zoho

Zoho: sanata vulnerabilità in prodotti ManageEngine Alert AL06/260813/CSIRT-ITA Sintesi Aggiornamenti di sicurezza Zoho sanano una vulnerabilità con gravità “alta” in ManageEngine Password Manager Pro e PAM360. Tipologia Information Disclosure Prodotti e versioni affette ManageEngine Password Manager Pro, versioni precedenti alla build 13232 PAM360, versioni precedenti alla build 8552 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti

The China-aligned espionage group Mustang Panda is running two campaigns against the Indian government and hydropower targets, deploying new malware and turning a legitimate cloud service into its command channel. Acronis Threat Research Unit found active compromises inside Indian government networks, including machines used by senior administrative staff, and worked with CERT-In on notification and cleanup. The malware abuses Zoho WorkDrive, a cloud storage platform common in India's government sector, to pass commands and exfiltrate data. That is the whole idea: the traffic looks like ordinary cloud activity, so it hides inside the network it is stealing from. Acronis names three new tools. SHARDLOADER is a loader that runs by sideloading a malicious DLL through a legitimately signed binary, a Solid PDF Creator executable in one campaign, and a Citrix Receiver binary in the other. It deploys one of two implants. MINIRECON is a reworked variant of the Toneshell backdoor documented by IBM X-Force, now beaconing over a WebSocket connection on HTTPS. ZOHOMURK is the novel piece: it carries hardcoded Zoho OAuth credentials and uses them to run an attacker-controlled WorkDrive account as a dead drop, reading commands from an inbox folder and writing stolen output to an outbox. Both campaigns arrive as ZIP archives with the malicious DLL marked hidden. Acronis believes they were delivered by spear-phishing. The lures fit the targets: one themed around a hydropower cooperation proposal, the other around a memorandum of understanding between Indian and Taiwanese institutions. Per Acronis, the goal is intelligence on India's hydropower plans and its defense ties with Taiwan. Acronis attributes the activity to Mustang Panda with high confidence. The report includes the reused Solid PDF Creator sideloading chain, code overlap with Toneshell, command servers sitting in the same network block as infrastructure IBM X-Force tied to the group, and a recurring typo, RunOnece, carried across multiple implants. Operational security was thin. Hardcoded tokens, plaintext identifiers, and reused infrastructure all helped analysts pin it down. Active beaconing ran from June 12 to June 22, 2026. This continues a steady push against Indian targets. In April, Acronis tied the group's LOTUSLITE backdoor to attacks on India's banking sector and South Korean policy circles, also staged through a legitimate cloud service. The broader China-linked interest in India's power sector goes back further: the 2021 RedEcho campaign targeted the country's electricity grid with ShadowPad. There is no patch to apply. The defense is catching the delivery and the cloud abuse. Acronis published indicators and hunting tips, including the persistence Run keys, a scheduled task named SolidPDFPcl2Bmp, the C2 domain couldinstallup[.]com, and the Zoho user agents that turn up on non-browser processes. Government and energy organizations, especially those tied to cross-border deals likely to interest Beijing, should watch for geopolitical lures and sideloading from signed binaries. And flag any endpoint process calling cloud APIs that it has no reason to touch.

Zoho: sanata vulnerabilità in diversi prodotti Alert AL08/260626/CSIRT-ITA Sintesi Sanata una vulnerabilità con gravità “critica” che interessa diversi prodotti Zoho. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato di eludere i meccanismi di autenticazione Tipologia Authentication Bypass Security Restrictions Bypass Prodotti e versioni affette ADSelfService Plus, versione 6258 e precedenti RecoveryManager Plus, versione 6320 e precedenti M365 Manager Plus, versione 4817 e precedenti ADAudit Plus, versione 8702 e precedenti Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti

Threat actors are exploiting a medium-severity vulnerability in the Gravity SMTP WordPress plugin to steal complete system details, Defiant warns. Gravity SMTP for WordPress is an email deliverability plugin that integrates with multiple SMTP providers and API-based services to allow admins to send and track emails directly from their websites. All plugin iterations before version 2.1.5 are affected by a sensitive information exposure vulnerability tracked as CVE-2026-4020 (CVSS score of 5.3) that has been exploited in the wild since early May. The issue impacts a REST API endpoint that unconditionally returns true, thus becoming accessible to any unauthenticated user. If a specific parameter is appended to a query, the endpoint returns internal connector data in JSON format. The data contains the full system report, including configuration data such as PHP and WordPress version, loaded extensions, web server details, document root path, database details, active plugins and theme, WordPress configuration details, and configured API keys/tokens. According to Defiant, the bug exists because the impacted REST API endpoint, registered within a shared library providing a configuration collection system, does not perform authentication or capability checks. “This makes it possible for unauthenticated attackers to harvest credentials that could be used to send email on behalf of the site, as well as to gather detailed reconnaissance about the site’s software stack that can be leveraged to identify and target other vulnerabilities,” Defiant explains. The WordPress security firm has observed in-the-wild exploitation of the security defect since early May. Attackers have been sending unauthenticated GET requests to the vulnerable endpoint to retrieve the full System Report JSON object. In June, Defiant has observed a surge in attacks targeting CVE-2026-4020. To date, the company has blocked over 17 million exploit attempts. Site owners and administrators are advised to update their Gravity SMTP deployments to version 2.1.5 as soon as possible and to check server access logs for requests to the affected endpoint, as the in-the-wild exploitation does not leave other obvious traces. “If you are running a vulnerable version of Gravity SMTP and have configured any third-party email integrations (such as Amazon SES, Google, Mailjet, Resend, or Zoho), you should assume the associated API keys, secrets, and OAuth tokens may have been exposed. We strongly recommend rotating these credentials after updating the plugin,” Defiant notes. Related: Majority of Internet-Accessible REDCap Servers Outdated Related: 15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown Related: Joomla, LiteSpeed Vulnerabilities Exploited in Attacks Related: No Exploits Required

