Search/China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years
● Story

China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years

The China-linked advanced persistent threat (APT) actor known as Salt Typhoon has continued its attacks targeting networks across the world, including organizations in the telecommunications, government, transportation, lodging, and military infrastructure sectors. "While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge (PE) and

View graph Export
CVEs
0
Highest CVSS
—
In KEV
0
Sources
4
Connections
8 relationships
Salt Typhoon Exploits Cisco, Ivanti, Palo Alto Flaws to Breach 600 Organizations Worldwide
The China-linked advanced persistent threat (APT) actor known as Salt Typhoon has continued its attacks targeting networks across the world, including organizations in the telecommunications, government, transportation, lodging, and military infrastructure sectors. "While these actors focus on large backbone routers of major telecommunications providers, as well as provider edge (PE) and customer edge (CE) routers, they also leverage compromised devices and trusted connections to pivot into other networks," according to a joint cybersecurity advisory published Wednesday. "These actors often modify routers to maintain persistent, long-term access to networks." The bulletin, courtesy of authorities from 13 countries, said the malicious activity has been linked to three Chinese entities, Sichuan Juxinhe Network Technology Co., Ltd., Beijing Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co., Ltd. These companies, the agencies said, provide cyber-related products and services to China's intelligence services, with the data stolen from the intrusions, specifically those against telecoms and Internet service providers (ISPs), providing Beijing with the ability to identify and track their targets' communications and movements globally. The countries that have co-sealed the security advisory include Australia, Canada, the Czech Republic, Finland, Germany, Italy, Japan, the Netherlands, New Zealand, Poland, Spain, the U.K., and the U.S. Brett Leatherman, head of the U.S. Federal Bureau of Investigation's Cyber Division, said the Salt Typhoon group has been active since at least 2019, engaging in a persistent espionage campaign aimed at "breaching global telecommunications privacy and security norms." In a standalone alert issued today, Dutch intelligence and security services MIVD and AIVD said while organizations in the country "did not receive the same degree of attention from the Salt Typhoon hackers as those in the U.S.," the threat actors gained access to routers of smaller ISPs and hosting providers. However, there is no evidence the hackers penetrated these networks further. "Since at least 2021, this activity has targeted organisations in critical sectors including government, telecommunications, transportation, lodging, and military infrastructure globally, with a cluster of activity observed in the U.K.," the National Cyber Security Centre said. According to The Wall Street Journal and The Washington Post, the hacking crew has expanded its targeting focus to other sectors and regions, attacking no less than 600 organizations, including 200 in the U.S., and 80 countries. Salt Typhoon, which overlaps with activity tracked as GhostEmperor, Operator Panda, RedMike, and UNC5807, has been observed obtaining initial access through the exploitation of exposed network edge devices from Cisco (CVE-2018-0171, CVE-2023-20198, and CVE-2023-20273), Ivanti (CVE-2023-46805 and CVE-2024-21887), and Palo Alto Networks (CVE-2024-3400). However, the agencies pointed out these vulnerabilities are not "exhaustive" and that the threat actors may also go after other devices such as Fortinet firewalls, Juniper firewalls, Microsoft Exchange, Nokia routers and switches, Sierra Wireless devices, and Sonicwall firewalls, among others for initial access. "The APT actors may target edge devices regardless of who owns a particular device," the agencies noted. "Devices owned by entities that do not align with the actors’ core targets of interest still present opportunities for use in attack pathways into targets of interest." The compromised devices are then leveraged to pivot into other networks, in some cases even modifying the device's configuration and adding a generic routing encapsulation (GRE) tunnel for persistent access and data exfiltration. Persistent access to target networks is accomplished by altering Access Control Lists (ACLs) to add IP addresses under their control, opening standard and non-standard ports, and running commands in an on-box Linux container on supported Cisco networking devices to stage tools, process data locally, and move laterally within the environment. Also put to use by the attackers are authentication protocols like Terminal Access Controller Access Control System Plus (TACACS+) to enable lateral movement across network devices, while simultaneously conducting extensive discovery actions and capturing network traffic containing credentials via compromised routers to burrow deeper into the networks. "The APT actors collected PCAPs using native tooling on the compromised system, with the primary objective likely being to capture TACACS+ traffic over TCP port 49," the agencies said. "TACACS+ traffic is used for authentication, often for administration of network equipment and including highly privileged network administrators' accounts and credentials, likely enabling the actors to compromise additional accounts and perform lateral movement." On top of that, Salt Typhoon has been observed enabling the sshd_operns service on Cisco IOS XR devices to create a local user and grant it sudo privileges to obtain root on the host OS after logging in via TCP/57722. Google-owned Mandiant, which was one of the many industry partners that contributed to the advisory, stated the threat actor's familiarity with telecommunications systems offers them a unique advantage, giving them an upper hand when it comes to defense evasion. It's worth pointing out that UNC5807 is a threat cluster that's distinct from UNC2286, which, in the past, has been identified as overlapping with FamousSparrow and GhostEmperor, according to Google Threat Intelligence Group (GTIG) and Mandiant. "While some public reporting has associated both UNC5807 and UNC2286 with the 'GhostEmperor' alias, Google assesses these to be distinct threat clusters," Dan Perez, China Mission Lead at GTIG, told The Hacker News. "Our analysis is based on distinctions in their operational tradecraft and motivations." "The toolsets used by each group are different. UNC5807 has been observed using a specific and limited set of malware families. In contrast, UNC2286 employs a much broader and more varied arsenal of malicious tools. Additionally their objectives are different. We have observed UNC2286 conducting financially motivated attacks, including ransomware deployment and extortion. The activities attributed to UNC5807, however, are consistent with espionage operations." "An ecosystem of contractors, academics, and other facilitators is at the heart of Chinese cyber espionage," John Hultquist, Chief Analyst at GTIG, told the publication. Contractors are used to build tools and valuable exploits as well as carry out the dirty work of intrusion operations. They have been instrumental in the rapid evolution of these operations and growing them to an unprecedented scale." "In addition to targeting telecommunications, reported targeting of hospitality and transportation by this actor could be used to closely surveil individuals. Information from these sectors can be used to develop a full picture of who someone is talking to, where they are, and where they are going." (The story was updated after publication to make it clear that the threat actors are targeting and may target a broad range of edge network appliances.)
