Security. In focus.

Windows Server Flaw a Shortcut to Privilege Escalation

A newly identified, unpatched vulnerability in Windows Server 2025, dubbed “BadSuccessor” by Akamai researchers, presents a significant security risk. This flaw, found in the new delegated Managed Service Accounts (dMSA) feature, is described as “trivial” to exploit and can lead to privilege escalation and full domain compromise in Active Directory environments, even if dMSAs are not actively used. While Microsoft has assessed the exploit as “moderate severity” and plans a future update, Akamai urges organizations to proactively limit who can create dMSAs to mitigate this threat.

Credit Washing and Synthetic ID Fraud Hit All-Time High

Synthetic identity and credit washing fraud are escalating, hitting record highs. Fraudsters are adeptly fabricating identities and building convincing credit histories, ultimately vanishing with high-value loans, particularly devastating the auto loan sector which saw $2.1 billion in losses to fictitious identities. This surge, intensified by deceptive credit repair practices and advanced AI-driven fraud techniques, has led U.S. lenders to a staggering $3.2 billion loss from synthetic identity fraud by mid-2024, presenting a severe challenge to financial institutions and underscoring the blurring line between cybercrime and credit fraud.

Dragos Industrial Ransomware Analysis: Q1 2025 www.dragos.com/blog/drag…

Our recent blog highlighting the latest Dragos Knowledge Pack explored critical advancements in ransomware detection capabilities for the Dragos Platform, designed to help industrial organizations proactively defend against evolving cyber threats. These continuously updated detections are crucial, especially as ransomware incidents affecting critical and industrial infrastructure increase frequency and impact. Today’s ransomware threat actors demonstrate persistent targeting, deliberate operational impacts, and strategic approaches, underscoring the heightened risk posed to industrial organizations globally. This quarterly ransomware threat landscape report provides deeper insights into these ongoing threats, revealing significant trends, geographic impacts, and sector-specific vulnerabilities identified by Dragos WorldView threat intelligence.

Ransomware remains a persistent threat to industrial organizations, consistently disrupting critical operations and challenging the security of essential infrastructure. In Q1 2025, Dragos identified 708 ransomware incidents impacting industrial entities worldwide, representing an increase from approximately 600 incidents documented in Q4 2024. This rise underscores the escalating frequency and complexity of ransomware operations affecting sectors such as manufacturing, transportation, industrial control systems (ICS) equipment, and engineering. North America reported 413 incidents in Q1, up from 360 in the previous quarter. Europe also saw an uptick from 102 to 135 incidents.

Brand impersonation, online ads, and malicious merchants help purchase scam network prey on victims www.recordedfuture.com/blog/purc…

On April 19, 2025, Recorded Future® Payment Fraud Intelligence identified lidlorg[.]com as a likely purchase scam website that employs brand impersonation against a German international discount retailer. As of May 8, 2025, our analysis has linked lidlorg[.]com to a network of 71 likely purchase scam websites, including others that combine brand impersonation and online ad campaigns for propagation. All identified scam websites use one or more of twelve shared merchant accounts to process visitor transactions. All transactions with these merchant accounts are highly likely to be fraudulent and facilitate card compromise.

Purchase scams present financial fraud risks to card issuers and compliance risks to merchant acquirers, especially in cases where linked scam merchant accounts are also abused to support transaction laundering activity. To reduce these risks, card issuers should take action against identified merchant accounts and card accounts that have transacted with those merchants, while merchant acquirers should take action against the merchant accounts. We describe these mitigation strategies in detail in the Mitigations section of this report.

Dero miner zombies biting through Docker APIs to build a cryptojacking horde securelist.com/dero-mine…

Imagine a container zombie outbreak where a single infected container scans the internet for an exposed Docker API, and bites exploits it by creating new malicious containers and compromising the running ones, thus transforming them into new “zombies” that will mine for Dero currency and continue “biting” new victims. No command-and-control server is required for the delivery, just an exponentially growing number of victims that are automatically infecting new ones. That’s exactly what the new Dero mining campaign does.