Threat actors are exploiting an unauthenticated information disclosure vulnerability in the WordPress plugin Gravity SMTP, active on 100,000 sites. The flaw is tracked as CVE-2026-4020 and received a medium severity rating. It affects all versions of the plugin from 2.1.4 and older and has been addressed in version 2.1.5, released on March 17. WordPress security company Defiant is warning that hackers are actively exploiting the vulnerability. The company's Wordfence firewall has blocked more than 17 million attempts against protected customers. The issue stems from an exposed REST API endpoint in Gravity SMTP, whose ‘permission_callback’ always returns ‘true,’ allowing unauthenticated GET requests to receive a comprehensive JSON “System Report” generated by the plugin. The exposed information may contain: API keys, secrets, and OAuth tokens for configured email integrations Credentials for third-party email services, including Amazon SES, Google, Mailjet, Resend, and Zoho WordPress configuration details, including installed plugins, themes, and software versions Server and PHP environment information Database configuration details, including server version and table names Despite its medium-severity rating, the CVE-2026-4020 vulnerability can be exploited without authentication, and the exposed information can be used to steal email service credentials. This allows an attacker to impersonate the victim to third parties and also to gain detailed information about the site’s software stack and the potential vulnerabilities present. “The exposure of live third-party API credentials means an attacker could abuse the site’s connected email services, while the detailed system report significantly lowers the effort required to plan further attacks against the site,” Wordfence researchers warn. Wordfence says exploitation activity spiked on June 7, with 4 million requests being blocked that day. Similar activity was recorded for several days afterward. The security firm listed the most prolific source IP addresses for exploit requests, which website administrators should add to their blocklists. A key indicator of compromise is requests to ‘/wp-json/gravitysmtp/v1/tests/mock-data’ found in web server access logs, particularly those including the ‘?page=gravitysmtp-settings’ query parameter. Yesterday, the company issued a separate advisory about a critical, unauthenticated, arbitrary file-deletion flaw in the Avada Builder WordPress plugin, used on one million sites. This vulnerability is identified as CVE-2026-8713 and allows attackers to delete arbitrary files on the server through a path traversal flaw, provided a published Avada form is configured to save submissions to the database. Deleting critical files, such as wp-config.php, can revert the site to its initial setup state, potentially leading to a full site takeover and remote code execution. The issue was fixed in version 3.15.4, which is the recommended upgrade target for website administrators. No active exploitation of CVE-2026-8713 has been observed yet, but this is a good candidate, so quick action is advised. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybersecurity researchers have disclosed details of a financially motivated data theft extortion campaign that has targeted dozens of organizations across professional, legal, and financial services in the U.S. between January and May 2026. The activity has been attributed by Google Mandiant and Google Threat Intelligence Group (GTIG) to a threat actor dubbed UNC3753, which is also known as Chatty Spider, Luna Moth, and Silent Ransom Group (SRG). "UNC3753 leverages voice phishing (vishing) and social engineering deception techniques to achieve remote access into corporate environments," researchers Chad Reams, Tufail Ahmed, Keith Knapp, Ashley Frazer, and Tyler McLellan said. "Using pretexts such as data migration or invoice-related emails, the threat actors initiate phone conversations posing as IT support and convince targets to host screen-sharing sessions and download remote monitoring and management (RMM) utilities." Upon gaining access, the threat actors have been found to either carry out direct searches to locate and exfiltrate files of interest or deceive the victim into carrying out the actions on their behalf. Stolen information includes proprietary legal agreements, personally identifiable information (PII), and financial records. In some instances, the attackers have accessed victims' systems in person, echoing an advisory issued by the U.S. Federal Bureau of Investigation (FBI) last month. These physical intrusions involve the threat actors posing as IT technicians to enter corporate offices and attempt to steal data using removable USB media. "By sending someone in-person to the victim's location to facilitate the intrusion, SRG actors exfiltrate data to an external hard drive or USB drive inserted by the threat actor into the victim's computer," the FBI said of the new escalation in UNC3753's capabilities. Google said UNC3753 shares tactical overlaps with UNC2686, a threat cluster previously known for carrying out BazarCall-style campaigns in 2021. Although the group has been observed deploying LockBit Black ransomware in the past, it has mainly focused on extortion-only operations since 2022, pressuring victims to pay up or risk getting their data published on the LEAKEDDATA data leak site. Both UNC3753 and UNC2686 are assessed to be offshoots of the now-defunct Conti ransomware gang, with early iterations of the campaigns using subscription cancellation lures as part of callback phishing attacks that aim to install remote access software on victims' machines. Beginning around March 2025, the hacking crew has impersonated internal corporate IT help desk staff to trick victims into joining a screen-sharing session on enterprise communication platforms like Zoom, Microsoft Teams, or Quick Assist under the guise of addressing a security issue helping with a corporate data migration project, effectively bypassing traditional security controls. "The threat group frequently initializes campaigns using benign, invoice-themed email lures sent from actor-controlled consumer email accounts," Google said. "These messages contain no active links or malicious attachments. Instead, they typically contain a brief, generic message. The primary purpose of these emails is to establish a pretext, raising the target's internal security concerns so they are more susceptible to follow-up voice calls." Once a session is established, the attackers attempt to establish a persistent foothold by guiding the victims to install legitimate remote desktop software like AnyDesk, Bomgar, SuperOps RMM, or Zoho Assist. Instructions to install these programs are shared via a legitimate service called "privnote[.]com," which allows users to send notes that self-destruct after being read by the recipient. UNC3753 has also been observed establishing Zoom sessions directly on targets' personal laptops to access corporate virtual desktop infrastructure (VDI) and burrow deeper into corporate file systems with the goal of enumerating local and cloud directories, crawling mapped network drives, and harvesting data from highly sensitive folders, including those related to tax filings, audits, corporate client agreements, and Social Security numbers (SSNs). In the final stage, the captured data is sent to the threat actors via WinSCP or Rclone, or to email addresses controlled by the threat actor from the target's mailbox. This is followed by the attackers sending an extortion demand in the form of an email message, typically within 30 minutes of exiting the target environment. The email messages give victims a three-day deadline to initiate ransom negotiations. They also threaten to call and email target employees and external clients directly to notify them of the data breach should they remain unresponsive, not to mention publish the entire stolen information on the data leak site. In many incidents investigated by Google's threat intelligence and incident response teams, the end-to-end operation from initial contact to data extortion is said to have occurred within a single business day. The fast-tempo operational model is exemplified by the fact that the attackers initiate data searches, staging, and theft in under an hour. "Legal services firms represent high-value targets for extortion actors. They maintain concentrated repositories of extremely sensitive client transaction files, merger and acquisition plans, client trade secrets, and corporate regulatory reports," Google said. "Threat groups recognize that legal entities are subject to heavy reputational and regulatory exposure and may be highly motivated to resolve extortion situations quietly to protect their professional standing. Threat actors recognize that targeting the human element - specifically using voice-guided social engineering-enables them to easily bypass robust technical perimeters, web security gateways, and MFA configurations." The findings coincide with a new report from Resecurity about the threat actor's use of DNS Fast Flux network infrastructure across various countries in Latin America, Eastern Europe, Central Asia, Middle East/Africa, East Asia, and the Caribbean to make its domains harder to block - business-data-leaks[.]com, the data leak site that lists close to 100 victim organizations as of June 2026 ep6pheij[.]com, which stages the stolen data per victim "By changing the DNS records and using short Time-To-Live (TTL) values, attackers make their malicious infrastructure resilient against takedowns," the cybersecurity company said. "Both domains operate on a fast-flux network backed by a botnet spread across 18 countries and 22 ISPs. The two domains share 50-60% of their bot pool, confirming a single threat actor operates both. The infrastructure contains zero datacenter or hosting IPs - every node traces back to a consumer ISP (e.g., Telecentro, Mega Cable, Vodafone) and is flagged as residential or mobile IP address."

