US Tops Hit List as 396 SharePoint Systems Compromised Globally

Check Point Research (CPR) conducted a focused analysis of Storm-2603, a threat actor associated with recent ToolShell exploitations, together with other Chinese APT groups. Storm-2603 utilizes a custom malware Command and Control (C2) framework dubbed internally by the attacker as “ak47c2”. This framework includes at least two different types of clients: HTTP-based (dubbed by us “ak47http”) and DNS-based (dubbed by us “ak47dns”). Based on VirusTotal data, Storm-2603 likely targeted some organizations in Latin America throughout the first half of 2025, in parallel to attacking organizations in APAC. Some of the actor’s TTPs align with many other ransomware groups, and involve open-source tools such as PsExec and masscan. In addition, the threat actors use a custom tool that leverages the BYOVD (Bring Your Own Vulnerable Driver) technique to tamper with endpoint protections. Storm-2603 attacks involved multiple ransomware families, sometimes bundled together. Those are commonly deployed by abusing DLL hijacking. Check Point Research (CPR) has been closely monitoring the ongoing exploitation of a group of Microsoft SharePoint Server vulnerabilities collectively referred to as “ToolShell.” These active attacks leverage four vulnerabilities—CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771—and are attributed to multiple China affiliated threat actors. Among the threat groups identified by Microsoft, two are known APTs: Linen Typhoon (aka APT27) and Violet Typhoon (aka APT31). Another group is a newly observed, previously undocumented cluster called Storm-2603. While Microsoft linked this cluster’s activity to potential ransomware deployment, it was unable to assess the group’s objectives. As part of our ongoing investigation into ToolShell and its associated risks, we launched a targeted effort to better understand and characterize the threat posed by Storm-2603. Throughout our analysis, we uncovered several files likely tied to Storm-2603 intrusions, offering new insights that correspond to Microsoft’s description of the group. In this publication, we provide an in-depth examination of Storm-2603’s tactics, techniques, and procedures (TTPs), along with a technical breakdown of the ak47c2, a custom malware framework used in their attacks and their different ransomware payloads. Storm-2603 was first mentioned by Microsoft during investigations into a set of attacks on Microsoft SharePoint servers, known as the “ToolShell” campaign. While some activity was tied to known Chinese affiliated groups like Linen Typhoon (APT27) and Violet Typhoon (APT31), Storm-2603 appeared as a new, previously unreported actor. Microsoft linked the group to Lockbit and Warlock ransomware use. Figure 1 – Events associated with Storm-2603. Microsoft’s report provided only limited information about Storm-2603, including some of the TTPs associated with it, most of them quite generic. In addition, some of the reported indicators of compromise (IOCs) helped us uncover additional artifacts associated with previous Storm-2603 intrusions. One domain in particular, update.updatemicfosoft[.]com, linked to Storm-2603’s SharePoint exploitation, turned out to have been used in earlier campaigns dating back to March 2025. In those operations, it served as a C2 server for both DNS tunneling malware and an HTTP backdoor and was part of infrastructure used to deliver LockBit Black and Warlock/x2anylock ransomware. Our search for cases where the IOCs reported by Microsoft, revealed two incidents in which LockBit Black and WarLock ransomware variants were deployed together, in addition to multiple other tools, mostly open-source. In April 2025, a RAR archive named Evidencia.rar was uploaded to VirusTotal. The archive contains several artifacts likely extracted from compromised machines in a Storm-2603 case in a LATAM country. The artifacts in the archive provide a look at some of the open-source tools used by the actors in the intrusions which correlates with previous knowledge of the group: WinPcap – Captures and filters network traffic on Windows. PsExec – Executes commands on remote Windows systems. SharpHostInfo – Collects host and domain info on Windows environments. nxc – Exploits common vulnerabilities in network services. In addition to the open-source tools, the archive also contains the custom backdoor used by the group, as well as its unique ransomware payloads. dnsclient.exe – A custom backdoor utilized by Storm-2603 that communicates over DNS tunneling with update.updatemicfosoft[.]com, a domain associated with the group. See the next section for our analysis of the backdoor. 7z.exe & 7z.dll – Legitimate 7z executable side-loading malicious 7z.dll delivering X2anylock (aka Warlock), a ransomware used by Storm-2603. bbb.msi – An installer which uses clink_x86.exe to side-load clink_dll_x86.dll, leading to the execution of LockBit Black ransomware. Another MSI file uploaded to VirusTotal in April used a similar deployment method, starting with the MSI installer to launch multiple ransomware strains simultaneously: Figure 2 – MSI Multi-Ransomware Deployment. The MSI relies on the following files: MpCmdRun.exe & Mpclient.dll – Warlock Ransomware, deployed via DLL-hijacking. clink_x86.exe & clink_dll_x86.dll – LockBit Black ransomware, deployed via DLL-hijacking. z.exe & z.dll – x2anylock ransomware, deployed via DLL-hijacking. VMToolsEng.exe – Custom Antivirus Terminator. ServiceMouse.sys – Vulnerable driver used by VMToolsEng.exe for killing Antivirus processes. log.exe – A list of Antivirus processes to kill. msi.bat – Executes VMToolsEng.exe. 1.bat – Executes all the needed executables and the MSI. We attributed two custom backdoors to Storm-2306, both of which appear to be part of the framework named AK47 C2 based on the shared PDB path: C:\Users\Administrator\Desktop\work\tools\ak47c2\. When executed, the program immediately hides its console window, determines the host computer name (defaulting to unknown.local if that fails), and builds a DNS‑based command‑and‑control payload. It chooses a random five-character session ID, such as H4T14, and prefixes it with 1 for task requests or 2 for result uploads (e.g., 1H4T14 or 2H4T14). Each element, such as the task/result tag, a size flag (a for “all” when the entire message fits into one request), and the computer name, is XOR‑encoded with the ASCII key “VHBD@H”, converted to hexadecimal, and concatenated with dots before being prepended to the C2 domain update.micfosoft[.]com. This what the overall query looks like: DNS TXT and MG (a mail group member record type) record lookups (DnsQuery_A) are used to transmit and retrieve data. If the C2 server is unreachable, the client simply receives error 9003 (DNS_ERROR_RCODE_NAME_ERROR). Otherwise, the response text is decoded from hex, XOR‑decrypted, and parsed for the delimiter “:::”, which separates metadata from the actual command string. Commands run under cmd.exe /c 2>&1; a built‑in directive sleep n pauses execution for n seconds. For outputs larger than 0xFF bytes, the backdoor fragments data into 63‑byte sub‑segments. Each DNS query then follows: HttpClient backdoor has the pdb path C:\Users\Administrator\Desktop\work\tools\ak47c2\httpclient-cpp\x64\Release\httpclient-cpp.pdb and uses plain HTTP instead of DNS for the C2. It is built as a 64‑bit console program that also immediately hides its window on launch. On start‑up, the malware gathers the host computer name (similar to the DNS version, it defaults to unknown.local), then builds a JSON object with the fields cmd, cmd_id, fqdn, result, and type. For a task request, the object looks like this: {"cmd":"","cmd_id":"","fqdn":" ","result":"","type":"task"} After the host executes a command, the result is sent back with type:”result”. Before transmission, the entire JSON blob is XOR‑encrypted with the ASCII key “VHBD@H”, converted to hexadecimal, and placed in the body of an HTTP POST to “/” with generic headers (Content‑Type: text/plain, Accept: */*). The C2 replies with a similarly encoded JSON where the cmd field contains the next command. The implant executes it via cmd.exe /c 2>&1 and returns the output. We identified that during these attacks, several types of ransomware were deployed simultaneously. One is regular LockBit Black, and the second uses the.x2anylock extension. This extension was later used by the Warlock ransomware operator, mentioned in Microsoft’s report on the SharePoint exploitation. The Warlock ransom note is usually saved as How to decrypt my data.txt and looks like this: Figure 3 – Warlock Group ransom note. The ransom notes for all ransomware strains deployed by Storm-2603 are named How to decrypt my data.log (x2anylock) or .README.txt (LockBit Black) and have the same short content: Your decrypt ID: [redacted] Tox ID Support: 3DCE[redacted] Email Support: [redacted]@proton.me,[redacted]@proton.me,[redacted]@proton.me You can contact us in email or qtox. This ransom note’s name How to decrypt my data.log