Today’s Topics:

• Threat Actor RomCom Exploits WinRAR Zero-Day in Targeted Espionage Campaign
• Over 29,000 Microsoft Exchange Servers Remain Unpatched for High-Severity Hybrid Cloud Exploit
• How can Netizen help?

Threat Actor RomCom Exploits WinRAR Zero-Day in Targeted Espionage Campaign

A Russia-linked threat group known as RomCom, also tracked as Storm-0978, Tropical Scorpius, and UNC2596, has been caught exploiting a newly discovered WinRAR zero-day vulnerability, CVE-2025-8088, in cyberespionage operations targeting organizations in Europe and Canada.

CVE-2025-8088 is a path traversal flaw in WinRAR involving the use of alternate data streams. It allows attackers to craft malicious archive files that extract contents to attacker-controlled paths rather than the user-specified directory. This can be abused to overwrite critical files or plant malicious payloads without user awareness.

The vulnerability was reported to WinRAR by ESET, which observed active exploitation beginning July 18, 2025. A beta fix was released on July 25, just one day after disclosure, and the final patch was issued on July 30.

RomCom leveraged spearphishing emails to deliver the malicious archives, disguising them as resumes to increase credibility. The targeting was precise, indicating prior reconnaissance. Intended victims included organizations in the financial, defense, manufacturing, and logistics sectors across Canada and Europe.

While ESET confirmed that none of the targeted organizations were successfully compromised, the payloads were designed to install a range of backdoors, including SnipBot, RustyClaw, and Mythic Agent.

RomCom has a history of combining cyberespionage with opportunistic cybercrime and is known for exploiting zero-days against high-value targets in Europe and North America. This activity underscores the group’s ability to pivot quickly to new vulnerabilities and weaponize them in targeted campaigns.

ESET noted that CVE-2025-8088 shares similarities with CVE-2025-6218, another WinRAR path traversal bug patched earlier this year. Russian security firm Bi.zone reported that both flaws have been exploited in recent operations, including attacks by a group it tracks as Paper Werewolf against Russian organizations such as an equipment manufacturer.

Organizations using WinRAR are advised to update immediately to the latest version to close CVE-2025-8088 and related vulnerabilities. Security teams should also review spearphishing defenses, enhance email filtering for malicious attachments, and monitor for the delivery of suspicious archive files.

Over 29,000 Microsoft Exchange Servers Remain Unpatched for High-Severity Hybrid Cloud Exploit

More than 29,000 Microsoft Exchange servers exposed to the internet have not been patched against CVE-2025-53786, a high-severity vulnerability that could enable attackers to escalate privileges within hybrid cloud environments and potentially achieve full domain compromise.

This flaw affects Exchange Server 2016, Exchange Server 2019, and Microsoft Exchange Server Subscription Edition in hybrid configurations. An attacker with administrative access to an on-premises Exchange server could exploit CVE-2025-53786 to forge or manipulate trusted tokens and API calls, moving laterally into the connected cloud environment. The activity leaves minimal traces, making detection difficult.

Microsoft addressed the vulnerability in April 2025 with a hotfix released as part of its Secure Future Initiative, introducing a dedicated hybrid app to replace the insecure shared identity model previously used between on-premises Exchange and Exchange Online. Although Microsoft has not observed active exploitation, it rated the flaw as “Exploitation More Likely” due to the potential for consistent exploit development.

According to scans by Shadowserver, as of August 10, 2025, there were 29,098 unpatched Exchange servers online. Over 7,200 were located in the United States, 6,700 in Germany, and 2,500 in Russia. The remaining vulnerable servers are distributed across other regions, all at risk of compromise if exploited.

Following Microsoft’s disclosure, CISA issued Emergency Directive 25-02, mandating all Federal Civilian Executive Branch agencies to mitigate CVE-2025-53786 by August 11, 2025, at 9:00 AM ET. Agencies were instructed to:

• Inventory Exchange environments using Microsoft’s Health Checker script.
• Disconnect unsupported, public-facing Exchange servers from the internet.
• Apply the April 2025 hotfix and update to the latest cumulative updates (CU14 or CU15 for Exchange 2019, CU23 for Exchange 2016).

CISA warned that failing to patch could result in a “hybrid cloud and on-premises total domain compromise.”

Although the directive applies only to federal agencies, CISA urged all organizations, public and private, to apply the same mitigations. The agency emphasized that the risk extends to “every organization and sector using this environment,” regardless of industry.

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

Today’s Topics:

• New Linux ‘Plague’ PAM Backdoor Enables Silent SSH Credential Theft
• Akira Ransomware Exploits SonicWall VPNs in Likely Zero-Day Attacks
• How can Netizen help?

New Linux ‘Plague’ PAM Backdoor Enables Silent SSH Credential Theft

Security researchers have identified a previously undocumented Linux backdoor called Plague, which leverages the Pluggable Authentication Module (PAM) framework to silently compromise systems and maintain persistent access. According to research from Nextron Systems, the malware has remained undetected for nearly a year, highlighting the growing sophistication of Linux-targeted threats.

