️ Explore new security trends that will shape the industry in the coming years.

Final Thoughts

ShowMeCon continues to grow as a hub for cybersecurity professionals. With its community-driven approach, diverse speaker lineup, and immersive experiences, it’s clear why this event has become a staple in the cybersecurity world.

🚀 Want to attend? Visit showmecon.com to learn more and register for the 2025 event.

🎙️ Listen to the full conversation on the Exploring Information Security podcast and you may just hear the discount code to save $50 on tickets or training: Podcast Website

See you at ShowMeCon 2025! 🔐🔥

Understanding the 2025 HIPAA Security Rule Proposal: Key Changes and Implications

In January 2025 I put together a presentation on the proposed changes to the HIPAA Security Rule. You can view the live recording on the ExplorSec YouTube channel. With Valentines Day recently passing I though this would be a good time for a blog post on the proposals for the HIPAA Security Rule. Below is a ChatGPT generated blog post using the transcript from that session that I’ve reviewed and edited .

The U.S. Department of Health and Human Services (HHS) recently proposed updates to the HIPAA Security Rule, aiming to enhance the cybersecurity resilience of healthcare organizations. These changes are in response to the evolving threat landscape, rising breach costs, and the need for stronger regulatory oversight. Let’s explore the proposal, its timeline, and the most significant updates impacting the healthcare industry. The proposal can be viewed at this link: https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html

Why the Change?

HIPAA, originally enacted in 1996, has undergone several updates, with the most recent in 2013. However, with data breaches in healthcare rising sharply, the government is taking action. The cost of healthcare breaches has surged by 50% since 2020, with an average breach costing $10.1 million per organization. Additionally, cybercriminals continue to target healthcare organizations despite previous claims that they would avoid them. In 2023 alone, the FBI received 250 ransomware reports from healthcare organizations—the most of any industry.

Proposed Timeline

• January 6, 2024: Proposal released

• March 7, 2024: Public comment period closes

• Spring 2025: HHS reviews comments and finalizes the rule

• 2026: Full compliance expected for specific requirements

Organizations have an opportunity to provide feedback before implementation, making this a crucial period for healthcare entities to review the proposed changes and assess their impact.

Key Changes in the HIPAA Security Rule Proposal

Revised Terminology and Definitions

Several terms are being modified or newly defined to eliminate ambiguity and prevent misinterpretations that have historically allowed organizations to circumvent security requirements. Notable changes include:

• Security Measures: Clarified to apply to both systems and information.

• Technical Controls & Safeguards: Expanded definitions to include firmware and hardware components.

• User Definitions: Adjusted to remove ambiguity between human users and system entities.

• Addressable and Reasonable & Appropriate Requirements: Refined to ensure organizations do not misinterpret them as optional.

Asset Inventory and Risk Analysis

One of the most critical updates is the requirement for a comprehensive asset inventory of all technical assets that create, receive, maintain, or transmit electronic protected health information (ePHI). Organizations must:

• Maintain a written inventory including device IDs, software versions, responsible personnel, and locations.

• Conduct annual risk analyses aligned with NIST cybersecurity standards.

• Update network maps to track ePHI movement and access points.

Patch Management Requirements

For the first time, HIPAA is setting explicit timelines for patch management:

• Critical vulnerabilities must be patched within 15 days.

• High vulnerabilities must be patched within 30 days.

• Organizations must document any exceptions and review them annually.

Workforce Security and Training Enhancements

Organizations must establish stronger internal security measures, including:

• Mandatory security training for new hires within 30 days.

• Job description reviews to align role-based access controls with actual job functions.

• Regular cybersecurity performance goals for employees, focusing on increasing phishing report rates and improving security awareness.

• Security training on new technology implementations, such as new systems that handle electronic health records (EHRs).

Strengthened Physical and Technical Safeguards

The proposal mandates that organizations demonstrate operational enforcement of security policies rather than relying solely on documentation. This includes:

• Mandatory encryption of ePHI at rest and in transit.

• Elimination of default passwords for all devices.

• Multi-Factor Authentication (MFA) requirements (with exceptions for FDA-approved medical devices).

• Stricter controls for legacy systems, including the requirement that manufacturers must still provide security updates; otherwise, organizations must replace outdated systems.

Business Associate Agreements (BAA)

Healthcare organizations rely on third-party vendors to handle sensitive patient data, and the proposal introduces stricter rules around vendor agreements:

• Vendors must report security incidents within 24 hours of detection.

• Organizations will have up to one year to update contracts.

• New requirements will apply to healthcare plan sponsors, who previously were not subject to the same security obligations.

Addressing Emerging Technologies

The proposal acknowledges the impact of new technologies in healthcare, requiring organizations to assess and prepare for:

• Quantum Computing: Organizations must develop a roadmap for quantum-resistant encryption.

• Artificial Intelligence (AI): Organizations must inventory AI use cases and assess associated security risks.

• Virtual Reality (VR) in Healthcare: VR devices must comply with access management, patch management, and risk management protocols.

Financial Impact and Justification

The estimated cost for implementing these new security controls across all healthcare organizations is $6.8 billion annually. However, HHS argues that if these measures will reduce healthcare breaches by 7-16% and will effectively pay for itself. For individual organizations, first-year compliance costs are estimated at $4.65 million, but with healthcare breaches averaging $10.95 million in damages per incident, the investment is likely to yield significant long-term savings.

What’s Next?

The proposed HIPAA Security Rule updates aim to close loopholes, modernize security requirements, and enforce stricter compliance. Healthcare organizations should begin:

• Reviewing their current security policies, training programs, and technical safeguards.

• Assessing their vendor contracts and business associate agreements.

• Engaging with industry groups or submitting public comments before the March 7 deadline.

For additional details on the HIPAA Security Rule proposal and how to submit public comments, visit the official HHS website.

What are your thoughts on the proposed changes? Let us know in the comments below!

February 2025 - ExploreSec Cybersecurity Awareness newsletter

This is a security awareness focused newsletter that I share internally. Feel free to grab and use for your own internal security awareness program. Created with help from ChatGPT.

How HIPAA Security Rule Updates Could Impact Healthcare Employees 

The U.S. Department of Health and Human Services (HHS) has proposed significant updates to the HIPAA Security Rule, aiming to enhance the protection of electronic protected health information (ePHI). These changes, the first major revision since 2013, will have implications for individuals working in healthcare organizations. 

What You Need to Know: 

• New Security Measures: Employees will be required to use multifactor authentication (MFA) for accessing systems containing ePHI. This adds an extra layer of security by requiring a second verification step, such as a code sent to your phone or email. 

• Improved Data Encryption: All ePHI must be encrypted, meaning employees may encounter updated tools or workflows for handling sensitive information securely. 

• Annual Audits: Organizations will perform regular audits to ensure compliance with the updated rules. Employees may be asked to participate in training or assessments to demonstrate understanding of security policies. 