During a recent compromise assessment project, we detected a number of running containers with malicious activities. Some of the containers were previously recognized, while others were not. After forensically analyzing the containers, we confirmed that a threat actor was able to gain initial access to a running containerized infrastructure by exploiting an insecurely published Docker API. This led to the running containers being compromised and new ones being created not only to hijack the victim’s resources for cryptocurrency mining but also to launch external attacks to propagate to other networks.

The entire attack vector is automated via two malware implants: the previously unknown propagation malware nginx and the Dero crypto miner. Both samples are written in Golang and packed with UPX.

BadSuccessor: Abusing dMSA to Escalate Privileges in Active Directory www.akamai.com/blog/secu…

Akamai researcher Yuval Gordon discovered a privilege escalation vulnerability in Windows Server 2025 that allows attackers to compromise any user in Active Directory (AD).

The attack exploits the delegated Managed Service Account (dMSA) feature that was introduced in Windows Server 2025, works with the default configuration, and is trivial to implement.

This issue likely affects most organizations that rely on AD. In 91% of the environments we examined, we found users outside the domain admins group that had the required permissions to perform this attack.

Although Microsoft states they plan to fix this issue in the future, a patch is not currently available. Therefore, organizations need to take other proactive measures to reduce their exposure to this attack. Microsoft has reviewed our findings and approved the publication of this information.

In this blog post, we provide full details of the attack, as well as detection and mitigation strategies.

Lumma infostealer’s infrastructure seized during US, EU, Microsoft operation therecord.media/lumma-inf…

Law enforcement agencies and cybersecurity firms coordinated a global takedown of the infrastructure of the Lumma malware — a powerful information-stealing tool used by cybercriminals to target dozens of industries.

Steven Masada, assistant general counsel at Microsoft’s Digital Crimes Unit, said in a blog post Wednesday that the malware, sometimes referred to as LummaC2, “steals passwords, credit cards, bank accounts, and cryptocurrency wallets and has enabled criminals to hold schools for ransom, empty bank accounts, and disrupt critical services.”

In a briefing with reporters on Wednesday, FBI officials said they have been investigating Lumma since September 2023 and have since found around 10 million infections. The FBI has tracked thousands of paying Lumma customers, with $250, $500 and $1,000 monthly subscription tiers available.

Microsoft said it identified more than 394,000 Windows computers infected with Lumma malware between March and May this year. The company worked with Europol, the U.S. and Japan on an operation disrupting Lumma’s technical infrastructure, effectively cutting off communications between the malicious tool and victims.

Asia Produces More APT Actors, as Focus Expands Globally www.darkreading.com/cyber-ris…

Advanced persistent threat (APT) actors aligned with China and North Korea now account for the majority of sophisticated attacks detected during the past two quarters, as tension in the Asia-Pacific region heats up and China increasingly flexes its muscle.

While the most significant growth in attacks from the two Asian nations have focused on European targets, the Southeast Asian region has seen increases in state-backed attacks as well, with government and educational organizations among the favorite targets, according to the biannual “APT Activity Report” published by cybersecurity firm ESET. The expansion in global activity comes as more regional players are developing their own capabilities in cyber offense, with India, Taiwan, and the Philippines all seeing more attacks but developing their own capabilities as well.

Governments in Asia Pacific are increasingly turning to the cyber domain to help them achieve national goals, says Robert Lipovsky, senior manager of malware research for ESET.

UK police looking at ‘range’ of potential perpetrators behind retail cyberattacks therecord.media/uk-retail…

Paul Foster, the head of the national cybercrime unit at Britain’s National Crime Agency (NCA), said the ongoing investigation into a spate of recent cyberattacks against the retail sector was considering “a range” of different perpetrators who could have been responsible.

Among these is an international threat group tracked as Scattered Spider, Foster acknowledged to BBC News, but he stressed the NCA was considering different hypotheses and was going to “follow the evidence to get to the offenders.”

The similarities between attacks previously attributed to Scattered Spider and a spate of incidents impacting British retailers Marks & Spencer, the Co-op and the London-based luxury store Harrods, have prompted speculation that the loosely-affiliated criminal subculture is involved, however there has not yet been a confident assessment from professionals that this is the case.