thehackernews.comAug 28, 2025extracted
China’s Salt Typhoon Hacked Critical Infrastructure Globally for Years
The China-linked cyberespionage group known as Salt Typhoon has been compromising backbone and edge routers globally for persistent access to networks across multiple industries, government agencies in the US and allied countries warn. Also tracked as GhostEmperor, Operator Panda, RedMike, and UNC5807, the threat group has been conducting cyberespionage operations in the US, Australia, Canada, New Zealand, and UK, and across other regions for over half a decade, the agencies note in a joint advisory. Blamed for multiple intrusions at telecom companies in the US and Canada, and for the hacking of a US National Guard unit, Salt Typhoon has been busy targeting government, telecom, transportation, lodging, and military infrastructure networks globally since at least 2021, the advisory reads. The APT’s operations have been linked to China-based companies such as Sichuan Juxinhe Network Technology Co. Ltd. (sanctioned by the US), Beijing Huanyu Tianqiong Information Technology Co., Ltd., and Sichuan Zhixin Ruijie Network Technology Co., Ltd., known for providing cyber products and services to the Chinese intelligence. “The data stolen through this activity against foreign telecommunications and Internet service providers (ISPs), as well as intrusions in the lodging and transportation sectors, ultimately can provide Chinese intelligence services with the capability to identify and track their targets’ communications and movements around the world,” the advisory reads. Salt Typhoon has exploited known vulnerabilities in Cisco (CVE-2018-0171, CVE-2023-20198, and CVE-2023-20273), Ivanti (CVE-2024-21887), and Palo Alto Networks (CVE-2024-3400) products for initial access, but has not targeted zero-day flaws. The APT was seen targeting backbone routers at telecom providers and edge routers, regardless of who owns them, and then leveraging them to pivot into other networks, as well as modifying routing and enabling traffic mirroring. For persistence and evasion, the hackers have been tampering with Access Control Lists (ACLs), opening standard and non-standard ports, creating tunnels over protocols, leveraging open source multi-hop pivoting tools, enumerating and altering other device’s configuration, and executing various commands. For lateral movement, they have been targeting authentication protocols, router interfaces, RSVP sessions, BGP routes, configuration files, network traffic, installed software, and provider-held data, and have been extracting credentials from captured network traffic. Additionally, Salt Typhoon was seen modifying server configurations to point to IP addresses it controls, creating privileged user accounts, scanning for ports, using monitoring tools, updating routing tables, hiding its tracks by deleting logs and disabling logging, and abusing peering connections for data exfiltration. Warning of Salt Typhoon’s persistent, long-term access to the compromised networks, the joint advisory provides indicators-of-compromise (IOCs) and recommendations on actions threat hunters should conduct to identify compromises and evict the attackers. “The APT actors often take steps to protect their established access, such as compromising mail servers or administrator devices/accounts to monitor for signs that their activity has been detected. Organizations should take steps to protect the details of their threat hunting and incident response from APT actor monitoring activities,” the advisory reads. According to John Hultquist, chief analyst of Google’s Threat Intelligence Group, the hackers “are distinguished by deep familiarity with the tech allowing them to evade detection and spread broadly,” and heavily rely on Chinese contractors for their large-scale operations. “The contractor ecosystem at the heart of Chinese cyber espionage has been instrumental in the rapid evolution of these operations and growing them to an unprecedented scale. Contractors do everything from building infrastructure to the dirty work of carrying out intrusions,” he said. In an emailed comment, Swimlane lead security automation architect Nick Tausek underlined the importance of corporate backing in Salt Typhoon’s operations, pointing out that the threat actor targeted hundreds of organizations in 80 countries in 2024 alone. “Unfortunately, just because we understand how it happened doesn’t mean the threat is now gone. Salt Typhoon is still just as dangerous as ever, and companies need to be prepared. Organizations should follow the guidelines set by the NSA and gain a full understanding of the APT actors’ accesses before implementing visible incident response and mitigation actions to maximize the chance of achieving full eviction from compromised networks,” Tausek said. Related: Report Links Chinese Companies to Tools Used by State-Sponsored Hackers Related: Salt Typhoon Targeting Old Cisco Vulnerabilities in Fresh Telecom Hacks Related: Chinese Silk Typhoon Hackers Targeting Multiple Industries in North America
securityweek.comAug 28, 2025extracted
If you thought China's Salt Typhoon was booted off critical networks, think again
SAAS Salesforce partners not seeing meaningful revenue from Agentforce AI platform, report saysShow us the money ai and ml AI companies are burning books, advocates complain to FTCFahrenheit 203, the temperature GPUs stop gorging on literature DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server
go.theregister.comAug 28, 2025extracted
Allied spy agencies blame 3 Chinese tech companies for Salt Typhoon attacks