Why It Matters to You: 

These updates are designed to strengthen defenses against data breaches and ensure the safety of patient information. As healthcare professionals, compliance with these measures not only protects patient data but also safeguards the organization from potential penalties and operational disruptions. 

The proposed rule will be open for public comment starting January 6, 2025. Employees should stay informed about the changes and prepare for any updates to internal policies and procedures. 

Further Reading: Dark Reading 

Phishing Campaign Delivers ConnectWise RAT via Spoofed Social Security Emails 

A recent phishing campaign has been identified wherein attackers impersonate the U.S. Social Security Administration to distribute the ConnectWise Remote Access Trojan (RAT). 

Key Developments: 

• Spoofed Emails: Beginning in September 2024, fraudulent emails masquerading as official communications from the Social Security Administration were disseminated, claiming to provide updated benefits statements. These emails contained links designed to deceive recipients into downloading malicious software. 

• Malware Delivery Mechanism: The embedded links directed users to a ConnectWise RAT installer. Initially, the campaign utilized ConnectWise infrastructure for command and control (C2) operations but later transitioned to dynamic DNS services and domains controlled by the threat actors. 

• One-Time Use Links: The malicious links employed a one-time-use mechanism, redirecting users to the malware installer upon first access and subsequently to the legitimate Social Security Administration website on further attempts. This tactic complicates detection and analysis efforts. 

• Timing and Volume: The campaign's activity surged in early to mid-November, peaking around Election Day, suggesting a potential link to the political climate during that period. 

Further Reading: GBHackers 

Phishing Campaign Targets Gamers with Fake Video Game Testing Offers 

Cybercriminals are employing deceptive emails that promise opportunities to test new video games, aiming to steal personal information and credentials from unsuspecting gamers. 

Key Details: 

• Deceptive Invitations: Victims receive emails inviting them to participate in exclusive game testing, often for highly anticipated titles. 

• Malicious Links: These emails contain links to counterfeit websites designed to mimic legitimate gaming platforms, prompting users to enter sensitive information. 

• Data Theft: Information entered on these fake sites is harvested by attackers for malicious purposes, including identity theft and unauthorized account access. 

Further Reading: KnowBe4 Blog 

New 'US Cyber Trust Mark' Labels to Identify Secure Smart Devices 

The U.S. government has introduced the 'US Cyber Trust Mark,' a voluntary labeling initiative to help consumers identify smart devices that meet federal cybersecurity standards. 

Key Details: 

• Purpose: The label aims to guide consumers in selecting internet-connected devices—such as baby monitors, home security cameras, and fitness trackers—that are less susceptible to hacking. 

• Label Features: Devices meeting the standards will display a distinctive shield logo and include QR codes. Scanning the QR code provides detailed security information about the product. 

• Availability: Products bearing the 'US Cyber Trust Mark' are expected to be available later this year, as manufacturers begin submitting devices for approval. 

• Industry Participation: Companies including Amazon, Best Buy, Google, LG Electronics USA, Logitech, and Samsung have expressed support for the initiative. 

Implications for Consumers: 

With the average American household containing numerous internet-connected devices, each potentially serving as an entry point for cybercriminals, this labeling system offers a straightforward method to assess the cybersecurity of products before purchase. 

Further Reading: SecurityWeek 

PowerSchool Software Cyberattack Potentially Affects 45 Million U.S. Students 

A recent cyberattack targeting PowerSchool, a widely used student information system in K-12 schools across the United States, has led to a significant data breach. This incident may impact over 45 million students and educational staff nationwide. 

Key Details: 

• Compromised Data: The breach has exposed sensitive information, including grades, attendance records, medical histories, Social Security numbers, student profiles, and communications between parents and educators. 

• Potential Risks: The stolen data could be exploited for malicious activities such as phishing attempts, identity theft, and unauthorized access to personal and financial information. 

• Regional Impact: Schools in North Dakota, including West Fargo Public Schools, have notified parents about the breach, indicating that the incident may have far-reaching implications across various educational districts. 

Further Reading: Cybersecurity Insiders 

Data Breach at Leading U.S. Addiction Treatment Provider 

BayMark Health Services, the largest provider of substance use disorder treatment in North America, has reported a data breach potentially compromising patient personal and health information. 

Key Details: 

• Incident Timeline: Unauthorized access to BayMark's systems occurred between September 24 and October 14, 2024. The breach was discovered on October 11, leading to immediate actions to secure systems and involve third-party forensic experts. 

• Compromised Information: While the exact data types accessed have not been publicly detailed, such breaches typically involve personal identifiers and health-related information. 

• Patient Notification: BayMark is in the process of notifying affected individuals and has stated that it will offer complimentary credit monitoring and identity protection services to those impacted. 

Further Reading: BleepingComputer 

Sophisticated Voice Phishing Scams Exploit Apple and Google Services 

Recent investigations have uncovered that cybercriminals are leveraging legitimate Apple and Google services to execute advanced voice phishing (vishing) attacks, deceiving users into divulging sensitive information. 

Key Details: 

• Exploiting Legitimate Services: Attackers initiate contact through genuine Apple and Google communication channels, such as Google Assistant and Apple's support lines, making the interactions appear authentic. 

• Manipulating System Notifications: By abusing these services, scammers can trigger legitimate system-level messages, emails, and automated phone calls, adding credibility to their fraudulent schemes. 

• Case Example: In one instance, a cryptocurrency investor was deceived into transferring over $4.7 million after receiving what seemed to be legitimate communications from Google and Apple, orchestrated by the attackers. 

Recommendations: 

• Verify Contacts: Be cautious of unsolicited communications claiming to be from Apple or Google. Always verify the authenticity of such interactions by contacting the company directly through official channels. 

• Protect Personal Information: Never share sensitive information, such as passwords or financial details, over the phone or through unsolicited messages. 

• Stay Informed: Familiarize yourself with common phishing tactics and remain vigilant for signs of fraudulent activity. 

Further Reading: Krebs on Security 

OneBlood Confirms Data Breach Following Ransomware Attack 

OneBlood, a prominent not-for-profit blood donation organization serving over 250 hospitals across the United States, has confirmed that personal information of donors was compromised during a ransomware attack in July 2024. 

Key Details: 

• Incident Timeline: Unauthorized access to OneBlood's network occurred between July 14 and July 29, 2024. The breach was discovered on July 28, prompting immediate containment measures. 

• Compromised Information: The attackers accessed and copied files containing personal data, including names and Social Security numbers. OneBlood has begun notifying affected individuals and is offering complimentary credit monitoring services. 

• Operational Impact: The ransomware attack led to the encryption of virtual machines, forcing OneBlood to revert to manual processes for blood collection, testing, and distribution. This disruption resulted in delays and shortages, prompting urgent calls for donations, particularly of O Positive, O Negative, and Platelet blood types. 