appeared in a recent LinkedIn post by Huntress, describing the case where multiple ransomware families were deployed together against the same target. While not a new tactic, this approach is rarely observed among established ransomware groups. An important part of the infection package described earlier is called Antivirus Terminator. It is a custom command line tool abusing a third-party signed legitimate driver to kill processes. From what we can see, it’s been in the wild since at least late 2024. The tool requires administrative privileges on the infected machine. The screenshot below shows how the listing is displayed in the console when the tool is run without parameters: Figure 4 – Antivirus Terminator supported arguments when run without parameters. The tool first creates a service called ServiceMouse, where the path to the service binary file is ServiceMouse.sys from the package. Next, the tool communicates with the installed service via IO control code 0x99000050, which is responsible for killing processes. The tool also has more capabilities, like deleting files and uninstalling drivers, and these use different IO control codes (0x990000D0 and 0x990001D0). Figure 6 – Antivirus Terminator kills process using third-party driver. The supplied third-party driver is a legitimate and signed component of Antiy System In-Depth Analysis Toolkit, originally named AToolsKrnl64.sys. The toolkit was developed by Antiy Labs, a Chinese security vendor, and features a graphical user interface that allows users, among others, to interact with and manipulate processes. The ability to kill processes is the most important feature which is abused by threat actors in this particular case. Figure 7 – Antiy System In-Depth Analysis Tookit GUI. The following piece of code in the driver handles the IO control code 0x99000050 mentioned above: Figure 8 – IO control code processing in the Antiy driver. The second function is the piece of code responsible for killing a process with a given PID. In this report we analyze Storm-2603, a relatively new threat actor first mentioned by Microsoft during investigations into the “ToolShell” campaign targeting SharePoint servers. While some of the exploitation activity was tied to known Chinese APT groups, Storm-2603 stood out as a previously undocumented group linked to ransomware deployment. By examining infrastructure indicators shared in public reporting, we were able to connect this actor to earlier campaigns involving LockBit Black and Warlock/X2anylock ransomware, dating back to at least March 2025. These earlier attacks used similar infrastructure and tools, including DNS tunneling and HTTP-based backdoors. Interestingly, multiple ransomware variants were deployed in the same attack. This behavior, along with the overlap in techniques, helps us better understand how Storm-2603 operates “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.

A total of 396 compromised systems have been identified following the widespread exploitation of the Microsoft SharePoint zero-day vulnerability ToolShell (CVE-2025-53770/53771). Eye Security, the Dutch company that discovered the global zero-day, analyzed 27,000 SharePoint servers between July 18 and 23 and confirmed the compromise affected at least 145 unique organizations across 41 countries. Many commentators have noted that long-term, the number of affected organizations is likely to grow. The US was the country with the most successfully attacked organizations, making up 31% of the total. Mauritius (8%), Germany (7%) and France (5%) were also among those affected. Eye Security told Infosecurity that while it couldn’t be certain, Mauritius could have been among the most targeted due to the strong presence of US government entities in the region. The firm also identified two organizations in Jordan that were affected. Eye Security noted these both experienced an “unusually high volume of attacks.” Government Organizations Most Targeted The government sector accounted for 30% of all confirmed infections. Reports have suggested that the US Nuclear Weapons Agency, Department of Homeland Security and Department of Health and Human Services were among the victims, but no official confirmation has come from these agencies at the time of writing. Large organizations, especially government agencies, typically use on-premises Microsoft SharePoint in their technology stack. Using SharePoint on-premises allows organizations to have greater control over the information they store on these systems. “From the data, it’s clear this wasn’t a random or opportunistic campaign. The attackers knew exactly what they were looking for,” said Lodi Hensen, VP of Security Operations at Eye Security. The cybersecurity firm told Infosecurity it was clear the attackers didn’t go after every vulnerable organization. “Instead, they appeared to focus on those that were likely to be of particular strategic or intelligence value, suggesting a targeted and deliberate approach,” the security firm said. The firm also said there was a strong suggestion that these organizations were targeted as part of intelligence-led operations. The education sector accounted for 13% of the attacks worldwide, followed by SaaS providers (9%), telecommunications firms (4%) and power grids (4%). Attacks Expected to Continue Eye Security expects continued abuse of the SharePoint flaw in the coming weeks, with ransomware and supply chain threats likely to follow. Microsoft attributed the initial attacks to China-linked actors including Linen Typhoon, Violet Typhoon and Storm-2603. However, more recent activity suggests that exploitation is not limited to state-backed groups. “Once a zero-day becomes public and technical details begin to circulate, other state and non-state actors tend to follow. That includes cybercriminal groups with very different motives, especially those focused on financial gain,” said Hensen. Low skilled actors may now be able to take advantage of the vulnerability. Eye Security explained that the exploit has now been incorporated into open-source tools like Metasploit, making it trivial for even low-skilled attackers to exploit unpatched systems. Outside of the three threat actors identified by Microsoft, Eye Security has not attributed the attacks to other groups. However, the firm told Infosecurity that given the public availability of the exploit, it’s very likely that additional threat actors are also taking advantage of this vulnerability. Eye Security directly notified its customers and partners about the threat on July 21 and is now urging all organizations using on-premises SharePoint to assume breach, verify patching and conduct thorough threat hunting. Image credit: jackpress / Shutterstock.com

Some risks don’t breach the perimeter—they arrive through signed software, clean resumes, or sanctioned vendors still hiding in plain sight. This week, the clearest threats weren’t the loudest—they were the most legitimate-looking. In an environment where identity, trust, and tooling are all interlinked, the strongest attack path is often the one that looks like it belongs. Security teams are now challenged to defend systems not just from intrusions—but from trust itself being turned into a weapon. ⚡ Threat of the Week Microsoft SharePoint Attacks Traced to China — The fallout from an attack spree targeting defects in on-premises Microsoft SharePoint servers continues to spread a week after the discovery of the zero-day exploits, with more than 400 organizations globally compromised. The attacks have been attributed to two known Chinese hacking groups tracked as Linen Typhoon (aka APT27), Violet Typhoon (aka APT31), and a suspected China-based threat actor codenamed Storm-2603 that has leveraged the access to deploy Warlock ransomware. The attacks leverage CVE-2025-49706, a spoofing flaw, and CVE-2025-49704, a remote code execution bug, collectively called ToolShell. Bloomberg reported that Microsoft is investigating whether a leak from Microsoft Active Protections Program (MAPP), which provides early access to vulnerability information to security software providers, may have led to the zero-day exploitation. China has denied allegations it was behind the campaign. Flare Customers Saw 321% ROI, Says Forrester Consulting Total Economic Impact™ (TEI) Study A new Forrester Consulting study commissioned by Flare shows how Flare’s threat exposure management platform delivered 321% ROI, cut manual work by 75%, and paid for itself in under 6 months for a composite organization representative of interviewed customers. Get the full business case. Read the Study ➝ 🔔 Top News U.S. Treasury Sanctions N. Korean Company for IT Worker Scheme — The U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned a North Korean front company and three associated individuals for their involvement in the fraudulent remote information technology (IT) worker scheme designed to generate illicit revenues for Pyongyang. In a related move, Christina Marie Chapman, a laptop farmer in Arizona responsible for