The Silent Ransom Group extortion gang is actively targeting U.S. law firms and professional services organizations in social engineering attacks that often lead to data theft within hours of initial contact, according to a new report by cybersecurity firm Mandiant. The report follows an FBI FLASH advisory published last week warning that the Silent Ransom Group was targeting U.S. law firms in social engineering and even in-person data theft attacks, with Mandiant now providing additional technical details about how the intrusions are conducted. Mandiant says the threat group, tracked as UNC3753, Luna Moth, and Chatty Spider, targeted dozens of organizations across the legal, financial, and professional services sectors between January and May 2026. Mandiant warned that legal firms remain especially attractive targets because they store large volumes of highly sensitive client information and may feel pressured to resolve extortion incidents to avoid reputational and regulatory damage. "Legal services firms represent high-value targets for extortion actors. They maintain concentrated repositories of extremely sensitive client transaction files, merger and acquisition plans, client trade secrets, and corporate regulatory reports," explains Mandiant. "Threat groups recognize that legal entities are subject to heavy reputational and regulatory exposure and may be highly motivated to resolve extortion situations quietly to protect their professional standing." The researchers say the attacks begin with invoice-themed phishing emails from consumer email accounts. These emails do not contain malicious links or attachments and instead serve as a precursor for follow-up phone calls from attackers impersonating corporate IT staff. Conducting attacks via voice calls has been an ongoing tactic by these threat actors for years, which they previously used in BazarCall social engineering campaigns tied to Ryuk and Conti ransomware attacks. A callback phishing attack is when threat actors send benign-looking phishing emails containing alarming or IT-related lures that prompt the recipient to call them back at an enclosed phone number. In the current campaign, the Silent Ransom Group impersonates IT help desks and convinces employees to join remote support sessions via Microsoft Teams, Zoom, Quick Assist, or Microsoft Terminal Services. During these sessions, the threat actors trick the target into installing remote monitoring and management tools such as AnyDesk, Zoho Assist, Bomgar, or SuperOps, thereby granting them initial access to the corporate network. Mandiant also discovered phishing domains tied to the campaign that impersonate internal IT portals using naming patterns such as: -itdesk[.]com -it[.]com -helpdesk[.]com The researchers say the threat actors also use privnote[.]com, a self-destructing messaging service, to share installation links and commands with targets during remote support sessions. According to Mandiant, this tactic helps reduce forensic artifacts left in browser histories or corporate chat logs. Once inside a network, the group searches for sensitive legal and financial documents, including contracts, tax records, Social Security numbers, and merger or acquisition files. The attackers commonly target document management platforms and cloud storage repositories before exfiltrating the data using tools such as WinSCP or Rclone. Mandiant says the extortion operation is highly aggressive, with ransom demands often arriving within 30 minutes of the attackers leaving the victim environment. "These highly aggressive extortion letters give organizations a three-day deadline to respond and initiate ransom negotiations. If the victim organization is unresponsive, the threat actors declare they will call and email target employees and external clients directly to alert them of the data breach," reports Mandiant. "The extortion letters explicitly emphasize that the leak will compromise client trust, invite substantial regulatory fines, and suggest that external clients sue the victim organization for data mishandling." The report also references the FBI's recent advisory in which law enforcement warned that the Silent Ransom Group was targeting U.S. law firms with in-person data theft attacks. According to the FBI, attackers impersonate internal IT staff over phone calls and emails, then attempt to gain remote access or physically visit offices to "image" computers or create backups while secretly stealing files. While Mandiant said there was limited forensic evidence, the researchers believe these in-person attacks are likely linked to UNC3753 based on similarities in targeting, timelines, and operational behavior. The Silent Ransom Group has been active since at least 2022, when it was part of the Ryuk and Conti cybercrime syndicate. As previously reported by BleepingComputer, the threat actors were previously linked to BazarCall callback phishing campaigns that provided initial access in Conti and Ryuk ransomware attacks. After the Conti syndicate shut down in 2022, the group shifted to standalone data theft and extortion operations under the Silent Ransom Group branding. Researchers say the group no longer relies on traditional ransomware encryption and instead focuses entirely on data-theft extortion, in which they steal sensitive data and pressure victims into paying to prevent leaks. A separate report released this week by Resecurity found that the gang is also operating fast-flux infrastructure to hide and protect its data-leak platforms. DNS fast flux is a method where attackers constantly rotate a domain's IP addresses through a large pool of compromised devices to hide their infrastructure and make takedowns or blocking far more difficult. According to the company, the infrastructure uses residential IP addresses across multiple countries and ISPs to make takedowns more difficult. Resecurity said the group's "business-data-leaks[.]com" leak site and related infrastructure rely on residential proxy networks spread across Latin America, Eastern Europe, Central Asia, the Middle East, and Asia. The researchers also linked the infrastructure to other cybercrime-related services and domains. To defend against the attacks, both Mandiant and the FBI recommend implementing strict verification procedures for IT support interactions, limiting remote access tools, enforcing MFA, restricting USB storage devices, and training employees to recognize voice phishing attempts. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Sanata vulnerabilità in prodotti Zoho Corporation Alert AL03/260522/CSIRT-ITA Sintesi Sanata una vulnerabilità con gravità “alta” in prodotti Zoho Corporation. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati. Tipologia Remote Code Execution Prodotti e versioni affette ADSelfService Plus, versioni precedenti alla 6525 DataSecurity Plus, versioni precedenti alla 6264 RecoveryManager Plus, versioni precedenti alla 6313 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.

