Alternate Data Streams: Adversary Defense Evasion and Detection

Good Primer of alternate data streams and how they are abused, as well as how to detect and defend against ADS abuse.

https://isc.sans.edu/diary/Alternate%20Data%20Streams%20%3F%20Adversary%20Defense%20Evasion%20and%20Detection%20%5BGuest%20Diary%5D/31990

Connectwise Breach Affects ScreenConnect Customers

Connectwise s ScreenConnect solution was compromised, leading to attacks against a small number of customers. This is yet another example of how attackers are taking advantage of remote access solutions.

https://www.connectwise.com/company/trust/advisories

Mark Your Calendar: APT41 Innovative Tactics

Google detected attacks leveraging Google s calendar solution as a command and control channel.

https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics

Webs of Deception: Using the SANS ICS Kill Chain to Flip the Advantage to the Defender

Defending a small Industrial Control System (ICS) against sophisticated threats can seem futile. The resource disparity between small ICS defenders and sophisticated attackers poses a significant security challenge.

https://www.sans.edu/cyber-research/webs-deception-using-sans-ics-kill-chain-flip-advantage-defender/

Exploring a Use Case of Artificial Intelligence Assistance with Understanding an Attack

Jennifer Wilson took a weird string found in a recent honeypot sample and worked with ChatGPT to figure out what it is all about.

https://isc.sans.edu/diary/%5BGuest%20Diary%5D%20Exploring%20a%20Use%20Case%20of%20Artificial%20Intelligence%20Assistance%20with%20Understanding%20an%20Attack/31980

Ransomware Deployed via SimpleHelp Vulnerabilities

Ransomware actors are using vulnerabilities in SimpleHelp to gain access to victim s networks via MSPs. The exploited vulnerabilities were patched in January.

https://news.sophos.com/en-us/2025/05/27/dragonforce-actors-target-simplehelp-vulnerabilities-to-attack-msp-customers/

OS Command Injection in Everetz Equipment

Broadcast equipment manufactured by Everetz is susceptible to an OS command injection vulnerability. Everetz has not responded to researchers reporting the vulnerability so far and there is no patch available.

https://www.onekey.com/resource/security-advisory-remote-code-execution-on-evertz-svdn-cve-2025-4009

SSH authorized_keys File

One of the most common techniques used by many bots is to add rogue keys to the authorized_keys file, implementing an SSH backdoor. Managing these files and detecting unauthorized changes is not hard and should be done if you operate Unix systems.

https://isc.sans.edu/diary/Securing%20Your%20SSH%20authorized_keys%20File/31986

REMOTE COMMAND EXECUTION ON SMARTBEDDED METEOBRIDGE (CVE-2025-4008)

Weatherstation software Meteobridge suffers from an easily exploitable unauthenticated remote code execution vulnerability

https://www.onekey.com/resource/security-advisory-remote-command-execution-on-smartbedded-meteobridge-cve-2025-4008

https://forum.meteohub.de/viewtopic.php?t=18687

Manageengine ADAuditPlus SQL Injection

Zoho patched two SQL Injection vulnerabilities in its ManageEngine ADAuditPlus product

https://www.manageengine.com/products/active-directory-audit/cve-2025-41407.html

https://www.manageengine.com/products/active-directory-audit/cve-2025-36527.html

Dero Miner Infects Containers through Docker API

Kaspersky found yet another botnet infecting docker containers to spread crypto coin miners. The initial access happens via exposed docker APIs.

https://securelist.com/dero-miner-infects-containers-through-docker-api/116546/

SVG Steganography

Steganography is not only limited to pixel-based images but can be used to embed messages into vector-based formats like SVG.

https://isc.sans.edu/diary/SVG%20Steganography/31978

Fortinet Vulnerability Details CVE-2025-32756

Horizon3.ai shows how it was able to find the vulnerability in Fortinet s products, and how to possibly exploit this issue. The vulnerability is already being exploited in the wild and was patched May 13th

https://horizon3.ai/attack-research/attack-blogs/cve-2025-32756-low-rise-jeans-are-back-and-so-are-buffer-overflows/

Remote Prompt Injection in GitLab Duo Leads to Source Code Theft

An attacker may leave instructions (prompts) for GitLab Duo embedded in the source code. This could be used to exfiltrate source code and secrets or to inject malicious code into an application.

https://www.legitsecurity.com/blog/remote-prompt-injection-in-gitlab-duo

Resilient Secure Backup Connectivity for SMB/Home Users

Establishing resilient access to a home network via a second ISP may lead to unintended backdoors. Secure the access and make sure you have the visibility needed to detect abuse.

https://isc.sans.edu/diary/Resilient%20Secure%20Backup%20Connectivity%20for%20SMB%20Home%20Users/31972

BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory

An attacker with the ability to create service accounts may be able to manipulate these accounts to mark them as migrated accounts, inheriting all privileges the original account had access to.

https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory

Flaw in samlify That Opens Door to SAML Single Sign-On Bypass CVE-2025-47949

The samlify Node.js library does not verify SAML assertions correctly. It will consider the entire assertion valid, not just the original one. An attacker may use this to obtain additional privileges or authenticate as a different user

https://www.endorlabs.com/learn/cve-2025-47949-reveals-flaw-in-samlify-that-opens-door-to-saml-single-sign-on-bypass