facilitating the scheme, was sentenced to jail for eight-and-a-half years, after raising $17 million in illicit funds for the regime. In these schemes, IT workers from North Korea use well-crafted, carefully curated portfolios, complete with full social media profiles, AI-enhanced photos and deepfakes, and stolen identities to pass background checks and land jobs at various U.S. companies. Once hired, they take the help of facilitators to receive company-issued laptops and other equipment, which they can then connect to remotely, thereby giving the impression that they are within the country where the company is located. The ongoing efforts operate with the twin goals of generating revenue for the Hermit Kingdom's nuclear program and other efforts via regular salaries, as well as gaining a foothold inside corporate networks for the purpose of planting malware for stealing secrets and extorting their employers. "DPRK's cyber operations challenge the traditional nation-state playbook – merging cryptocurrency theft, espionage, and nuclear ambition within a self-funded system driven by profit, loyalty, and survival," said Sue Gordon, a member of DTEX's Advisory Board and former principal deputy director of U.S. National Intelligence. "Recognizing it as a family-run mafia syndicate unblurs the lines between cybercrime and statecraft. This report pulls back the curtain on their inner workings and psychology, revealing how deeply embedded they already are within our workforce – providing the context needed to anticipate their next move." Soco404 and Koske Target Misconfigured Cloud Instances to Drop Miners — Two different malware campaigns have targeted vulnerabilities and misconfigurations across cloud environments to deliver cryptocurrency miners. These activity clusters have been codenamed Soco404 and Koske. While Soco404 targets both Linux and Windows systems to deploy platform-specific malware, Koske is a Linux-focused threat. There is also evidence to suggest that Koske has been developed using a large language model (LLM), given the presence of well-structured comments, best-practice logic flow with defensive scripting habits, and synthetic panda-related imagery to host the miner payload. XSS Forum Taken Down and Suspected Admin Arrested — Law enforcement notched a significant victory against the cybercrime economy with the disruption of the notorious forum XSS and the arrest of its suspected administrator. That said, it's important to note that takedowns of similar forums have proved short-lived, and threat actors often move to new platforms or other alternatives, such as Telegram channels. The development comes as LeakZone, a self-styled "leaking and cracking forum" where users advertise and share breached databases, stolen credentials, and pirated software, was caught leaking the IP addresses of its logged-in users to the open web. Coyote Trojan Exploits Windows UI Automation — The Windows banking trojan known as Coyote has become the first known malware strain to exploit the Windows accessibility framework called UI Automation (UIA) to harvest sensitive information. Coyote, which is known to target Brazilian users, comes with capabilities to log keystrokes, capture screenshots, and serve overlays on top of login pages associated with financial enterprises. Akamai's analysis found that the malware invokes the GetForegroundWindow() Windows API in order to extract the active window's title and compare it against a hard-coded list of web addresses belonging to targeted banks and cryptocurrency exchanges. "If no match is found Coyote will then use UIA to parse through the UI child elements of the window in an attempt to identify browser tabs or address bars," Akamai said. "The content of these UI elements will then be cross-referenced with the same list of addresses from the first comparison." Cisco Confirms Active Exploits Targeting ISE — Cisco has warned that a set of security flaws in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) have come under active exploitation in the wild. The flaws, CVE-2025-20281, CVE-2025-20337, and CVE-2025-20282, allow an attacker to execute arbitrary code on the underlying operating system as root or upload arbitrary files to an affected device and then execute those files on the underlying operating system as root. The network equipment vendor did not disclose which vulnerabilities have been weaponized in real-world attacks, the identity of the threat actors exploiting them, or the scale of the activity. ️🔥 Trending CVEs Hackers are quick to jump on newly discovered software flaws – sometimes within hours. Whether it’s a missed update or a hidden bug, even one unpatched CVE can open the door to serious damage. Below are this week’s high-risk vulnerabilities making waves. Review the list, patch fast, and stay a step ahead. This week's list includes — CVE-2025-54068 (Laravel Livewire Framework), CVE-2025-34300 (Lighthouse Studio), CVE-2025-6704, CVE-2025-7624 (Sophos Firewall), CVE-2025-40599 (SonicWall SMA 100 Series), CVE-2025-49656, CVE-2025-50151 (Apache Jena), CVE-2025-22230, CVE-2025-22247 (Broadcom VMware Tools), CVE-2025-7783 (form-data), CVE-2025-34140, CVE-2025-34141, CVE-2025-34142, CVE-2025-34143 (Hexagon ETQ Reliance), CVE-2025-8069 (AWS Client VPN for Windows), CVE-2025-7723, CVE-2025-7724 (TP-Link VIGI NVR), CVE-2025-7742 (LG Innotek LNV5110R), CVE-2025-24000 (Post SMTP), CVE-2025-52449, CVE-2025-52452, CVE-2025-52453, CVE-2025-52454, CVE-2025-52455 (Salesforce Tableau Server), and CVE-2025-6241 (SysTrack). 📰 Around the Cyber World Google Removes 1000s of YouTube Channels Tied to Influence Ops — Google removed nearly 11,000 YouTube channels and other accounts tied to state-linked propaganda campaigns from China, Russia and more in the second quarter of 2025. It removed over 2,000 removed channels linked to Russia, including 20 YouTube channels, 4 Ads accounts, and 1 Blogger blog associated with RT, a Russian state-controlled media outlet. The takedown also included more than 7,700 YouTube channels linked to China, which shared content in Chinese and English that promoted the People’s Republic of China, supported President Xi Jinping and commented on U.S. foreign affairs. Surveillance Company Bypasses SS7 Safeguards — An unnamed surveillance company has been using a new attack technique to bypass the Signaling System 7 (SS7) protocol's protections and trick telecommunications companies into disclosing the location of their users. The attack method, likely used since the fourth quarter of 2024, hinges on Transaction Capabilities Application Part (TCAP) manipulation through SS7 commands that have been encoded in such a manner that their contents are not parsed by the protection systems or firewalls at the target network. "We don't have any information on how successful this attack method has been worldwide, as its success is vendor/software specific, rather than being a general protocol vulnerability, but its use as part of a suite indicates that it has had some value," Enea researchers Cathal Mc Daid and Martin Gallagher said. Number of Phishing Sites Aimed at Telegram Spikes — A new report has found that the number of phishing sites aimed at Telegram users increased to 12,500 in the second quarter of 2025. In one variant of the scheme, fraudsters create a phishing page that simulates the login page associated with Telegram or Fragment, a platform on the TON blockchain that allows users to buy and sell unique Telegram usernames and virtual phone numbers. Should victims enter their credentials and the confirmation codes, the accounts are hijacked by the attackers. The second scenario entails the attacker approaching a victim to purchase a rare digital gift from them in Telegram for a large amount. "As payment, the fraudster sends fake tokens," BI.ZONE said. "At first glance, they are indistinguishable from the real ones, but they have no real value. After the transfer, the victim is left without a gift and with a fake digital currency." In a related report, Palo Alto Networks Unit 42 said it identified 54,446 domains hosting phishing sites in a campaign impersonating Telegram dubbed telegram_acc_hijack. "These pages collect Telegram login credentials submitted and real-time one-time passcodes (OTPs) to hijack user accounts," the company added. Former NCA Employee Sentenced to 5.5 Years in Prison — A former officer with the U.K. National Crime Agency (NCA) was sentenced to five-and-a-half years in prison after stealing a chunk of the Bitcoin seized by the agency as part of a law enforcement operation targeting the now-defunct illicit dark web marketplace Silk Road. Paul Chowles, 42, was identified as the culprit after authorities recovered his iPhone, which linked him to an account used to transfer Bitcoin as well as relevant browser search history relating to a cryptocurrency exchange service. "Within the NCA, Paul Chowles was regarded as someone who was competent, technically minded and very aware of the dark web and cryptocurrencies," Alex Johnson, Specialist Prosecutor