Further Reading: BleepingComputer 

Phishing Campaigns Exploit YouTube Links and Microsoft 365 Themes 

Cybercriminals are deploying sophisticated phishing attacks targeting Microsoft 365 users by utilizing deceptive URLs that closely resemble legitimate Office 365 domains. These attacks often involve claims of imminent password expiration to create urgency, prompting users to click on malicious links. 

Key Developments: 

• Deceptive URLs: Attackers craft URLs that appear to be legitimate, incorporating prefixes like "youtube.com" followed by obfuscation characters or using the "@" symbol to redirect users to malicious domains while maintaining a facade of legitimacy. 

• Social Engineering Tactics: Phishing emails are designed to induce panic by falsely claiming that the recipient's password has expired, urging immediate action. The emails contain malicious buttons labeled to appear as legitimate account maintenance actions. 

• Obfuscation Techniques: The use of "%20" for HTML space encoding and the "@" symbol in URLs helps attackers conceal the true destination of the links, making it challenging for users to identify the threat. 

Further Reading: GBHackers 

Phishing Texts Target Apple iMessage Users by Disabling Link Protections 

Cybercriminals are employing a new tactic to deceive Apple iMessage users into disabling built-in phishing protections, thereby exposing them to potential scams. 

Key Details: 

• Disabled Links for Unknown Senders: Apple's iMessage automatically disables links in messages received from unknown senders to protect users from potential phishing attacks. 

• Deceptive Tactics: Recent smishing (SMS phishing) attacks have been observed where attackers send messages prompting users to reply with "Y" or another response. This action re-enables the disabled links, making users susceptible to malicious websites. 

• Common Scenarios: Examples include fake shipping issue notifications or unpaid toll alerts, urging immediate action and instructing users to reply to the message to resolve the fabricated issue. 

Recommendations: 

• Avoid Responding to Unknown Messages: Do not reply to messages from unknown senders, especially those prompting you to take specific actions. 

• Verify Sender Authenticity: If a message claims to be from a legitimate organization, contact the entity directly using official channels to confirm the message's legitimacy. 

• Maintain Built-in Protections: Refrain from actions that disable iMessage's security features, such as replying to suspicious messages or adding unknown contacts without verification. 

Stay Vigilant: Always exercise caution when receiving unsolicited messages, and be aware of tactics that attempt to bypass security measures designed to protect your personal information. 

Further Reading: BleepingComputer 

Surge in Phishing Scams Exploiting California Wildfires 

As California confronts devastating wildfires, cybercriminals are exploiting the crisis by launching phishing scams targeting affected individuals and those seeking to assist. 

Key Insights: 

• Emergence of Suspicious Domains: Within a 72-hour period, multiple domains mimicking official services related to the wildfires have been registered. Examples include malibu-fire[.]com and fire-relief[.]com. These domains are likely intended for phishing attacks, fake donation requests, and malicious downloads. 

• Tactics Employed by Scammers: Attackers are creating domains that resemble legitimate services or agencies, distributing phishing emails urging recipients to click on fraudulent links, and using social engineering techniques to create a sense of urgency, such as fake donation drives or critical safety alerts. 

Recommendations: 

• Verify Authenticity: Before engaging with any disaster-related communications or websites, confirm their legitimacy through official channels. 

• Be Cautious with Donations: When donating to relief efforts, use established and reputable organizations. Avoid unsolicited requests for donations, especially those asking for unusual payment methods. 

• Stay Informed: Keep abreast of common phishing tactics and remain vigilant for signs of fraudulent activity, particularly during disaster situations. 

Further Reading: Veriti Blog 

U.S. Sanctions Target North Korean IT Worker Network 

The U.S. Treasury Department has imposed sanctions on a network of individuals and front companies associated with North Korea's Ministry of National Defense, aiming to disrupt revenue streams generated through illicit remote IT work schemes. 

Key Insights: 

• Entities Sanctioned: The Office of Foreign Assets Control (OFAC) has designated North Korean front companies Korea Osong Shipping Co. (Osong) and Chonsurim Trading Corporation (Chonsurim), along with their presidents, Jong In Chol and Son Kyong Sik. Additionally, Chinese firm Liaoning China Trade has been sanctioned for supplying electronics equipment to North Korea's Department 53, a weapons-trading entity that also operates IT and software development front companies. 

• Revenue Generation Tactics: North Korea employs thousands of IT workers who conceal their identities to secure employment with companies abroad. The earnings from these positions are funneled back to the regime, supporting its illegal weapons programs and contributing to destabilizing activities, including support for Russia's war in Ukraine. 

• Legal Implications: As a result of these sanctions, U.S. individuals and organizations are prohibited from engaging in transactions with the designated entities and individuals. Furthermore, any assets linked to them within U.S. jurisdiction are subject to freezing. 

Further Reading: BleepingComputer 

Cybercriminals Exploit Fake Google Ads to Hijack Advertiser Accounts 

Cybercriminals are conducting a sophisticated malvertising campaign targeting Google Ads users by deploying fraudulent advertisements that impersonate legitimate Google Ads services. This tactic aims to steal advertiser account credentials, leading to unauthorized access and potential misuse of advertising budgets. 

Key Insights: 

• Impersonation of Google Ads: Attackers create deceptive ads that appear to be official Google Ads promotions. When clicked, these ads redirect users to counterfeit login pages designed to harvest Google account credentials. 

• Use of Google Sites for Phishing: The fraudulent ads often lead to phishing pages hosted on Google Sites, lending an air of legitimacy and making detection more challenging. These pages are crafted to closely mimic authentic Google login interfaces. 

• Credential Theft and Account Compromise: Once users enter their credentials on these fake pages, attackers gain unauthorized access to their Google Ads accounts. This access can be exploited to run malicious ad campaigns, deplete advertising budgets, or sell the compromised accounts on blackhat forums. 

Recommendations: 

• Verify Ad URLs: Before clicking on any Google Ads-related advertisements, hover over the link to inspect the URL. Ensure it directs to an official Google domain. 

• Enable Multi-Factor Authentication (MFA): Implement MFA on your Google accounts to add an extra layer of security, making unauthorized access more difficult even if credentials are compromised. 

Further Reading: Malwarebytes 

Ransomware Gangs Exploit Microsoft Teams by Impersonating IT Support 

Cybersecurity researchers have identified ransomware groups, including Black Basta, using Microsoft Teams to impersonate IT support and gain unauthorized access to corporate networks. 

Key Insights: 

• Email Bombardment: Attackers flood employee inboxes with non-malicious emails to create confusion and urgency. 

• Fake IT Support: Posing as help desk personnel, attackers use Teams to contact employees and build trust. 

• Remote Access: Victims are tricked into installing remote tools, enabling ransomware deployment and network access. 

Further Reading: BleepingComputer 

Introducing 'Identity Check' 

Google has recently unveiled a new security feature for Android devices called "Identity Check," designed to bolster protection against unauthorized access, especially in the event of device theft. This feature mandates biometric authentication—such as fingerprint or facial recognition—to access sensitive settings when the device is outside of trusted locations like home or work. 