Allied spy agencies blame 3 Chinese tech companies for Salt Typhoon attacks Intelligence and cybersecurity agencies from more than a dozen allied countries published an advisory on Wednesday blaming three Chinese technology companies for cyber-espionage campaigns targeting global critical infrastructure. The activity identified by the intelligence services partially overlaps with campaigns reported by the cybersecurity industry and tracked as Salt Typhoon, RedMike, OPERATOR PANDA, UNC5807 and Ghost Emperor among others, stated the document. The campaign first came to light last year after threat actors intercepted the correspondence of senior officials within both presidential campaigns, including from President-elect Donald Trump and his running mate JD Vance. In December, U.S. officials said dozens of other countries had been impacted. The group more recently breached devices linked to seven telecommunications companies — including Comcast and MTN Group — since February, according to research from Recorded Future. The Record is an editorially independent unit of the company. Thirteen countries co-sealed the announcement on Wednesday, including agencies from the United States, Australia, Canada, New Zealand, United Kingdom, Czech Republic, Finland, Germany, Italy, Japan, Netherlands, Poland and Spain. The three Chinese companies — Huanyu Tianqiong Information Technology Co., Ltd, Sichuan Zhixin Ruijie Network Technology Co., Ltd and Sichuan Juxinhe Network Technology Co. Ltd, which was sanctioned by the United States back in January — were accused of providing “cyber-related products and services to China’s intelligence services, including multiple units in the People’s Liberation Army and Ministry of State Security” since at least 2021, according to the advisory. Data obtained through these companies’ intrusions against the telecommunications, lodging and transportation sectors, has provided “Chinese intelligence services with the capability to identify and track their targets’ communications and movements around the world,” it warned. A list of vulnerabilities included in the advisory include CVE-2024-21887, which in January the U.S. Cybersecurity and Infrastructure Security Agency warned was being exploited in attacks targeting federal agencies, and CVE-2024-3400, a zero-day discovered in Palo Alto Networks’ VPN product in April last year. The advisory comes as Brett Leatherman, the top cyber official at the FBI, told the Wall Street Journal that more than 80 countries had been impacted by a China-sponsored espionage campaign known as Salt Typhoon targeting telecommunications providers. Richard Horne, the chief executive of Britain’s National Cyber Security Centre, said: “We are deeply concerned by the irresponsible behaviour of the named commercial entities based in China that has enabled an unrestrained campaign of malicious cyber activities on a global scale. “It is crucial organisations in targeted critical sectors heed this international warning about the threat posed by cyber actors, who have been exploiting publicly known — and so therefore fixable — vulnerabilities.” The advisory stresses that these bugs have all been patched and provides remediation advice for companies still running the exploitable software, as well as ways for companies in the co-authors’ countries to contact their respective cybersecurity authorities. Alexander Martin is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79
therecord.mediaAug 27, 2025extracted
Related Stories
6
2026-013: Critical Vulnerability in F5 BIG-IP APM
History: 22/09/2026 --- v1.0 -- Initial publication Summary On 22 September 2026, F5 published an advisory addressing a critical vulnerability affecting its BIG-IP APM product. The vendor confirmed active exploitation in the wild [1]. CERT-EU recommends taking appropriate actions as soon as possible. Technical Details The vulnerability CVE-2026-94127, with a CVSS score of 9.8, is a heap-based buffer overflow vulnerability and allow unauthenticated attacker to achieve remote code execution (RCE) on the affected device [1]. Affected Products The vulnerability affects the following versions of BIG-IP APM if configured with an access policy and an OAuth profile on a virtual server [1]: 17.1.0 - 17.1.3 17.5.0 - 17.5.1 21.1.0 Recommendations CERT-EU recommends taking the following actions as soon as possible: Preserve forensic evidence. Apply the relevant hotfix. Check for signs of compromise (see the compromise assessment section). If any sign of compromise is detected, start the incident response process. Mitigation If patching cannot be applied immediately, F5 provides an iRule-based mitigation for the affected virtual server. To obtain it, F5 BIG-IP clients should contact the F5 support [1]. Compromise Assessment CERT-EU strongly advises to look for the following indicators of compromise provided by the vendor in its advisory [1]: At a high level, multiple OAuth authentication failures, followed by suspicious commands, shortly followed by a TMM SIGABRT is the combination that should lead to human review of the system. OAuth authentication failures: check /var/log/apm for repeated occurrences of the following, especially 10 or more from a single IP in a short window. err tmm1\[30975\]: 01990004:3: : Request UserInfo from Source ID (null) IP failed. Error Code (invalid\_token) Error Description (The access token is invalid.) - Increase of OAuth failure statistics. Run the following and look for an unexplained increase in total_failed : $ tmctl global_oauth_stat -s total_requests,total_userinfo_requests,total_failed - Audit log anomalies: if OAuth failures are observed, review /var/log/audit around those timestamps for suspicious commands. TMM core files: Presence of a TMM core file alone is not an indicator, but core files should be investigated. The vendor indicates that they have observed TMM entering a loop, which causes the SOD daemon to send a SIGABRT.
