Scans for Ichano AtHome IP Cameras

A couple days ago, a few sources started scanning for the username super_yg and the password 123. This is associated with Ichano IP Camera software.

https://isc.sans.edu/diary/Scans%20for%20Ichano%20AtHome%20IP%20Cameras/32062

Critical Netscaler Security Update CVE-2025-5777

CVE 2025-5777 is a critical severity vulnerability impacting NetScaler Gateway, i.e. if NetScaler has been configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server.

https://www.netscaler.com/blog/news/critical-security-updates-for-netscaler-netscaler-gateway-and-netscaler-console/

WinRar Vulnerability CVE-2025-6218

WinRar may be tricked into extracting files into attacker-determined locations, possibly leading to remote code execution

https://www.win-rar.com/singlenewsview.html?&L=0&tx_ttnews%5Btt_news%5D=276&cHash=b5165454d983fc9717bc8748901a64f9

ADS & Python Tools

Didier explains how to use his tools cut-bytes.py and filescanner to extract information from alternate data streams.

https://isc.sans.edu/diary/ADS%20%26%20Python%20Tools/32058

Enhanced security defaults for Windows 365 Cloud PCs

Microsoft announced more secure default configurations for its Windows 365 Cloud PC offerings.

https://techcommunity.microsoft.com/blog/windows-itpro-blog/enhanced-security-defaults-for-windows-365-cloud-pcs/4424914

CVE-2025-34508: Another File Sharing Application, Another Path Traversal

Horizon3 reveals details of a recently patched directory traversal vulnerability in zend.to.

https://horizon3.ai/attack-research/attack-blogs/cve-2025-34508-another-file-sharing-application-another-path-traversal/

Unexpected security footguns in Go's parsers

Go parsers for JSON and XML are not always compatible and can parse data in unexpected ways. This blog by Trails of Bits goes over the various security implications of this behaviour.

https://blog.trailofbits.com/2025/06/17/unexpected-security-footguns-in-gos-parsers/

How Long Until the Phishing Starts? About Two Weeks

After setting up a Google Workspace and adding a new user, it took only two weeks for the new employee to receive somewhat targeted phishing emails.

https://isc.sans.edu/diary/How%20Long%20Until%20the%20Phishing%20Starts%3F%20About%20Two%20Weeks/32052

Scammers hijack websites of Bank of America, Netflix, Microsoft, and more to insert fake phone numbers

Scammers are placing Google ads that point to legitimate companies sites, but are injecting malicious text into the page advertising fake tech support numbers

https://www.malwarebytes.com/blog/news/2025/06/scammers-hijack-websites-of-bank-of-america-netflix-microsoft-and-more-to-insert-fake-phone-number

What s in an ASP? Creative Phishing Attack on Prominent Academics and Critics of Russia

Targeted attacks are tricking victims into creating app-specific passwords to Google resources.

https://cloud.google.com/blog/topics/threat-intelligence/creative-phishing-academics-critics-of-russia

Extracting Data From JPEGs

Didier shows how to efficiently extract data from JPEGs using his tool jpegdump.py

https://isc.sans.edu/diary/A%20JPEG%20With%20A%20Payload/32048

Windows Recall Export in Europe

In its latest insider build for Windows 11, Microsoft is testing an export feature for data stored by Recall. The feature is limited to European users and requires that you note an encryption key that will be displayed only once as Recall is enabled.

https://blogs.windows.com/windows-insider/2025/06/13/announcing-windows-11-insider-preview-build-26120-4441-beta-channel/

Anubis Ransomware Now Wipes Data

The Anubis ransomware, usually known for standard double extortion, is now also wiping data preventing any recovery even if you pay the ransom.

https://www.trendmicro.com/en_us/research/25/f/anubis-a-closer-look-at-an-emerging-ransomware.html

Mitel Vulnerabilities CVE-2025-47188

Mitel this week patched a critical path traversal vulnerability (sadly, no CVE), and Infoguard Labs published a PoC exploit for an older file upload vulnerability.

https://labs.infoguard.ch/posts/cve-2025-47188_mitel_phone_unauthenticated_rce/ https://www.mitel.com/support/mitel-product-security-advisory-misa-2025-0007

Katz Stealer in JPG

Xavier found some multistage malware that uses an Excel Spreadsheet and an HTA file to load an image that includes embeded a copy of Katz stealer.

https://isc.sans.edu/diary/More+Steganography/32044

https://unit42.paloaltonetworks.com/malicious-javascript-using-jsfiretruck-as-obfuscation/

JavaScript obfuscated with JSF*CK is being used on over 200,000 websites to direct victims to malware

Expired Discord Invite Links Used for Malware Distribution

Expired discord invite links are revived as vanity links to direct victims to malware sites

https://research.checkpoint.com/2025/from-trust-to-threat-hijacked-discord-invites-used-for-multi-stage-malware-delivery/