Key Highlights: 

• Biometric Verification: Critical actions, including changing the device's PIN, disabling theft protection, turning off 'Find My Device,' performing a factory reset, and modifying biometric data, now require biometric authentication when the device is in untrusted locations. 

• Trusted Locations: Users can designate specific areas, such as home or workplace, as trusted locations. Outside these zones, the enhanced security measures are activated to prevent unauthorized access. 

• Device Compatibility: Initially, 'Identity Check' is available on Google Pixel devices running Android 15 and Samsung Galaxy devices with One UI 7. Plans are underway to extend this feature to other manufacturers' devices later this year. 

Further Reading: BleepingComputer 

Banshee Stealer Targets macOS Users 

A sophisticated malware known as "Banshee Stealer" is actively targeting macOS users, posing significant risks to personal and financial data. 

Key Details: 

• Stealthy Operation: Banshee operates undetected, blending seamlessly with normal system processes while stealing browser credentials, cryptocurrency wallets, user passwords, and sensitive file data. 

• Distribution Methods: The malware is distributed through phishing websites and malicious GitHub repositories, posing as popular software tools such as Chrome, Telegram, and TradingView. 

Protective Measures: 

• Verify Software Sources: Only download software from official and reputable sources. Be cautious of unsolicited links or prompts to install applications. 

• Update Security Systems: Ensure your macOS and security software are up-to-date to detect and prevent the latest threats. 

• Monitor for Suspicious Activity: Regularly check for unusual system behavior or unauthorized access to accounts. 

Further Reading: Check Point Research 

Texas Investigates Automakers Over Consumer Data Practices 

Texas has broadened its investigation into how automakers collect, use, and share consumer data from modern connected vehicles. The focus is on whether manufacturers are obtaining proper consent, how data is shared with third parties, and whether it is being sold without transparency. This follows growing concerns over privacy risks associated with the data generated by advanced vehicle technologies. 

Key Insights: 

• Automakers Under Scrutiny: Texas is investigating Ford, Hyundai, Toyota, and Fiat Chrysler over data collection, sharing, and sales practices. 

• Data Concerns: The focus includes how consumer data is collected, shared with third parties, and whether consumer consent is obtained. 

• Legal Background: This expands on previous investigations and lawsuits, including action against General Motors for alleged unauthorized data sales. 

Further Reading: Malwarebytes News 

Phishing Campaign Exploits Legitimate Services to Send Fraudulent PayPal Requests 

A recent phishing campaign has been identified that abuses legitimate services to send fraudulent PayPal payment requests, aiming to deceive recipients into compromising their accounts. 

Key Insights: 

• Methodology: Attackers register free Microsoft 365 test domains and create distribution lists containing target email addresses. They then use these lists to send payment requests via PayPal's web portal. 

• Deceptive Tactics: Recipients receive a legitimate-looking PayPal payment request. Clicking the link directs them to a PayPal login page displaying the payment request. If the recipient logs in, their PayPal account becomes linked to the scammer's account, potentially granting the attacker unauthorized access. 

Further Reading: KnowBe4 Security Awareness Training Blog 

Malicious WordPress Plugin Assists in Phishing Attacks 

A newly identified malicious WordPress plugin is being exploited by attackers to conduct phishing campaigns. This plugin allows cybercriminals to send phishing emails from compromised WordPress sites, emphasizing the need for vigilance in securing web platforms and carefully managing plugins. 

Key Insights: 

• The malicious plugin facilitates phishing attacks by using compromised websites to send emails to targets. 

• Regular audits of WordPress sites and plugin installations are essential for mitigating such threats. 

• Ensuring plugins are sourced from trusted providers can help reduce the risk of exploitation. 

Further Reading: Malicious WordPress Plugin Assists in Phishing Attacks 

Insurance Company Accused of Using Secret Software to Illegally Collect and Sell Location Data 

A prominent insurance company is under scrutiny for using secret software to collect and sell location data on millions of Americans without their knowledge or consent. This case raises serious concerns about privacy violations and the unethical use of personal data for profit. It serves as a reminder of the importance of transparency and consent in handling personal information, particularly when it comes to sensitive data like location tracking. 

Key Insights: 

• The insurance company allegedly used secret software to gather location data from individuals without their consent. 

• The collected data was sold, violating privacy laws and raising ethical concerns about data exploitation. 

• Organizations must prioritize transparency and user consent when collecting and using personal data to avoid legal and reputational risks. 

Further Reading: Malwarebytes 

Google Chrome AI Extensions Deliver Info-Stealing Malware in Broad Attack 

A new wave of cyberattacks is targeting Google Chrome users through AI-powered extensions that deliver information-stealing malware. These malicious extensions are designed to steal sensitive data, including login credentials and financial information, from unsuspecting victims. The attack highlights the growing threat posed by browser extensions and the need for users to exercise caution when installing third-party software. 

Key Insights: 

• AI-powered Chrome extensions are being used to deliver info-stealing malware, potentially compromising users' personal and financial information. 

• The use of AI in these extensions makes them more difficult to detect and mitigate. 

• Users should carefully vet any browser extensions they install and prioritize security practices such as using trusted sources and multi-factor authentication. 

Further Reading: Malwarebytes 

Phishing Campaign Targets Mobile Banking Users with Sophisticated Techniques 

A new phishing campaign is targeting mobile banking users with increasingly sophisticated techniques. The attackers are using fake mobile apps and messages that appear to come from trusted financial institutions, convincing victims to provide sensitive information such as account credentials and personal identification details. This attack highlights the growing threat to mobile banking and the importance of user vigilance in identifying fraudulent communications. 

Key Insights: 

• The phishing campaign uses fake mobile apps and messages that mimic legitimate banking services to deceive users. 

• Attackers are focusing on mobile platforms, where users may be less cautious about security risks. 

• Financial institutions and mobile users should remain vigilant, employing multi-factor authentication and other security measures to protect sensitive information. 

Further Reading: Infosecurity Magazine 

Phishing Attack Protection for Teams Chat 

Phishing attacks targeting communication platforms like Microsoft Teams are becoming more prevalent. These attacks often involve malicious links, fake login prompts, or social engineering tactics aimed at stealing sensitive information. Microsoft is introducing a feature that flags external messages, helping users identify and avoid potentially harmful communications. Organizations should also reinforce security measures and provide ongoing training to users to strengthen defenses against these threats. 

Key Insights: 

• Phishing attacks are increasingly targeting platforms such as Microsoft Teams, using malicious links and social engineering techniques. 

• Microsoft is rolling out a feature that flags external messages, which helps users spot potential phishing attempts. 

• Ongoing user education and security best practices remain essential to defending against evolving phishing tactics. 

Further Reading: GBHackers 

These Are the 10 Worst PIN Codes 

A new report highlights the 10 worst PIN codes that are most commonly used, making accounts highly vulnerable to unauthorized access. Cybersecurity experts have long warned against using simple, predictable PINs, but many users still rely on easily guessable codes. This report serves as a reminder to always choose strong, unique PINs to safeguard sensitive accounts. 