3 shared
Sep 25, 2026
Microsoft releases emergency .NET patches for critical Brotli flaw
A vulnerability in Google’s Brotli data compression library, tracked as CVE-2026-111497 and dubbed Node2Shell, has led to security updates from Microsoft, the Node.js project and the maintainers of two Python packages. Node.js and the Python packages were patched last week, and Microsoft followed on October 25 with fixes for .NET, Visual Studio and PowerShell. Bun, Envoy and Istio have also been updated. Brotli is a popular choice for compressing data sent over the web, and its decoder is embedded in a long list of applications and libraries. Described as an out-of-bounds write, the bug impacts Brotli 1.0.3 through 1.2.0. Google gave it a CVSS v4 score of 9.2, which puts it in the critical category. Brotli versions 1.0.10, 1.1.1 and 1.2.1 contain the fix. The Node.js project said specially crafted input can push data beyond the limits of a buffer used by the decoder. The resulting memory corruption could cause the process to crash or leak memory contents, and could also allow an unauthenticated attacker to run arbitrary code. Node.js credited the discovery to members of OpenAI Codex Security. According to OpenAI, the issue was uncovered during red-teaming work, after which the company notified the Brotli developers and the projects that rely on the library. OpenAI noted that the fix predates the disclosure. “This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli,” the AI company said. Code execution demonstrated on official Node.js image Imperva has shown that it can be exploited for code execution on the official Node.js 24.22.0 image for Linux arm64. Its researchers sent the malicious data both in a server response retrieved by the targeted application and in a request body processed by Express 5 or body-parser 2. “The proof did not succeed on every attempt. Our results establish code execution for the tested Linux arm64 build and application setups, and show how the fixed build handled the same inputs,” Imperva said. The security firm has not made its exploit public. Attacks only work if malicious Brotli data reaches the decoder, for instance through a library that unpacks compressed content on the application’s behalf. “Any application that passes attacker-controlled data to an affected Google Brotli decoder may be exposed. This includes compressed HTTP request bodies, responses fetched from untrusted servers, and compressed files,” OpenAI’s Patch the Planet initiative said in its advisory. No exploitation in the wild has been reported so far. A proof-of-concept exploit published on GitHub reportedly achieves code execution only against an intentionally weakened build, and some researchers argued the bug can only be used for denial-of-service (DoS) attacks. Microsoft products and Python packages affected Microsoft’s October 25 updates include .NET runtime versions 8.0.33, 9.0.22 and 10.0.14, along with .NET 11 Release Candidate 3. Visual Studio 2019, 2022 and 2026, as well as PowerShell 7.4, 7.5 and 7.6, have also been updated. Microsoft has categorized CVE-2026-111497 as an elevation of privilege issue with a CVSS v3.1 base score of 8.1. It rates the flaw critical for .NET and Visual Studio and important for PowerShell, and its exploitability assessment is “Exploitation More Likely.” In Python’s case, the vulnerable decoder is built into two PyPI packages, Brotli and brotlicffi. They have been patched with the release of versions 1.2.1 and 1.2.1.0, respectively. As more affected software emerged, researchers began referring to the flaw as HTTP2Shell and Broccoli2Shell. A public tracker of software that bundles its own copy of the Brotli decoder lists several projects that are still unpatched, including DuckDB, Apache Arrow, 7-Zip-zstd, p7zip and EDK II. Its maintainers say the list is incomplete, and that not every configuration of these projects necessarily exposes the vulnerable code. Applying the updates also requires restarting affected services and rebuilding container images on top of a patched base, since processes that are already running keep using the vulnerable code. Related: Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge Related: Attackers Exploit Third Arista VCO Zero-Day in Four Months Related: LiteLLM Compromised in Fresh Supply Chain Attack
3 shared
Oct 29, 2026
Analyzing Sharepoint Exploits (CVE-2025-53770, CVE-2025-53771), (Wed, Jul 23rd)
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously issued fixes for CVE-2025-49704 and CVE-2025-49706. The release of the new, “proper” updates has caused confusion about exactly which vulnerabilities attackers are exploiting and whether they are using zero-day exploits. Kaspersky products proactively detected and blocked malicious activity linked to these attacks, which allowed us to gather statistics about the timeframe and spread of this campaign. Our statistics show that widespread exploitation started on July 18, 2025, and attackers targeted servers across the world in Egypt, Jordan, Russia, Vietnam, and Zambia. Entities across multiple sectors were affected: government, finance, manufacturing, forestry, and agriculture. While analyzing all artifacts related to these attacks, which were detected by our products and public information provided by external researchers, we found a dump of a POST request that was claimed to contain the malicious payload used in