Incidents
Activity attributed to a China‑nexus adversary surged, with CrowdStrike detailing MURKY PANDA’s intrusions against government, technology, academic, legal and professional services organizations across North America. The actor exploits internet‑facing appliances, rapidly weaponizes n‑day and zero‑day vulnerabilities (including CVE‑2023‑3519 against Citrix NetScaler), and deploys web shells and a statically linked Golang RAT dubbed CloudedHope. CrowdStrike highlights trusted‑relationship compromises: abuse of SaaS providers and Microsoft cloud solution providers to pivot into downstream tenants, steal Entra ID application registration secrets, authenticate as service principals, and read email. In other cases, delegated administrative privileges and Admin Agent roles were misused to create backdoor accounts and add secrets to service principals. Guidance centers on auditing service principal credentials and activity, enabling Graph activity logs, hunting for anomalous service principal sign‑ins, reviewing Entra sign‑in/session details, auditing cloud solution provider actions and MFA usage, and prioritizing patching of cloud and edge devices.
Talos warned that a Russian state‑backed group known as Static Tundra is exploiting long‑standing vulnerabilities in end‑of‑life and unpatched Cisco devices, including the seven‑year‑old CVE‑2018‑0171. The actor installs persistent implants and bespoke SNMP tools for stealthy, long‑term access and data exfiltration. The advisory underscores that age does not diminish risk: organizations running unsupported or unpatched network gear remain exposed and should patch or disable vulnerable features, harden configurations, and monitor for suspicious management activity.
Microsoft reported a marked rise in the ClickFix technique, which convinces users to copy and run attacker‑supplied commands via the Windows Run dialog, PowerShell/Terminal, or macOS workflows after encountering fake CAPTCHAs, browser errors, or spoofed vendor pages. Delivery uses phishing, malvertising, and compromised sites. Observed payloads include infostealers (Lumma, Lampion, AMOS), RATs (Xworm, AsyncRAT, NetSupport, SectopRAT), loaders (Latrodectus, MintsLoader) and modified rootkits, often filelessly via LOLBins such as msbuild.exe, rundll32.exe, and powershell.exe. Microsoft recommends combining awareness with technical controls: restrict Run dialog usage, enforce PowerShell logging and execution policies, apply Group Policy/App Control rules to prevent native binary launches, deploy enterprise‑managed browsers, and enable network/web protections. Microsoft Defender XDR, Defender for Office 365, AMSI, and Cloud Protection provide detections and hunting queries.
The Hacker News highlighted Mandiant’s tracking of UNC5518 using ClickFix lures to deliver CORNFLAKE.V3, a backdoor that adds registry persistence and HTTP‑based delivery of executable, script, and PowerShell payloads, with traffic proxying through Cloudflare tunnels. Observed payloads include an Active Directory reconnaissance utility, a Kerberoasting script, and a C‑language backdoor named WINDYTWIST.SEA capable of relaying TCP traffic, spawning reverse shells, executing commands, and attempting lateral movement. The reporting also describes a parallel USB‑borne campaign since September 2024 that installs components and a C++ backdoor (PUMPBENCH) to fetch XMRig and spread via removable drives. Recommended mitigations include restricting the Run dialog, enforcing strict PowerShell execution policies, enabling script block and robust endpoint logging, hardening Group Policy, adopting managed browsers and safe‑attachment policies, and running regular user‑focused simulations.
Unit 42 analyzed exploitation of CVE‑2024‑36401 in GeoServer to deploy SDKs and apps that monetize victims’ internet connections by turning hosts into proxy/shared‑bandwidth nodes. The RCE flaw allows attacker‑controlled JXPath expressions to invoke Java runtime methods across multiple service endpoints, enabling command execution and staged payload retrieval. Operators deployed lightweight stagers and binaries (e.g., z401/z402, a193, d593, z593), used legitimate vendor SDKs without modification, and compiled app binaries in Dart for cross‑platform Linux deployment to reduce detection. Telemetry showed shifting infrastructure and thousands of exposed GeoServer instances across many countries. Recommended steps include applying patches, restricting internet exposure, enforcing access controls and segmentation, blocking known distribution hosts, and instrumenting detections for JXPath/Geotools exploitation patterns.
Kaspersky documented a phishing campaign targeting Ledger hardware wallet users with apology‑style emails that claim fragments of private keys were transmitted to Ledger servers and exfiltrated. Recipients are urged to install an “emergency” firmware update via professionally designed but unaffiliated domains. The sites attempt to harvest wallet seed phrases, granting attackers full control of funds if disclosed. Emails were sent via a legitimate mailing service to improve deliverability, and some sites include functional support chats to increase credibility. Guidance stresses skepticism toward unsolicited update prompts, targeted awareness training, and endpoint/network protections to block phishing sites.