Zoho: sanate vulnerabilità in prodotti ManageEngine Alert AL01/260417/CSIRT-ITA Sintesi Aggiornamenti di sicurezza Zoho sanano due vulnerabilità con gravità “alta” in ManageEngine Password Manager Pro, PAM360 e Log360. Tipologia Privilege Escalation Authentication Bypass Prodotti e versioni affette ManageEngine Password Manager Pro, dalla build 8600 alla 13230 PAM360, versioni precedenti alla build 8531 Log360, dalla build 13000 alla 13013 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti

A North Korea-linked threat actor tracked as APT37 has been observed using five new malicious tools in a recent campaign targeting air-gapped systems, Zscaler reports. Also tracked as ScarCruft, Ruby Sleet, and Velvet Chollima, APT37 has been active since 2012, focusing on data theft and surveillance and mainly targeting entities in South Korea. As part of a campaign discovered in December 2025, named Ruby Jumper, APT37 was seen using LNK files to execute a PowerShell script and deploy multiple payloads, including a decoy document in Arabic about the Palestine-Israel conflict. The payloads work together to execute a payload in memory. Dubbed RestLeaf, it uses the Zoho WorkDrive cloud storage for command-and-control (C&C) and attempts to fetch a file containing shellcode from it. The shellcode, which is executed in memory, acts as a launcher, fetching and decrypting second-stage shellcode that loads an embedded Windows executable, dubbed SnakeDropper. The malware creates a working directory and installs the Ruby 3.3.0 runtime environment disguised as a USB speed monitoring utility, backdoors the Ruby interpreter, and creates a scheduled task to execute the interpreter every five minutes, establishing persistence. Executed every time the Ruby interpreter starts, SnakeDropper drops ThumbsBD, a backdoor that uses removable drives to exfiltrate data from air-gapped systems, using them as bidirectional relays. When detecting USB drives, the malware creates a hidden directory in their root folder, which is used to stage backdoor commands and data for exfiltration. ThumbsBD also collects system information, downloads additional payloads, and executes shellcode from a specific directory. SnakeDropper was also observed dropping VirusTask, a removable media propagation tool designed to infect air-gapped systems, which exclusively weaponizes USB drives for initial access. It copies the payload executables to a folder in the drive’s root directory and enumerates files on the drive, replacing them with LNK files that lead to the execution of shellcode on the air-gapped systems when the user attempts to open those files. “VirusTask complements ThumbsBD to form a complete air-gap attack toolkit. While ThumbsBD handles C&C communication and data exfiltration, VirusTask ensures the malware spreads to new systems through social engineering by replacing legitimate files with malicious shortcuts that victims trust and execute,” Zscaler explains. The security firm also observed ThumbsBD deploying FootWine, an encrypted Android package file containing a shellcode launcher with surveillance capabilities, such as keystroke logging and audio and video capturing. FootWine supports various surveillance-related commands, including file manipulation, shell management, and registry and process manipulation. “ThumbsBD and VirusTask weaponize removable media to bypass network isolation and infect air-gapped systems. To maintain a strong security posture, the security community should focus on monitoring endpoint activity and physical access points to counter this threat and other campaigns led by APT37,” Zscaler notes. Related: North Korean Hackers Distributed Android Spyware via Google Play Related: North Korean Hackers Target macOS Developers via Malicious VS Code Projects Related: FBI: North Korean Spear-Phishing Attacks Use Malicious QR Codes