with the Crown Prosecution Service's Special Crime Division, said. "He took advantage of his position working on this investigation by lining his own pockets while devising a plan that he believed would ensure that suspicion would never fall upon him. Once he had stolen the cryptocurrency, Paul Chowles sought to muddy the waters and cover his tracks by transferring the Bitcoin into mixing services to help hide the trail of money." U.K. Sanctions 3 Russian GRU Units for Sustained Cyber Attacks — The U.K. sanctioned three units of the Russian military intelligence agency (GRU) and 18 military intelligence officers for "conducting a sustained campaign of malicious cyber activity over many years" with an aim to "sow chaos, division and disorder in Ukraine and across the world." The sanctions cover Unit 26165 (linked to APT28), Unit 29155 (linked to Cadet Blizzard), and Unit 74455 (linked to Sandworm), as well as African Initiative, a "social media content mill established and funded by Russia and employing Russian intelligence officers to conduct information operations in West Africa." U.K. Floats Ransomware Payments Ban for Public Bodies — The U.K. government has proposed new legislation that would ban public sector organizations and critical national infrastructure from paying criminal operators behind ransomware attacks, as well as enforce mandatory reporting requirements for all victims to inform law enforcement of attacks. "Public sector bodies and operators of critical national infrastructure, including the NHS, local councils and schools, would be banned from paying ransom demands to criminals under the measure," the government said. "The ban would target the business model that fuels cyber criminals' activities and makes the vital services the public rely on a less attractive target for ransomware groups." Businesses that do not fall under the ambit of the law would be required to notify the government of any intent to pay a ransom. A failure to download patches to address widely exploited vulnerabilities could lead to daily fines of £100,000 or 10 percent of turnover should a digital break-in occur. Thought Lumma Was Out of Commission? Think Again! — The Lumma Stealer operations have recovered following a law enforcement takedown of its infrastructure earlier this year, with the malware being distributed through more discreet channels and stealthier evasion tactics. "Lumma's infrastructure began ramping up again within weeks of the takedown," Trend Micro said. "This rapid recovery highlights the group's resilience and adaptability in the face of disruption." A notable shift is the reduction in volume of domains using Cloudflare's services to obfuscate their malicious domains and make detection more challenging, instead shifting to Russian alternatives like Selectel. "This strategic pivot suggests a move towards providers that might be perceived as less responsive to law enforcement requests, further complicating efforts to track and disrupt their activities," the company added. Lumma Stealer is known for its diverse and evolving delivery methods, leveraging social media posts, GitHub, ClickFix, and fake sites distributing cracks and key generators, as initial access methods. The resurgence of Lumma is par for the course with modern cybercriminal operations that often can quickly resume activity even after significant law enforcement disruptions. In a statement shared with The Hacker News, ESET confirmed the resurgence of Lumma Stealer and that the current activity has approached levels similar to those before the law enforcement action. "Lumma Stealer operators continue to register dozens of new domains weekly – activity that didn’t stop even after the disruption – but switched to primarily resolving them at nameservers located in Russia," Jakub Tománek, ESET malware analyst, said. "The codebase itself has shown minimal changes since the takedown attempt. This indicates the group’s primary focus has been on restoring operations rather than innovating their 'product' and introducing new features." U.S. Government Warns of Interlock Ransomware — The U.S. government has warned of Interlock ransomware attacks targeting businesses, critical infrastructure, and other organizations in North America and Europe since late September 2024. The attacks, designed to target both Windows and Linux systems, employ drive-by downloads from compromised legitimate websites or ClickFix- and FileFix-style lures to drop payloads for initial access. "Actors then use various methods for discovery, credential access, and lateral movement to spread to other systems on the network," the U.S. government said. "Interlock actors employ a double extortion model in which actors encrypt systems after exfiltrating data, which increases pressure on victims to pay the ransom to both get their data decrypted and prevent it from being leaked." Also part of the threat actor's tooling are Cobalt Strike and a custom remote access trojan called NodeSnake RAT, and information stealers like Lumma Stealer and Berserk Stealer to harvest credentials for lateral movement and privilege escalation. Apple Notifies Iranians of Spyware Attacks — Apple notified more than a dozen Iranians in recent months that their iPhones had been targeted with government spyware, according to a digital rights and security organization called Miaan Group. This included individuals who have a long history of political activism. Also notified by Apple were dissidents and a technology worker. It's unclear which spyware maker is behind these attacks. The attacks mark the first known example of advanced mercenary tools being used both inside Iran and against Iranians living abroad. Linux Servers Targeted by SVF Bot — Poorly managed Linux servers are being targeted by a campaign that delivers a Python-based malware called SVF Bot that enlists infected machines in a botnet that can conduct distributed denial-of-service (DDoS) attacks. "When the SVF Bot is executed, it can authenticate with the Discord server using the following Bot Token and then operate according to the threat actor's commands," ASEC said. "Most of the supported commands are for DDoS attacks, with L7 HTTP Flood and L4 UDP Flood being the main types supported." Turkish Companies Targeted by Snake Keylogger — Turkish organizations are the target of a new phishing campaign that delivers an information stealer called Snake Keylogger. The activity, primarily singling out defense and aerospace sectors, involves distributing bogus email messages that impersonate Turkish Aerospace Industries (TUSAŞ) in an attempt to trick victims into opening malicious files under the guise of contractual documents. "Once executed, the malware employs advanced persistence mechanisms – including PowerShell commands to evade Windows Defender and scheduled tasks for auto-execution – to harvest sensitive data, such as credentials, cookies, and financial information, from a wide range of browsers and email clients," Malwation said. Former Engineer Pleads Guilty to Trade Theft — A Santa Clara County man and former engineer at a Southern California company pleaded guilty to stealing trade secret technologies developed for use by the U.S. government to detect nuclear missile launches, track ballistic and hypersonic missiles, and to allow U.S. fighter planes to detect and evade heat-seeking missiles. Chenguang Gong, 59, of San Jose, pleaded guilty to one count of theft of trade secrets. He remains free on a $1.75 million bond. Gong – a dual citizen of the United States and China – transferred more than 3,600 files from a Los Angeles-area research and development company where he worked to personal storage devices during his brief tenure with the company last year. The victim company hired Gong in January 2023 as an application-specific integrated circuit design manager. He was terminated three months later. Gong, who was arrested and charged in February, is scheduled for sentencing on September 29, 2025. He faces up to 10 years in prison. FBI Issues Warning About The Com — The Federal Bureau of Investigation (FBI) is warning the public about an online group called In Real Life (IRL) Com that provides violence-as-a-service (VaaS), including shootings, kidnappings, armed robbery, stabbings, physical assault, and bricking. "Services are posted online with a price breakdown for each act of violence," the FBI said. "Groups offering VaaS advertise contracts on social media platforms to solicit individuals willing to conduct the act of violence for monetary compensation." The threat group is also said to advertise swat-for-hire services via communication applications and social media platforms. IRL Com is assessed to be one of three subsets of The Com (short for The Community), a growing online collective comprising primarily of thousands of English-speaking individuals, many of whom are minors, and engage in a wide range of criminal endeavors. The other two offshoots are Hacker Com, which is linked to DDoS and ransomware-as-a-service (RaaS) groups, and Extortion