Google warned last week that while it suspected the attacks were “linked to UNC3944, also known as Scattered Spider,” it could not confirm whether they were part of the same criminal grouping.

EU sanctions target individuals, organizations behind Russia’s disinformation and sabotage operations therecord.media/eu-sancti…

The European Union has unveiled a new sanctions package targeting individuals and entities linked to Russia’s hybrid warfare efforts, including its disinformation, sabotage and espionage campaigns across Europe and Africa.

Among those sanctioned are members of the Russian military intelligence unit GRU, as well as individuals involved in promoting Kremlin narratives through social media campaigns. The EU also targeted companies providing critical support to these activities, including web hosting services and GPS jamming equipment.

The round of sanctions is part of a broader European strategy to counter Russia’s ongoing hybrid warfare activities, which have escalated since the start of the war in Ukraine. It also marks the second time the EU has targeted Russian disinformation networks.

One of the sanctioned disinformation networks, Prague-based Voice of Europe, is engaged in “media manipulation and distortion of facts” through its website and accounts on Facebook, YouTube, Telegram and X. The organization was secretly financed and directed by Viktor Medvedchuk, a pro-Russian Ukrainian politician and businessman with close ties to the Kremlin.

Another entity linked to Russian disinformation campaigns is the U.K.-based web hosting service provider Stark Industries, along with two Moldovan nationals operating it. According to previous reports, Stark Industries has become a central hub for large-scale cyberattacks and disinformation campaigns, including Kremlin-backed Doppelgänger. Its infrastructure is often used by Russian hacktivist groups and cybercriminals.

A familiar playbook with a twist: 3AM ransomware actors dropped virtual machine with vishing and Quick Assist news.sophos.com/en-us/202…

Ransomware is usually a crime of opportunity. Attackers typically strike through an easily-discovered vulnerability or security weakness— unpatched Internet-facing software, vulnerable network edge devices or exposed inbound virtual private network ports lacking multifactor authentication are among the most common points of initial compromise. However, some attacks appear much more targeted and include significant pre-attack reconnaissance and identification of specific organization employees as targets.

Sophos has been tracking multiple ransomware actors leveraging an attack pattern first reported by Microsoft in May 2024 in connection with the threat group designated Storm-1811: using “email bombing” to overload a targeted organization’s employee with unwanted emails, and then making a voice or video call over Microsoft Teams posing as a tech support team member to deceive that employee into allowing remote access to their computer. Between November 2024 and mid-January 2025, Sophos documented two distinct threat clusters using these techniques in over 15 incidents. Further hunting has found over 55 attempted attacks using this technique.

in the first quarter of 2025, Sophos Incident Response aided an organization targeted by attackers affiliated with the 3AM ransomware group. The pattern followed other email bombing attacks in many ways. But there were many aspects of the attack that made it stand apart from previous Teams “vishing” incidents connected to the two threat clusters Sophos had previously associated with these tactics.

In this case, the attacker used a phone call that spoofed the phone number of organization’s IT department. The attack included deployment of a virtual machine to a compromised computer, providing the attackers with an initial foothold hidden from the view of endpoint protection software. The ransomware attack itself was thwarted, but the attackers were able to stay on the network for 9 days before attempting to launch ransomware. They succeeded in stealing data from the targeted organization’s network.

‘Ongoing’ Ivanti hijack bug exploitation reaches clouds www.theregister.com/2025/05/2…

The “ongoing exploitation” of two Ivanti bugs has now extended beyond on-premises environments and hit customers' cloud instances, according to security shop Wiz.

CVE-2025-4427 is an authenticated bypass vulnerability and CVE-2025-4428 is a post-authentication remote-code execution (RCE) flaw. Together they allow a miscreant to run malware on a vulnerable deployment and hijack it. Both holes affect Ivanti Endpoint Manager Mobile (EPMM), on-premises software used to manage company-issued devices and applications and secure access to sensitive corporate data.

