28 Jul
This week we have cute? panda images delivering rootkits, US-nuclear weapons facility breached by a zero day and yet again a few examples of companies failing at the basics – handing out passwords over support phone calls and blindly accepting pull requests from unknown parties …
P.S. Scroll to the bottom to subscribe and get these weekly cyber security news summaries to your inbox.
1. Microsoft issues emergency patches for SharePoint ToolShell zero-days
Microsoft has released emergency patches for the exploited SharePoint zero-days CVE-2025-53770 and CVE-2025-53771 known as ToolShell, actively exploited by Chinese state-backed groups Linen Typhoon, Violet Typhoon, and Storm-2603.
These vulnerabilities enable unauthenticated remote code execution, key theft, and malware installation on on-premises SharePoint servers, impacting over 400 organizations including US government agencies.
The first patch was incomplete, allowing rapid bypass and exploitation. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog, urging immediate remediation. Microsoft recommends AMSI integration and Defender deployment, and highlights the importance of rotating server machine keys and restarting IIS after patching.
Key Details
- The flaws allow unauthenticated, remote code execution when chained together.
- Eye Security and Google TAG observed initial attacks on July 18 planting webshells.
- ShadowServer reports over 9,000 internet-exposed SharePoint instances, mostly in North America and Europe.
- Palo Alto Networks saw related exploitation of earlier CVE-2025-49704/49706 variants.
Next Steps
- Install the July 21 SharePoint patches immediately.
- Enable SharePoint’s Antimalware Scan Interface (AMSI) in full mode.
- Rotate SharePoint cryptographic keys after patching or mitigation.
Read more at
2. Amazon AI Coding Agent Compromised with Malicious System Commands in Supply Chain Attack
A malicious pull request was injected into version 1.84.0 of Amazon's AI coding assistant extension 'Amazon Q' for Visual Studio Code, containing destructive system commands to wipe local files and AWS resources. The malicious code was pushed through an unverified GitHub account and released to users before being mitigated.
Key Details
- The attacker gained access via an unverified GitHub account and submitted a malicious pull request in late June.
- Malicious code was inserted on July 13 and released as version 1.84.0 on July 17 before detection.
- The code instructed the AI agent to act as a system cleaner, aiming to delete user data and cloud resources.
- Amazon mitigated the issue quickly; users are advised to update to version 1.85 as a precaution.
Next Steps
- Enforce strict code review and least-privilege access in DevSecOps.
Read more at
3. Arizona Woman Sentenced to 8.5 Years for Facilitating North Korean IT Worker Infiltration
Christina Chapman was sentenced to 102 months in prison for running a "laptop farm" that enabled North Korean government–linked IT workers to access networks at 309 U.S. companies using stolen identities. Her scheme generated $17 million for North Korea’s Munitions Industry Department and underscores the insider threat posed by fraudulent remote hires.
Key Details
- 309 U.S. companies targeted, including a major TV network, automaker, and Silicon Valley tech firm
- FBI seized over 90 laptops from Chapman’s home and 49 devices shipped overseas
- Chapman used 68 stolen identities to forge payroll checks and launder $17 million
- Operation linked to DPRK’s Munitions Industry Department supporting weapons development
Next Steps
- Monitor remote-access software installations for unauthorized backdoor tools
Read more at
4. International Operation Seizes BlackSuit Ransomware Gang’s Darknet Sites
Law enforcement from nine countries, led by U.S. Homeland Security Investigations, seized the BlackSuit gang’s darknet extortion sites, halting its ability to post victims and negotiate ransoms.
Active since mid-2023 as a Royal/Conti rebrand, BlackSuit had extorted over $500 million globally and forced the temporary closure of nearly 200 blood plasma centers.
Following the takedown, core operators are resurfacing under the Chaos ransomware scheme, signaling a continuing threat.
Key Details
- The operation involved 17 law enforcement agencies and Bitdefender alongside HSI.
- BlackSuit targeted high-profile victims including Kadokawa and Tampa Bay Zoo.
- In April 2024, its attack on Octapharma closed almost 200 plasma collection centers.
- Cisco Talos links former BlackSuit members to the emerging Chaos ransomware.
Read more at
5. Fire Ant Campaign Abuses VMware Flaws to Infiltrate Segmented Networks
Suspected China-linked APT "Fire Ant" has exploited unpatched VMware vCenter and ESXi vulnerabilities
to gain initial access, forge credentials, and implant hypervisor-level backdoors that persist across
reboots. The threat actors then bypassed network segmentation—using F5 load balancer exploits, IPv6
bypasses, and tunneled web shells—to reach isolated environments, demonstrating deep knowledge of target infrastructure.