Key Insights: 

• Many users still rely on simple, predictable PIN codes, which increases the risk of unauthorized access. 

• The 10 worst PIN codes are some of the most common and easiest to guess, highlighting the importance of stronger security practices. 

• Users should choose complex, unique PIN codes for their accounts to protect personal and financial information from attackers. 

Further Reading: Malwarebytes 

Chinese Innovations Spawn Wave of Toll Phishing via SMS 

A new wave of phishing attacks is emerging, primarily driven by Chinese technological innovations. Cybercriminals are using SMS-based toll phishing to trick users into paying for services or accessing malicious websites. This surge in attacks highlights the growing sophistication of phishing tactics and the need for stronger protections against mobile-based threats. 

Key Insights: 

• Toll phishing attacks via SMS are on the rise, with cybercriminals using Chinese innovations to make the attacks more convincing and widespread. 

• Victims are tricked into paying for non-existent services or clicking on malicious links. 

• Organizations and individuals should implement mobile security practices and be cautious when receiving unsolicited SMS messages. 

Further Reading: Krebs on Security 

Your Location or Browsing Habits Could Lead to Price Increases When Buying Online 

A recent study reveals that online retailers may use your location and browsing habits to adjust prices, leading to potential price increases for certain customers. This practice, known as dynamic pricing, raises privacy concerns and the need for transparency in how personal data is used for commercial purposes. Consumers are advised to be aware of these tactics and consider using privacy tools to protect their online behavior. 

Key Insights: 

• Retailers may adjust prices based on location and browsing behavior, potentially leading to higher costs for some users. 

• Dynamic pricing practices raise concerns about privacy and the ethical use of personal data. 

• Consumers can protect themselves by using privacy tools and being mindful of how their data is shared with online retailers. 

Further Reading: Malwarebytes 

New Syncjacking Attack Hijacks Devices Using Chrome Extensions 

A new form of attack called "Syncjacking" is targeting users by exploiting Chrome extensions to hijack their devices. This attack allows cybercriminals to gain access to users' synchronized data across multiple devices, including passwords, browsing history, and other sensitive information. This highlights the need for users to be cautious when installing browser extensions and to regularly review their sync settings. 

Key Insights: 

• Syncjacking attacks exploit vulnerabilities in Chrome extensions to hijack synced data across multiple devices. 

• The attack compromises sensitive information, such as passwords and browsing history, by gaining access to synchronized accounts. 

• Users should be cautious when installing extensions and ensure they review their sync settings regularly to prevent unauthorized access. 

Further Reading: BleepingComputer 

States Get Failing Grades for Privacy Laws, but Tide May Be Turning 

A new report from the Electronic Privacy Information Center (EPIC) and U.S. PIRG Education Fund reveals that nearly half of U.S. states with consumer privacy laws received failing grades for protecting citizens' data. Of the 19 states with laws, eight received an F, and none earned an A. While many of these laws are seen as weak and influenced by major tech companies, some states like Maryland are starting to adopt stronger privacy protections, offering hope for a more secure future. 

Key Insights: 

• Many states with consumer privacy laws received failing grades due to weak protections for personal data. 

• Big Tech companies have influenced state privacy laws, leading to minimal consumer protection. 

• Maryland’s recent privacy law is one of the strongest in the U.S., limiting data collection and banning targeted ads to minors. 

• States like Vermont, Massachusetts, and Maine are moving toward stronger privacy laws this year. 

Further Reading: EPIC 

February 2025 - ExploreSec Cybersecurity Threat Intelligence Newsletter

This is a monthly newsletter that I share internally with our Cybersecurity team. Feel free to take and use for your own team. Created with the help of ChatGPT.

ModeLeak Vulnerabilities in Google's Vertex AI Platform 

Palo Alto Networks' Unit 42 team has uncovered two critical vulnerabilities, collectively termed "ModeLeak," within Google's Vertex AI platform. These flaws could enable attackers to escalate privileges and exfiltrate sensitive machine learning (ML) models, including fine-tuned large language model (LLM) adapters. 

Key Insights: 

• Privilege Escalation via Custom Jobs: Attackers can exploit custom job permissions to gain unauthorized access to data services within a project, leading to potential exposure of sensitive information. 

• Model Exfiltration through Malicious Models: By deploying a poisoned model, adversaries can exfiltrate other fine-tuned models in the environment, risking proprietary data and custom optimizations. 

Google has addressed these vulnerabilities by implementing fixes in the Vertex AI platform. Organizations utilizing Vertex AI should review their security protocols to ensure protection against similar threats. 

Further Reading: Unit 42 Blog 

Black Basta Ransomware Adopts Advanced Social Engineering Tactics 

The Black Basta ransomware group has recently enhanced its attack strategies by incorporating sophisticated social engineering techniques, including email bombing, QR code phishing, and the deployment of custom malware payloads. 

Key Developments: 

• Email Bombing: Attackers inundate targets with excessive emails by subscribing their addresses to numerous mailing lists. This tactic overwhelms victims and increases the likelihood of interaction with subsequent malicious communications. 

• Impersonation via Microsoft Teams: Threat actors pose as IT support personnel, contacting victims through Microsoft Teams to establish trust and facilitate the installation of remote access tools. 

• QR Code Phishing: Malicious QR codes are sent to victims, directing them to phishing sites designed to harvest credentials or deploy additional malware. 

• Custom Malware Deployment: The group utilizes bespoke tools such as KNOTWRAP (a memory-only dropper) and KNOTROCK (a .NET-based utility) to execute ransomware payloads stealthily. 

Further Reading: The Hacker News 

North Korean IT Workers Infiltrating Global Companies 

Recent investigations have uncovered that operatives from the Democratic People's Republic of Korea (DPRK) are securing remote IT positions in international companies under false identities. These individuals channel their earnings to fund North Korea's weapons programs, posing significant security and compliance risks to employers. 

Key Insights: 

• Use of False Identities: North Korean IT workers often utilize stolen or fabricated identities to obtain employment, making detection challenging. 

• Revenue Generation for DPRK: Earnings from these positions are funneled back to North Korea, supporting its sanctioned weapons development initiatives. 

• Potential for Insider Threats: Beyond financial implications, these operatives may have access to sensitive company data, increasing the risk of intellectual property theft and cyber espionage. 

Further Reading: Unit 42 Blog 

North Korean IT Workers Linked to Phishing Attacks via Malicious Video Conferencing Apps 

Unit 42 researchers have identified a cluster of North Korean IT operatives, designated as CL-STA-0237, involved in phishing attacks that deploy malware through counterfeit video conferencing applications. Operating primarily from Laos, these individuals have secured positions in various companies, leveraging their roles to further malicious activities. 