these attacks. After performing our own analysis, we were able to confirm that this dump indeed contained the malicious payload detected by our technologies, and that sending this single request to an affected SharePoint installation was enough to execute the malicious payload there. Our analysis of the exploit showed that it did rely on vulnerabilities fixed under CVE-2025-49704 and CVE-2025-49706, but by changing just one byte in the request, we were able to bypass those fixes. In this post, we provide detailed information about CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, and one related vulnerability. Since the exploit code is already published online, is very easy to use, and poses a significant risk, we encourage all organizations to install the necessary updates. The exploit Our research started with an analysis of a POST request dump associated with this wave of attacks on SharePoint servers. We can see that this POST request targets the “/_layouts/15/ToolPane.aspx” endpoint and embeds two parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. Looking at the code of ToolPane.aspx, we can see that this file itself does not contain much functionality and most of its code is located in the ToolPane class of the Microsoft.SharePoint.WebPartPages namespace in Microsoft.SharePoint.dll. Looking at this class reveals the code that works with the two parameters present in the exploit. However, accessing this endpoint under normal conditions is not possible without bypassing authentication on the attacked SharePoint server. This is where the first Microsoft SharePoint Server Spoofing Vulnerability CVE-2025-49706 comes into play. CVE-2025-49706 This vulnerability is present in the method PostAuthenticateRequestHandler, in Microsoft.SharePoint.dll. SharePoint requires Internet Information Services (IIS) to be configured in integrated mode. In this mode, the IIS and ASP.NET authentication stages are unified. As a result, the outcome of IIS authentication is not determined until the PostAuthenticateRequest stage, at which point both the ASP.NET and IIS authentication methods have been completed. Therefore, the PostAuthenticateRequestHandler method utilizes a series of flags to track potential authentication violations. A logic bug in this method enables an authentication bypass if the “Referrer” header of the HTTP request is equal to “/_layouts/SignOut.aspx”, “/_layouts/14/SignOut.aspx”, or “/_layouts/15/SignOut.aspx” using case insensitive comparison. The code displayed in the image above handles the sign-out request and is also triggered when the sign-out page is specified as the referrer. When flag6 is set to false and flag7 is set to true, both conditional branches that could potentially throw an “Unauthorized Access” exception are bypassed. On July 8, 2025, Microsoft released an update that addressed this vulnerability by introducing additional checks to detect the usage of the “ToolPane.aspx” endpoint with the sign-out page specified as the referrer. The added check uses case insensitive comparison to verify if the requested path ends with “ToolPane.aspx”. Is it possible to bypass this check, say, by using a different endpoint? Our testing has shown that this check can be easily bypassed. CVE-2025-53771 We were able to successfully bypass the patch for vulnerability CVE-2025-49706 by adding just one byte to the exploit POST request. All that was required to bypass this patch was to add a “/” (slash) to the end of the requested “ToolPane.aspx” path. On July 20, 2025, Microsoft released an update that fixed this bypass as CVE-2025-53771. This fix replaces the “ToolPane.aspx” check to instead check whether the requested path is in the list of paths allowed for use with the sign-out page specified as the referrer. This allowlist includes the following paths: “/_layouts/15/SignOut.aspx”, “/_layouts/15/1033/initstrings.js”, “/_layouts/15/init.js”, “/_layouts/15/theming.js”, “/ScriptResource.axd”, “/_layouts/15/blank.js”, “/ScriptResource.axd”, “/WebResource.axd”, “/_layouts/15/1033/styles/corev15.css”, “/_layouts/15/1033/styles/error.css”, “/_layouts/15/images/favicon.ico”, “/_layouts/15/1033/strings.js”, “/_layouts/15/core.js”, and it can contain additional paths added by the administrator. While testing the CVE-2025-49706 bypass with the July 8, 2025 updates installed on our SharePoint debugging stand, we noticed some strange behavior. Not only did the bypass of CVE-2025-49706 work, but the entire exploit chain did! But wait! Didn’t the attackers use an additional Microsoft SharePoint Remote Code Execution Vulnerability CVE-2025-49704, which was supposed to be fixed in the same update? To understand why the entire exploit chain worked in our case, let’s take a look at the vulnerability CVE-2025-49704 and how it was fixed. CVE-2025-49704 CVE-2025-49704 is an untrusted data deserialization vulnerability that exists due to improper validation of XML content. Looking at the exploit POST request, we can see that it contains two URL encoded parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. We can see how they are handled by examining the code of the method GetPartPreviewAndPropertiesFromMarkup in Microsoft.SharePoint.dll. A quick analysis reveals that “MSOtlPn_Uri” is a page URL that might be pointing to an any file in the CONTROLTEMPLATES folder and the parameter “MSOtlPn_DWP” contains something known as WebPart