North Korean hackers are deploying newly uncovered tools to move data between internet-connected and air-gapped systems, spread via removable drives, and conduct covert surveillance. The malicious campaign has been named Ruby Jumper and is attributed to the state-backed group APT37, also known as ScarCruft, Ricochet Chollima, and InkySquid. Air-gapped computers are disconnected from external networks, especially the public internet. Physical isolation is achieved at the hardware level by removing all connectivity (Wi-Fi, Bluetooth, Ethernet), while logical segregation relies on various software-defined controls, like VLANs and firewalls. In a physical air-gap environment, typical in critical infrastructure, military, and research sectors, data transfer is done through removable storage drives. Researchers at cloud security company Zscaler analyzed the malware employed in APT37's Ruby Jumper campaign and identified a toolkit of five malicious tools: RESTLEAF, SNAKEDROPPER, THUMBSBD, VIRUSTASK, and FOOTWINE. Bridging the air gap The infection chain begins when the victim opens a malicious Windows shortcut file (LNK), which deploys a PowerShell script that extracts payloads embedded in the LNK file. To divert attention, the script also launches a decoy document. Although the researchers did not specify any victims, they note that the document is an Arabic translation of a North Korean newspaper article about the Palestine-Israel conflict. The PowerShell script loads the first malware component, called RESTLEAF, an implant that communicates with APT37's command-and-control (C2) infrastructure using Zoho WorkDrive. RESTLEAF fetches encrypted shellcode from the C2 to download the next-stage payload, a Ruby-based loader named SNAKEDROPPER. The attack continues with installing the Ruby 3.3.0 runtime environment - complete with the interpreter, standard libraries, and gem infrastructure - disguised as a legitimate USB-related utility named usbspeed.exe. "SNAKEDROPPER is primed for execution by replacing the RubyGems default file operating_system.rb with a maliciously modified version that is automatically loaded when the Ruby interpreter starts," via a scheduled task (rubyupdatecheck) that executes every five minutes, the researchers say. The THUMBSBD backdoor is downloaded as a Ruby file named ascii.rb, as well as the VIRUSTASK malware as the bundler_index_client.rb file. The role of THUMBSBD is to collect system information, stage command files, and prepare data for exfiltration. Its most crucial function is to create hidden directories on detected USB drives and copy files to them. According to the researchers, the malware turns removable storage devices "into a bidirectional covert C2 relay." This allows the threat actor to deliver commands to air-gapped systems as well as extract data from them. “By leveraging removable media as an intermediary transport layer, the malware bridges otherwise air-gapped network segments,” Zscaler researchers say. VIRUSTASK's role is to spread the infection to new air-gapped machines, weaponizing removable drives by hiding legitimate files and replacing them with malicious shortcuts that execute the embedded Ruby interpreter when opened. The module will only trigger an infection process if the inserted removable media has at least 2GB of free space. Zscaler reports that THUMBSBD also delivers FOOTWINE, a Windows spyware backdoor disguised as an Android package file (APK) that supports keylogging, screenshot capture, audio and video recording, file manipulation, registry access, and remote shell commands. Another piece of malware also observed in the APT37's RubyJumper campaign is BLUELIGHT, a full-fledged backdoor previously associated with the North Korean threat group. Zscaler has high confidence attributing the RubyJumper campaign to APT37 based on several indicators, including the use of the BLUELIGHT malware, initial vector relying on LNK files, two-stage shellcode delivery technique, and C2 infrastructure typically observed in attacks from this actor. The researchers also note that the decoy document indicates that the target of the RubyJumper activity is interested in North Korean media narratives, which aligns with the victim profile of this threat group. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A cyber espionage group linked to North Korea has been observed deploying a new malicious campaign using removable media infection tools to gain access to air-gapped systems. The group, APT37, is well-known hacking team active since at least 2012 and known under many names, including ScarCruft, Ruby Sleet, InkySquid, Ricochet Chollima and Velvet Chollima. Initially focused on the public and private sectors in South Korea, the group expanded its operations in 2017 to include Japan, Vietnam and the Middle East, and to a wider range of industry verticals, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities. In this new campaign, spotted by security researchers at Zscaler ThreatLabz and dubbed ‘Ruby Jumper,’ APT37 utilized a set of six malicious tools throughout the attack lifecycle, five of which had never been documented (Restleaf, SnakeDropper, ThumbSBD, VirusTask and FootWine). It also leveraged removable media to infect and pass commands and information between air-gapped systems. APT37’s Ruby Jumper Campaign Explained The Ruby Jumper campaign was discovered by the ThreatLabz team in December 2025. During this campaign, documented in a report published on February 26, APT37 gained access using the group’s traditional method: abusing Windows shortcut (LNK) files. When a victim opens a malicious LNK file, it launches a PowerShell command and scans the current directory to locate itself based on file size. Then, the PowerShell script launched by the LNK file carves multiple embedded payloads from fixed offsets within that LNK, including a decoy document, an executable payload, an additional PowerShell script and a batch file. This document displays an article about the Palestine-Israel conflict, translated from a North Korean newspaper into Arabic. The executable payload is a newly discovered implant, dubbed Restleaf by the ThreatLabz team, that uses Zoho WorkDrive for command-and-control (C2) communications to fetch additional payloads. “To our knowledge, this is the first time APT37 has abused Zoho WorkDrive,” the researchers noted. RestLeaf profiles the compromised system and establishes persistence before retrieving follow‑on components from Zoho WorkDrive. Among these is SnakeDropper, a loader responsible for decrypting and deploying additional modules in memory, reducing on‑disk artefacts. To extend access beyond the initially infected host, APT37 deploys ThumbSBD, a tool specifically designed to propagate via removable media. ThumbSBD monitors for connected USB drives, copies a tailored infection package onto them and abuses shortcut files to ensure execution when the drive is opened on another system. This enables lateral movement into isolated or segmented environments. When a USB device reaches an air‑gapped machine, the infection chain resumes. VirusTask executes as a lightweight backdoor, collecting system information and staging data for exfiltration. Because the system lacks direct internet access, APT37 again relies on removable media: stolen data is written back to the USB drive in hidden or obfuscated form. The operators also deploy FootWine, a reconnaissance and collection utility focused on harvesting documents and monitoring removable drive activity, ensuring valuable data is queued for extraction. Supporting these newer components is BlueLight, a previously documented APT37 tool used for command execution and data theft. In connected environments, BlueLight communicates with external C2 infrastructure. In air‑gapped scenarios, it facilitates tasking and data staging for delayed exfiltration via USB.

