Scattered Spider Related Domain Names

A quick demo of our domain feeds and how they can be used to find Scattered Spider related domains

https://isc.sans.edu/diary/Scattered+Spider+Related+Domain+Names/32162

Excel External Workbook Links to Blocked File Types Will Be Disabled by Default

Excel will discontinue allowing links to dangerous file types starting as early as October.

https://support.microsoft.com/en-us/topic/external-workbook-links-to-blocked-file-types-will-be-disabled-by-default-6dd12903-0592-463d-9e68-0741cf62ee58

CISA Releases Thorium

CISA announced that it released its malware analysis platform, Thorium, as open-source software.

https://www.cisa.gov/news-events/alerts/2025/07/31/thorium-platform-public-availability

Securing Firebase: Lessons Re-Learned from the Tea Breach

Inspried by the breach of the Tea app, Brendon Evans recorded a video to inform of Firebase security issues

https://isc.sans.edu/diary/Securing%20Firebase%3A%20Lessons%20Re-Learned%20from%20the%20Tea%20Breach/32158

WebKit Vulnerability Exploited before Apple Patch

A WebKit vulnerablity patched by Apple yesterday has already been exploited in Google Chrome. Google noted the exploit with its patch for the same vulnerability in Chrome.

https://nvd.nist.gov/vuln/detail/CVE-2025-6558

Scattered Spider Update

CISA released an update for its report on Scattered Spider, noting that the group also calls helpdesks impersonating users, not just the other way around.

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a

Apple Updates Everything: July 2025 Edition

Apple released updates for all of its operating systems patching 89 different vulnerabilities. Many vulnerabilities apply to multiple operating systems.

https://isc.sans.edu/diary/Apple%20Updates%20Everything%3A%20July%202025/32154

Python Triage

A quick python script by Xavier to efficiently search through files, even compressed once, for indicators of compromise.

https://isc.sans.edu/diary/Triage+is+Key+Python+to+the+Rescue/32152/

PaperCut Attacks

CISA added a 2024 Papercut vulnerability to the known exploited vulnerability list.

https://www.cisa.gov/news-events/alerts/2025/07/28/cisa-adds-three-known-exploited-vulnerabilities-catalog

Parasitic SharePoint Exploits

We are seeing attacks against SharePoint itself and attempts to exploit backdoors left behind by attackers.

https://isc.sans.edu/diary/Parasitic%20Sharepoint%20Exploits/32148

Cisco ISE Vulnerability Exploited

A recently patched vulnerability in Cisco ISE is now being exploited. The Zero Day Initiative has released a blog detailing the exploit chain to obtain code execution as an unauthenticated user.

https://www.zerodayinitiative.com/blog/2025/7/24/cve-2025-20281-cisco-ise-api-unauthenticated-remote-code-execution-vulnerability

MyAsus Vulnerablity

The MyAsus tool does not store its access tokens correctly, potentially providing an attacker with access to sensitive functions

https://www.asus.com/content/security-advisory/

Linux Namespaces

Linux namespaces can be used to control networking features on a process-by-process basis. This is useful when trying to present a different network environment to a process being analysed.

https://isc.sans.edu/diary/Sinkholing%20Suspicious%20Scripts%20or%20Executables%20on%20Linux/32144

Coyote in the Wild: First-Ever Malware That Abuses UI Automation

Akamai identified malware that takes advantage of Microsoft s UI Automation Framework to programatically interact with the user s system and steal credentials.

https://www.akamai.com/blog/security-research/active-exploitation-coyote-malware-first-ui-automation-abuse-in-the-wild

Testing REST APIs with Autoswagger

The tool Autoswagger can be used to automate the testing of REST APIs following the OpenAPI/Swagger standard.

https://github.com/intruder-io/autoswagger/

New File Integrity Tool: ficheck.py

Jim created a new tool, ficheck.py, that can be used to verify file integrity. It is a drop-in replacement for an older tool, fcheck, which was written in Perl and no longer functions well on modern Linux distributions.

https://isc.sans.edu/diary/New%20Tool%3A%20ficheck.py/32136

Mitel Vulnerability

Mitel released a patch for a vulnerability in its MX-ONE product. The authentication bypass could provide an attacker with user or even admin privileges.

