Netizen Blog and News

The Netizen team sharing expertise, insights and useful information in cybersecurity, compliance, and software assurance.

recent posts

about

  • LOLBins and Fileless Malware: Why Your Antivirus Isn’t Enough

    LOLBins and Fileless Malware: Why Your Antivirus Isn’t Enough

    Fileless malware and Living Off the Land Binaries (LOLBins) represent a class of adversarial tradecraft that relies on legitimate, signed system utilities to execute payloads, establish persistence, and exfiltrate data, all without writing detectable artifacts to disk. As signature-based detection continues to lose effectiveness, security teams must understand how these binaries are abused, how they operate in memory, and what telemetry is needed to detect them.

    Living off the Land (LOL): Definition and Scope

    Living off the land techniques exploit trusted binaries, scripts, and libraries that are either pre-installed on the system or placed there through administrative activity. These techniques offer three critical advantages to attackers:

    1. Execution under a trusted signature, which defeats basic application whitelisting and many antivirus heuristics.
    2. In-memory persistence, reducing forensic visibility.
    3. Process masquerading, blending into baseline administrative or user activity.

    LOLBins (binaries), LOLLibs (DLLs), and LOLScripts (scripting engines such as PowerShell or WSH) serve different roles in the attack chain. A binary like mshta.exe, for instance, can be used to load malicious JavaScript or VBScript remotely over HTTP. Others, like rundll32.exe, can be leveraged to execute shellcode from memory or invoke exported DLL functions.

    For a tool to qualify as a LOLBin, it must meet the following criteria:

    • Be signed or native to the OS.
    • Contain unintended behavior exploitable for malicious purposes.
    • Provide execution, lateral movement, persistence, or reconnaissance capability.

    Transition from Post-Exploitation to Initial Access

    Historically, LOL techniques were primarily used in post-exploitation stages, once the attacker had shell access and was enumerating the environment. Today, threat actors are embedding LOLBin abuse in their initial access payloads, making detection more difficult from the onset.

    TA505, for example, used phishing emails in 2018 to deliver macros that launched msiexec.exe to download and execute payloads via remote MSI packages. By chaining LOLBins, the attackers bypassed common endpoint protections and maintained execution entirely under signed binaries.

    Fileless Malware: Operation in Memory

    Fileless malware operates within volatile memory, avoiding persistent installation. The attacker’s payload may be stored in registry keys (regsvr32), loaded through WMI Event Consumers, or delivered directly via PowerShell Remoting or Invoke-Expression. This approach leaves few if any artifacts on disk—meaning no hashes to identify, no static binaries to reverse-engineer, and no easily acquired IOCs.

    Frodo, Code Red, and SQL Slammer were early examples. These worms relied on buffer overflows to directly manipulate memory and inject code, bypassing the need for traditional file-based payloads. In the modern landscape, similar approaches are now packaged into APT toolkits.

    Detection and Mitigation Strategies

    1. Event-Level Logging

    Enable command-line logging via Windows Event ID 4688 and Script Block Logging for PowerShell. Include WMI logging (Event ID 5858) and track usage of known LOLBins such as:

    • certutil.exe
    • mshta.exe
    • regsvr32.exe
    • rundll32.exe
    • wmic.exe
    • msiexec.exe
      Monitor child processes spawned from explorer.exe, svchost.exe, and service host binaries.

    2. Application Control

    Deploy AppLocker or Windows Defender Application Control (WDAC) with explicit deny rules for non-administrative invocation of LOLBins. Use publisher-based rules instead of file-path rules when possible.

    3. Behavioral Detection

    Deploy EDR platforms that support process tree analysis and memory-based detection. Flag unusual execution flows (e.g., wmic.exe spawning powershell.exe, or explorer.exe launching certutil.exe).

    4. Least Privilege and JEA

    Use Just Enough Administration (JEA) to restrict PowerShell capabilities based on role and context. Configure constrained language mode in environments where PowerShell is needed but should not have full scripting capabilities.

    5. Memory Forensics

    Implement YARA rules and live memory scanning to detect known shellcode injection techniques and malicious memory sections. Look for reflective DLL loading or abnormal use of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.

    Final Thoughts

    LOLBins are not inherently malicious, they’re system tools built for administration. But when co-opted by attackers, they become a potent way to stay under the radar. Their use in fileless malware campaigns has blurred the line between legitimate system behavior and adversarial activity. Traditional detection mechanisms focused on files and signatures are no longer sufficient.

    Security teams must pivot to detection strategies that account for context, command-line telemetry, and memory artifacts. Fileless attacks are not a niche tactic, they’re now a preferred method of intrusion and should be treated as such in any serious detection strategy.

    How Can Netizen Help?

    Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

    Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

    Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

    Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

  • Netizen: Monday Security Brief (8/4/2024)

    Netizen: Monday Security Brief (8/4/2024)

    Today’s Topics:

    • New Linux ‘Plague’ PAM Backdoor Enables Silent SSH Credential Theft
    • Akira Ransomware Exploits SonicWall VPNs in Likely Zero-Day Attacks
    • How can Netizen help?

    New Linux ‘Plague’ PAM Backdoor Enables Silent SSH Credential Theft

    Security researchers have identified a previously undocumented Linux backdoor called Plague, which leverages the Pluggable Authentication Module (PAM) framework to silently compromise systems and maintain persistent access. According to research from Nextron Systems, the malware has remained undetected for nearly a year, highlighting the growing sophistication of Linux-targeted threats.

    Pluggable Authentication Modules are core components of Linux and UNIX-based authentication systems, handling user logins and authentication requests for services such as SSH. By embedding itself as a malicious PAM module, Plague can:

    • Bypass authentication checks and allow attackers to log in without valid credentials
    • Silently steal user credentials during legitimate login attempts
    • Maintain persistent SSH access without triggering standard monitoring tools

    Because PAM modules operate with elevated privileges and integrate directly into the authentication stack, a rogue module like Plague can operate without leaving typical forensic artifacts.

    Researchers discovered several Plague samples uploaded to VirusTotal since July 29, 2024, none of which were flagged as malicious. This suggests both active development and effective evasion techniques. The malware demonstrates a strong focus on stealth through several key behaviors:

    1. Static credentials for covert access that allow attackers to log in without leaving a standard audit trail
    2. Anti-debugging and obfuscation to resist reverse engineering and analysis
    3. Audit trail wiping by unsetting environment variables like SSH_CONNECTION and SSH_CLIENT and redirecting HISTFILE to /dev/null to prevent shell command logging
    4. Persistence through system updates by integrating deeply into the authentication stack

    As researcher Pierre-Henri Pezier noted, this combination of obfuscation, environment tampering, and deep integration makes Plague exceptionally hard to detect using traditional Linux security tools.

    Plague represents a high-risk threat to organizations relying on Linux servers for critical applications, including web hosting, finance, and cloud environments. PAM-based implants allow attackers to establish long-term footholds, conduct credential theft, and potentially escalate attacks into broader supply chain compromises.

    While attribution remains unknown, the discovery of multiple variants indicates an ongoing campaign or the active testing of new features by threat actors.