Com, which primarily involves the exploitation of children. Notably, the Com encompasses threat clusters tracked as LAPSUS$ and Scattered Spider. A similar warning was issued by the U.K. National Crime Agency (NCA) earlier this March, calling attention to The Com's trend of recruiting teenage boys to commit a range of criminal acts, from cyber fraud and ransomware to child sexual abuse. Organized Crime Group Behind Large-Scale Fraud Disrupted — A highly organised criminal group involved in large-scale fraud in Western Europe was dismantled in a coordinated operation led by authorities from Romania and the United Kingdom. "The gang had travelled from Romania to several Western European countries, mainly the UK, and withdrew large sums of money from ATM machines," Europol said. "They later laundered the proceeds by investing in real estate, companies, vacations, and luxury products, including cars and jewelry." The operation has led to two arrests, 18 house searches, and the seizure of real estate, luxury cars, electronic devices, and cash. The attackers committed what has been described as Transaction Reversal Fraud (TRF), in which the screen of an ATM is removed and a bank card is inserted to request funds. The transactions were canceled (or reversed) before the funds were dispensed, allowing them to reach inside the ATM and take the cash before it was retracted. The gang is estimated to have plundered about €580,000 (about $681,000) using this method. "The perpetrators were also involved in other criminal activities, including skimming, forging electronic means of payment and transport cards, and conducting bin attacks — a type of card fraud carried out using software designed to identify card numbers and generate illicit income through fraudulent payments," Europol added. The development came as a 21-year-old U.K. student, Ollie Holman, who designed and distributed 1,052 phishing kits linked to £100 million (approximately $134 million) worth of fraud, was jailed for seven years. It is estimated that Holman received £300,000 from selling the kits between 2021 and 2023. The phishing kits were sold via Telegram. Holman previously pleaded guilty to seven counts, including encouraging or assisting the commission of an offence, making or supplying articles for use in fraud, and transferring, acquiring, and possessing criminal property, per the Crown Prosecution Service. Endgame Gear Acknowledges Supply Chain Attack — Gaming peripheral manufacturer Endgame Gear confirmed that unidentified threat actors compromised its official software distribution system to spread dangerous Xred malware to unsuspecting customers for nearly two weeks via the OP1w 4k v2 product page. The security breach occurred between June 26 and July 9, 2025. The company stated that "access to our file servers was not compromised, and no customer data was accessible or affected on our servers at any time," and that "This issue was isolated to the OP1w 4k v2 product page download only." New Campaign Targeted Crypto Users Since March 2024 — A new sophisticated and evasive malware campaign has managed to stay unnoticed and target cryptocurrency users globally since March 2024. Dubbed WEEVILPROXY, the activity leverages Facebook advertisement campaigns masquerading as well-known cryptocurrency-related software and platforms, such as Binance, Bybit, Kraken, Revolut, TradingView, and others, to trick users into downloading fake installers that ultimately drop information stealers and cryptocurrency drainers. "We have also observed the threat actor propagate ads through Google Display Network since April-May 2025, which are displayed throughout the internet in the form of images/videos," WithSecure said. "These ads appear geographically bound as well, for instance, we have observed such ads specifically targeting the Philippines, Malaysia, Thailand, Vietnam, Bangladesh, and Pakistan." VMDetector Loader Delivers Formbook Malware — A new variant of the VMDetector Loader malware has been found embedded within the "pixel data" of a seemingly benign JPG image that's delivered via phishing emails to ultimately deploy an information stealer called Formbook. The JPG image is retrieved from archive.org by means of Visual Basic Scripts present within zipped archives that are sent as attachments to the email messages. Threat Actors Use mount Binary in Hikvision Attacks — Attacks in the wild exploiting CVE-2021-36260, a command injection bug affecting Hikvision cameras, have been uncovered, leveraging the flaw to mount a remote NFS share and execute a file off of it. "The attacker tells mount to make the remote NFS share, /srv/nfs/shared, on 87.121.84[.]34 available locally as the directory ./b," VulnCheck said. How Windows Drivers Can Be Weaponized? — In a new detailed analysis, Security Joes has highlighted the threat posed by kernel-mode attacks and how attacks abusing vulnerable drivers, called the Bring Your Own Vulnerable Driver (BYOVD) technique, can be used by attackers to exploit signed-but-flawed drivers to bypass kernel protections. "Because drivers run in kernel mode, they possess high privileges and unrestricted access to system resources," the company said. "This makes them a high-value target for attackers aiming to escalate privileges, disable security mechanisms such as EDR callbacks, and achieve full control over the system." Organizations' Attack Surface Increases — Organizations have created more entry points for attackers. That's according to a report from ReliaQuest, which found a 27% increase in exposed ports between the second half of 2024 and the first half of 2025, a 35% increase in exposed operational technology (OT), and a surge in vulnerabilities in public-facing systems, such as PHP and WordPress. "Vulnerabilities in public-facing assets more than doubled, rising from 3 per organization in the second half of 2024 to 7 in the first half of 2025," the company said. "From late 2024 to early 2025, the number of exposed access keys for organizations in our customer base doubled, creating twice the opportunity for attackers to slip in unnoticed." Iranian Bank Pasargad Targeted During June Conflict — The Iranian bank known as Pasargad was targeted as part of a cyber attack during the Iran-Israel war in June 2025, impacting access to crucial services. A suspected Israeli operation called Predatory Sparrow claimed responsibility for the attack on another Iranian bank Sepah and the country's largest cryptocurrency exchange, Nobitex. CrowdStrike Outage Impacted Over 750 U.S. Hospitals — A new study undertaken by a group of academics from the University of California, San Diego, found that 759 U.S. hospitals experienced IT outages last July due to a faulty CrowdStrike update. "A total of 1098 distinct network services with outages were identified, of which 631 (57.5%) were unable to be classified, 239 (21.8%) were direct patient-facing services, 169 (15.4%) were operationally relevant services, and 58 (5.3%) were research-related services," the study said. North Korean Actors Employ NVIDIA Lures — The North Korean threat actors behind the Contagious Interview (aka DeceptiveDevelopment) campaign are leveraging ClickFix-style lures to trick unsuspecting job seekers into downloading a supposed NVIDIA-related update to address camera or microphone issues when attempting to provide a video assessment. The attack leads to the execution of a Visual Basic Script that launches a Python payload called PylangGhost that steals credentials and enables remote access via MeshAgent. ACRStealer Variant Distributed in New Attacks — Threat actors are propagating a new variant of ACRStealer that incorporates new features aimed at detection evasion and analysis obstruction. "The modified ACRStealer uses the Heaven's Gate to disrupt detection and analysis," AhnLab said. "Heaven's Gate is a technique used to execute x64 code in WoW64 processes and is widely used for analysis evasion and detection avoidance." The new version has been rebranded as Amatera Stealer, per Proofpoint. It's offered for sale for $199 per month to $1,499 per year. Aeza Group Shifts Infrastructure After U.S. Sanctions — Earlier this month, the U.S. Treasury Department imposed sanctions against Russia-based bulletproof hosting (BPH) service provider Aeza Group for assisting threat actors in their malicious activities, such as ransomware, data theft, and darknet drug trafficking. Silent Push, in a new analysis, said IP ranges from Aeza's AS210644 began migrating to AS211522, a new autonomous system operated by Hypercore Ltd., starting July 20, 2025, in an attempt to evade sanctions enforcement and operate under new infrastructure. Request for Quote Scams Demonstrate Sophistication — Cybersecurity researchers are calling attention to a widespread Request for Quote (RFQ) scam that employs common Net financing options (Net 15, 30, 45) to steal a variety of high-value electronics and goods. "In RFQ campaigns, the actor reaches out to a business to ask for quotes for various products or services," Proofpoint