Law enforcement outcomes also featured: KrebsOnSecurity reported a 10‑year federal sentence and roughly $13 million restitution for a member of Scattered Spider linked to SIM‑swapping and social‑engineering campaigns that compromised corporate accounts and siphoned cryptocurrency. The case underscores the sustained risk from vishing, smishing, and credential theft campaigns that target people rather than systems.
Patches
The Hacker News covered watchTowr Labs’ disclosure of four Commvault defects affecting on‑premises versions before 11.36.60: unauthenticated API access (CVE‑2025‑57788), setup‑time default credential exposure (CVE‑2025‑57789), a high‑impact path traversal leading to unauthorized filesystem access and RCE (CVE‑2025‑57790), and insufficient input validation enabling command‑line argument manipulation (CVE‑2025‑57791). Researchers demonstrated pre‑auth exploit chains, including one that requires the built‑in admin password to remain unchanged since installation. Commvault addressed the issues in builds 11.32.102 and 11.36.60 and said its SaaS offering is unaffected. Organizations should prioritize patching, validate that administrative passwords were changed post‑installation, and audit for anomalous API or file‑access activity.
CISA added CVE‑2025‑43300—an out‑of‑bounds write in Apple iOS, iPadOS, and macOS—to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. Under BOD 22‑01, Federal Civilian Executive Branch agencies must remediate KEV entries by due dates; CISA urges all organizations to prioritize fixes and mitigations, verify exposure, and implement compensating controls while deploying vendor updates.
CISA also issued ICSA‑25‑233‑01 for Mitsubishi Electric MELSEC iQ‑F Series CPU modules, describing a DoS vulnerability (CVE‑2025‑5514) in the web server due to improper handling of length parameter inconsistencies. Mitsubishi Electric does not plan a fixed firmware release; mitigations include restricting network exposure, using firewalls/VPNs, employing IP filters, operating within trusted LANs, and limiting physical access. CISA advises isolating control networks and avoiding direct internet exposure.
Separately, CISA published ICSMA‑25‑233‑01 for FUJIFILM Healthcare Americas Synapse Mobility, noting a privilege‑escalation flaw (CVE‑2025‑54551) stemming from external control of an assumed‑immutable web parameter. Versions prior to 8.2 are affected; patches exist for 8.0–8.1.1 and 8.2+ resolves the issue. Recommended actions include upgrading, disabling certain configurator functions to force SecureURL, minimizing network exposure, and using secure, updated remote access.
Platforms
Following mass exploitation of SharePoint flaws in July, The Register reported changes to Microsoft’s Microsoft Active Protections Program (MAPP): proof‑of‑concept exploit code will no longer be shared with firms in countries that must report vulnerabilities to their governments. Those participants will receive general written descriptions alongside patches. The shift aims to reduce the risk of pre‑release technical details fueling large‑scale exploitation while balancing the need for timely defensive information.
AWS introduced native integrations between AWS Security Incident Response and IT service management platforms, initially Jira and ServiceNow. The open‑source connectors support bidirectional sync of issues, comments, and attachments, allowing teams to preserve existing ticketing and escalation paths while centralizing incident data. AWS recommends validating data mapping, access control, and auditing requirements before production rollout.
In a separate update, AWS announced customer‑managed key support in AWS IoT Core via AWS KMS. Customers can encrypt stored IoT Core data with keys they control; AWS will automatically re‑encrypt existing data during opt‑in. The change increases control over key lifecycle, rotation, and monitoring, aligning with internal policy and regulatory needs. Proper KMS key policies, IAM permissions, and logging remain customer responsibilities.
Research and policy
The Hacker News summarized Picus Security’s Blue Report 2025, which analyzed more than 160 million simulated attacks and found credential‑based intrusions remain dominant. Password cracking succeeded in 46% of tested environments, and Valid Accounts (T1078) attacks succeeded in 98%, indicating weak password hygiene, legacy hashing, and incomplete MFA adoption. The report recommends stronger password policies, eliminating outdated hashing, broad MFA rollout, routine validation of credential defenses, identity‑centric anomaly detection, and outbound traffic inspection to reduce data‑exfiltration risk.
The Hacker News also covered IBM X‑Force research into QuirkyLoader, a .NET loader delivered via spam archives that uses DLL side‑loading and process hollowing to inject payloads into commonly abused processes. Observed payloads include Agent Tesla, AsyncRAT, Formbook, Masslogger, Remcos, Rhadamanthys, and Snake Keylogger. Limited campaigns in July 2025 targeted users in Taiwan and Mexico. Analysts note ahead‑of‑time compilation complicates detection and analysis, and the findings track broader phishing evolutions aiding credential theft and account takeover.