    To defend against backdoors like Plague, organizations should adopt enhanced Linux security monitoring and forensic readiness:

    • Monitor for unauthorized PAM modules in /lib/security or equivalent directories
    • Audit system logs for unexpected SSH access patterns or disabled history logging
    • Deploy host-based intrusion detection with a focus on file integrity monitoring for authentication-related libraries
    • Conduct regular memory and file system scans using YARA rules for Linux-specific malware
    • Enforce principle of least privilege and multi-factor authentication for all SSH access to reduce the impact of credential theft

    Akira Ransomware Exploits SonicWall VPNs in Likely Zero-Day Attacks

    Security researchers have observed a spike in Akira ransomware campaigns targeting SonicWall SSL VPN appliances, with evidence suggesting the possible use of a zero-day vulnerability. The activity, first noted in mid-July 2025, has impacted even fully-patched devices, raising significant concerns for organizations relying on SonicWall for remote access.

    According to Arctic Wolf Labs, the intrusions involve multiple pre-ransomware compromises executed in rapid succession, all of which leveraged VPN access through SonicWall SSL VPNs. Researcher Julian Tuin reported that in the reviewed cases, a very short interval separated the initial VPN login from the onset of ransomware encryption.

    The company’s analysis indicates that the attacks may exploit an as-yet-undisclosed flaw in SonicWall appliances, although credential-based compromises have not been ruled out. Evidence of malicious VPN activity dates as far back as October 2024, pointing to a sustained campaign against these devices.

    One notable characteristic of these intrusions is the difference in VPN login behavior compared to legitimate users. While authorized logins typically originate from broadband ISP networks, ransomware operators often authenticate through Virtual Private Server (VPS) hosting environments to disguise their activity and facilitate automated lateral movement.

    Akira ransomware, first observed in March 2023, has become a prominent threat actor in the global ransomware ecosystem. By early 2024, it was credited with generating approximately $42 million in illicit profits from over 250 victims.

    Check Point’s recent statistics show that Akira was the second most active ransomware group in Q2 2025, behind Qilin, claiming 143 victims in that quarter. Analysts also note that Akira maintains a regional focus on Italian enterprises, with 10% of its observed victims based in Italy, compared to 3% in the general ransomware landscape.

    Given the high likelihood that the SonicWall attacks involve an unpatched zero-day vulnerability, organizations are urged to take immediate defensive measures:

    • Consider temporarily disabling the SonicWall SSL VPN service until a patch or official mitigation is released
    • Enforce multi-factor authentication (MFA) for all remote access to limit the impact of credential theft
    • Remove unused or inactive local firewall user accounts to reduce potential attack vectors
    • Maintain strong password hygiene and monitor VPN access logs for anomalous patterns

    Until a vendor fix becomes available, treating these appliances as potentially exposed is prudent for reducing the risk of Akira ransomware intrusions.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

  • Netizen Cybersecurity Bulletin (July 31th, 2025)

    Netizen Cybersecurity Bulletin (July 31th, 2025)

    Overview:

    • Phish Tale of the Week
    • UNC2891 Targets ATM Networks Using 4G-Enabled Raspberry Pi and CAKETAP Rootkit
    • Apple Patches Safari Vulnerability Also Exploited as Chrome Zero-Day
    • How can Netizen help?

    Phish Tale of the Week

    Often times phishing campaigns, created by malicious actors, target users by utilizing social engineering. For example, in this text message, the actors are appearing as Royal Mail, a courier service, and informing you that action needs to be taken regarding your package’s delivery. The message politely explains that “RoyalMail” is holding our parcel at the nearest PO Depot, and that we just need to rearrange a delivery in order to receive it. It seems both urgent and genuine, so why shouldn’t we visit the link they sent us? Luckily, there’s plenty of reasons that point to this being a scam.

    Here’s how we can tell not to click on this smishing link:

    1. The first warning sign for this SMS is the fact that it includes a URL in the message. Typically, companies will send notifications like this through SMS, but they’ll end with a call to action within an already trusted environment, for example the statement “check your tracking details for more information.” Always be sure to think twice and check “urgent” statuses like this one through a trusted environment, and never click on links sent through an SMS from an unknown number.
    2. The second warning signs in this text is the messaging. This message tries to create a sense of urgency and get you to take action by using language such as “is being held” and “Please visit.” Phishing scams commonly attempt to create a sense of urgency in their messages in order to get you to click their link without thinking about it first. Always be sure to thoroughly inspect the style and tone of all texts before following a link sent through SMS.
    3. The final warning sign for this email is the style of the link. After a quick look at the address, one can quickly deduce that we’ve been sent a phishing link. Trusted companies like Royal Mail typically will use a simple, standardized domain as their website. For example, Royal Mail’s official website is simply “royalmail.com.” Threat actors typically will utilize message-related words in the links they send you. After taking one quick look at the URL, “post.office-costs.com,” it’s very obvious that this email is an attempt at a smish.


    General Recommendations:

    A smishing attack will typically direct the user to click on a link where they will then be prompted to update personal information, such as a password, credit card, social security, or bank account information. A legitimate company already has this sensitive information and would not ask for it again, especially via your text messages. 

    1. Scrutinize your messages before clicking anything. Have you ordered anything recently? Does this order number match the one I already have? Did the message come from a store you don’t usually order supplies from or a service you don’t use? If so, it’s probably a phishing attempt.
    2. Verify that the sender is actually from the company sending the message.
    3. Did you receive a message from someone you don’t recognize? Are they asking you to sign into a website to give Personally Identifiable Information (PII) such as credit card numbers, social security number, etc. A legitimate company will never ask for PII via instant message or email.
    4. Do not give out personal or company information over the internet.
    5. Do not click on unrecognized links or attachments. If you do proceed, verify that the URL is the correct one for the company/service and it has the proper security in place, such as HTTPS.

    Many smishing messages pose a sense of urgency or even aggressiveness to prompt a form of intimidation. Any SMS requesting immediate action should be vetted thoroughly to determine whether or not it is a scam. Also, beware of messages that seek to tempt users into opening an attachment or visiting a link. For example, “Fix your account now” may draw the question “What is wrong with my account?” and prompt you to click a suspicious link.

    Cybersecurity Brief

    In this month’s Cybersecurity Brief:

    UNC2891 Targets ATM Networks Using 4G-Enabled Raspberry Pi and CAKETAP Rootkit

    A financially motivated threat group tracked as UNC2891 has been linked to a sophisticated cyber-physical intrusion targeting ATM infrastructure, using a 4G-connected Raspberry Pi to gain covert access to a bank’s internal network.

    According to a recent report by Group-IB, the attackers physically installed a Raspberry Pi equipped with a 4G modem directly onto the same network switch as an ATM, effectively bypassing external perimeter defenses. It remains unclear how the attacker gained the physical access required to deploy the device.

    Once connected, the device initiated outbound communication over mobile data, evading traditional network monitoring. The command-and-control (C2) channel was established using a TINYSHELL backdoor that communicated via a Dynamic DNS (DDNS) domain, enabling persistent remote access to the ATM network.