New Variant of Crypto Confidence Scam

Scammers are offering login credentials for what appears to be high value crypto coin accounts. However, the goal is to trick users into paying for expensive VIP memberships to withdraw the money.

https://isc.sans.edu/diary/New%20Variant%20of%20Crypto%20Confidence%20Scam/31968

Malicious Chrome Extensions

Malicious Chrome extensions mimick popular services like VPNs to trick users into installing them. Once installed, the extensions will exfiltrate browser secrets

https://dti.domaintools.com/dual-function-malware-chrome-extensions/

Malicious VS Code Extensions

Malicious Visual Studio Code extensions target crypto developers to trick them into installing them to exfiltrate developer secrets.

https://securitylabs.datadoghq.com/articles/mut-9332-malicious-solidity-vscode-extensions/#indicators-of-compromise

Researchers Scanning the Internet

A newish RFC, RFC 9511, suggests researchers identify themselves by adding strings to the traffic they send, or by operating web servers on machines from which the scan originates. We do offer lists of researchers and just added three new groups today

https://isc.sans.edu/diary/Researchers%20Scanning%20the%20Internet/31964

Cloudy with a change of Hijacking: Forgotten DNS Records

Organizations do not always remove unused CNAME records. An attacker may take advantage of this if an attacker is able to take possession of the now unused public cloud resource the name pointed to.

https://blogs.infoblox.com/threat-intelligence/cloudy-with-a-chance-of-hijacking-forgotten-dns-records-enable-scam-actor/

Message signature verification can be spoofed CVE-2025-47934

A vulnerability in openpgp.js may be used to spoof message signatures. openpgp.js is a popular library in systems implementing end-to-end encrypted browser applications.

https://github.com/openpgpjs/openpgpjs/security/advisories/GHSA-8qff-qr5q-5pr8

RAT Dropped By Two Layers of AutoIT Code

Xavier explains how AutoIT was used to install a remote admin tool (RAT) and how to analyse such a tool

https://isc.sans.edu/diary/RAT%20Dropped%20By%20Two%20Layers%20of%20AutoIT%20Code/31960

RVTools compromise confirmed

Robware.net, the site behind the popular tool RVTools now confirmed that it was compromised. The site is currently offline.

https://www.robware.net/readMore

Trojaned Version of Keepass used to install info stealer and Cobalt Strike beacon

A backdoored version of KeePass was used to trick victims into installing Cobalt Strike and other malware. In this case, Keepass itself was not compromised and the malicious version was advertised via search engine optimization tricks

https://labs.withsecure.com/publications/keepass-trojanised-in-advanced-malware-campaign

Procolored UV Printer Software Compromised

The official software offered by the makers of the Procolored UV printer has been compromised, and versions with malware were distributed for about half a year.

https://www.hackster.io/news/the-maker-s-toolbox-procolored-v11-pro-dto-uv-printer-review-680d491e17e3

https://www.gdatasoftware.com/blog/2025/05/38200-printer-infected-software-downloads

xorsearch.py: Python Functions

Didier s xorsearch tool now supports python functions to filter output

https://isc.sans.edu/diary/xorsearch.py%3A%20Python%20Functions/31858

Pwn2Own Berlin 2025

Last weeks Pwn2Own contest in Berlin allowed researchers to demonstrate a number of new exploits with a large focus on privilege escalation and virtual machine escape.

https://www.zerodayinitiative.com/blog/2025/5/17/pwn2own-berlin-2025-day-three-results

Senior US Officials Impersonated in Malicious Messaging Campaign

The FBI warns of senior US officials being impersonated in text and voice messages.

https://www.ic3.gov/PSA/2025/PSA250515

Scattered Spider: TTP Evolution in 2025

Pushscurity provided an update on how Scattered Spider evolved. One thing they noted was that Scattered Spider takes advantage of legit dynamic domain name systems to make detection more difficult

https://pushsecurity.com/blog/scattered-spider-ttp-evolution-in-2025/

Web Scanning SonicWall for CVE-2021-20016 - Update

Scans for SonicWall increased by an order of magnitude over the last couple of weeks. Many of the attacks appear to originate from Global Host , a low-cost virtual hosting provider.

https://isc.sans.edu/diary/Web%20Scanning%20SonicWall%20for%20CVE-2021-20016%20-%20Update/31952

Google Update Patches Exploited Chrome Flaw

Google released an update for Chrome. The update fixes two specific flaws reported by external researchers, CVE-2025-4664 and CVE-2025-4609. The first flaw is already being exploited in the wild.

https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html

https://x.com/slonser_/status/1919439373986107814

RVTools Bumblebee Malware Attack

Zerodaylabs published its analysis of the RV-Tools Backdoor attack. It suggests that this may not be solely a search engine optimization campaign directing victims to the malicious installer, but that the RVTools distribution site was compromised.

https://zerodaylabs.net/rvtools-bumblebee-malware/

Operation RoundPress

ESET Security wrote up a report summarizing recent XSS attacks against open-source webmail systems

https://www.welivesecurity.com/en/eset-research/operation-roundpress/