ManageEngine adds causal and autonomous AI to Site24x7 to cut MTTR ManageEngine has added new causal intelligence and autonomous AI capabilities in Site24x7, its full-stack observability platform. These enhancements transform how enterprises handle outages, shifting from firefighting to autonomous resilience. By reducing mean time to recovery (MTTR) and ensuring service-level agreement (SLA) compliance, Site24x7 helps IT teams safeguard the customer experience and retain trust. IT environments are increasingly fragmented across hybrid clouds, microservices, and dynamic networks, generating massive volumes of telemetry and predictive anomaly signals every second. When an incident occurs, this complexity turns troubleshooting into a needle-in-a-haystack search, often leading to prolonged downtime. IT teams struggle to correlate anomaly signals and events across these layers, delaying the critical fix to restore normalcy, jeopardizing brand reputation. “Hybrid and cloud-native architectures have made IT operations highly interconnected, while IT managers are under constant pressure to resolve incidents quickly amid growing complexity,” said Srinivasa Raghavan, director of product management at ManageEngine. “By combining predictive anomaly detection, intelligent event correlation, service dependency context, and AI-driven causal insights, Site24x7 cuts through alert noise to show not just what is broken, but what caused it and what it impacts, helping teams identify the true fault faster and significantly reduce MTTR while minimizing service disruption.” “Triaging and resolving incidents in hybrid environments with growing infrastructure complexity can quickly become a nightmare, especially when SLA commitments are on the line,” said Pravir Kumar Sinha, IT leader at Synechron, a global IT services company and one of the early customers to access the feature. “With Site24x7 AIOps, we’re able to filter out nearly 90% of alert noise, pinpoint issues faster, and accelerate resolution. This helps us achieve stronger SLA adherence, reduce MTTR, and ultimately deliver reliable digital experience for customers.” The introduction of autonomous AI in Site24x7 represent a practical step toward more autonomous IT operations by analyzing observability data, reducing cognitive overload, and turning insights into clear, actionable guidance. “With MCP providing the control and governance layer, we ensure this intelligence is applied securely and within enterprise guardrails. This empowers IT leaders move toward agentic workflows with confidence, stay ahead of the AI adoption curve, and strengthen the resilience of their critical digital services,” said Raghavan. Key capabilities include: Domain-aware causal correlation with predictive anomaly detection: Detects anomalies and correlates related signals across applications, infrastructure, and networks into a single, context-rich problem, so teams can understand what is connected and where to start. Customizable AI agents with governed, task-driven automation: Enables customers to create and tailor AI agents, set approved guardrails using solution documents, and assign tasks that guide agents from analysis to guided action—making response workflows more consistent across teams. MCP-enabled agentic foundation for customers: MCP provides the enabling layer for customers to build and operationalize agentic use cases on top of observability data—standardizing how agents access data, follow approved guidance, and execute tasks within enterprise-ready controls and auditability. Orchestrated remediation with Qntrl: Coordinates downstream actions through structured workflows and repeatable runbooks, powered by Zoho’s workflow and orchestration platform Qntrl, with approvals and traceability built in to support controlled automation.

Zoho: sanata vulnerabilità in Zoho Analytics Plus Alert AL02/251114/CSIRT-ITA Sintesi Sanata una vulnerabilità con gravità “critica” in Zoho Analytics Plus, strumento per la gestione e il reporting di dati aziendali, sviluppato da Zoho Corporation. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato di accedere a informazioni sensibili sui sistemi target. Tipologia Authentication Bypass Prodotti e versioni affette Analytics Plus on-premise, versioni precedenti alla 6171 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.

Zoho: sanata vulnerabilità in ManageEngine ADManager Plus Alert AL06/251022/CSIRT-ITA Sintesi Sanata una vulnerabilità con gravità “critica” in ManageEngine ADManager Plus, strumento per la gestione e il reporting di Active Directory (AD), sviluppato da Zoho Corporation. Tale vulnerabilità interessa la componente Custom Script, dove un'errata gestione dei parametri potrebbe consentire a un utente con privilegi minimi l’esecuzione di comandi di sistema arbitrari sul server. Tipologia Arbitrary Code Execution Prodotti e versioni affette ManageEngine ADManager Plus, tutte le versioni precedenti alla 8024 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza riportati nella sezione Riferimenti.

A China-aligned threat actor known as TA415 has been attributed to spear-phishing campaigns targeting the U.S. government, think tanks, and academic organizations utilizing U.S.-China economic-themed lures. "In this activity, the group masqueraded as the current Chair of the Select Committee on Strategic Competition between the United States and the Chinese Communist Party (CCP), as well as the U.S.-China Business Council, to target a range of individuals and organizations predominantly focused on U.S.-China relations, trade, and economic policy," Proofpoint said in an analysis. The enterprise security company said the activity, observed throughout July and August 2025, is likely an effort on part of Chinese state-sponsored threat actors to facilitate intelligence gathering amid ongoing U.S.-China trade talks, adding the hacking group shares overlaps with a threat cluster tracked broadly under the names APT41 and Brass Typhoon (formerly Barium). The findings come days after the U.S. House Select Committee on China issued an advisory warning of an "ongoing" series of highly targeted cyber espionage campaigns linked to Chinese threat actors, including a campaign that impersonated the Republican Party Congressman John Robert Moolenaar in phishing emails designed to deliver data-stealing malware. The campaign, per Proofpoint, mainly focused on individuals who specialized in international trade, economic policy, and U.S.-China relations, sending them emails spoofing the U.S.-China Business Council that invited them to a supposed closed-door briefing on U.S.-Taiwan and U.S.-China affairs. The messages were sent using the email address "uschina@zohomail[.]com," while also relying on the Cloudflare WARP VPN service to obfuscate the source of the activity. They contain links to password-protected archives hosted on public cloud sharing services such as Zoho WorkDrive, Dropbox, and OpenDrive, within which there exists a Windows shortcut (LNK) along with other files in a hidden folder. The primary function of the LNK file is to execute a batch script within the hidden folder, and display a PDF document as a decoy to the user. In the background, the batch script executes an obfuscated Python loader named WhirlCoil that's also present in the archive. "Earlier variations of this infection chain instead downloaded the WhirlCoil Python loader from a Paste site, such as Pastebin, and the Python package directly from the official Python website," Proofpoint noted. The script is also designed to set up a scheduled task, typically named GoogleUpdate or MicrosoftHealthcareMonitorNode, to run the loader every two hours as a form of persistence. It also runs the task with SYSTEM privileges if the user has administrative access to the compromised host. The Python loader subsequently establishes a Visual Studio Code remote tunnel to establish persistent backdoor access and harvests system information and the contents of various user directories. The data and the remote tunnel verification code are sent to a free request logging service (e.g., requestrepo[.]com) in the form of a base64-encoded blob within the body of an HTTP POST request. "With this code, the threat actor is then able to authenticate the VS Code Remote Tunnel and remotely access the file system and execute arbitrary commands via the built-in Visual Studio terminal on the targeted host," Proofpoint said. It's worth noting that the infection chain adopted in this campaign has remained largely unchanged from a prior attack sequence targeting organizations in the aerospace, chemicals, insurance, and manufacturing sectors in September 2024 that delivered Visual Studio Code Remote Tunnels via the Python loader. Proofpoint told The Hacker News that it has observed TA415 incorporate incremental changes in the infection chain used to deliver Visual Studio Code Remote Tunnels since it was first used a year ago. "The continued use of Visual Studio Code Remote Tunnels since this time is likely because abuse of this legitimate VS Code feature can be relatively difficult for network defenders to detect, particularly if they are not explicitly monitoring for it," Mark Kelly, threat researcher at Proofpoint, said. "Additionally, TA415 activity leveraging Visual Studio Code Remote Tunnels has remained highly targeted and low in volume, particularly before the recent uptick observed in July and August detailed in our reporting." (The story was updated after publication to include a response from Proofpoint.)