markup. This markup contains special directives that can be used to execute safe controls on a server and has a format very similar to XML. While this “XML” included in the “MSOtlPn_DWP” parameter does not itself contain a vulnerability, it allows attackers to instantiate the ExcelDataSet control from Microsoft.PerformancePoint.Scorecards.Client.dll with CompressedDataTable property set to malicious payload and trigger its processing using DataTable property getter. Looking at the code of the ExcelDataSet’s DataTable property getter in Microsoft.PerformancePoint.Scorecards.Client.dll, we find the method GetObjectFromCompressedBase64String, responsible for deserialization of CompressedDataTable property contents. The data provided as Base64 string is decoded, unzipped, and passed to the BinarySerialization.Deserialize method from Microsoft.SharePoint.dll. Attackers use this method to provide a malicious DataSet whose deserialized content is shown in the image above. It contains an XML with an element of dangerous type "System.Collections.Generic.List1[[System.Data.Services.Internal.ExpandedWrapper2[...], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]", which allows attackers to execute arbitrary methods with the help of the well-known ExpandedWrapper technique aimed at exploitation of unsafe XML deserialization in applications based on the .NET framework. In fact, this shouldn’t be possible, since BinarySerialization.Deserialize in Microsoft.SharePoint.dll uses a special XmlValidator designed to protect against this technique by checking the types of all elements present in the provided XML and ensuring that they are on the list of allowed types. However, the exploit bypasses this check by placing the ExpandedWrapper object into the list. Now, to find out why the exploit worked on our SharePoint debugging stand with the July 8, 2025 updates installed, let’s take a look at how this vulnerability was fixed. In this patch, Microsoft did not really fix the vulnerability but only mitigated it by adding the new AddExcelDataSetToSafeControls class to the Microsoft.SharePoint.Upgrade namespace. This class contains new code that modifies the web.config file and marks the Microsoft.PerformancePoint.Scorecards.ExcelDataSet control as unsafe. Because SharePoint does not execute this code on its own after installing updates, the only way to achieve the security effect was to manually run a configuration upgrade using the SharePoint Products Configuration Wizard tool. Notably, the security guidance for CVE-2025-49704 does not mention the need for this step, which means at least some SharePoint administrators may skip it. Meanwhile, anyone who installed this update but did not manually perform a configuration upgrade remained vulnerable. CVE-2025-53770 On July 20, 2025, Microsoft released an update with a proper fix for the CVE-2025-49704 vulnerability. This patch introduces an updated XmlValidator that now properly validates element types in XML, preventing exploitation of this vulnerability without requiring a configuration upgrade and, more importantly, addressing the root cause and preventing exploitation of the same vulnerability through controls other than Microsoft.PerformancePoint.Scorecards.ExcelDataSet. CVE-2020-1147 Readers familiar with previous SharePoint exploits might feel that the vulnerability CVE-2025-49704/CVE-2025-53770 and the exploit used by the attackers looks very familiar and very similar to the older .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability CVE-2020-1147. In fact, if we compare the exploit for CVE-2020-1147 and an exploit for CVE-2025-49704/CVE-2025-53770, we can see that they are almost identical. The only difference is that in the exploit for CVE-2025-49704/CVE-2025-53770, the dangerous ExpandedWrapper object is placed in the list. This makes CVE-2025-53770 an updated fix for CVE-2020-1147. Conclusions Despite the fact that patches for the ToolShell vulnerabilities are now available for deployment, we assess that this chain of exploits will continue being used by attackers for a long time. We have been observing the same situation with other notorious vulnerabilities, such as ProxyLogon, PrintNightmare, or EternalBlue. While they have been known for years, many threat actors still continue leveraging them in their attacks to compromise unpatched systems. We expect the ToolShell vulnerabilities to follow the same fate, as they can be exploited with extremely low effort and allow full control over the vulnerable server. To stay better protected against threats like ToolShell, we as a community should learn lessons from previous events in the industry related to critical vulnerabilities. Specifically, the speed of applying security patches nowadays is the most important factor when it comes to fighting such vulnerabilities. Since public exploits for these dangerous vulnerabilities appear very soon after vulnerability announcements, it is paramount to install patches as soon as possible, as a gap of even a few hours can make a critical difference. At the same time, it is important to protect enterprise networks against zero-day exploits, which can be leveraged when there is no available public patch for vulnerabilities. In this regard, it is critical to equip machines with reliable cybersecurity solutions that have proven effective in combatting ToolShell attacks before they were publicly disclosed. Kaspersky Next with its Behaviour detection component proactively protects against exploitation of these vulnerabilities. Additionally, it is able to detect exploitation and the subsequent malicious activity. Kaspersky products detect the exploits and malware used in these attacks with the following verdicts: UDS:DangerousObject.Multi.Generic PDM:Exploit.Win32.Generic PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.gen ASP.Agent.* PowerShell.Agent.*