Key Insights: 

• Malware Distribution: The group utilizes fraudulent video conferencing platforms to disseminate malware, notably the BeaverTail and InvisibleFerret remote access trojans, compromising systems during supposed job interview processes. 

• Global Reach: By infiltrating organizations worldwide, these operatives support North Korea's illicit endeavors, including its weapons of mass destruction and ballistic missile programs. 

• Evolving Tactics: The shift from merely seeking income to engaging in aggressive malware campaigns indicates a significant escalation in their operational strategies. 

Further Reading: Unit 42 Blog 

Surge in 'ClickFix' Social Engineering Attacks 

Cybersecurity researchers have identified a significant increase in the use of a social engineering tactic known as "ClickFix." This method deceives users into copying and pasting malicious commands into their systems, leading to malware infections. 

Key Developments: 

• Deceptive Error Messages: Attackers present fake error dialogs, prompting users to execute provided commands to resolve non-existent issues. 

• Malware Delivery: By following these instructions, users inadvertently run scripts that download and install malware such as Lumma Stealer and AsyncRAT. 

• Global Impact: Campaigns employing ClickFix techniques have targeted organizations worldwide, with notable incidents involving fake GitHub security notifications and counterfeit software updates. 

Further Reading: Proofpoint Blog 

Malicious Ads Deliver SocGholish Malware to Kaiser Permanente Employees 

A recent cyberattack has targeted Kaiser Permanente employees through malicious advertisements on Google Search, leading to the distribution of SocGholish malware. 

Key Developments: 

• Malicious Advertisements: Threat actors placed deceptive ads mimicking Kaiser Permanente's HR portal to lure employees searching for benefits and payroll information. 

• Compromised Website Redirects: Clicking the fraudulent ad redirected users to a compromised website, bellonasoftware[.]com, which briefly displayed a phishing page before prompting a fake browser update. 

• SocGholish Malware Deployment: The fake browser update led to the download of "Update.js," a malicious script associated with the SocGholish malware campaign, designed to collect system information and potentially allow human operators to execute further malicious actions. 

This incident highlights the evolving tactics of cybercriminals in exploiting trusted platforms like Google Ads to distribute malware. 

Further Reading: Malwarebytes Blog 

DarkGate Malware Leveraging Vishing via Microsoft Teams 

Recent analyses have identified a concerning trend in which cybercriminals are deploying DarkGate malware through vishing (voice phishing) attacks conducted via Microsoft Teams. 

Key Developments: 

• Social Engineering Tactics: Attackers impersonate employees from known client organizations during Microsoft Teams calls, convincing victims to download remote desktop applications like AnyDesk. 

• Malware Deployment: Once remote access is established, DarkGate malware is installed, enabling threat actors to execute malicious commands, gather system information, and maintain persistent access. 

• Operational Impact: Although some attacks have been thwarted before data exfiltration, the initial breach underscores vulnerabilities in user awareness and the potential for significant security incidents. 

Further Reading: Trend Micro Research 

Sophisticated Phishing Campaigns Exploit Trusted Platforms 

Recent analyses have uncovered advanced phishing campaigns targeting employees across multiple industries and jurisdictions. These operations employ sophisticated techniques to bypass Secure Email Gateways (SEGs) and exploit trusted platforms, creating highly convincing schemes to deceive victims and steal their credentials. 

Key Developments: 

• Exploitation of Trusted Platforms: Attackers leverage familiar platforms and services to enhance the credibility of their phishing attempts, making it more challenging for victims to identify fraudulent communications. 

• Bypassing Secure Email Gateways (SEGs): The campaigns utilize advanced methods to evade detection by SEGs, allowing malicious emails to reach employees' inboxes undetected. 

• Wide-Ranging Targets: Over 30 companies across 12 industries and 15 jurisdictions have been affected, indicating a broad and indiscriminate approach by the threat actors. 

Further Reading: Group-IB Blog 

Top Cyber Attacker Techniques (August–October 2024) 

Recent analyses have identified key cyber attacker tactics, techniques, and procedures (TTPs) observed between August 1 and October 31, 2024. 

Key Developments: 

• Phishing Incidents: Phishing accounted for 46% of all customer incidents during this period, indicating a significant rise likely due to high employee turnover and the accessibility of phishing kits. 

• Prevalent Malware: "SocGholish" and "LummaC2" emerged as the most frequently observed malware in customer environments, highlighting their widespread use in recent attacks. 

• Cloud Services Alerts: There was a 20% increase in cloud services alerts, correlating with the rising adoption of cloud accounts and associated security challenges. 

• Ransomware Activity: Despite a slowdown in "LockBit" ransomware activity due to law enforcement actions and a loss of affiliate trust, it remains a key player. Meanwhile, "RansomHub" is rising rapidly due to its attractive ransomware-as-a-service (RaaS) model. The U.S., manufacturing sector, and professional, scientific, and technical services (PSTS) sector are primary targets amidst an overall increase in ransomware attacks. 

• Initial Access Broker (IAB) Activity: IAB activity increased by 16%, heavily targeting U.S.-based organizations, possibly due to perceived financial capabilities stemming from cyber insurance. 

• Insider Threat Content: A 7% rise in insider threat discussions on cybercrime forums was noted, driven by significant financial incentives, underscoring the growing complexity of cybersecurity challenges. 

• Impersonating Domain Alerts: There was a 6% increase in alerts related to impersonating domains, indicating ongoing reliance on simple techniques to capture credentials and data. 

Further Reading: ReliaQuest Blog 

Phishing Attacks Double in 2024 

Recent analyses reveal a significant surge in phishing activities throughout 2024, with overall phishing messages increasing by 202% in the latter half of the year. Notably, credential phishing attacks have escalated by 703% during the same period. 

Key Developments: 

• Prevalence of Zero-Day URLs: Approximately 80% of malicious links identified are zero-day threats—newly created URLs designed to evade traditional detection methods. 

• Diversification of Attack Vectors: While link-based phishing remains predominant, there is a notable increase in text-based threats, such as business email compromise (BEC) and invoice scams, as well as file-based threats employing techniques like HTML smuggling. 

• Expansion Beyond Email: Phishing attacks are increasingly targeting multiple platforms, including SMS, LinkedIn, and Microsoft Teams, indicating a shift towards multichannel approaches. 

Further Reading: Infosecurity Magazine 

Surge in Phishing Attacks via New Top-Level Domains 

Recent analyses reveal a significant increase in phishing attacks, with a 40% rise observed in the year ending August 2024. A substantial portion of this growth is attributed to the exploitation of new generic top-level domains (gTLDs) such as .shop, .top, and .xyz, which are favored by cybercriminals due to their low registration costs and minimal verification requirements. 

Key Developments: 

• Disproportionate Use in Cybercrime: Although new gTLDs constitute only 11% of the market for new domains, they account for approximately 37% of reported cybercrime domains between September 2023 and August 2024. 