Pluggable Authentication Modules are core components of Linux and UNIX-based authentication systems, handling user logins and authentication requests for services such as SSH. By embedding itself as a malicious PAM module, Plague can:

• Bypass authentication checks and allow attackers to log in without valid credentials
• Silently steal user credentials during legitimate login attempts
• Maintain persistent SSH access without triggering standard monitoring tools

Because PAM modules operate with elevated privileges and integrate directly into the authentication stack, a rogue module like Plague can operate without leaving typical forensic artifacts.

Researchers discovered several Plague samples uploaded to VirusTotal since July 29, 2024, none of which were flagged as malicious. This suggests both active development and effective evasion techniques. The malware demonstrates a strong focus on stealth through several key behaviors:

1. Static credentials for covert access that allow attackers to log in without leaving a standard audit trail
2. Anti-debugging and obfuscation to resist reverse engineering and analysis
3. Audit trail wiping by unsetting environment variables like SSH_CONNECTION and SSH_CLIENT and redirecting HISTFILE to /dev/null to prevent shell command logging
4. Persistence through system updates by integrating deeply into the authentication stack

As researcher Pierre-Henri Pezier noted, this combination of obfuscation, environment tampering, and deep integration makes Plague exceptionally hard to detect using traditional Linux security tools.

Plague represents a high-risk threat to organizations relying on Linux servers for critical applications, including web hosting, finance, and cloud environments. PAM-based implants allow attackers to establish long-term footholds, conduct credential theft, and potentially escalate attacks into broader supply chain compromises.

While attribution remains unknown, the discovery of multiple variants indicates an ongoing campaign or the active testing of new features by threat actors.

To defend against backdoors like Plague, organizations should adopt enhanced Linux security monitoring and forensic readiness:

• Monitor for unauthorized PAM modules in /lib/security or equivalent directories
• Audit system logs for unexpected SSH access patterns or disabled history logging
• Deploy host-based intrusion detection with a focus on file integrity monitoring for authentication-related libraries
• Conduct regular memory and file system scans using YARA rules for Linux-specific malware
• Enforce principle of least privilege and multi-factor authentication for all SSH access to reduce the impact of credential theft

Akira Ransomware Exploits SonicWall VPNs in Likely Zero-Day Attacks

Security researchers have observed a spike in Akira ransomware campaigns targeting SonicWall SSL VPN appliances, with evidence suggesting the possible use of a zero-day vulnerability. The activity, first noted in mid-July 2025, has impacted even fully-patched devices, raising significant concerns for organizations relying on SonicWall for remote access.

According to Arctic Wolf Labs, the intrusions involve multiple pre-ransomware compromises executed in rapid succession, all of which leveraged VPN access through SonicWall SSL VPNs. Researcher Julian Tuin reported that in the reviewed cases, a very short interval separated the initial VPN login from the onset of ransomware encryption.

The company’s analysis indicates that the attacks may exploit an as-yet-undisclosed flaw in SonicWall appliances, although credential-based compromises have not been ruled out. Evidence of malicious VPN activity dates as far back as October 2024, pointing to a sustained campaign against these devices.

One notable characteristic of these intrusions is the difference in VPN login behavior compared to legitimate users. While authorized logins typically originate from broadband ISP networks, ransomware operators often authenticate through Virtual Private Server (VPS) hosting environments to disguise their activity and facilitate automated lateral movement.

Akira ransomware, first observed in March 2023, has become a prominent threat actor in the global ransomware ecosystem. By early 2024, it was credited with generating approximately $42 million in illicit profits from over 250 victims.

Check Point’s recent statistics show that Akira was the second most active ransomware group in Q2 2025, behind Qilin, claiming 143 victims in that quarter. Analysts also note that Akira maintains a regional focus on Italian enterprises, with 10% of its observed victims based in Italy, compared to 3% in the general ransomware landscape.

Given the high likelihood that the SonicWall attacks involve an unpatched zero-day vulnerability, organizations are urged to take immediate defensive measures:

• Consider temporarily disabling the SonicWall SSL VPN service until a patch or official mitigation is released
• Enforce multi-factor authentication (MFA) for all remote access to limit the impact of credential theft
• Remove unused or inactive local firewall user accounts to reduce potential attack vectors
• Maintain strong password hygiene and monitor VPN access logs for anomalous patterns

Until a vendor fix becomes available, treating these appliances as potentially exposed is prudent for reducing the risk of Akira ransomware intrusions.

How Can Netizen Help?

Netizen ensures that security gets built-in and not bolted-on. Providing advanced solutions to protect critical IT infrastructure such as the popular “CISO-as-a-Service” wherein companies can leverage the expertise of executive-level cybersecurity professionals without having to bear the cost of employing them full time. 

We also offer compliance support, vulnerability assessments, penetration testing, and more security-related services for businesses of any size and type. 

Additionally, Netizen offers an automated and affordable assessment tool that continuously scans systems, websites, applications, and networks to uncover issues. Vulnerability data is then securely analyzed and presented through an easy-to-interpret dashboard to yield actionable risk and compliance information for audiences ranging from IT professionals to executive managers.

Netizen is a CMMI V2.0 Level 3, ISO 9001:2015, and ISO 27001:2013 (Information Security Management) certified company. We are a proud Service-Disabled Veteran-Owned Small Business that is recognized by the U.S. Department of Labor for hiring and retention of military veterans.