said. "The quotes they receive can be used to make very convincing lures to send malware, phishing links, and even additional business email compromise (BEC) and social engineering fraud." Besides using vendor-supplied financing and stolen identities of real employees to steal physical goods, these scams utilize email and legitimate online quote request forms to reach potential victims. Fake Games Distribute Stealer Malware — A new malware campaign is distributing fake installers for indie game titles such as Baruda Quest, Warstorm Fire, and Dire Talon, promoting them via fraudulent websites, YouTube channels, and Discord, to trick unwitting users into infecting their machines with stealers like Leet Stealer, RMC Stealer (a modified version of Leet Stealer), and Sniffer Stealer. The origins of Leet and RMC malware families can be traced back to Fewer Stealer, suggesting a shared lineage. It's believed that the campaign originally targeted Brazil, before expanding worldwide. U.S. FCC Wants to Ban Companies from Using Chinese Equipment When Laying Submarine Cables — The U.S. Federal Communications Commission said it plans to issue new rules that would ban Chinese technology from U.S. submarine cables in order to protect underwater telecommunications infrastructure from foreign adversary threats. "We have seen submarine cable infrastructure threatened in recent years by foreign adversaries, like China," FCC Chairman Brendan Carr said. "We are therefore taking action here to guard our submarine cables against foreign adversary ownership, and access as well as cyber and physical threats." In a recent report, Recorded Future said the risk environment for submarine cables has "escalated" and that the "threat of state-sponsored malicious activity targeting submarine cable infrastructure is likely to rise further amid heightened geopolitical tensions." The cybersecurity company also cited a lack of redundancy, a lack of diversity of cable routes, and limited repair capacity as some of the key factors that raise the risk of severe impact caused by damage to submarine cables. China Warns Citizens of Backdoored Devices and Supply Chain Threats — China's Ministry of State Security (MSS) has issued an advisory, warning of backdoors in devices and supply chain attacks on software. The security agency said such threats not only risk personal privacy and theft of corporate secrets, but also affect national security. "Potential technical backdoor security risks can also be reduced by strengthening technical protection measures, such as formulating patch strategies, regularly updating operating systems, regularly checking device logs, and monitoring abnormal traffic," MSS said, urging organizations to avoid foreign software and instead adopt domestic operating systems. In a separate bulletin, the MSS also alleged that overseas spy intelligence agencies may set up backdoors in its ocean observation sensors to steal data. NyashTeam Hacking Group Infrastructure Disrupted — Russia-based cybersecurity company F6 said it dismantled a network of domains operated by a relatively unknown hacking crew known as NyashTeam, which sells two different remote access trojans known as DCRat (DarkCrystal RAT) and WebRAT through Telegram bots and websites under the malware-as-a-service (MaaS) model. The malware is distributed using YouTube and GitHub by passing them off as game cheats or pirated software. The group is also believed to provide hosting services for cybercriminal infrastructure and support customers through plugins, guides, and data processing tools, appealing to both novice hackers and experienced cybercriminals alike. RenderShock Attack Technique Detailed — Cybersecurity researchers have detailed a zero-click attack strategy called RenderShock that leverages trusted operating system behaviors to conduct reconnaissance and deliver payloads without requiring any user interaction. "By embedding malicious logic in metadata, preview triggers, and document formats, RenderShock capitalizes on system convenience as an unguarded attack vector," CYFIRMA said. "Modern enterprise systems are built for convenience, automatically previewing, indexing, synchronizing, and rendering files across endpoints, cloud platforms, and productivity suites. These systems often process files without explicit user action, trusting that the rendering process is safe. RenderShock exploits these passive execution surfaces: trusted components that parse untrusted files silently in the background." 🎥 Cybersecurity Webinars AI Is Breaking Trust—Here’s How to Save It Before It’s Too Late — Discover how customers are reacting to AI-driven digital experiences in 2025. The Auth0 CIAM Trends Report reveals rising identity threats, new trust expectations, and the hidden costs of broken logins. Join this webinar to learn how AI can be your biggest asset—or your biggest risk. Python Devs: Your Pip Install Could Be a Malware Bomb — In 2025, Python’s supply chain is under siege — from typosquats to hijacked AI libraries. One wrong pip install could inject malware straight into production. This session shows how to secure your builds with tools like Sigstore, SLSA, and hardened containers. Stop hoping your packages are clean — start verifying. 🔧 Cybersecurity Tools Vendetect - It is an open-source tool designed to detect copied or vendored code across repositories — even when the code has been modified. Built for real-world security and compliance needs, it uses semantic fingerprinting and version control analysis to identify where code was copied from, including the exact source commit. Unlike academic plagiarism tools, Vendetect is optimized for software engineering environments: it catches renamed functions, stripped comments, and altered formatting, and helps trace untracked dependencies, license violations, and inherited vulnerabilities often found during security assessments. Telegram Channel Scraper - It is a Python-based tool designed for advanced monitoring and data collection from public Telegram channels. It uses the Telethon library to scrape messages and media, storing everything in optimized SQLite databases. Built for efficiency and scale, it supports real-time scraping, parallel media downloads, and batch data exports. This makes it useful for researchers, analysts, and security teams who need structured access to Telegram content for investigation or archiving — without depending on manual scraping or third-party platforms. Disclaimer: These newly released tools are for educational use only and haven’t been fully audited. Use at your own risk—review the code, test safely, and apply proper safeguards. 🔒 Tip of the Week Don’t Trust Your Browser Blindly — Most people think of their browser as just a tool to get online — but in reality, it’s one of the most exposed parts of your device. Behind the scenes, your browser quietly stores names, emails, companies, and sometimes even payment info. This data often lives in plain, unencrypted files that are easy to extract if someone gains local access — even briefly. For example, in Chrome or Edge, personal autofill details are stored in a file called Web Data, which is a basic SQLite database anyone with access can read. This means that if your machine is compromised — even by a simple script — your personal or even work identity can be quietly stolen. Red teamers and attackers love this kind of recon gold. It doesn’t stop there. Browsers also keep session cookies, local storage, and site databases that often don’t get wiped, even after logout. This data can allow attackers to hijack your logged-in sessions or extract sensitive info stored by web apps — including company tools. Even browser extensions, if malicious or hijacked, can quietly spy on your activity or inject bad code into pages you trust. Another weak spot? Browser extensions. Even legitimate-looking add-ons can have wide permissions — letting them read what you type, track your browsing, or inject scripts. If a trusted extension gets compromised in an update, it can silently become a data theft tool. This happens more often than people think. Here’s how to reduce the risk: Clear autofill, cookies, and site data regularly Disable autofill entirely on workstations Limit extensions — audit them using tools like CRXcavator or Extension Police Use DB Browser for SQLite to inspect stored files (Web Data, Cookies) Use tools like BleachBit to securely wipe traces Browsers are essentially lightweight application platforms. If you’re not auditing how they store data and who can access it, you’re leaving a major gap open — especially on shared or endpoint-exposed machines. Conclusion This week’s signals are less a conclusion and more a provocation: What else might we be misclassifying? What familiar data could become meaningful under a different lens? If the adversary thinks in systems, not symptoms, our defenses must evolve accordingly. Sometimes, the best response isn’t a patch—it’s a perspective shift. There’s value in looking twice where others have stopped looking altogether.