Key Details
- Exploited CVE-2023-34048 and CVE-2023-20867 to compromise vCenter and guest VMs
- Used CVE-2022-1388 on F5 load balancers and IPv6 gaps to tunnel into isolated networks
- Custom tools disabled SentinelOne EDR and maintained persistence post-reboot
Next Steps
- Apply latest VMware vCenter and ESXi security patches
- Enforce PIM, unique complex passwords, and MFA for vCenter/ESXi accounts
- Restrict vCenter administrative access and enable ESXi Normal Lockdown Mode
Read more at
6. AI-Generated Panda Images Used to Deploy Persistent Linux Cryptominer ‘Koske’ via JupyterLab
A new Linux malware strain dubbed "Koske" uses AI-assisted code and polyglot JPEGs of panda images to deliver in-memory cryptomining rootkits that evade antivirus detection. Attackers exploit misconfigured JupyterLab instances—potentially via CVE-2025-30370—and weaponize benign-looking images to establish stealthy, persistent mining operations on compromised servers.
Key Details
- Initial access via unauthenticated JupyterLab (Serbian IP 178.220.112.53), possibly exploiting CVE-2025-30370.
- Polyglot JPEGs append C code and shell scripts, executing entirely in memory to bypass disk-based AV.
- Rootkit hooks readdir() and hijacks Bash configs to hide “Koske” processes and ensure persistence.
- AI-assisted logic selects among 18 cryptocurrency miners, checks proxy status, and uses fallback routines.
Next Steps
- Audit and patch all internet-exposed JupyterLab instances.
- Block execution of polyglot image payloads at ingress points.
Read more at
7. Clorox Files $380M Negligence Suit Against Cognizant Over Helpdesk Enabling Social Engineering Attack
Clorox alleges Cognizant helpdesk agents handed over network credentials and reset MFA without identity verification, enabling a social engineering attack that caused $380 million in damages.
Key Details
- August 2023 attack by Scattered Spider group via simple phone calls.
- Transcripts show agents provided passwords, MFA resets, and SMS changes with no verification.
- Clorox incurred $49 million in remediation and “hundreds of millions” in business interruption
Next Steps
- Enforce zero-trust identity checks for all helpdesk resets.
- Require supervisor co-approval on credential and MFA changes.
- Audit outsourcing contracts for clear security controls and vendor liability.
Read more at
8. Allianz Life Breach Exposes Data of 1.4 Million Customers via Third-Party CRM Attack
Allianz Life Insurance confirmed that on July 16 attackers used social engineering to compromise its cloud-based CRM, exposing personal details for the majority of its 1.4 million U.S. customers and select employees. The insurer alerted the FBI, found no evidence of further network intrusion, and will begin state-required notifications around August 1.
Key Details
- Breach disclosed in a mandatory filing with Maine’s attorney general.
- Attackers impersonated trusted parties to extract CRM login credentials.
- No compromise detected on critical policy administration or other systems.
- Security firms link a surge in insurance breaches to the “Scattered Spider” group.
Next Steps
- Run targeted social-engineering simulations on staff.
- Audit CRM vendor’s access controls and enforce multi-factor authentication.
- Verify breach-notification processes meet all state requirements.
Read more at
9. Stealthy Backdoor in WordPress mu-plugins Directory Bypasses Detection and Grants Persistent Access
A sophisticated WordPress backdoor named wp-index.php is leveraging the rarely monitored mu-plugins directory to maintain undeactivatable, stealthy access to compromised sites. It uses ROT13 obfuscation, stores and executes payloads from the database under “_hdra_core”, and creates hidden admin accounts to evade file-based scans and UI detection. This approach gives attackers persistent remote code execution and full administrative control, increasing risk of data theft, defacement, or further compromise.
Key Details
- Must-use plugin loader in mu-plugins prevents deactivation via admin panel.
- Downloads Base64-encoded payloads from hxxps://1870y4rr4y3d1k757673q[.]xyz/cron.php.
- Stores payloads in wp_options under key “_hdra_core” and removes temp files.
- Creates hidden admin user “officialwp” and conceals it with custom filters.
Next Steps
- Audit mu-plugins for unauthorized loader scripts.
- Inspect wp_options for suspicious entries like “_hdra_core”.
- Review user list for hidden accounts (e.g., “officialwp”).
Read more at
10. Supply Chain Attack Inserts Backdoor into Popular npm Packages like the “is” package
Last week, attackers hijacked maintainer accounts for several widely used npm JavaScript utilities via a typosquatted phishing domain, inserting cross-platform backdoor loaders into versions of the “is” package and others. The malicious releases remained available for up to six hours, putting millions of downstream projects at risk and evading most antivirus detections.