3 shared
Jul 28, 2025
Check Point, Kaspersky, Tanium Patch Product Vulnerabilities
Attackers exploited a previously unknown flaw in Check Point's Security Management Server in a handful of targeted attacks on July 23, the company said. The flaw, CVE-2026-93616, allows an attacker who can access the server's web service to run scripts on it without logging in. Check Point released a fix on September 22 for the server that controls firewall policies for the Check Point gateways it manages. Separately, Check Point said attackers have been trying since September 12 to exploit a VPN flaw it fixed on September 9. The attempts, against a flaw tracked as CVE-2026-85102, have targeted customers of Spark, Check Point's firewall line for small businesses. When the fix came out, Check Point had no evidence the flaw was being exploited. CVE-2026-93616 is a path traversal bug in the management server's web service. The service does not properly limit which files and folders a request can reach. An attacker can use it to upload scripts to the server and then run them. Check Point rated it 9.8 out of 10 on the CVSS scale in the CVE record for the flaw. Check Point's advisory does not name the targets of the July attacks or the attackers, nor does it say what the attackers did after exploiting the flaw. Management Server Versions and Fix Check Point numbers the Jumbo Hotfix updates for each release by "Take." Its LivePatch channel, which pushes urgent fixes, uses a separate set of take numbers. The CVE record lists these versions as affected: R82.20 with no Jumbo Hotfix installed R82.10 with Jumbo Hotfix Take 44 or below R82 with Jumbo Hotfix Take 126 or below R81.20 with Jumbo Hotfix Take 166 or below R81.10 with Jumbo Hotfix Take 190 or below (end of support) R81, R80.40, R80.30, R80.20, R80.10 and R80 (all end of support) Check Point's advisory lists R82.20 as affected without the "no Jumbo Hotfix" condition. On September 16, Check Point fixed a separate flaw in the management server, CVE-2026-91843, through LivePatch. That update was LivePatch Take 28, or Take 29 on R82.20, according to a summary of Check Point's advisory by France's CERT Santé. Check Point says those LivePatch takes do not fix CVE-2026-93616. CVE-2026-85103, a VPN certificate flaw that Check Point fixed on September 9, affected both gateways and management servers. On R82.10, R82, and R81.20, the new flaw's affected list goes one take higher than that flaw's. So a server updated only enough to be outside that September flaw's range is still affected by CVE-2026-93616. The fixed builds, and Check Point's guidance on mitigation, hunting and indicators of compromise, are in support article sk1000171. Administrators of management servers should: Check the server's release and Jumbo Hotfix take against the list above. Install the fix listed in sk1000171. Use the hunting guidance and indicators of compromise in sk1000171 to look for signs of an attack. Installing the fix does not show whether the server was attacked before. Check Point's advisory names only Security Management as affected and does not say what network access an attacker needs. The Hacker News has asked Check Point about other affected products, the fixed builds, and the July attacks. Spark Firewalls Targeted Through VPN Flaw CVE-2026-85102 is in the way Check Point gateways check certificates while a VPN connection is being set up. It may let an attacker who has not logged in run code on the gateway. Fixes have been out since September 9 and are in support article sk1000117. The affected products are Security Gateway and Spark firewalls, whether centrally or locally managed, on R81 and R81.10 (both end of support), R81.10.x, R81.20, R82, R82.00.x and R82.10. The Netherlands' National Cyber Security Centre (NCSC) says the flaw applies when these products use Site-to-Site VPN or Remote Access VPN. Check Point said the attempts came from anonymizing infrastructure, including VPN services and proxies, and used certificates with these subjects: Certificate subject: CN=vpn,OU=users,O=global Certificate subject: CN=vpn-user,OU=users,O=global Certificate subject: CN=vpnuser,OU=users,O=global The list is not complete, and other subjects may be in use. Administrators should check logs for any unusual certificate-based Mobile Access login, not only those with these subjects. They should also check what suspicious Mobile Access users do after logging in, which often includes scanning internal ports and services. Check Point says customers who installed the September 9 fix are protected, but its advisory does not say whether any attempt succeeded. For gateways that cannot be patched yet, the NCSC lists a Check Point workaround for Site-to-Site VPN: turn off the implied VPN rules and allow UDP ports 500 and 4500 only from specific peer IP addresses. The workaround does not apply to locally managed Spark firewalls. Mitigation steps from Check Point are in sk1000117.
