Incidents
Unit 42 reported active, widespread exploitation of multiple on‑premises Microsoft SharePoint flaws collectively tracked as ToolShell (CVE‑2025‑49704, CVE‑2025‑49706, CVE‑2025‑53770, CVE‑2025‑53771). Telemetry shows reconnaissance and exploitation against internet‑exposed SharePoint Enterprise Server 2016/2019 and SharePoint Server Subscription Edition, accelerating after proof‑of‑concept code surfaced. Observed chains delivered custom .NET modules and persistent web shells (including spinstall0.aspx), exfiltrated cryptographic MachineKeys and ViewState material, and in at least one case dropped a loader that executed the 4L4MD4R ransomware. Attackers used Base64‑encoded PowerShell via w3wp.exe/cmd.exe to write web shells into LAYOUTS directories, and retrieved ValidationKeys and DecryptionKeys to forge ViewState for credential and session abuse. The brief advises disconnecting exposed servers, applying vendor updates and mitigations for the listed CVEs, rotating ASP.NET machine keys, restarting IIS, and conducting thorough hunts for backdoors—recognizing that patching alone may not evict entrenched access. The team also shared IOCs and detection guidance to support containment and remediation.
Research
ESET reviewed July’s major developments, highlighting exploitation of SharePoint ToolShell, the reemergence of Lumma Stealer, and the business impact of credential weaknesses—citing a ransomware case that began with a guessed employee password and led to a UK transport firm’s closure. The roundup also noted an exposure in the McHire chatbot platform reportedly tied to trivial admin credentials, critical PerfektBlue flaws in a Bluetooth stack with implications for vehicles, and a UK proposal to ban ransom payments by public sector and critical infrastructure entities. The throughline is consistent: disciplined authentication, timely patching, and vendor security practices remain central to resilience.
Unit 42 introduced its Attribution Framework to make threat actor assessments more transparent and repeatable. The model fuses the Diamond Model of Intrusion Analysis with the Admiralty System, assigning default source reliability (A–F) and information credibility (1–6) to evidence while allowing analyst adjustments. Activity is first clustered (CL‑) based on correlated IoCs, TTPs, targeting, or timing; sustained, corroborated clusters can be elevated to temporary groups (TGR‑), and only after robust multi‑source evidence mapped across adversary, infrastructure, capability, and victim vertices are names assigned. An internal review board vets promotions, aiming to reduce naming drift and to report confidence levels consistently.
CISA released Thorium, a high‑throughput malware and forensic analysis framework developed with Sandia National Laboratories. Thorium orchestrates automated workflows across commercial, open‑source, and custom tools, emphasizing speed and scale—ingesting over 10 million files per hour per permission group and scheduling more than 1,700 jobs per second—while maintaining fast queries. It supports containerized command‑line tools, with options to integrate VM or bare‑metal tools, and provides tagging, full‑text search, strict group‑based permissions, and horizontal scaling via Kubernetes and ScyllaDB to match operational demand.
Platforms
AWS outlined a defense‑in‑depth approach for CodeBuild pipelines, clarifying shared responsibility and focusing on risks from untrusted pull requests that can run arbitrary code with access to secrets and artifacts. The guidance defines trust boundaries for internal and external contributors, uses webhook filterGroups to enforce push‑only, branch‑based, or contributor‑allowlist patterns, and proposes a staged rollout. It recommends per‑build least‑privilege IAM roles validated with IAM Access Analyzer, narrowly scoped GitHub tokens stored in Secrets Manager with rotation, isolated VPC environments, combined automated scanning with human approval gates, and monitoring via CloudTrail and AWS Config to detect configuration drift.
For secure file sharing, a two‑part analysis weighs architectures against access patterns, protocol needs, and operational constraints. The first installment, Part 1, examines Transfer Family, Transfer Family web apps, S3 pre‑signed URLs, and a serverless presigned‑URL model via API Gateway and Lambda—highlighting security controls, cost drivers, and risks such as URL reuse and upload limits. The sequel, Part 2, evaluates CloudFront signed URLs for global, cache‑friendly distribution; a PrivateLink VPC endpoint service for private, flexible protocol support at higher operational complexity; and S3 Access Points for scaled access management and VPC‑only S3 access. The guidance concludes no single pattern fits all, and combinations may best balance security, cost, and operational effort.
Policies
An update from MSRC expands the .NET Bounty Program’s scope and clarifies rewards. Coverage now spans supported .NET and ASP.NET versions, adjacent technologies such as F#, repository templates, and relevant GitHub Actions. Awards align with explicit severity and impact categories used across Microsoft programs, and report quality is defined as “complete” (requiring a fully functional exploit) or “not complete,” with payouts scaled accordingly. Top awards reach $40,000 for complete Remote Code Execution or Elevation of Privilege findings, with graduated amounts for other impacts. The changes aim to increase transparency and encourage detailed, actionable submissions across the .NET ecosystem.