According to the vendor, the flaws are not present in Ivanti Neurons for MDM, Ivanti’s cloud-based version. “We cannot comment on unverified third party research and that our security advisory contains the latest facts,” an Ivanti spokesperson told The Register.

Wiz researchers, however, say otherwise. “We can confirm that the incident we found was on cloud hosted virtual appliances and not an on-prem device,” Gili Tikochinski, malware researcher at Wiz, told The Register. “This doesn’t mean that the attacker explicitly targeted cloud environments because from an outside network perspective it is hard to differentiate the two deployment options but it does mean that both cloud and on-prem customers are at risk.”

Decommissioning assets www.ncsc.gov.uk/guidance/…

This guidance describes why it’s important for organisations to decommission digital assets, and how to do so securely. It’s aimed at technical staff and risk owners. For advice dealing specifically with decommissioning hardware, please refer to our guidance on discontinuing obsolete products or network devices.

Decommissioning involves retiring digital assets - such as data, software, or hardware - from operation. It is a critical phase in the lifecycle of any asset. Decommissioning can be highly expensive and complex, with potentially severe repercussions if not executed properly.

Outdated or unsupported assets can pose an unacceptable risk to the organisation. As the NCSC guidance on asset management explains, assets that are no longer required become liabilities because they can open up vulnerabilities or expose information. Decommissioning helps to reduce unnecessary risks.

Dutch government passes law to criminalize cyber-espionage therecord.media/netherlan…

The Dutch government has approved a law criminalizing a broader range of espionage activities, including digital espionage, in an effort to protect national security, critical infrastructure and sensitive technologies.

The new legislation, passed over the weekend, extends existing espionage laws that already make it a criminal offense to share state secrets. Under the updated law, leaking sensitive information that is not classified as a state secret or engaging in activities on behalf of a foreign government that harm Dutch interests can also result in criminal charges.

The rise of cyber-espionage also has prompted the government to introduce harsher penalties for computer-related offenses. Offenders could face up to eight years in prison, with the possibility of a 12-year sentence in extreme cases.

Windows 11’s most important new feature is post-quantum cryptography. Here’s why. arstechnica.com/security/…

Microsoft is updating Windows 11 with a set of new encryption algorithms that can withstand future attacks from quantum computers in a move aimed at jump-starting what’s likely to be the most formidable and important technology transition in modern history.

Computers that are based on the physics of quantum mechanics don’t yet exist outside of sophisticated labs, but it’s well-established science that they eventually will. Instead of processing data in the binary state of zeros and ones, quantum computers run on qubits, which encompass myriad states all at once. This new capability promises to bring about new discoveries of unprecedented scale in a host of fields, including metallurgy, chemistry, drug discovery, and financial modeling.

One of the most disruptive changes quantum computing will bring is the breaking of some of the most common forms of encryption, specifically, the RSA cryptosystem and those based on elliptic curves.

At Microsoft’s BUILD 2025 conference on Monday, the company announced the availability of quantum-resistant algorithms to SymCrypt, the core cryptographic code library in Windows. The updated library is available in Build 27852 and higher versions of Windows 11. Additionally, Microsoft has updated SymCrypt-OpenSSL, its open source project that allows the widely used OpenSSL library to use SymCrypt for cryptographic operations.

Threat Analysis: Malicious NPM Package Leveraged in O365 Phishing Attack www.fortra.com/blog/thre…

In early April 2025, a novel and sophisticated phishing attempt targeting our clients was identified by Fortra’s Suspicious Email Analysis (SEA) team. The threat actor’s main goal was to harvest Microsoft O365 credentials. While phishing attacks are not new, nor a rare occurrence, the approach employed in this case is notable due to its complexity and creative use of modern technologies, including the linking of an .htm file, use of AES, calling to a well-known Content Delivery Network (CDN) and a npm package containing the malicious code. All of these tactics have been observed before, however this is the first time Fortra has documented them being used together to deliver a Microsoft O365 phish. While the effectiveness of this campaign remains to be seen, the combining of these tactics is clearly an attempt to target unsuspecting victims where they may be vulnerable.