Key Details
- Phishing emails originated from typo-squat domain npnjs.org targeting maintainers.
- Malicious v3.3.1 of “is” was live for six hours before npm admins rolled back.
- “Scavenger” malware uses a JavaScript loader and maintains a live C2 on Node.js.
- Socket reported 60+ malicious npm packages in May and additional backdoors in June.
Next Steps
- Enforce MFA on all npm maintainer accounts.
- Freeze approved versions using package-lock.json.
- Implement pre-install scanning of npm packages.
Read more at
11. Pentagon Audits Microsoft ‘Digital Escort’ Cloud Support Model
ProPublica exposed that Microsoft used China-based engineers to remotely support DoD cloud systems via US-based “digital escorts,” creating an unvetted foreign-access risk. Following Congressional inquiries, Microsoft has barred China-based support for government cloud services. The Pentagon has ordered a two-week audit of all DoD cloud contracts to identify and remediate similar counterintelligence gaps.
Key Details
- The digital escort model routed firewall updates and bug fixes through US-cleared personnel who executed commands from China-based engineers.
- Senator Tom Cotton demanded lists of DoD contractors using foreign support and details on escort training and vetting processes.
- Defense Secretary Pete Hegseth condemned the practice and initiated a two-week audit of all Department of Defense cloud agreements.
- Experts warn escorts lacked the technical expertise to detect malicious code or espionage-focused instructions.
Next Steps
- Inventory vendor support models for foreign-based engineering involvement
- Enforce policies prohibiting non-approved subcontractor engineer access to sensitive systems
- Provide targeted code-review training for personnel executing third-party commands
Read more at
- ProPublica: Microsoft ‘Digital Escorts’ in DoD Systems
- CSO Online: Microsoft Digital Escorts Reveal Blind Spot
12. Attackers Hijack FIDO Cross-Device Sign-In with QR Code Trick
PoisonSeed phishing operators are bypassing hardware-based FIDO keys by abusing QR-based cross-device sign-in workflows. Users unwittingly scan attacker-controlled QR codes that complete legitimate FIDO challenges and hand over active sessions—no physical key theft required.
Key Details
- Discovered by Expel, the campaign mirrors genuine login flows for providers like Okta.
- Victims enter credentials on a fake page, then scan a cloned QR prompt that finalizes the session for attackers.
- No flaw in FIDO’s cryptography—the abuse lies in the cross-device feature and social engineering.
- Experts advise disabling QR-based sign-ins, monitoring new device registrations and anomalous geolocations.
Next Steps
- Disable cross-device QR logins where policies allow.
- Alert on registrations from unfamiliar devices or unusual geographies.
- Train users to verify QR origins before scanning.
Read more at
- CSO Online: PoisonSeed Outsmarts FIDO Keys Without Touching Them
- Expel: PoisonSeed Downgrading FIDO Key Authentications
13. US Nuclear Security Administration Breached via SharePoint Zero-Day Exploit
Chinese government-affiliated hackers exploited an unpatched zero-day in on-premises Microsoft SharePoint Server to infiltrate the National Nuclear Security Administration’s network. No classified data was accessed thanks to the agency’s Microsoft 365 cloud migration, but the breach highlights the critical risk of legacy on-premise software.
Key Details
- Attack exploited a deserialization flaw plus authentication bypass (CVSS 9.8).
- Vulnerabilities were demonstrated at Pwn2Own Vancouver 2024 in May.
- Over 50 organizations—including NNSA—were targeted.
- Cloud-based SharePoint Online deployments were unaffected.
Next Steps
- Deploy Microsoft’s SharePoint Server emergency security updates.
Read more at
14. Microsoft confirms Warlock ransomware in SharePoint CVE-2025-49706 attacks
Microsoft attributes new Warlock ransomware activity to China-based Storm-2603 exploiting on-premises SharePoint servers via CVE-2025-49706.
Over 400 governments and businesses—including U.S. agencies NNSA, NIH and DHS—may be impacted as operators disable Defender and encrypt environments.
CISA and MS-ISAC are coordinating notifications and mitigation efforts for state, local and federal partners.
Key Details
- Storm-2603 began deploying Warlock ransomware on July 18 after exploiting CVE-2025-49706.
- Warlock emerged in June as a RaaS advertised on Russian forum RAMP; at least 11 victims are confirmed.
- Attackers disable Microsoft Defender, then encrypt file shares and servers.
- Government bodies notified include the National Nuclear Security Administration, NIH and DHS.
Next Steps
- Apply Microsoft’s SharePoint security updates immediately.
- Audit logs for CVE-2025-49706 exploitation indicators.
- Restrict external SharePoint exposure and enforce zero-trust access.
Read more at
English 
Estonian