Transition to passkeys promises organizations a cost-effective path toward robust employee authentication, increased productivity, and regulatory compliance. We’ve already covered all the pros and cons of this business solution in a separate, in-depth article. However, the success of the transition — and even its feasibility — really hinges on the technical details and implementation specifics across numerous corporate systems. Passkey support in identity management systems Before tackling organizational hurdles and drafting policies, you’ll have to determine if your core IT systems are ready for the switch to passkeys. Microsoft Entra ID (Azure AD) fully supports passkeys, letting admins set them as the primary sign-in method. For hybrid deployments with on-premises resources, Entra ID can generate Kerberos tickets (TGTs), which your Active Directory domain controller can then process. However, Microsoft doesn’t yet offer native passkey support for RDP, VDI, or on-premises-only AD sign-ins. That said, with a few workarounds, organizations can store passkeys on a hardware token like a YubiKey. This kind of token can simultaneously support both the traditional PIV (smart cards) technology and FIDO2 (passkeys). There are also third-party solutions for these scenarios, but you’ll need to evaluate how using them impacts your overall security posture and regulatory compliance. Good news for Google Workspace and Google Cloud users: they offer full passkey support. Popular identity management systems like Okta, Ping, Cisco Duo, and RSA IDplus also support FIDO2 and all major forms of passkeys. Passkey support on client devices We have a detailed post on the subject. All modern operating systems from Google, Apple, and Microsoft support passkeys. However, if your company uses Linux, you’ll likely need extra tools, and overall support is still limited. Also, while for all major operating systems it might look like full support on the surface, there’s a lot of variety in how passkeys are stored, and that can lead to compatibility headaches. Combinations of several systems like Windows computers and Android smartphones are the most problematic. You might create a passkey on one device and then find you can’t access it on another. For companies with a strictly managed device fleet, there are a couple of ways to tackle this. For example, you could have employees generate a separate passkey for each company device they use. This means a bit more initial setup: employees will need to go through the same process of creating a passkey on every device. However, once that’s done, signing in takes minimal time. Plus, if they lose one device, they won’t be completely locked out of their work data. Another option is to use a company-approved password manager to store and sync passkeys across all employees’ devices. This is also a must for companies using Linux computers, as its operating system can’t natively store passkeys. Just a heads-up: this approach might add some complexity when it comes to regulatory compliance audits. If you’re looking for a solution with almost no issues with sync and multiple platforms, hardware passkeys like the YubiKey are the way to go. The catch is that they can be significantly more expensive to deploy and manage. Passkey support in business applications The ideal scenario for bringing passkeys into your business apps is to have all your applications sign in through single sign-on (SSO). That way, you only need to implement passkey support in your corporate SSO solution, such as Entra ID or Okta. However, if some of your critical business applications don’t support SSO, or if that support isn’t part of your contract (which, unfortunately, happens), you’ll have to issue individual passkeys for users to sign in to each separate system. Hardware tokens can store anywhere from 25 to 100 passkeys, so your main extra cost here would be on the administrative side. Popular business systems that fully support passkeys include Adobe Creative Cloud, AWS, GitHub, Google Workspace, HubSpot, Office 365, Salesforce, and Zoho. Some SAP systems also support passkeys. Employee readiness Rolling out passkeys means getting your team up to speed regardless of the scenario. You don’t want them scratching their heads trying to figure out new interfaces. The goal is for everyone to feel confident using passkeys on every single device. Here are the key things your employees will need to understand. Why passkeys beat passwords (they’re much more secure, faster to sign in with, and don’t need to be rotated) How biometrics work with passkeys (the biometric data never leaves the device, and isn’t stored or processed by the employer) How to get their very first passkey (for example, Microsoft has a Temporary Access Pass feature, and third-party IAM systems often send an onboarding link; the process needs to be thoroughly documented, though) What to do if their device doesn’t recognize their passkey What to do if they lose a device (sign in from another device that has its own passkey, or use an OTP, perhaps given to them in a sealed envelope for just such an emergency) How to sign in to work systems from other computers (if the company’s policies permit it) What a passkey-related phishing attempt might look like Passkeys are no silver bullet Moving to passkeys doesn’t mean your cybersecurity team can just cross identity threats off their risk list. Sure, it makes things tougher for attackers, but they can still do the following: Target systems that haven’t switched to passkeys Go after systems that still have fallback login methods like passwords and OTPs Steal authentication tokens from devices infected with infostealers Use special techniques to bypass passkey protections While it’s impossible to phish the passkey itself, attackers can set up fake web infrastructure to trick a victim into authenticating and validating a malicious session on a corporate service. A recent example of this kind of AiTM attack was documented in the U.S. In that incident, the victim was lured to a fake authentication page for a corporate service, where attackers first phished their username and password, and then the session confirmation by having them scan a QR code. In this incident, the security policies were configured correctly, so scanning this QR code did not lead to successful authentication. But since such a mechanism with passkeys was implemented, the attackers hope that somewhere it is configured incorrectly, and the physical proximity of the device on which authentication is carried out and the device where the key is stored is not checked. Ultimately, switching to passkeys requires detailed policy configuration. This includes both authentication policies (such as disabling passwords when a passkey is available, or banning physical tokens from unknown vendors) and monitoring policies (such as logging passkey registrations or cross-device scenarios from suspicious locations).