The abuse of open-source repositories, such as npm, has been well documented and is known to pose a significant threat to organizations. These tactics have allowed threat actors to not only deliver malware but also conduct supply chain attacks and now leverage them to deliver phishing URLs.

Duping Cloud Functions: An emerging serverless attack vector blog.talosintelligence.com/duping-cl…

Google Cloud Platform (GCP) Cloud Functions are event-triggered, serverless functions that automatically scale and execute code in response to specific events like Hypertext Transfer Protocol (HTTP) requests or data changes. Tenable Research published an article discussing a vulnerability they discovered within GCP’s Cloud Functions serverless compute service and its Cloud Build continuous integration and continuous delivery or deployment (CI/CD) pipeline service.

“When a GCP user creates or updates a Cloud Function, a multi-step backend process is triggered,” Tenable author Liv Matan writes. “This process, among other things, attaches a default Cloud Build service account to the Cloud Build instance that is created as part of the function’s deployment.” This default Cloud Build Service Account (SA) previously gave users excessive Cloud Function permissions. An attacker who has gained the ability to create or update a cloud function could utilize the function’s deployment process to escalate privileges to the default Cloud Build service account or assign a higher privileged SA. Google has since partially addressed Tenable’s discovery to ensure the default Cloud Build service account no longer provides users with excessive permissions.

Based on Tenable’s research, Cisco Talos conducted a series of offensive tests within Cisco’s Google Cloud Platform (GCP) to identify additional threats that may affect customer environments.

During its research, Talos discovered that the technique Tenable identified could be adapted to perform other malicious activities. By implementing different malicious console commands into the Node Package Manager (NPM) ‘package.json’ file used in this technique, threat actors could execute behaviors such as environment enumeration.

The Sting of Fake Kling: Facebook Malvertising Lures Victims to Fake AI Generation Website research.checkpoint.com/2025/impe…

In early 2025, Check Point Research (cp) started tracking a threat campaign that abuses the growing popularity of AI content generation platforms by impersonating Kling AI, a legitimate AI-powered image and video synthesis tool. Promoted through Facebook advertisements, the campaign directs users to a convincing spoof of Kling AI’s website, where visitors are invited to create AI-generated images or videos directly in the browser.

Instead of delivering a media file, the site offers a malicious “image or video output” for download. These files carry extensions like .mp4 or .jpg but in reality are disguised Windows executables using double extensions and Hangul Filler characters to obscure their true nature in the filesystem and file dialogs.

Users expecting to preview their generated video instead unknowingly launched a loader. In several instances, this executable utilized .NET Native AOT (Ahead-Of-Time) Compilation to complicate analysis and evade many traditional detection techniques. Once executed, the loader staged and deployed follow-up payloads—primarily infostealers to exfiltrate browser-stored credentials, session tokens, and other sensitive data.

In our report, we detail the campaign’s end-to-end kill chain—from the initial lure to payload execution—and focus on the technical mechanisms used for file masquerading, obfuscation, and staged delivery. We analyze the loader’s internals and behavioral footprint and highlight the evolving techniques used to exploit trust in generative AI workflows.

100+ Fake Chrome Extensions Found Hijacking Sessions, Stealing Credentials, Injecting Ads thehackernews.com/2025/05/1…

An unknown threat actor has been attributed to creating several malicious Chrome Browser extensions since February 2024 that masquerade as seemingly benign utilities but incorporate covert functionality to exfiltrate data, receive commands, and execute arbitrary code.

“The actor creates websites that masquerade as legitimate services, productivity tools, ad and media creation or analysis assistants, VPN services, crypto, banking and more to direct users to install corresponding malicious extensions on Google’s Chrome Web Store (CWS),” the DomainTools Intelligence (DTI) team said in a report shared with The Hacker News.

While the browser add-ons appear to offer the advertised features, they also enable credential and cookie theft, session hijacking, ad injection, malicious redirects, traffic manipulation, and phishing via DOM manipulation.

Another factor that works in the extensions' favor is that they are configured to grant themselves excessive permissions via the manifest.json file, allowing them to interact with every site visited on the browser, execute arbitrary code retrieved from an attacker-controlled domain, perform malicious redirects, and even inject ads.