    UNC2891, first profiled by Mandiant in 2022, has a history of targeting ATM switching networks to enable fraudulent cash withdrawals using counterfeit cards. At the center of this campaign is a Linux kernel rootkit named CAKETAP, which is capable of:

    • Hiding active network connections, processes, and filesystem entries
    • Intercepting and spoofing card and PIN verification messages from Hardware Security Modules (HSMs)
    • Facilitating unauthorized transactions through ATM networks

    The group demonstrates deep familiarity with Unix and Linux-based environments and has been observed using advanced evasion techniques.

    During the investigation, Group-IB uncovered additional persistence mechanisms inside the compromised network. A custom backdoor named lightdm was discovered on a network monitoring server, providing a secondary access path to both the compromised Raspberry Pi and an internal mail server.

    The attacker also abused bind mounts to mask the presence of malicious processes, a technique that complicates detection by traditional process monitoring tools.

    Although the CAKETAP rootkit was not fully deployed, the infrastructure and tooling were consistent with UNC2891’s previous operations. The campaign was reportedly disrupted before financial losses occurred, though the group retained internal access even after the Raspberry Pi was discovered and removed. Persistence was maintained through the mail server backdoor, which continued communicating with a DDNS-based C2 infrastructure.

    Group-IB notes operational similarities between UNC2891 and another known actor, UNC1945 (also referred to as LightBasin), particularly in their targeting of financial institutions and use of Unix-based malware. Both groups have demonstrated capabilities in compromising managed service providers (MSPs) and internal banking infrastructure.

    To read more about this article, click here.

    Apple Patches Safari Vulnerability Also Exploited as Chrome Zero-Day

    Apple has issued a security update for its major platforms to address a critical browser vulnerability, CVE-2025-6558, which has been exploited in the wild as a zero-day in Google Chrome earlier this month.

    The vulnerability, identified as CVE-2025-6558 with a CVSS score of 8.8, stems from improper validation of untrusted input within the ANGLE and GPU components of web browsers. According to Google’s Threat Analysis Group (TAG), this flaw can be triggered through a maliciously crafted HTML page, potentially allowing attackers to escape the browser sandbox.

    Google confirmed that the vulnerability was actively exploited and credited researchers Clément Lecigne and Vlad Stolyarov of TAG with the discovery. Although detailed exploitation methods remain undisclosed, the flaw poses a real threat across both Chromium-based and WebKit-based browsers.

    In line with Google’s disclosure, Apple acknowledged that WebKit, the core engine behind the Safari browser, is also affected. The company noted that the vulnerability could cause unexpected crashes when processing malicious web content.

    Apple classified the issue as stemming from open-source code shared across projects and promptly released patches as part of its July 30 security updates.

    Apple’s updates mitigate CVE-2025-6558 across a wide range of hardware:

    • iOS 18.6 / iPadOS 18.6: Affects iPhone XS and later, iPad Pro (13″, 12.9″ 3rd gen+, 11″), iPad Air 3rd gen+, iPad 7th gen+, and iPad mini 5th gen+
    • iPadOS 17.7.9: Patches for iPad Pro 12.9″ (2nd gen), 10.5″, and iPad 6th gen
    • macOS Sequoia 15.6: Applies to all Macs running Sequoia
    • tvOS 18.6: Affects all models of Apple TV HD and Apple TV 4K
    • watchOS 11.6: Available for Apple Watch Series 6 and newer
    • visionOS 2.6: Issued for Apple Vision Pro

    As of now, there are no confirmed reports of this vulnerability being exploited against Apple users directly. However, given that CVE-2025-6558 has already been abused in Chrome, its presence in Safari and other Apple platforms raises concern, especially for users who haven’t yet applied the update.

    All Apple users are strongly encouraged to update to the latest versions of their operating systems. Keeping software current remains one of the most effective ways to defend against browser-based zero-days and WebKit exploitation tactics.

    For IT security teams and CISOs, monitoring for browser patch status across endpoints is advisable, especially within environments where both Google Chrome and Apple Safari are used.

    To read more about this article, click here.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

  • Scattered Spider Ramps Up Targeted Attacks: What Security Teams Need to Know

    Scattered Spider Ramps Up Targeted Attacks: What Security Teams Need to Know

    A recent update from the FBI, CISA, NCSC-UK, and allied cybersecurity agencies has revealed new techniques used by the threat actor known as Scattered Spider. The advisory, originally published in late 2023 and revised on July 29, 2025, outlines a series of campaigns that continue to exploit enterprises, especially those managing critical infrastructure, through a blend of social engineering, stealthy remote access, and data extortion.

    Scattered Spider, also tracked under names like UNC3944, Octo Tempest, and Muddled Libra, is known for aggressive targeting of IT help desks and employees with elevated access privileges. The group’s operations are distinguished not by zero-day exploits, but by well-practiced human manipulation and abuse of legitimate IT tools to blend in.

    Shifting Tactics, Persistent Threats

    This year’s update highlights a strategic shift toward using DragonForce ransomware in tandem with traditional data theft operations. Once access is secured, often through phone-based impersonation or SIM swap attacks, the group proceeds to exfiltrate sensitive data and, in many cases, encrypt systems to hold the target hostage on both fronts.

    In newer incidents, attackers leveraged remote access software like AnyDesk and tunneling tools like Teleport.sh, sidestepping common security detections. Data was funneled out of victim environments using services like MEGA and Amazon S3. In some cases, they even joined internal incident response calls by monitoring emails and chat platforms like Microsoft Teams and Slack.

    A Refined Playbook for Access

    Initial access still relies heavily on phishing, both traditional and voice-based (vishing). The attackers frequently register domains spoofing helpdesk or SSO portals (e.g., targetsname-sso[.]com, oktalogin-targetcompany[.]com) and impersonate internal IT staff to extract login credentials or push employees into installing remote access tools.

    Social engineering tactics are evolving. Recent cases show attackers conducting multi-step calls to learn password reset procedures, then looping back with that knowledge to request MFA token transfers or account resets. This has proven especially effective against contracted helpdesk providers who may not be aware of the full threat context.

    Credentials are also acquired through dark web marketplaces like Russia Market and through compromises of third-party vendors with downstream access.

    Living Off the Land

    The group is adept at using “living off the land” techniques, relying on approved or common IT tools rather than malware. This includes RMM platforms like Tactical RMM and TeamViewer, and credential-stealing software such as Mimikatz and WarZone (AveMaria).

    In cloud environments, Scattered Spider has been seen activating AWS Systems Manager Inventory to identify targets for lateral movement, then spinning up or taking over EC2 instances to move laterally or stage data.

    They’ve also been probing for Snowflake access, running thousands of queries in short bursts, highlighting a new area of focus in their data theft operations.

    Signs of Intrusion

    Organizations should watch for several key indicators:

    • Unusual use of remote access tools (especially AnyDesk, Ngrok, and Teleport.sh)
    • Creation of new identities backed by fake social media accounts
    • Exfiltration to cloud platforms like MEGA or S3 buckets
    • MFA fatigue attempts and SIM swap reports from employees
    • New domain registrations spoofing internal IT services

    It’s not just the tools that matter, it’s the behavior. Scattered Spider frequently impersonates employees or IT support, gains access through small lapses in protocol, then pivots rapidly to high-value systems.