La clamorosa ondata di attacchi che ha preso di mira l’ambiente Microsoft SharePoint ha scosso alle fondamenta il mondo della cyber security. La comparsa di una vulnerabilità zero-day come ToolShell, però, non può essere considerata semplicemente come un “cigno nero”. L’emersione di bug e nuove tecniche di attacco in grado di violare i sistemi critici dell’azienda deve sempre essere considerata come una possibilità. “Per garantire l’inviolabilità dei dati non basta utilizzare strumenti orientati alla prevenzione e al contrasto degli attacchi informatici” spiega Marco Iannuci, CEO di Boolebox. “L’unica strategia che offre la certezza di rendere inaccessibili i dati ai cyber criminali è quella che prevede un’efficace protezione crittografica dei dati”. Indice degli argomenti Il ragionamento del CEO di Boolebox, azienda milanese specializzata nello sviluppo e gestione di soluzioni di crittografia, si colloca in un contesto in cui gli esperti di sicurezza si trovano a fronteggiare un volume di attacchi inedito, sia sotto il profilo quantitativo, sia sotto quello qualitativo. In questo scenario è inevitabile partire dall’assunto che qualcuno, prima o poi, riuscirà a fare breccia nei sistemi. “La protezione tramite crittografia è la migliore garanzia di impedire l’accesso ai dati nel caso di un incidente di sicurezza” sottolinea Iannucci. “Anche se i cyber criminali dovessero ottenere l’accesso ai documenti, infatti, si troverebbero tra le mani informazioni che non sarebbero in grado di decodificare”. Se la protezione crittografica dei dati è considerata ormai una misura standard nella maggior parte degli ambienti software, il manager di Boolebox sottolinea come l’adozione di strumenti specifici permetta di alzare l’asticella e complicare notevolmente la vita ai cyber criminali. “L’implementazione di una soluzione come Boolebox attraverso plugin specifici, permette di applicare un livello di protezione elevato in qualsiasi ambiente, come Windows, Outlook, Gmail, OneDrive e SharePoint, senza stravolgere l’esperienza utente” spiega Iannucci. Sotto un profilo squisitamente tecnologico, l’adozione di sistemi di crittografia dei documenti deve per prima cosa attenersi a quello che è lo stato dell’arte del settore. “In Boolebox utilizziamo un livello di crittografia ‘militare’, basato sull’affidabile algoritmo AES-256, tra i più solidi e diffusi” spiega Iannucci. “L’aspetto tecnico, per quanto importante, non è però l’unico che incide sui sistemi di protezione basati su crittografia”. I fattori che incidono sull’equazione della sicurezza crittografica, in realtà, sono molti. Primo tra tutti quello della gestione delle chiavi. La strategia caldeggiata da Iannucci prevede che la loro gestione sia sempre affidata direttamente all’organizzazione, sui propri server nella modalità on premises, sui server del fornitore di servizio in caso di adozione di una soluzione cloud. Le chiavi, infine, devono essere conservate all’interno di “cassetti” a loro volta protetti da crittografia. “Uno degli aspetti fondamentali è quello di compartimentare la gestione dei documenti protetti, offrendo per esempio la possibilità che ogni singolo utente possa creare chiavi crittografiche personali, addirittura prevedendone di diverse per ogni singolo documento protetto” prosegue Iannucci. Può sembrare una complicazione dal punto di vista logistico, ma il livello di sicurezza garantito dall’adozione di chiavi personali è incomparabile rispetto all’uso di un sistema di protezione “generalista”. Differenziando il più possibile le chiavi crittografiche utilizzate per proteggere i documenti, se gli eventuali attaccanti volessero provare a violarne la protezione si troverebbero infatti di fronte a un compito immane. Un aspetto ulteriore legato alla compartimentazione è quello di evitare che nell’ecosistema ci siano punti deboli, impedendo per esempio che gli amministratori IT abbiano ‘mani libere’ su qualsiasi tipo di operazione. In caso contrario, la compromissione dell’account (o del dispositivo) di un admin potrebbe avere conseguenze devastanti. “La nostra piattaforma prevede che gli amministratori non possano avere accesso ai documenti” sottolinea Iannucci. “Nel caso in cui un utente perda le credenziali per l’accesso, è previsto l’avvio di una procedura di recupero che, in ogni caso, non allarga le maglie del sistema”. Se l’implementazione di una piattaforma per la protezione crittografica dei documenti rappresenta un fattore che incide notevolmente sulla postura di sicurezza, un ruolo di primo piano è riservato alle modalità adottate nel suo utilizzo, a partire dalle policy. “Sulla nostra piattaforma consentiamo di graduare le impostazioni di sicurezza a seconda della classificazione dei documenti protetti” spiega Iannucci. “Per esempio, è possibile utilizzare sistemi di autenticazione multi-fattore (MFA) che possono arrivare a coinvolgere 4 diversi strumenti. Il vero nodo, in questo caso, è la capacità delle organizzazioni di prevedere policy specifiche che permettano di sfruttare questa opportunità”. In altre parole, il tema non riguarda tanto la disponibilità di funzionalità, quanto la capacità della singola azienda o ente pubblico di prevedere regole e processi che permettano di metterle a valore. Qualcosa che è parte di una “cultura della sicurezza” che si sta affermando sempre di più, soprattutto in settori particolarmente sensibili. “L’adozione della nostra soluzione da parte di soggetti come la Commissione Europea, il Servizio Europeo per l’Azione Esterna (EEAS) e addirittura l’Agenzia per la Cybersicurezza Nazionale è la dimostrazione del fatto che la strategia della protezione crittografica ‘forte’ è considerata ormai una best practice in tema di sicurezza”. Contributo editoriale sviluppato in collaborazione con Boolebox

The ESET research team has released their findings about exploitation of CVE-2025-53770 and CVE‑2025‑53771, zero-day vulnerabilities in on-premises Microsoft SharePoint servers dubbed ToolShell. ESET's data shows that attacks hit victims globally, with the US (13.3% of attacks) being the most-targeted country. What else is there to know about the incursions and what should organizations do to stay safe? Watch the video with ESET Chief Security Evangelist Tony Anscombe and make sure to read the blogpost itself.

On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously issued fixes for CVE-2025-49704 and CVE-2025-49706. The release of the new, “proper” updates has caused confusion about exactly which vulnerabilities attackers are exploiting and whether they are using zero-day exploits. Kaspersky products proactively detected and blocked malicious activity linked to these attacks, which allowed us to gather statistics about the timeframe and spread of this campaign. Our statistics show that widespread exploitation started on July 18, 2025, and attackers targeted servers across the world in Egypt, Jordan, Russia, Vietnam, and Zambia. Entities across multiple sectors were affected: government, finance, manufacturing, forestry, and agriculture. While analyzing all artifacts related to these attacks, which were detected by our products and public information provided by external researchers, we found a dump of a POST request that was claimed to contain the malicious payload used in these attacks. After performing our own analysis, we were able to confirm that this dump indeed contained the malicious payload detected by our technologies, and that sending this single request to an affected SharePoint installation was enough to execute the malicious payload there. Our analysis of the exploit showed that it did rely on vulnerabilities fixed under CVE-2025-49704 and CVE-2025-49706, but by changing just one byte in the request, we were able to bypass those fixes. In this post, we provide detailed information about CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, and one related vulnerability. Since the exploit code is already published online, is very easy to use, and poses a significant risk, we encourage all organizations to install the necessary updates. The exploit Our research started with an analysis of a POST request dump associated with this wave of attacks on SharePoint servers. We can see that this POST request targets the “/_layouts/15/ToolPane.aspx” endpoint and embeds two parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. Looking at the code of ToolPane.aspx, we can see that this file itself does not contain much functionality and most of its code is located in the ToolPane class of the Microsoft.SharePoint.WebPartPages namespace in Microsoft.SharePoint.dll. Looking at this class reveals the code that works with the two parameters present in the exploit. However, accessing this endpoint under normal conditions is not possible without bypassing authentication on the attacked SharePoint server. This is where the first Microsoft SharePoint Server Spoofing Vulnerability CVE-2025-49706 comes into play. CVE-2025-49706 This vulnerability is present in the method PostAuthenticateRequestHandler, in Microsoft.SharePoint.dll. SharePoint requires Internet Information Services (IIS) to be configured in integrated mode. In this mode, the IIS and ASP.NET authentication stages are unified. As a result, the outcome of IIS authentication is not