Patches
Talos disclosed a cluster of five vulnerabilities collectively dubbed ReVault affecting Broadcom/Dell ControlVault3 firmware and its associated Windows APIs. The issues include out‑of‑bounds reads/writes (CVE‑2025‑24311, CVE‑2025‑25050), an arbitrary free (CVE‑2025‑25215), a stack overflow (CVE‑2025‑24922), and an unsafe deserialization bug (CVE‑2025‑24919). ControlVault/USH modules on more than 100 Dell Latitude and Precision models handle passwords, biometric templates, smartcards and NFC. Talos reports that a non‑admin Windows user can achieve code execution on the ControlVault device, potentially exfiltrating key material and installing persistent implants that survive OS reinstalls. With physical access, an attacker could also connect to the USH board over USB and exploit the device without Windows credentials, enabling biometric bypass or local privilege escalation. Recommended actions include installing Dell ControlVault firmware updates distributed via Dell support channels and Windows Update where available, disabling unused ControlVault services or devices, and turning off fingerprint login when risk is elevated. Detection guidance highlights enabling chassis‑intrusion alerts in BIOS, monitoring Windows Biometric and Credential Vault service crashes, and applying endpoint detection rules where available.
Incidents
An analysis by Unit 42 details operational overlaps between Microsoft’s ToolShell/Storm‑2603 reporting and activity it tracks as CL‑CRI‑1040, connecting the cluster to a modular toolkit dubbed Project AK47. Components include AK47C2, a backdoor with DNS and HTTP variants, and AK47/X2ANYLOCK ransomware. The backdoor’s command‑and‑control uses shared command formats and XOR‑encoded messages; the DNS variant evolved from UPX‑packed JSON‑over‑DNS to a fragmented session‑key format in April 2025. The ransomware encrypts with AES+RSA, appends “.x2anylock,” drops notes with a Tox ID and ProtonMail contact, and can self‑terminate after a specified date to hinder analysis. Recovered evidence contained AK47 modules alongside offensive utilities and LockBit 3.0 dropper/loader artifacts; a leaked LockBit database and screenshots from the Warlock double‑extortion site showed the same Tox ID as the ransom notes, supporting a financially motivated assessment with ties to LockBit‑affiliated infrastructure. While Microsoft assesses Storm‑2603 as China‑based, Unit 42 does not make a definitive nation‑state attribution and notes tools common in Chinese‑speaking communities. The team advises immediate patching of referenced SharePoint CVEs, review of indicators of compromise, and updated endpoint, DNS, URL filtering, and XDR/XSIAM detections.
An investigation by CNN outlines a multi‑year effort that placed thousands of North Korean IT workers into Western companies using stolen and fabricated U.S. identities. Operatives, often operating from third countries, reportedly leverage AI to mass‑generate applications, craft resumes and interview scripts, and use faceswap tools, VPNs, and remote access to mask origin. U.S.‑based facilitators launder paychecks, procure identities, and run “laptop farms” of company‑issued machines that allow remote operatives to appear local. One facilitator pleaded guilty in 2025 and received a 102‑month sentence after aiding placements at hundreds of companies and moving millions of dollars. In June, authorities executed raids across 16 states, seizing roughly 200 laptops from 29 suspected farms. Experts cited in the report describe layered detection challenges—multiple personas, automated submissions, and subtle cultural or behavioral red flags—while warning the scheme both evades sanctions and could enable pivots to malware or ransomware if positions are compromised. The findings point to the need for tighter hiring controls, human‑risk management, and coordinated enforcement.
Separately, the Cyber Risk Team at UpGuard found a publicly accessible code repository maintained by AggregateIQ that exposed campaign assets and sensitive credentials for multiple Canadian politicians and parties. The materials included WordPress backups, configuration files, API tokens, PEM‑encoded SSL keys, database dumps, and scripts supporting donations, surveys, and reporting. Examples cited include a Stripe secret key and NationBuilder tokens in a candidate repository, a private SSL key and wp‑config credentials in another, and exposed payment endpoint code and an API token associated with a party repository. These assets created realistic attack paths—unauthorized access to donation processors, impersonation using private keys, content‑management takeover, and potential access to voter/contact platforms—illustrating how third‑party misconfigurations can translate into campaign and citizen risk. The disclosure arrives amid broader scrutiny of the firm’s past relationships and ongoing inquiries, underscoring the importance of vendor security controls and credential hygiene in political technology ecosystems.
Research
The H1 2025 threat roundup from ESET highlights three dynamics. First, social‑engineering techniques branded as ClickFix surged from near‑zero to widespread prevalence, with variants such as FakeCaptcha coercing users into running commands under the guise of human verification. Second, coordinated disruptions hit multiple infostealer‑as‑a‑service operations: a late‑2024 takedown of RedLine/Meta Stealer and later actions against LummaStealer and Danabot reduced activity and demonstrated effective public‑private collaboration. ESET describes investigative contributions that supported these efforts and explains why such services flourish—low entry barriers, subscription distribution, and straightforward monetization of stolen credentials. Third, the report documents infighting among ransomware operators, including defacements of leak sites by the smaller Dragonforce group and disruption of a leading operation’s site, emphasizing the ecosystem’s volatility. The researchers characterize the period as a mixed picture: successful disruption has impact, but attackers rapidly adapt with new lures and opportunistic rivalries. The episode encourages teams to consult the full report for indicators and mitigation guidance.
Platforms
A year‑in‑review from the MSRC reports $17 million in 2025 awards to 344 researchers across 59 countries, the program’s largest single‑year payout. The bounties span Azure, Microsoft 365, Dynamics 365, Power Platform, Windows, Edge, and Xbox, with clearly scoped rules, tiers, and submission guidance to support coordinated disclosure. The inaugural Zero Day Quest live hacking competition focused on Copilot and cloud scenarios, generating more than 600 submissions and over $1.6 million in awards across qualifiers and the final event. Over the past year, program priorities expanded to emphasize AI‑related scenarios, identity and Defender scope increases, Microsoft 365 updates, new AI award categories for Dynamics 365 and Power Platform, and refreshed Windows attack‑scenario awards. Awards are determined by severity, customer impact, and submission quality, with continued emphasis on safe research practices. The update frames bounty programs as a proactive control that channels researcher expertise into measurable product hardening.