    Recommendations for Defenders

    Security teams should review and implement several practices immediately:

    • Deploy phishing-resistant MFA using FIDO2/WebAuthn or PKI-based methods. Avoid SMS or app-based MFA alone.
    • Harden remote access protocols. Audit all RMM tools in use and block unauthorized installations. Use application allowlisting to prevent portable executables.
    • Monitor helpdesk interactions. Establish protocols for verifying identity during password resets or MFA changes—especially across departments.
    • Segment internal networks. Limit access between systems to prevent lateral movement and deploy EDR tools to flag unusual behaviors.
    • Keep backups offline and tested. Store encrypted, immutable backups in separate locations, and test restoration regularly.

    Security teams should also routinely inspect their Microsoft Teams, Exchange, and Slack environments for signs of eavesdropping, particularly if a breach is suspected. In recent cases, attackers have joined remediation calls in real time to stay one step ahead of response efforts.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Why Zero-Day Vulnerabilities Matter and What to Do About Them

    Why Zero-Day Vulnerabilities Matter and What to Do About Them

    Zero-day vulnerabilities are one of the most difficult problems defenders face in cybersecurity. These flaws are unknown to vendors, meaning no patch exists at the time of discovery or exploitation. Once weaponized, they allow attackers to bypass traditional defenses and gain access to sensitive systems, often without detection. This guide explains how zero-day vulnerabilities work, why they’re dangerous, how organizations can detect them, and what steps to take to reduce the risk of exploitation.

    What Are Zero-Day Vulnerabilities?

    The term “zero-day” refers to the fact that the vulnerability is not yet known publicly or to the vendor, and therefore there are zero days of protection or lead time. These gaps may result from coding mistakes, architectural oversights, or failures in logic. Since attackers can exploit these flaws before any fix is available, the consequences can range from data breaches and credential theft to the deployment of ransomware and long-term espionage operations.

    Real-World Example: MOVEit Transfer Exploits

    One of the most widely publicized zero-day incidents in recent memory involved Progress Software’s MOVEit Transfer product in 2023. The vulnerability, exploited before any patch was available, allowed unauthenticated attackers to access and exfiltrate sensitive data from public- and private-sector organizations. The threat actor, later linked to the Cl0p ransomware group, used the flaw to automate attacks across hundreds of targets, including state agencies, universities, and healthcare providers. Despite having secure infrastructure and active security teams, many of the affected organizations were caught off guard due to the unknown nature of the flaw and the speed of exploitation.

    Why They Are So Dangerous

    What makes zero-days so effective is that defenders typically have no signatures to detect the attack, no patches to apply, and no prior knowledge to guide a response. These vulnerabilities are often used in highly targeted campaigns, especially by advanced threat groups and criminal syndicates. Even security-aware organizations can struggle to spot exploitation early, especially when attackers use common tools and legitimate credentials.

    In many cases, a zero-day is not exploited in isolation. It may be part of a chain, where one flaw provides initial access and others are used to escalate privileges, disable protections, or exfiltrate data. This makes visibility, speed, and coordinated response critical.

    How Zero-Day Exploits Work

    The exploitation process usually starts with the discovery of a flaw. Attackers may find these issues through reverse engineering, fuzzing software for errors, or inspecting systems for overlooked weaknesses. Once discovered, the exploit code is written and tested, often against unpatched systems or vulnerable configurations.

    After that, the attacker delivers the exploit through phishing emails, compromised websites, infected software updates, or lateral movement within a network. Since the vulnerability is unknown, endpoint protection and intrusion detection systems may not raise alerts unless behavior-based detection is in place.

    Detecting Zero-Day Exploits

    Identifying a zero-day in use is challenging but not impossible. Analysts can look for behavioral anomalies rather than relying on known malware signatures. This might include spotting unexpected outbound connections, abnormal use of administrative tools, or unusual access patterns.

    Machine learning models trained on normal system behavior can help surface oddities. Sandboxing suspicious files or binaries allows teams to safely observe behavior in isolated environments. Correlation between threat intelligence, user activity monitoring, and endpoint telemetry can also provide early indicators of something going wrong.

    Mitigation Tactics That Work

    While zero-days are, by definition, unpatched, organizations are not defenseless. Applying defense-in-depth practices can significantly reduce the impact or reach of a zero-day attack. Segmenting networks limits lateral movement. Enforcing multi-factor authentication on all privileged accounts makes credential theft less effective. Disabling unused services, removing unnecessary software, and limiting administrative privileges help minimize exposure.

    Automated logging and centralized alerting make it easier to spot incidents in real time. Building a culture of consistent patching for known vulnerabilities reduces the risk of attackers combining zero-day exploits with other known flaws to expand their foothold.

    What to Do After a Zero-Day is Discovered

    If a zero-day vulnerability is identified—whether disclosed by the vendor or discovered internally—organizations should first determine if the affected systems are in use. If they are, compensating controls should be applied. These might include disabling specific features, isolating exposed services, or restricting access based on network location or role.

    Security teams should monitor for any signs of compromise, especially indicators that are consistent with public descriptions of the exploit. This includes reviewing system logs, analyzing outbound traffic, and scanning for dropped files or suspicious binaries.

    If compromise is confirmed or strongly suspected, the affected systems should be contained, and forensic analysis should begin immediately. Depending on the severity and scale, a broader incident response process may be required, including notifying partners or customers and involving legal or regulatory bodies.

    Preparing for the Next One

    Zero-day vulnerabilities are not going away. To reduce risk over time, organizations should invest in regular vulnerability assessments, security audits, and red teaming. It is equally important to ensure that security updates are tested and deployed quickly, especially for internet-facing systems.

    Establishing relationships with external security researchers and participating in responsible disclosure programs can help catch issues early. Training staff to recognize phishing and suspicious activity remains one of the simplest yet most effective defenses against the delivery of zero-day exploits.

    Finally, having an updated incident response plan, complete with contact trees, escalation paths, and forensic readiness, ensures that when a zero-day does strike, the response is swift, measured, and effective.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Netizen: Monday Security Brief (7/28/2024)

    Netizen: Monday Security Brief (7/28/2024)

    Today’s Topics:

    • Scattered Spider Exploits VMware ESXi in Targeted Ransomware Attacks Across Critical U.S. Sectors
    • Securing ChatGPT Agent Mode: What You Need to Know
    • How can Netizen help?

    Scattered Spider Exploits VMware ESXi in Targeted Ransomware Attacks Across Critical U.S. Sectors

    A sophisticated ransomware campaign attributed to the threat group Scattered Spider, also known as 0ktapus, Octo Tempest, Muddled Libra, and UNC3944, is actively targeting VMware ESXi hypervisors in the United States, with victims spanning retail, transportation, and airline industries. The operation has been described as fast-moving, stealthy, and reliant on a combination of social engineering and “living off the land” techniques to bypass traditional endpoint defenses.

    Scattered Spider does not rely on software vulnerabilities to gain entry. Instead, attackers contact IT help desks directly, impersonating administrators to reset credentials. According to Mandiant, this playbook—while simple—is remarkably effective, even against organizations with advanced security programs. These intrusions are not random but carefully orchestrated, with clear intent to access and compromise core infrastructure.