determined until the PostAuthenticateRequest stage, at which point both the ASP.NET and IIS authentication methods have been completed. Therefore, the PostAuthenticateRequestHandler method utilizes a series of flags to track potential authentication violations. A logic bug in this method enables an authentication bypass if the “Referrer” header of the HTTP request is equal to “/_layouts/SignOut.aspx”, “/_layouts/14/SignOut.aspx”, or “/_layouts/15/SignOut.aspx” using case insensitive comparison. The code displayed in the image above handles the sign-out request and is also triggered when the sign-out page is specified as the referrer. When flag6 is set to false and flag7 is set to true, both conditional branches that could potentially throw an “Unauthorized Access” exception are bypassed. On July 8, 2025, Microsoft released an update that addressed this vulnerability by introducing additional checks to detect the usage of the “ToolPane.aspx” endpoint with the sign-out page specified as the referrer. The added check uses case insensitive comparison to verify if the requested path ends with “ToolPane.aspx”. Is it possible to bypass this check, say, by using a different endpoint? Our testing has shown that this check can be easily bypassed. CVE-2025-53771 We were able to successfully bypass the patch for vulnerability CVE-2025-49706 by adding just one byte to the exploit POST request. All that was required to bypass this patch was to add a “/” (slash) to the end of the requested “ToolPane.aspx” path. On July 20, 2025, Microsoft released an update that fixed this bypass as CVE-2025-53771. This fix replaces the “ToolPane.aspx” check to instead check whether the requested path is in the list of paths allowed for use with the sign-out page specified as the referrer. This allowlist includes the following paths: “/_layouts/15/SignOut.aspx”, “/_layouts/15/1033/initstrings.js”, “/_layouts/15/init.js”, “/_layouts/15/theming.js”, “/ScriptResource.axd”, “/_layouts/15/blank.js”, “/ScriptResource.axd”, “/WebResource.axd”, “/_layouts/15/1033/styles/corev15.css”, “/_layouts/15/1033/styles/error.css”, “/_layouts/15/images/favicon.ico”, “/_layouts/15/1033/strings.js”, “/_layouts/15/core.js”, and it can contain additional paths added by the administrator. While testing the CVE-2025-49706 bypass with the July 8, 2025 updates installed on our SharePoint debugging stand, we noticed some strange behavior. Not only did the bypass of CVE-2025-49706 work, but the entire exploit chain did! But wait! Didn’t the attackers use an additional Microsoft SharePoint Remote Code Execution Vulnerability CVE-2025-49704, which was supposed to be fixed in the same update? To understand why the entire exploit chain worked in our case, let’s take a look at the vulnerability CVE-2025-49704 and how it was fixed. CVE-2025-49704 CVE-2025-49704 is an untrusted data deserialization vulnerability that exists due to improper validation of XML content. Looking at the exploit POST request, we can see that it contains two URL encoded parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. We can see how they are handled by examining the code of the method GetPartPreviewAndPropertiesFromMarkup in Microsoft.SharePoint.dll. A quick analysis reveals that “MSOtlPn_Uri” is a page URL that might be pointing to an any file in the CONTROLTEMPLATES folder and the parameter “MSOtlPn_DWP” contains something known as WebPart markup. This markup contains special directives that can be used to execute safe controls on a server and has a format very similar to XML. While this “XML” included in the “MSOtlPn_DWP” parameter does not itself contain a vulnerability, it allows attackers to instantiate the ExcelDataSet control from Microsoft.PerformancePoint.Scorecards.Client.dll with CompressedDataTable property set to malicious payload and trigger its processing using DataTable property getter. Looking at the code of the ExcelDataSet’s DataTable property getter in Microsoft.PerformancePoint.Scorecards.Client.dll, we find the method GetObjectFromCompressedBase64String, responsible for deserialization of CompressedDataTable property contents. The data provided as Base64 string is decoded, unzipped, and passed to the BinarySerialization.Deserialize method from Microsoft.SharePoint.dll. Attackers use this method to provide a malicious DataSet whose deserialized content is shown in the image above. It contains an XML with an element of dangerous type "System.Collections.Generic.List1[[System.Data.Services.Internal.ExpandedWrapper2[...], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]", which allows attackers to execute arbitrary methods with the help of the well-known ExpandedWrapper technique aimed at exploitation of unsafe XML deserialization in applications based on the .NET framework. In fact, this shouldn’t be possible, since BinarySerialization.Deserialize in Microsoft.SharePoint.dll uses a special XmlValidator designed to protect against this technique by checking the types of all elements present in the provided XML and ensuring that they are on the list of allowed types. However, the exploit bypasses this check by placing the ExpandedWrapper object into the list. Now, to find out why the exploit worked on our SharePoint debugging stand with the July 8, 2025 updates installed, let’s take a look at how this vulnerability was fixed. In this patch, Microsoft did not really fix the vulnerability but only mitigated it by adding the new AddExcelDataSetToSafeControls class to the Microsoft.SharePoint.Upgrade namespace. This class contains new code that modifies the web.config file and marks the Microsoft.PerformancePoint.Scorecards.ExcelDataSet control as unsafe. Because SharePoint does not execute this code on its own after installing updates, the only way to achieve the security effect was to manually run a configuration upgrade using the SharePoint Products Configuration Wizard tool. Notably, the security guidance for CVE-2025-49704 does not mention the need for this step, which means at least some SharePoint administrators may skip it. Meanwhile, anyone who installed this update but did not manually perform a configuration upgrade remained vulnerable. CVE-2025-53770 On July 20, 2025, Microsoft released an update with a proper fix for the CVE-2025-49704 vulnerability. This patch introduces an updated XmlValidator that now properly validates element types in XML, preventing exploitation of this vulnerability without requiring a configuration upgrade and, more importantly, addressing the root cause and preventing exploitation of the same vulnerability through controls other than Microsoft.PerformancePoint.Scorecards.ExcelDataSet. CVE-2020-1147 Readers familiar with previous SharePoint exploits might feel that the vulnerability CVE-2025-49704/CVE-2025-53770 and the exploit used by the attackers looks very familiar and very similar to the older .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability CVE-2020-1147. In fact, if we compare the exploit for CVE-2020-1147 and an exploit for CVE-2025-49704/CVE-2025-53770, we can see that they are almost identical. The only difference is that in the exploit for CVE-2025-49704/CVE-2025-53770, the dangerous ExpandedWrapper object is placed in the list. This makes CVE-2025-53770 an updated fix for CVE-2020-1147. Conclusions Despite the fact that patches for the ToolShell vulnerabilities are now available for deployment, we assess that this chain of exploits will continue being used by attackers for a long time. We have been observing the same situation with other notorious vulnerabilities, such as ProxyLogon, PrintNightmare, or EternalBlue. While they have been known for years, many threat actors still continue leveraging them in their attacks to compromise unpatched systems. We expect the ToolShell vulnerabilities to follow the same fate, as they can be exploited with extremely low effort and allow full control over the vulnerable server. To stay better protected against threats like ToolShell, we as a community should learn lessons from previous events in the industry related to critical vulnerabilities. Specifically, the speed of applying security patches nowadays is the most important factor when it comes to fighting such vulnerabilities. Since public exploits for these dangerous vulnerabilities appear very soon after vulnerability announcements, it is paramount to install patches as soon as possible, as a gap of even a few hours can make a critical difference. At the same time, it is important to protect enterprise networks against zero-day exploits, which can be leveraged when there is no available public patch for vulnerabilities. In this regard, it is critical to equip machines with reliable cybersecurity solutions that have proven effective in combatting ToolShell attacks before they were publicly disclosed. Kaspersky Next with its Behaviour detection component proactively protects against exploitation of these vulnerabilities. Additionally, it is able to detect exploitation and the subsequent malicious activity. Kaspersky products detect the exploits and malware used in these attacks with the following verdicts: UDS:DangerousObject.Multi.Generic PDM:Exploit.Win32.Generic PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.gen ASP.Agent.* PowerShell.Agent.*