• Attraction to Low-Cost Registrations: Registrars offering domain registrations for less than $1, with little to no identity verification, are particularly appealing to spammers and scammers seeking to conduct malicious activities anonymously. 

• ICANN's Expansion Plans: Despite the misuse of these new gTLDs, the Internet Corporation for Assigned Names and Numbers (ICANN) is proceeding with plans to introduce additional gTLDs, potentially broadening the landscape for cybercriminal activities. 

Further Reading: Krebs on Security 

 

Surge in Suspicious Domain Registrations Exploiting High-Profile Events 

Recent analyses have identified a significant increase in suspicious domain registration campaigns exploiting high-profile events, such as the 2024 Summer Olympics in Paris. 

Key Developments: 

• Event-Driven Domain Registrations: Threat actors register deceptive domains containing event-specific keywords to mimic official websites, aiming to deceive users seeking legitimate information. 

• Exploitation of Public Interest: Cybercriminals leverage global events to attract large audiences, using fraudulent domains to distribute malware, conduct phishing attacks, or sell counterfeit merchandise. 

• Indicators of Malicious Activity: Monitoring domain registrations, DNS traffic, URL patterns, and textual characteristics can help identify and mitigate these threats. 

Further Reading: Unit 42 Blog 

Zloader Malware Adopts DNS Tunneling for Stealthier C2 Communications 

Recent analyses have identified that the Zloader malware, a modular Trojan based on the leaked Zeus source code, has incorporated DNS tunneling into its command-and-control (C2) communication methods. 

Key Developments: 

• DNS Tunneling Implementation: Zloader now employs a custom protocol over DNS, utilizing IPv4 to tunnel encrypted TLS network traffic. This technique enables the malware to conceal its C2 communications within standard DNS queries and responses, making detection more challenging. 

• Enhanced Anti-Analysis Features: The latest version of Zloader includes improved anti-analysis capabilities, such as environment checks and API import resolution algorithms, to evade malware sandboxes and static detection methods. 

• Interactive Shell Capability: Zloader has introduced an interactive shell that supports over a dozen commands, potentially facilitating hands-on keyboard activity by threat actors during attacks. 

Further Reading: Zscaler Blog 

Cybercriminals Exploit Fake CAPTCHAs to Distribute Malware 

Recent analyses have identified a deceptive tactic where cybercriminals use fake CAPTCHA pages to distribute malware, exploiting users' trust in these verification systems. 

Key Developments: 

• Malicious Redirects: Users visiting compromised websites are redirected to fraudulent CAPTCHA pages that closely mimic legitimate services like Google and CloudFlare. 

• Clipboard Hijacking: These fake CAPTCHAs silently copy malicious commands to the user's clipboard via JavaScript, prompting them to execute these commands unknowingly through the Windows Run prompt. 

• Malware Installation: Executing the copied commands leads to the installation of malware, including information stealers and remote-access trojans (RATs), which can extract sensitive data and provide persistent access to compromised systems. 

Further Reading: ReliaQuest Blog 

Threat Actors Exploit LDAP for Network Enumeration 

Recent analyses have identified that both nation-state and cybercriminal threat actors are leveraging the Lightweight Directory Access Protocol (LDAP) to perform network enumeration within Active Directory environments. 

Key Developments: 

• Abuse of LDAP Attributes: Attackers utilize LDAP queries to extract sensitive information, such as user accounts, group memberships, and permissions, facilitating lateral movement and privilege escalation within compromised networks. 

• Use of Enumeration Tools: Tools like BloodHound and its data collector, SharpHound, are commonly employed to map Active Directory structures, identifying potential attack paths and high-value targets. 

• Detection Challenges: Distinguishing between legitimate and malicious LDAP activity is difficult due to the high volume of benign LDAP traffic in typical network environments, complicating efforts to detect and mitigate these attacks. 

Further Reading: Unit 42 Blog 

'Araneida' Web Hacking Service Linked to Turkish IT Firm 

Recent investigations have uncovered that 'Araneida,' a cloud-based web hacking service, is utilizing a cracked version of Acunetix—a commercial web application vulnerability scanner—to facilitate cyberattacks. Notably, this service has been traced back to a Turkish information technology firm. 

Key Developments: 

• Exploitation of Cracked Software: Araneida employs an unauthorized version of Acunetix, enabling users to perform offensive reconnaissance, extract user data, and identify exploitable vulnerabilities on target websites. 

• Proxy Integration for Anonymity: The service incorporates a robust proxy network, allowing scans to originate from a diverse pool of IP addresses, thereby concealing the true source of the activity. 

• Cybercriminal Promotion: Advertised on multiple cybercrime forums and boasting a Telegram channel with nearly 500 subscribers, Araneida has been linked to the compromise of over 30,000 websites within six months. One user claimed to have purchased a luxury vehicle using proceeds from payment card data obtained through the service. 

• Connection to Turkish IT Firm: Investigations reveal that the domain araneida[.]co, operational since February 2023, is associated with an individual employed as a senior software developer at Bilitro Yazilim, an IT firm based in Ankara, Turkey. 

Further Reading: Krebs on Security 

LLMs Employed to Obfuscate Malicious JavaScript 

Recent analyses have revealed that adversaries are leveraging large language models (LLMs) to obfuscate malicious JavaScript code, enhancing its ability to evade detection mechanisms. 

Key Developments: 

Automated Code Obfuscation: Attackers utilize LLMs to iteratively transform malicious JavaScript through techniques such as variable renaming, dead code insertion, and whitespace removal, without altering the code's functionality. 

Evasion of Detection Tools: These LLM-generated variants can bypass traditional detection tools, including static analysis models, by producing natural-looking code that is harder to identify as malicious. 

Scalability of Attacks: The use of LLMs enables the creation of numerous unique malware variants at scale, increasing the difficulty for security systems to detect and mitigate these threats effectively. 

Further Reading: Unit 42 Blog 

Mobile Phishing Attacks Employ New Tactics to Evade Security Measures 

Recent analyses have identified a novel social engineering tactic targeting mobile banking users. Attackers are leveraging Progressive Web Apps (PWAs) and WebAPKs to distribute phishing websites disguised as legitimate applications, effectively bypassing traditional security warnings and app store vetting processes. 

Key Insights: 

• Exploitation of PWAs and WebAPKs: Unlike traditional apps, these malicious PWAs and WebAPKs are essentially phishing websites packaged to look like legitimate applications. This means they do not exhibit the typical behaviors or characteristics associated with malware, making detection more challenging. 

• Bypassing Security Measures: Their ability to bypass traditional security warnings of a mobile operating system, and total sidestepping of app store vetting processes, is particularly concerning. This allows attackers to distribute malicious content without triggering standard security alerts. 

• Anticipated Increase in Sophistication: It is anticipated that more sophisticated and varied phishing campaigns utilizing PWAs and WebAPKs will emerge, unless mobile platforms change their approach towards them. 