Automated Tools to Assist with DShield Honeypot Investigations

https://isc.sans.edu/diary/Automated%20Tools%20to%20Assist%20with%20DShield%20Honeypot%20Investigations%20%5BGuest%20Diary%5D/32038

EchoLeak: Zero-Click Microsoft 365 Copilot Data Leak

Microsoft fixed a vulnerability in Copilot that could have been abused to exfiltrate data from Copilot users. Copilot mishandled instructions an attacker included in documents inspected by Copilot and executed them.

https://www.aim.security/lp/aim-labs-echoleak-blogpost

Thunderbolt Vulnerability

Thunderbolt users may be tricked into downloading arbitrary files if an email includes a mailbox:/// URL.

https://www.mozilla.org/en-US/security/advisories/mfsa2025-49/

Quasar RAT Delivered Through Bat Files

Xavier is walking you through a quick reverse analysis of a script that will injection code extracted from a PNG image to implement a Quasar RAT.

https://isc.sans.edu/diary/Quasar%20RAT%20Delivered%20Through%20Bat%20Files/32036

Delayed Windows 11 24H2 Rollout

Microsoft slightly throttled the rollout of windows 11 24H2 due to issues stemming from the patch Tuesday fixes.

https://learn.microsoft.com/en-us/windows/release-health/windows-message-center#3570

An In-Depth Analysis of CVE-2025-33073

Patch Tuesday fixed an already exploited SMB client vulnerability. A blog by Synacktiv explains the nature of the issue and how to exploit it.

https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025

Connectwise Rotating Signing Certificates

Connectwise is rotating signing certificates after a recent compromise, and will release a new version of its Screen share software soon to harden its configuration.

https://www.connectwise.com/company/trust/advisories

KDE Telnet URL Vulnerablity

The Konsole delivered as part of KDE may be abused to execute arbitrary code via telnet URLs.

https://kde.org/info/security/advisory-20250609-1.txt

Microsoft Patch Tuesday

Microsoft today released patches for 67 vulnerabilities. 10 of these vulnerabilities are rated critical. One vulnerability has already been exploited and another vulnerability has been publicly disclosed before today.

https://isc.sans.edu/diary/Microsoft%20Patch%20Tuesday%20June%202025/32032

Adobe Vulnerabilities

Adobe released patches for 7 different applications. Two significant ones are Adobe Commerce and Adobe Acrobat Reader. All vulnerabilities patched for Adobe Commerce can only be exploited by an authenticated user. The Adobe Acrobat Reader vulnerabilities are exploited by a user opening a crafted PDF, and the exploit may execute arbitrary code.

https://helpx.adobe.com/security/Home.html

OctoSQL & Vulnerability Data

OctoSQL is a neat tool to query files in different formats using SQL. This can, for example, be used to query the JSON vulnerability files from CISA or NVD and create interesting joins between different files.

https://isc.sans.edu/diary/OctoSQL+Vulnerability+Data/32026

Mirai vs. Wazuh

The Mirai botnet has now been observed exploiting a vulnerability in the open-source EDR tool Wazuh.

https://www.akamai.com/blog/security-research/botnets-flaw-mirai-spreads-through-wazuh-vulnerability

DNS4EU

The European Union created its own public recursive resolver to offer a public resolver compliant with European privacy laws. This resolver is currently operated by ENISA, but the intent is to have a commercial entity operate and support it by a commercial entity.

https://www.joindns4.eu/

WordPress FAIR Package Manager

Recent legal issues around different WordPress-related entities have made it more difficult to maintain diverse sources of WordPress plugins. With WordPress plugins usually being responsible for many of the security issues, the Linux Foundation has come forward to support the FAIR Package Manager, a tool intended to simplify the management of WordPress packages.

https://github.com/fairpm

Extracting With pngdump.py

Didier extended his pngdump.py script to make it easier to extract additional data appended to the end of the image file.

https://isc.sans.edu/diary/Extracting%20With%20pngdump.py/32022

16 React Native Packages for GlueStack Backdoored Overnight

16 npm packages with over a million weekly downloads between them were compromised. The compromised packages include a remote admin tool that was seen before in similar attacks.

https://www.aikido.dev/blog/supply-chain-attack-on-react-native-aria-ecosystem

Atomic MacOS Stealer Exploits Clickfix

MacOS users are now also targeted by fake captchas, tricking users into running exploit code.

https://www.cloudsek.com/blog/amos-variant-distributed-via-clickfix-in-spectrum-themed-dynamic-delivery-campaign-by-russian-speaking-hackers

Microsoft INETPUB Script

Microsoft published a simple PowerShell script to restore the inetpub folder in case you removed it by mistake.

https://www.powershellgallery.com/packages/Set-InetpubFolderAcl/1.0