Freshly discovered bug in OpenPGP.js undermines whole point of encrypted comms www.theregister.com/2025/05/2…

Security researchers are sounding the alarm over a fresh flaw in the JavaScript implementation of OpenPGP (OpenPGP.js) that allows both signed and encrypted messages to be spoofed.

Discovered by Codean Labs' Edoardo Geraci and Thomas Rinsma, the vulnerability essentially undermines the core purpose of using public key cryptography to secure communications.

Tracked as CVE-2025-47934 (8.7 – high), the vulnerability stems from the openpgp.verify and openpgp.decrypt functions. The advisory posted to the library’s GitHub repo states that a maliciously modified message can be passed to one of these functions and return a result indicating a valid signature without actually being signed.

The researchers said a full write-up of the vulnerability, complete with a proof of concept (PoC) exploit, is “coming soon.” It’s common practice to delay disclosing PoCs to allow users time to patch affected products.

Fake KeePass password manager leads to ESXi ransomware attack www.bleepingcomputer.com/news/secu…

Threat actors have been distributing trojanized versions of the KeePass password manager for at least eight months to install Cobalt Strike beacons, steal credentials, and ultimately, deploy ransomware on the breached network.

WithSecure’s Threat Intelligence team discovered the campaign after they were brought in to investigate a ransomware attack. The researchers found that the attack started with a malicious KeePass installer promoted through Bing advertisements that promoted fake software sites.

As KeePass is open source, the threat actors altered the source code to build a trojanized version, dubbed KeeLoader, that contains all the normal password management functionality. However, it includes modifications that install a Cobalt Strike beacon and export the KeePass password database as cleartext, which is then stolen through the beacon.

WithSecure says that the Cobalt Strike watermarks used in this campaign are linked to an initial access broker (IAB) that is believed to be associated with Black Basta ransomware attacks in the past.

Major Russian state services disrupted, reportedly due to cyberattack therecord.media/major-rus…

Access to several major Russian state services was disrupted on Tuesday, reportedly due to a distributed denial-of-service (DDoS) attack “originating from abroad.”

As of the time of writing, outage monitoring site Downdetector showed ongoing disruptions to Russia’s tax service (FNS), as well as services for managing secure digital keys (Goskey) and documents (Saby), among others.

Saby and FNS confirmed that the outages were caused by a large-scale DDoS attack from abroad and said they are working to restore access to their systems.

Russian businesses also reported being unable to access a government service that controls the distribution and sale of alcoholic beverages, as well as the system that tracks the production of certain goods to prevent counterfeiting.

Ransomware attack on food distributor spells more pain for UK supermarkets www.theregister.com/2025/05/2…

It’s more bad news for UK supermarkets with chilled and frozen food distribution business Peter Green Chilled confirming a ransomware attack with customers.

According to UK public broadcaster the BBC, which saw emails to the customers, the ransomware attack took hold on May 14 and by the following day customers were informed via email.

Managing director Tom Binks said “the transport activities of the business” were continuing to run unchanged, although at the time of the emails sent on May 15, the company had said it wouldn’t be processing new orders on that day.

The logistics provider said it would not be making any further comments about the attack itself.

Red Hat has officially released Red Hat Enterprise Linux 10, introducing major enhancements across AI, security, and containerization. The standout feature is Lightspeed, an AI assistant embedded in the command line to provide real-time support. Security updates include early support for post-quantum cryptography, a new sudo system role, and OpenSSH 9.9. Containers take centre stage with a new image-based architecture and streamlined tooling. Other upgrades include improved installer defaults, updated developer tools and packages, expanded system roles, and a revamped web console. RHEL 10 is now available via the Red Hat Customer Portal and the Red Hat Developer Program.

betanews.com/2025/05/2…

REcollapse is a helper tool for black-box regex fuzzing to bypass validations and discover normalizations in web applications.

It can also be helpful to bypass WAFs and weak vulnerability mitigations.

github.com/0xacb/rec…