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0009

SonicWall SMA 100 Vulnerability

SonicWall fixed an arbitrary file upload issue in its SMA 100 series firewalls. But exploitation will require credentials.

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0014

Reversing SharePoint Toolshell Exploits CVE-2025-53770 and CVE-2025-53771

A quick walk-through showing how to decode the payload of recent SharePoint exploits

https://isc.sans.edu/diary/Analyzing%20Sharepoint%20Exploits%20%28CVE-2025-53770%2C%20CVE-2025-53771%29/32138

Compromised JavaScript NPM is Package

The popular npm package is was compromised by malware. Luckily, the malicious code was found quickly, and it was reversed after about five hours.

https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack

Microsoft Quick Machine Recovery

Microsoft added a new quick machine recovery feature to Windows 11. If the system is stuck in a reboot loop, it will boot to a rescue partition and attempt to find fixes from Microsoft.

https://learn.microsoft.com/en-gb/windows/configuration/quick-machine-recovery/?tabs=intune

Microsoft Updates SharePoint Vulnerability Guidance CVE-2025-53770 and CVE-2025-53771

Microsoft released its update for SharePoint 2016, completing the updates across all currently supported versions.

https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

WinZip MotW Privacy

Starting with version 7.10, WinZip introduced an option to no longer include the download URL in zip files as part of the Mark of the Web (MotW).

https://isc.sans.edu/diary/WinRAR%20MoTW%20Propagation%20Privacy/32130

Interlock Ransomware

Several government agencies collaborated to create an informative and comprehensive overview of the Interlock ransomware. Just like prior writeups, this writeup is very informative, including many technical details useful to detect and block this ransomware.

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-203a

Sophos Firewall Updates

Sophos patched five different vulnerabilities in its firewalls. Two of them are critical, but these only affect a small percentage of users.

https://www.sophos.com/en-us/security-advisories/sophos-sa-20250721-sfos-rce

Microsoft Released Patches for SharePoint Vulnerability CVE-2025-53770 CVE-2025-53771

Microsoft released a patch for the currently exploited SharePoint vulnerability. It also added a second CVE number identifying the authentication bypass vulnerability.

https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/

How Quickly Are Systems Patched?

Jan took Shodan data to check how quickly recent vulnerabilities were patched. The quick answer: Not fast enough.

https://isc.sans.edu/diary/How%20quickly%20do%20we%20patch%3F%20A%20quick%20look%20from%20the%20global%20viewpoint/32126

HP Enterprise Instant On Access Points Vulnerability

HPE patched two vulnerabilities in its Instant On access points (aka Aruba). One allows for authentication bypass, while the second one enables arbitrary code execution as admin.

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04894en_us

Revealing the AppLocker Bypass Risks in The Suggested Block-list Policy

AppLocker sample policies suffer from a simple bug that may enable some rule bypass, but only if signatures are not enforced.

While reviewing Microsoft s suggested configuration, Varonis Threat Labs noticed a subtle but important issue: the MaximumFileVersion field was set to 65355 instead of the expected 65535.

https://www.varonis.com/blog/applocker-bypass-risks

Ghost Crypt Malware Leverages Zoho WorkDrive

The Ghost malware tricks users into downloading by sending links to Zoho WorkDrive locations.

https://www.esentire.com/blog/ghost-crypt-powers-purerat-with-hypnosis

SharePoint Servers Exploited via 0-day CVE-2025-53770

Late last week, CodeWhite found a new remote code execution exploit against SharePoint. This vulnerability is now actively exploited.

https://isc.sans.edu/diary/Critical+Sharepoint+0Day+Vulnerablity+Exploited+CVE202553770+ToolShell/32122/

Veeam Voicemail Phishing

Attackers appear to impersonate VEEAM in recent voicemail-themed phishing attempts.

https://isc.sans.edu/diary/Veeam%20Phishing%20via%20Wav%20File/32120

Passkey Phishing Attack

A currently active phishing attack takes advantage of the ability to use QR codes to complete the Passkey login procedure

https://expel.com/blog/poisonseed-downgrading-fido-key-authentications-to-fetch-user-accounts/