3 shared
Sep 23, 2026
Attackers Exploit Third Arista VCO Zero-Day in Four Months
Networking solutions provider Arista Networks on Thursday rolled out patches for an exploited zero-day vulnerability in its centralized management tool VeloCloud Orchestrator (VCO). The critical-severity security defect is tracked as CVE-2026-114625 (CVSS score of 9.9) and is described as a remotely exploitable SQL injection. “VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host,” Arista notes in its advisory. Successful exploitation could impact the confidentiality, integrity, and availability of both VCO and the data it manages. “On an affected system, any authenticated user can gain operator privileges and masquerade as a local ‘superuser operator’ user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible,” the company says. All VCO releases before versions 5.2.3.18, 6.1.3.10, and 6.4.2.12 are affected. Arista has already patched the hosted VCO deployments, but urges users to update their on-premises installations as soon as possible. “This issue was detected by Arista and is known to be actively exploited,” the company says. Arista notes that VCO deployments are exposed by default, and that attackers need access to the VCO web interface and a valid authenticated session, with the lowest built-in tenant role privileges. “There is no configuration that can prevent the exposure,” the company notes. Attacks have been observed originating from two IP addresses, 74.82.197.86 and 38.54.50.151. Administrators should block them, check logs for their presence, and investigate high-request rates, as well as requests with unusual URL-like path components, encoded characters, and references to local or internal services. “If compromise is suspected, operators should preserve VCO web access logs, backend application logs, system logs, database logs, and relevant file-system timestamps before remediation where operationally feasible,” Arista notes. Updating to a fixed VCO release is the recommended remediation action. Until the fixes are deployed, administrators should restrict access to the VCO interface, review recent admin activity, monitor for suspicious access, block outbound ports, and monitor for backdoor daemons and webshells. CVE-2026-114625 is the third exploited zero-day vulnerability Arista patches in VCO in four months, after CVE-2026-16812 in July and CVE-2026-93952 in September. Related: Atlassian Patches 75 Flaws in Data Center and Server Products Related: Signal Vulnerability Lets Malicious Callers Block Hang-Ups Related: Splunk, SolarWinds Release Fresh Security Updates Related: Cisco Patches 34 Vulnerabilities Across Multiple Products
3 shared
Oct 29, 2026
Hackers Infect 953 Online Stores With Scanner-Evading Code
Attackers have infected 953 online stores, mostly running Magento, with a JavaScript loader that has evolved to tell security scanners apart from real shoppers. The campaign has been active since July 2025 and has cycled through five loader domains, according to research from Dutch e-commerce security firm Sansec. Its latest domain, registered October 6, was found in the content management system (CMS) blocks of 83 stores, 60 of which had carried an earlier version of the loader. The loader is stored in Magento's cms_block database table and has visitors' browsers fetch instructions from the attackers. Sansec said the server first works out whether a request comes from a genuine customer or a security scanner, and gives scanners nothing. Latest Loader Filters Security Scanners Before October, the operator relied on the Keitaro traffic distribution system to choose, for each visitor, between delivering a payload, redirecting the browser and returning nothing. The loader Sansec first found on October 7 instead called the new domain directly and replayed code saved in the browser, so anyone served the payload would rerun it on later page loads, even with the domain down or blocked. An October 23 rewrite added browser fingerprinting, checking for signs of browser automation and collecting hardware details, screen size, time zone and language before the server chose its response. When scanning service urlscan.io loaded an infected store in an automated browser, Sansec found no injected content. The company has yet to obtain the final payload, so the campaign's ultimate purpose remains unclear. Patches Did Not Always Stop Reinfection Sansec said a March wave planted the loader on 471 stores within an hour, using webshells placed through PolyShell (CVE-2026-48356). Among 169 infected Magento 2 installations lacking at least one core patch, 102 showed evidence of file uploads via PolyShell or SessionReaper (CVE-2025-54236). Patching alone did not prevent reinfection. A fully patched store running Magento 2.4.7-p10 picked up the newest loader on October 23, an hour after passing a clean scan. Sansec had spotted a rogue admin account and a GSocket backdoor on the store in September. Sansec advised merchants to look for the loader in CMS content, review admin accounts and hunt for backdoors, rotate database, admin and integration credentials once the store is clean and apply the latest Magento and Adobe Commerce security updates. It warned that removing the script leaves an attacker's write access to the database intact, so a compromised store can be reinfected while the original way in remains.
3 shared
Nov 1, 2026