    Once inside, the group maps Active Directory privileges to vSphere credentials, providing access to the VMware vCenter Server Appliance (vCSA). From there, they deploy a persistent, encrypted reverse shell—nicknamed “teleport”—that evades firewalls and blends in with legitimate traffic.

    The ransomware deployment follows a structured, multi-phase process:

    1. Initial Access and Reconnaissance: Attackers obtain IT documentation, internal org charts, and PAM credentials from tools like HashiCorp Vault. They often impersonate admins to escalate access.
    2. vSphere Pivoting and Shell Deployment: After gaining vCSA access, attackers use teleport to install a reverse shell and establish persistent remote access.
    3. NTDS Extraction via Disk Swap: Threat actors shut down Domain Controller VMs, detach their virtual disks, mount them on attacker-controlled VMs, and extract the NTDS.dit file—an approach that allows full AD database exfiltration without triggering typical alerts.
    4. Destruction of Recovery Paths: Backup jobs, VM snapshots, and recovery repositories are deleted to inhibit restoration.
    5. Ransomware Deployment via SSH: Custom ransomware is pushed directly to ESXi hosts using SCP/SFTP, bypassing Windows-based defenses entirely.

    Google and Palo Alto Networks Unit 42 stress that the entire operation, from initial access to data theft and ransomware deployment, can unfold within hours. In one incident, over 100 GB of sensitive data was exfiltrated in just two days.

    Unlike conventional ransomware campaigns that rely on encrypting Windows endpoints, Scattered Spider’s approach targets virtualization infrastructure directly. By compromising ESXi and vCenter environments, attackers can cripple multiple business-critical systems in a single strike. Google warns that the end-of-life (EoL) of vSphere 7 in October 2025 could further expose organizations that delay modernization and hardening efforts.

    To defend against this threat actor’s methodology, Google and security researchers recommend a multi-layered strategy:

    • Monitoring and Resilience: Centralize logging for ESXi and vCenter, isolate backups from production AD, and confirm that backups cannot be accessed by compromised admin accounts.
    • Hardening VMware Infrastructure: Enable vSphere lockdown mode, enforce execInstalledOnly, encrypt VMs, and remove unused virtual machines. Help desk procedures should be hardened to resist impersonation attempts.
    • Identity and Access Controls: Implement phishing-resistant multi-factor authentication (MFA), segregate administrative credentials, and prevent identity chaining between services.

    Securing ChatGPT Agent Mode: What You Need to Know

    ChatGPT’s Agent Mode introduces a flexible framework for automating internal workflows, connecting APIs, and enabling custom logic through AI. While the feature unlocks a wide range of possibilities, from document parsing to internal knowledge retrieval, it also comes with new security considerations that organizations should not ignore. The combination of persistent memory, tool integrations, and code execution creates a surface area that needs to be treated as seriously as any service account with system access.

    At its core, Agent Mode allows developers to define custom behaviors and integrate toolsets directly into the ChatGPT interface. An agent might be tasked with answering internal policy questions, retrieving data from a CRM, or transforming input via Python code. But every one of these capabilities, if misconfigured, introduces a potential entry point for abuse. Without proper restrictions, an agent might access sensitive documents, operate across departments, or inadvertently store private information in its memory.

    OpenAI enforces some baseline controls. Agents cannot access tools unless they’ve been explicitly granted permission. Memory can be toggled on or off, and Python code runs in a sandbox with no internet access. These constraints are helpful, but they aren’t a substitute for enterprise-grade governance. Organizations deploying agents, especially those embedded in workflows with access to customer data or internal APIs, need to consider additional safeguards.

    One of the primary risks is prompt injection, where a user crafts input that manipulates an agent into revealing unintended data or executing unauthorized actions. For agents used in customer-facing or employee-support roles, this means input sanitization, behavior constraints, and real-time auditing are critical. Memory, if enabled, should never be used to store regulated or personally identifiable information; accidental retention is still a possibility, and retrieval is not always straightforward.

    Role scoping is also key. An agent built for HR support should not be able to interact with financial records or IT infrastructure. Similarly, an engineering-focused agent should be deployed in isolation from systems containing legal or compliance data. By assigning each agent to a narrow, clearly defined function, the blast radius of any incident can be significantly reduced.

    API credentials are another common point of failure. Many agents use token-based access to retrieve or post data. These tokens must be scoped tightly, rotated regularly, and audited for usage patterns. Developers should avoid hardcoding secrets or storing keys in memory, and instead use secure vaults or environment variables with short time-to-live intervals. Every agent should be treated as a privileged identity within the enterprise identity and access management (IAM) strategy.

    Logging and observability also play a major role. Organizations should route agent logs into their SIEM or XDR platforms and monitor for anomalous usage. Failed tool invocations, repeated access to restricted resources, or interactions outside working hours may indicate misuse or compromise. Integrating agents into the broader detection and response ecosystem makes it easier to contain issues early.

    Security teams should also run tabletop exercises simulating abuse scenarios. What happens if an agent begins leaking sensitive data? How quickly can memory be wiped, or access to external APIs revoked? Can an attacker exfiltrate internal documents via a prompt injection? By treating these questions seriously before deployment, organizations can prepare well in advance of any real incident.

    ChatGPT agents offer real productivity gains, but they must be deployed with the same rigor given to any code with persistent access to systems or data. Isolation, least privilege, continuous monitoring, and regular reviews are foundational. Without these practices, the flexibility that makes Agent Mode so attractive could become its greatest liability.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

  • Netizen: July 2025 Vulnerability Review

    Netizen: July 2025 Vulnerability Review

    Security vulnerabilities are a common occurrence in managing any business’s organizational security. The prompt patching and remediation of any new vulnerabilities are critical to reducing the outside attack surface. Netizen’s Security Operations Center (SOC) has compiled five critical vulnerabilities from July that should be immediately patched or addressed if present in your environment. Detailed writeups below:

    CVE-2025-53770

    CVE-2025-53770 is a critical vulnerability affecting on-premises Microsoft SharePoint Server, stemming from the unsafe deserialization of untrusted data. The flaw enables unauthenticated remote attackers to execute arbitrary code over a network without needing any prior access. The issue was confirmed to be exploited in the wild as of July 2025, prompting Microsoft and CISA to issue urgent guidance. Until a full patch is released, Microsoft has advised all administrators to apply a mitigation strategy described in the CVE documentation, which includes hardening machineKey configuration and isolating untrusted inputs.

    The vulnerability lies in how SharePoint handles serialized data. When untrusted or manipulated input is passed to the server and deserialized without adequate validation, it can be crafted in such a way that code is executed during the deserialization process. In the case of CVE-2025-53770, this flaw enables attackers to leak or modify critical configuration values such as machineKey parameters, which are used to sign and encrypt authentication tokens. If an attacker is able to retrieve or guess these keys, they can forge authentication tokens or session identifiers, ultimately granting themselves unauthorized administrative access.

