All news with #persistence tag

🔒 Eclypsium discovered that Framework shipped signed UEFI shells containing a dangerous mm (memory modify) command that can directly read and write system RAM and be leveraged to disable Secure Boot. By overwriting the gSecurity2 security handler pointer to NULL or redirecting it to a stub that always returns success, the mm command stops signature verification and can permit bootkits to load. Framework estimates roughly 200,000 affected units; users should apply available firmware and DBX updates, restrict physical access, or temporarily remove Framework's DB key in BIOS until patches are applied.

🔒 Researchers say a Chinese state-linked actor, likely Flax Typhoon, exploited a component of the ArcGIS geo-mapping platform to maintain undetected access for over a year. Using valid admin credentials, the attackers uploaded a malicious Java SOE that acted as a web shell, accepting base64-encoded commands via a REST parameter protected by a hardcoded secret. They then installed SoftEther VPN as a Windows service to create an outbound HTTPS tunnel to 172.86.113[.]142 on port 443, enabling persistent lateral movement and credential harvesting even if the SOE were removed.

🔐 ReliaQuest linked the campaign to the Flax Typhoon APT, which converted a legitimate public-facing ArcGIS Java server object extension (SOE) into a stealthy web shell. The group activated the SOE through a standard ArcGIS REST extension, embedding a base64-encoded payload and a hardcoded key to trigger command execution while hiding activity behind normal portal operations. Attackers uploaded a renamed SoftEther VPN binary to preserve access and targeted IT workstations, and the SOE was later found in backups, enabling persistence after remediation. ReliaQuest warns organisations to go beyond IOC detection, proactively hunt for anomalous behaviour in trusted tools, and treat every public-facing application as a high-risk asset.

🛡️ FortiGuard Labs reports that the long-running cyber-espionage group Confucius has shifted tactics against Microsoft Windows users, moving from document stealers like WooperStealer to Python-based backdoors such as AnonDoor. The change, observed between December 2024 and August 2025, favors persistent access and command execution over simple data exfiltration. Researchers describe layered evasion and persistence techniques including DLL side-loading, obfuscated PowerShell, scheduled tasks and stealthy exfiltration to minimize detection. Targeting remains focused in South Asia, particularly Pakistan.

🔍 Microsoft Threat Intelligence describes a new XCSSET variant that infects Xcode projects and expands capabilities to include clipboard hijacking, Firefox data theft, and additional persistence via LaunchDaemon entries. The actor uses run-only compiled AppleScripts, AES-based encryption, and layered obfuscation to evade analysis. A bnk submodule monitors and can replace wallet addresses in the clipboard while a new Mach-O binary targets Firefox data. Organizations are advised to patch promptly, inspect Xcode project sources, and deploy Microsoft Defender for Endpoint.

🔐 Chinese state-linked actors deployed a custom Linux/BSD backdoor called BRICKSTORM on network edge appliances to maintain persistent access into U.S. legal, technology, SaaS and outsourcing firms. These implants averaged 393 days of undetected dwell time and were used to pivot to VMware vCenter/ESXi hosts, Windows systems, and Microsoft 365 mailboxes. Mandiant and Google TAG attribute the activity to UNC5221 and have released a scanner and hunting guidance to locate affected appliances.

🔒 Proofpoint reported that a China-aligned threat actor tracked as TA415 conducted spear-phishing in July–August 2025, impersonating U.S. policy officials and the U.S.-China Business Council to target government, think tank, and academic personnel focused on trade and economic policy. The messages delivered password-protected archives on public cloud services that contained a Windows shortcut which executed a hidden batch script and an obfuscated Python loader named WhirlCoil while displaying a decoy PDF. The loader establishes a VS Code Remote Tunnel to enable persistent backdoor access, harvests system and user data, exfiltrates it via base64-encoded HTTP posts to free request-logging services, and establishes scheduled tasks (e.g., GoogleUpdate) for persistence.

⚠️ Cybersecurity researchers disclosed a campaign that abuses ConnectWise ScreenConnect remote sessions to deliver a fileless loader which ultimately executes the AsyncRAT remote-access trojan. Attackers use hands-on-keyboard activity to run a layered VBScript and PowerShell chain that loads obfuscated .NET assemblies and spawns AsyncClient.exe. Persistence is maintained via a scheduled task disguised as "Skype Updater," and stolen credentials, keystrokes, and wallet artifacts are exfiltrated to a DuckDNS command-and-control host.

🔒 FortiGuard Labs has uncovered MostereRAT, a Remote Access Trojan targeting Microsoft Windows that uses layered evasion and persistence techniques. Written in Easy Programming Language, the malware deploys a multi-stage chain, uses mutual TLS for C2 communication, and can disable Windows Update and antivirus processes. The campaign, aimed largely at Japanese users, begins with phishing emails that lead to a malicious Word download and installs services running at SYSTEM-level, while deploying remote access tools such as AnyDesk and TightVNC.

🔐 Mandiant observed attackers exploiting a zero‑day ViewState deserialization flaw (CVE-2025-53690) in legacy Sitecore deployments that reused a sample ASP.NET machineKey. Adversaries delivered a WeepSteel reconnaissance backdoor to collect system and network data and disguised exfiltration as normal ViewState traffic. Sitecore advises replacing and encrypting static machineKey values and instituting regular key rotation to mitigate further risk.