Further Reading: KnowBe4 Blog 

Tax Fraud: How to Avoid Criminals Filing Fraudulent Returns

This is a post I put together for my own internal security awareness program. Feel free to grab and use within your own organization. Created with help from ChatGPT. 

Tax season is a time when individuals and businesses focus on filing their returns and securing their refunds. However, it is also a prime opportunity for fraudsters looking to exploit the system. One particularly alarming form of fraud is when criminals file tax returns on behalf of individuals without their knowledge, stealing valuable refunds in the process. This type of fraud, known as tax-related identity theft, can have serious financial consequences for the victim. In this post, we'll dive into how this scheme works, its impact, and the steps you can take to protect yourself.

How the Scheme Operates

1. Data Acquisition Criminals obtain personal information through a variety of methods, such as data breaches, phishing attacks, or purchasing stolen data from underground markets. This personal information—such as your Social Security number and other identifying details—becomes their key to committing fraud.

2. Filing False Returns Once they have the necessary information, criminals file tax returns on behalf of individuals without their consent, typically early in the tax season to get ahead of the legitimate filer.

3. Refund Diversion The fraudsters request that the refund be deposited into bank accounts they control, bypassing the rightful taxpayer entirely. By the time the legitimate taxpayer files their return, the criminals have already claimed the refund.

Consequences for Victims

• Delayed Refunds The IRS will flag the duplicate filings, resulting in significant delays for the legitimate taxpayer's refund. This can cause frustration and financial strain, especially if the refund was anticipated to cover expenses.

• Tax Liabilities Victims may find themselves liable for taxes owed on fraudulent returns filed by the criminals. This unexpected liability can lead to a tax debt that wasn’t part of the original financial planning.

• Identity Theft Beyond the immediate tax consequences, the stolen personal information can be used in other fraudulent activities, such as opening new credit accounts or applying for loans in the victim’s name.

How to Protect Yourself

• File Early One of the best ways to prevent criminals from filing fraudulent returns is to file your taxes early. The sooner your return is filed, the less likely criminals are to file a fake return using your information. Early filing reduces the opportunity for fraudsters to get to your refund first.

• Use a Reputable Tax Service Ensure that the tax preparer you use is legitimate and has a good reputation. If you're using a tax professional, verify their credentials, such as their IRS Preparer Tax Identification Number (PTIN). Check online reviews or ask for referrals from trusted sources to avoid working with fraudulent tax preparers who might exploit your information.

• Consider an Identity Protection PIN (IP PIN) The IRS offers an Identity Protection PIN program, which provides an added layer of security for taxpayers. This PIN is used when filing taxes and helps prevent unauthorized returns from being filed in your name.

Conclusion

Tax fraud in the form of criminals filing fraudulent returns can cause significant stress and financial loss. By understanding how the scheme works and taking proactive measures, you can better protect yourself from becoming a victim. Filing early, using a reputable tax service, monitoring your personal information, and using additional security measures like an IP PIN are all critical steps in preventing and mitigating the effects of tax-related identity theft. 

Further Reading

For more tips on protecting yourself from tax fraud, visit the IRS website and read about common scams and how to avoid them.

Beware of Fake Job Offers in the 2025 job market

In today's job market, the allure of remote work has become increasingly enticing. However, companies have started to shift away from remote work post-pandemic and are requiring more in-person or hybrid for employees. Combine that with the downsizing companies are going through at this time and job scams are going to pop up on a more regular basis. Recently, I got the above text from a “recruiter.”

While this might seem like a great opportunity it’s a scam. A job offer does not typically come over text nor does it happen without an interview. This is a path to getting personal information, financial, or drawn into the scam ecosystem as a money mule.

The Scam: Too Good to Be True

The scam typically begins with an unsolicited message from an individual claiming to be "Emily," a customer service agent at Bonanza. The message outlines an attractive remote position with the following promises:

• High Earnings: Potential to earn between $50 to $500 per day, with a base salary of $1,000 for every four days worked.

• Flexible Hours: Commitment of just 60 to 90 minutes per day.

• Comprehensive Benefits: Offers include paid annual leave, maternity and paternity leave, and other legal holidays.

• Minimal Effort: Assurances of free training and a guaranteed paid probation period.

Recipients are encouraged to respond to a provided phone number to seize this "opportunity."

Red Flags in the Offer

While the proposition may appear appealing, several indicators suggest it's a scam:

• Unsolicited Contact: Legitimate companies seldom extend job offers without prior interaction or application. Receiving such a message without prior engagement is suspicious.

• Free Email Account: This text was sent with a Gmail account that anyone that is available to anyone for free.

• Exaggerated Earnings and Benefits: Promises of substantial income for minimal work are classic red flags. Genuine employers provide realistic compensation aligned with industry standards.

• Vague Job Description: The lack of specific details about job responsibilities, using ambiguous phrases like "helping merchants update data," is a common tactic to obscure the scam's true nature.

• Urgency to Respond: Scammers often create a sense of urgency to prevent thorough consideration. Pressuring immediate action is a tactic to catch victims off-guard.

• Unprofessional Communication: Errors in grammar, informal language, or inconsistencies in the message are telltale signs of fraudulent communication.

• Request for Contact via Personal Number: Legitimate companies typically use official communication channels. Requests to contact personal numbers are uncommon and suspicious.

What Happens If You Respond?

Engaging with the scammer can lead to several detrimental outcomes:

• Phishing for Personal Information: Scammers may request sensitive data, such as Social Security numbers or banking details, under the guise of processing employment paperwork.

• Upfront Payments: Requests for fees covering "training" or "equipment," with promises of reimbursement, are common. Once paid, these funds are unrecoverable.

• Identity Theft: Shared personal information can be exploited for identity theft, leading to financial and legal complications.

• No Real Job: After extracting money or information, the scammer disappears, leaving the victim without employment and at a loss.

• Become a Money Mule: A money mule is someone who transfers or moves illegally acquired money on behalf of others, often unknowingly.

Protecting Yourself from Job Scams

To shield yourself from such fraudulent schemes, consider the following precautions:

• Research the Company: Visit the official website and verify job postings. Authentic opportunities are listed on company websites or reputable job boards.

• Verify the Contact: Ensure that communications come from official company channels. Be wary of contacts using personal email addresses or phone numbers.

• Be Skeptical of Extravagant Claims: If an offer seems too good to be true, it warrants skepticism. Legitimate jobs have clear expectations and reasonable compensation.

• Never Pay to Work: Authentic employers do not require upfront payments for any reason.

• Report Suspicious Offers: Report potential scams to the Federal Trade Commission (FTC) at ReportFraud.ftc.gov and to the platform where the offer was encountered.

Conclusion

Scammers continually adapt their tactics to exploit the evolving job market and technological landscape. By staying informed and vigilant, you can protect yourself from falling victim to such schemes. Always verify the legitimacy of job offers and remain cautious of unsolicited communications. Remember, if something feels amiss, it's worth investigating further. Stay safe and informed in your job search and digital interactions.