    Because the exploit requires no authentication and can be executed remotely, the risk is exceptionally high, particularly for organizations exposing SharePoint to the internet or using it for cross-organizational collaboration. The attack chain is typically initiated via a specially crafted HTTP request that triggers the deserialization logic. From there, attackers can escalate privileges, install webshells, pivot into the internal network, or steal sensitive internal documents.

    The CVSS v3 score of 9.8 accurately reflects the severity of the issue, especially since exploitation does not require user interaction, privileges, or prior compromise. Organizations running affected versions of SharePoint should treat this as a high-priority threat. Even in environments with limited internet exposure, internal attackers or compromised devices can exploit the flaw to move laterally or establish persistent access.

    Until Microsoft completes its patch testing and release cycle, the only protection available is through manual mitigations and enhanced monitoring. Administrators are urged to follow Microsoft’s mitigation steps immediately and to monitor for signs of compromise—such as anomalous web requests, PowerShell activity, or unexpected machineKey changes. Detection rules focused on deserialization payloads, encoded web requests, and suspicious access to configuration files should be deployed across affected SharePoint environments.

    CVE-2025-53771

    CVE-2025-53771 is a medium-severity vulnerability in Microsoft Office SharePoint that stems from improper restrictions on pathnames, leading to a path traversal condition. This flaw allows an unauthenticated, remote attacker to perform spoofing attacks by crafting malicious requests that reference directories outside of the intended file structure. The vulnerability was publicly disclosed on July 21, 2025, and appears to be part of the same broader issue set as CVE-2025-53770, though it involves a different attack vector and threat outcome.

    In this case, the weakness lies in SharePoint’s failure to properly sanitize or validate user-supplied input used in file or directory paths. Exploiting this, an attacker could manipulate HTTP requests to access or reference unauthorized files or directories, potentially tricking users or systems into accepting spoofed responses or metadata. This could result in the exposure of sensitive file locations or allow redirection to malicious content under the guise of legitimate resources.

    The vulnerability does not require user interaction or authentication, which makes it accessible to unauthenticated attackers over the network. However, because the impact is limited to confidentiality and integrity, without availability or direct code execution, the CVSS v3 score is capped at 6.5.

    While Microsoft has not flagged active exploitation as of its initial advisory, organizations using SharePoint in externally accessible environments should still apply available updates promptly. Monitoring for unexpected file references or URL patterns containing encoded traversal sequences (such as ../) may help detect early reconnaissance or exploitation attempts. Given its proximity in disclosure date to the high-profile CVE-2025-53770 SharePoint flaw, it is likely that threat actors targeting one may probe for the other.

    CVE-2025-49704

    CVE-2025-49704 is a high-severity remote code execution vulnerability in Microsoft SharePoint Server that stems from improper control over the generation of code, enabling a code injection condition. The vulnerability was first disclosed during the May 2025 Pwn2Own Berlin competition and later patched by Microsoft as part of the July 2025 Patch Tuesday updates. Despite being addressed, it remains under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog due to its inclusion in real-world attack chains.

    This flaw arises from deserialization of untrusted data, a scenario where the server processes attacker-controlled input in a way that allows arbitrary code execution. The vulnerability specifically affects on-premises SharePoint environments where authenticated users—those with limited privileges—can exploit the platform’s internal mechanisms to inject and execute code without requiring user interaction. The attack is conducted over the network and does not rely on elevated privileges or local access, making it an attractive vector for lateral movement or privilege escalation within compromised environments.

    While CVE-2025-49704 alone poses significant risk, it has been observed in conjunction with related vulnerabilities, including CVE-2025-49706, to form more robust exploit chains capable of bypassing Microsoft’s initial mitigations. The underlying deserialization issue that enables code injection makes this a particularly dangerous vulnerability in environments where SharePoint serves as an externally accessible collaboration or content management platform.

    The vulnerability has a CVSS v3 base score of 8.8 and an EPSS score of 0.14805, reflecting a moderate likelihood of exploitation and significant impact on confidentiality, integrity, and availability. Organizations using vulnerable SharePoint versions should apply Microsoft’s July 2025 updates immediately, audit SharePoint logs for suspicious user actions or unexpected workflow behavior, and isolate internet-facing SharePoint instances where possible until patching is confirmed. The continued presence of CVE-2025-49704 in active exploit chains indicates that threat actors view this vulnerability as a reliable entry point, particularly when paired with newer bypasses or privilege escalation techniques.

    CVE-2025-49706

    CVE-2025-49706 is a medium-severity vulnerability in Microsoft SharePoint that allows remote, unauthenticated attackers to bypass authentication mechanisms through improper validation of HTTP Referer headers. Initially demonstrated during the May 2025 Pwn2Own competition, this flaw was a key component in the broader ToolShell exploit chain. It enables spoofing attacks that grant unauthorized access to sensitive SharePoint components, particularly the ToolPane.aspx endpoint, which is crucial in the deployment of further exploitation payloads.

    Although Microsoft released a patch as part of its July 2025 Patch Tuesday updates, this vulnerability has retained significance in active threat campaigns. Attackers have continued to use it as an entry point to exploit CVE-2025-49704 for remote code execution. In environments where the authentication bypass is successful, the attacker can trigger the deserialization of malicious input, resulting in full compromise of the underlying system. The vulnerability does not require user interaction, privileges, or complex attack setup, making it especially dangerous when used in chained attacks.

    Security researchers have since observed follow-on bypasses, such as CVE-2025-53771, that emerged shortly after Microsoft’s patch. This indicates that mitigation efforts targeting CVE-2025-49706 alone may be insufficient without broader hardening of authentication and input validation logic within SharePoint.

    The CVSS v3 base score for this vulnerability is 6.5, reflecting moderate impact with low attack complexity, while the EPSS score remains low at 0.00041, suggesting that exploitation is highly targeted. Despite its medium rating, the real-world risk escalates when CVE-2025-49706 is leveraged as part of an exploit chain. Organizations using on-premises SharePoint installations should not only apply the July 2025 security updates, but also monitor for signs of Referer-based manipulation in web traffic, and review access logs to detect unauthorized entry attempts. The vulnerability’s role in the ToolShell campaign makes clear its value to threat actors seeking stealthy network entry and control.

    CVE-2025-54309

    CVE-2025-54309 describes a critical vulnerability in CrushFTP versions 10 prior to 10.8.5 and version 11 prior to 11.3.4_23 that permits unauthenticated remote attackers to gain administrative access over HTTPS. The flaw lies in improper handling of AS2 validation logic, and it only affects configurations where the DMZ proxy feature is not enabled. By bypassing proper verification in the AS2 request processing, a remote attacker can craft malicious HTTPS requests that are accepted as legitimate administrative actions—resulting in full compromise of the affected CrushFTP server.

    The vulnerability was first identified and exploited in the wild in mid-July 2025, prompting an emergency response from the vendor. Researchers observed the flaw being actively used to deploy remote access payloads on exposed systems, often without triggering standard detection mechanisms. Successful exploitation does not require user interaction or any level of prior authentication, making this vulnerability especially dangerous for publicly accessible instances of CrushFTP.