Mexican organizations are still being targeted by threat actors to deliver a modified version of AllaKore RAT and SystemBC as part of a long-running campaign. The activity has been attributed by Arctic Wolf Labs to a financially motivated hacking group called Greedy Sponge. It's believed to be active since early 2021, indiscriminately targeting a wide range of sectors, such as retail, agriculture, public sector, entertainment, manufacturing, transportation, commercial services, capital goods, and banking. "The AllaKore RAT payload has been heavily modified to enable the threat actors to send select banking credentials and unique authentication information back to their command-and-control (C2) server, for the purpose of conducting financial fraud," the cybersecurity company said in an analysis published last week. Details of the campaign were first documented by the BlackBerry Research and Intelligence Team (which is now part of Arctic Wolf) in January 2024, with the attacks employing phishing or drive-by compromises to distribute booby-trapped ZIP archives that ultimately facilitate the deployment of AllaKore RAT. Attack chains analyzed by Arctic Wolf show that the remote access trojan is designed to optionally deliver secondary payloads like SystemBC, a C-based malware that turns compromised Windows hosts into SOCKS5 proxies to allow attackers to communicate with their C2 servers. Besides dropping potent proxy tools, Greedy Sponge has also refined and updated its tradecraft to incorporate improved geofencing measures as of mid-2024 in an attempt to thwart analysis. "Historically, geofencing to the Mexican region took place in the first stage, via a .NET downloader included in the trojanized Microsoft software installer (MSI) file," the company said. "This has now been moved server-side to restrict access to the final payload." The latest iteration sticks to the same approach as before, distributing ZIP files ("Actualiza_Policy_v01.zip") containing a legitimate Chrome proxy executable and a trojanized MSI file that's engineered to drop AllaKore RAT, a malware with capabilities for keylogging, screenshot capture, file download/upload, and remote control. The MSI file is configured to deploy a .NET downloader, which is responsible for retrieving and launching the remote access trojan from an external server ("manzisuape[.]com/amw"), and a PowerShell script for cleanup actions. This is not the first time AllaKore RAT has been used in attacks targeting Latin America. In May 2024, HarfangLab and Cisco Talos revealed that an AllaKore variant known as AllaSenha (aka CarnavalHeist) has been used to single out Brazilian banking institutions by threat actors from the country. "Having spent those four years-plus actively targeting Mexican entities, we would deem this threat actor persistent, but not particularly advanced," Arctic Wolf said. "The strictly financial motivation of this actor coupled with their limited geographic targeting is highly distinctive." "Additionally, their operational longevity points to probable operational success – meaning they’ve found something that works for them, and they are sticking with it. Greedy Sponge has held the same infrastructure models for the duration of their campaigns." The development comes as eSentire detailed a May 2025 phishing campaign that employed a new crypter-as-a-service offering known as Ghost Crypt to deliver and run PureRAT. "Initial access was gained through social engineering, where the threat actor impersonated a new client and sent a PDF containing a link to a Zoho WorkDrive folder containing malicious zip files," the Canadian company noted. "The attacker also created a sense of urgency by calling the victim and requesting that they extract and execute the file immediately." Further examination of the attack chain has revealed that the malicious file contains a DLL payload that's encrypted with Ghost Crypt, which then extracts and injects the trojan (i.e., the DLL) into a legitimate Windows csc.exe process using a technique called process hypnosis injection. Ghost Crypt, which was first advertised by an eponymous threat actor on cybercrime forums on April 15, 2025, offers the ability to bypass Microsoft Defender Antivirus, and serve several stealers, loaders, and trojans like Lumma, Rhadmanthys, StealC, BlueLoader, PureLoader, DCRat, and XWorm, among others. The discovery also follows the emergence of a new version of Neptune RAT (aka MasonRAT) that's distributed via JavaScript file lures, allowing the threat actors to extract sensitive data, take screenshots, log keystrokes, drop clipper malware, and download additional DLL payloads. Neptune RAT, according to Gen Digital, shares striking overlaps with another remote access trojan referred to as XWorm, suggesting that the first iteration of the malware is a derivative of the latter. Neptune RAT V2, in contrast, incorporates significant changes from its predecessor, alluding to a rewrite or an extensive refactoring. "Both XWorm and Neptune RAT V1 use the exact same encryption routine: The mutex is hashed using MD5, and the hash is duplicated to form a 32-byte key used for AES encryption running in the insecure ECB mode," security researcher Ajin Deepak said. "Both XWorm and Neptune RAT share a similar approach to initialization: they load all configuration settings at the start of their respective main functions and then launch executor threads to carry out their tasks." In recent months, cyber attacks have employed malicious Inno Setup installers that serve as a conduit for Hijack Loader (aka IDAT Loader), which then delivers the RedLine information stealer. The attack "leverages Inno Setup's Pascal scripting capabilities to retrieve and execute the next-stage payload in a compromised or targeted host," the Splunk Threat Research Team said. "This technique closely resembles the approach used by a well-known malicious Inno Setup loader called D3F@ck Loader, which follows a similar infection pattern."