    The issue carries a CVSS v3 base score of 9.8 (CVSS v2: 10.0), placing it at the highest tier of severity. With an EPSS score of 0.00101, it represents a highly targeted attack surface, rather than a broad-based exploitation pattern. Nevertheless, the fact that it has been confirmed as actively exploited and added to CISA’s Known Exploited Vulnerabilities (KEV) catalog means that organizations should prioritize patching immediately.

    CrushFTP administrators are advised to update to version 10.8.5 or 11.3.4_23 and review any anomalous access logs dating back to early July 2025. Those not using the DMZ proxy, particularly in cloud or externally accessible deployments, face the greatest exposure. Vendors and security teams should also validate that AS2 message handling is properly gated by access controls in any customized configurations. Failure to patch this flaw may lead to silent compromise and persistent unauthorized access across enterprise file transfer systems.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Paradox.ai Breach: McDonald’s Hiring Platform Compromised Through “123456” Password

    Paradox.ai Breach: McDonald’s Hiring Platform Compromised Through “123456” Password

    Security researchers have discovered that weak password practices and malware infections have compromised data from millions of job applicants at McDonald’s, raising concerns about Paradox.ai’s internal cybersecurity practices. Paradox.ai is an AI hiring chatbot vendor whose clients include numerous Fortune 500 companies.

    McDonald’s Account Breach Revealed 64 Million Records

    Researchers Ian Carroll and Sam Curry uncovered a major security lapse on McHire.com, the hiring portal used by many McDonald’s franchisees, by guessing the password for Paradox.ai’s backend system: “123456.” Their investigation revealed access to 64 million records, including job seekers’ names, phone numbers, and email addresses.

    While Paradox confirmed the issue, the company stated that this was an outdated test account last accessed in 2019. They claimed the data viewed was limited to a handful of chat interactions and not full job applications. In a blog post, Paradox said the account “should have been decommissioned” and asserted no Social Security numbers were involved.

    Malware Infection Exposes Internal Developer Credentials

    However, leaked credentials from Paradox.ai paint a broader picture. In June 2025, a developer in Vietnam fell victim to “Nexus Stealer,” a well-known infostealer malware that harvested hundreds of credentials. These included logins for Fortune 500 client environments, as well as access to platforms such as Okta (used for SSO), Atlassian, and other developer tools.

    According to data indexed by breach aggregation platforms like Intelligence X, the stolen credentials featured poor password hygiene, frequently reusing a basic 7-digit numeric password across multiple client environments, including Aramark, Lockheed Martin, Lowe’s, and Pepsi.

    Modern password-cracking tools can instantly break such numeric passwords. Password strength data from Hive Systems shows that seven-digit numeric passwords offer essentially zero resistance to brute-force attacks.

    SSO and MFA Were Not Enough to Prevent Risk

    Paradox claims it enforced SSO with multi-factor authentication since 2020. However, the malware also stole valid authentication cookies from the developer’s device, potentially bypassing MFA entirely. One of the cookies associated with a login to paradoxai.okta.com was valid through December 2025. Other cookies tied to Atlassian accounts showed similar expiration dates.

    Security experts say stolen session cookies, combined with reused weak passwords, are a potent attack vector, one capable of giving attackers deep access to sensitive systems even when MFA is in place.

    Infostealers Pose Ongoing Threat

    Infostealers like Nexus are now one of the leading causes of data breaches and ransomware infections. They extract not only saved passwords but also session cookies, browser history, and clipboard data. These infections often leave a remote access backdoor, and reports suggest the Paradox developer’s compromised system was later sold on underground markets.

    This incident follows a similar infection in late 2024, where another Paradox employee in Vietnam lost credentials, including those to GitHub. Both compromised devices showed evidence of repeated downloads of pirated movies, often bundled with fake codec software laced with malware.

    Security Certifications and Missed Penetration Tests

    Paradox.ai had previously announced SOC 2 Type II and ISO 27001 certification in 2019. Yet the now-exposed McDonald’s test account with its weak credentials went unnoticed during penetration tests, despite being active since 2019.

    The company said that during that time, contractors were not held to the same standards as internal staff. Paradox stated that this policy has since changed, and internal security and password requirements have been updated.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • CISA Orders Emergency Patching After Active Exploitation of SharePoint Vulnerabilities

    CISA Orders Emergency Patching After Active Exploitation of SharePoint Vulnerabilities

    On July 22, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive requiring all Federal Civilian Executive Branch (FCEB) agencies to patch two critical SharePoint vulnerabilities: CVE-2025-49704 and CVE-2025-49706. These flaws, exploited in combination, enable unauthorized access and remote code execution on on-premise Microsoft SharePoint servers. Based on confirmation of ongoing exploitation, they have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.

    Chinese State-Sponsored Hackers Linked to Exploit Chain

    The attack chain, now tracked under the name “ToolShell,” has been attributed to Chinese state-sponsored threat groups Linen Typhoon and Violet Typhoon. The SharePoint zero-day chain combines a spoofing flaw with an insecure deserialization issue, effectively bypassing authentication protections. Microsoft has also disclosed related variants, CVE-2025-53770 and CVE-2025-53771, believed to be patch bypasses of the original bugs.

    According to researchers at Akamai, CVE-2025-53770 allows attackers to exploit the system before authentication occurs, giving them full code execution capability through crafted requests that SharePoint treats as trusted.

    Exploitation Tactics: PowerShell and VIEWSTATE Abuse

    Once initial access is gained, attackers deploy web shells and execute PowerShell payloads designed to evade detection. Symantec observed malicious actors downloading a file named client.exe, renaming it as debug.js to avoid suspicion, then using it to execute batch scripts that extract system metadata and cryptographic secrets—including the MachineKey.

    This key allows attackers to forge trusted VIEWSTATE payloads, a method that effectively enables long-term persistence on compromised systems even after updates are applied.

    AMSI Bypass Undermines Recommended Mitigation

    Microsoft initially advised enabling Antimalware Scan Interface (AMSI) as a defense mechanism; however, security researchers at watchTowr Labs demonstrated that AMSI can be bypassed entirely. “Organizations assuming that enabling AMSI is sufficient are placing themselves at serious risk,” said watchTowr CEO Benjamin Harris. “We’ve shown that AMSI will not stop nation-state actors who are already using these exploits effectively.”

    Recommendations for SharePoint Security Teams

    Given the severity of these remote code execution vulnerabilities and the active exploitation by advanced threat actors, organizations must move beyond temporary mitigations. Immediate steps include applying the latest SharePoint patches, reviewing endpoint logs for signs of compromise, and deploying robust Endpoint Detection and Response (EDR) solutions.

    Security teams should also look for evidence of unauthorized VIEWSTATE manipulation, obfuscated PowerShell commands, and unexpected outbound connections from SharePoint servers. Full remediation is critical, partial fixes like enabling AMSI alone are not sufficient against this level of threat activity.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is an ISO 27001:2013 (Information Security Management), ISO 9001:2015, and CMMI V 2.0 Level 3 certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans. 

    Questions or concerns? Feel free to reach out to us any time –

    https://www.netizen.net/contact

  • Netizen: Monday Security Brief (7/21/2024)

    Netizen: Monday Security Brief (7/21/2024)

    Today’s Topics:

    • CVE-2025-53770: Critical SharePoint Zero-Day Exploited in Active Attacks, 85+ Servers Compromised
    • Dell Confirms Breach of Product Demo Lab by World Leaks Extortion Group
    • How can Netizen help?

    CVE-2025-53770: Critical SharePoint Zero-Day Exploited in Active Attacks, 85+ Servers Compromised

    A critical zero-day vulnerability in Microsoft SharePoint Server, now tracked as CVE-2025-53770 and assigned a CVSS score of 9.8, is being exploited in ongoing large-scale attacks that have already breached at least 85 SharePoint servers worldwide.

    CVE-2025-53770 is a variant of CVE-2025-49704, a previously patched remote code execution (RCE) vulnerability in SharePoint. The flaw stems from insecure deserialization of untrusted data, allowing attackers to execute code over the network without authentication.

    Discovered by Viettel Cyber Security and reported through Trend Micro’s Zero Day Initiative (ZDI), the vulnerability affects on-premises SharePoint Servers but does not impact SharePoint Online in Microsoft 365.

    According to Microsoft, attackers are exploiting the way SharePoint deserializes untrusted objects, enabling them to execute arbitrary commands before any authentication occurs. Once inside, they can extract the server’s MachineKey configuration, specifically the ValidationKey and DecryptionKey, using PowerShell scripts.

    These keys allow attackers to craft forged __VIEWSTATE payloads that SharePoint treats as valid, effectively granting persistent access and enabling seamless remote code execution. This persistence is extremely difficult to remove, even after patching, unless the cryptographic keys are rotated.

    Compromised servers appear to blend malicious activity into normal SharePoint operations, allowing attackers to move laterally and remain undetected unless organizations have deep endpoint monitoring in place—such as Defender for Endpoint or other EDR tools.

    Security researchers at Eye Security and Palo Alto Networks’ Unit 42 have observed attackers chaining CVE-2025-49704 with CVE-2025-49706—a spoofing vulnerability related to how SharePoint handles HTTP Referer headers. This exploit chain, codenamed ToolShell, leverages CVE-2025-49706 to deliver a POST payload that ultimately triggers RCE via CVE-2025-49704.

    Eye Security suspects that adding the '_layouts/SignOut.aspx' endpoint as a Referer header is the key step that transforms CVE-2025-49706 into CVE-2025-53770. The implication is that CVE-2025-53770 may be functionally similar to or overlap with both CVE-2025-49704 and CVE-2025-49706, making attribution complex.

    As of the latest reports, over 85 SharePoint servers have been compromised globally. At least 29 affected organizations span government agencies and multinational corporations. Many compromised systems have been found hosting ASPX-based web shells used to maintain access.

    WatchTowr CEO Benjamin Harris explained that with access to the ValidationKey and DecryptionKey, attackers can create arbitrary __VIEWSTATE payloads that are accepted by the server, allowing them to re-enter systems even after a patch is applied, unless the cryptographic secrets are also rotated.

    Microsoft acknowledged the vulnerability in a security advisory on July 19, 2025, and urged customers to enable Antimalware Scan Interface (AMSI) integration and install Microsoft Defender Antivirus on SharePoint servers. AMSI integration is enabled by default in the September 2023 security updates for SharePoint Server 2016/2019 and in the 23H2 feature release for the SharePoint Server Subscription Edition.

    For organizations unable to enable AMSI, Microsoft recommends disconnecting vulnerable SharePoint servers from the internet until a patch is applied.

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also issued a formal alert, confirming the vulnerability’s active exploitation and encouraging immediate defensive action. According to Chris Butera, Acting Executive Assistant Director for Cybersecurity at CISA, the agency coordinated with Microsoft and alerted potentially impacted entities.

    Microsoft has since released an official patch for CVE-2025-53770, alongside a new related vulnerability, CVE-2025-53771. All organizations running on-premises SharePoint are urged to apply these updates without delay. In parallel, organizations should rotate MachineKey settings to invalidate any secrets that may have been stolen during exploitation.

    Security teams are also encouraged to deploy EDR solutions with visibility into SharePoint-specific behavior, monitor for unusual ASPX payload executions, and scan for unauthorized changes to ViewState and authentication mechanisms.

    Dell Confirms Breach of Product Demo Lab by World Leaks Extortion Group

    Bracknell, United Kingdom – January 18, 2015: The Dell Corporation Ltd sign at the entrance of their registered company address in Bracknell, England. Dell opened their first international subsidiary in the UK in 1987

    Dell Technologies has confirmed that a newly rebranded extortion group, World Leaks, compromised one of its Customer Solution Centers, a test environment used to showcase Dell products and run proof-of-concept trials for commercial clients. While the group appears to be attempting to extort Dell over the incident, the company maintains that no sensitive customer or internal data was compromised.

    In a statement to BleepingComputer, Dell explained that the breach was limited to its Solution Center, which operates independently of core production networks and customer-facing systems. According to the company, “a threat actor recently gained access to our Solution Center, an environment designed to demonstrate our products and test proofs-of-concept for Dell’s commercial customers.”

    Dell emphasized that the impacted environment is isolated from customer and partner systems and does not play any role in the delivery of services to customers. The company further noted that most of the data housed within the test platform is synthetic or publicly available—including sample datasets, generic medical and financial information, and Dell-internal testing scripts.

    The only legitimate data reportedly exposed during the intrusion was an outdated contact list, which Dell characterized as limited in sensitivity. Customers are routinely warned not to upload personal or proprietary data into the Customer Solution Centers, reducing the potential impact of breaches in these environments.

    The group behind the breach, World Leaks, is a rebranded version of Hunters International, which itself was flagged as a successor to the notorious Hive ransomware group due to code-level similarities. Originally launched in late 2023 as a ransomware-as-a-service (RaaS) operation, Hunters International pivoted to data extortion after determining that ransomware encryption had become both less profitable and riskier to carry out.

    In January 2025, the group formally rebranded to World Leaks, shifting its tactics to focus entirely on data theft and extortion, rather than encrypting victims’ files. According to threat intelligence, they use a custom-built exfiltration tool and maintain a data leak site where stolen information is published as leverage. To date, World Leaks has claimed responsibility for at least 49 data leaks and over 280 total attacks across multiple sectors worldwide.

    While World Leaks has not yet listed Dell on its data leak site, its involvement in this breach suggests continued targeting of high-profile technology companies. The attackers have previously been linked to post-compromise activity on end-of-life SonicWall SMA 100 devices, where they deployed a custom OVERSTEP rootkit to maintain persistence and evade detection.

    Dell has not disclosed how the attackers gained access to the test environment, citing the ongoing nature of its investigation. Nor has the company confirmed whether it received a ransom demand or engaged with the extortion group.

    While this incident did not compromise core systems or sensitive customer data, it serves as a reminder for enterprises to apply zero trust principles not just to operational environments, but also to development, testing, and demonstration platforms. These auxiliary systems often lack the same hardened defenses but can still be targeted as footholds for more advanced attacks.

    Organizations should treat demo and lab environments with the same level of scrutiny given to production systems, ensuring network segmentation, proper user authentication, vulnerability management, and telemetry visibility remain in place.

    How Can Netizen Help?

    Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

    We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

    Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

    Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.