CTO at NCSC Summary: week ending February 2nd
'forgivable' vs 'unforgivable' vulnerabilities - should CVSS go to 11?
Welcome to the weekly highlights and analysis of the blueteamsec subreddit (and my wider reading). Not everything makes it in, but the best bits do.
Operationally this week nothing overly of note.
In the high-level this week:
A method to assess 'forgivable' vs 'unforgivable' vulnerabilities - UK National Cyber Security Centre publishes - “Research from the NCSC designed to eradicate vulnerability classes and make the top-level mitigations easier to implement.”
I suggested internally this week we should now update CVSS to include a binary field which is [forgiveable|unforgivable] - maybe it could make CVSS go to 11.
Preserving integrity in the age of generative AI - UK National Cyber Security Centre publishes our view to the new ‘Content Credentials’ guidance. The National Security Agency (NSA) has published introductory guidance on Content Credentials, which we and other international cyber security partners endorse. This is an important, but embryonic, topic.
Cyber threat to UK government is severe and advancing quickly, spending watchdog finds - National Audit Office publishes
Cyber threat to UK government is severe and advancing quickly.
58 critical government IT systems independently assessed in 2024 had significant gaps in cyber resilience, and the government does not know how vulnerable at least 228 ‘legacy’ IT systems are to cyber attack.
Skills gaps are the biggest risk to building cyber resilience, with one in three cyber security roles in government vacant or filled by temporary staff in 2023-24.
World-leading AI cyber security standard to protect digital economy and deliver Plan for Change - Department for Science, Innovation and Technology and Feryal Clark MP publish with support from the UK’s National Cyber Security Centre
AI Cyber Security Code of Practice - Department for Science, Innovation and Technology, Feryal Clark MP and The Rt Hon Peter Kyle MP publish - “This Code of Practice sets out baseline cyber security principles to help secure AI systems and the organisations which develop and deploy them. Addressing the cyber risks to AI will protect our citizens and our digital economy while ensuring the many benefits of AI can be realised.”
“Following support for our approach, DSIT, in close collaboration with NCSC, will submit the Code and the implementation guide in the European Telecommunications Standards Institute (ETSI) where it will be used as the basis for a new global standard (TS 104 223) and accompanying implementation guide (TR 104 128). The Government will update the content of the Code and Guide to mirror the future ETSI global standard and guide.”
How vulnerable is the UK to undersea cable attacks? - UK Parliament enquires - “MPs and Lords will examine threats to undersea cables in a new inquiry launched today by the Joint Committee on the National Security Strategy (JCNSS).”
It Is Time to Standardize Principles and Practices for Software Memory Safety - Communications ACM publishes - “Twenty-one co-authors, spanning academia and industry, with expertise in memory-safety research, deployment, and policy, argue that standardization is an essential next step to achieving universal strong memory safety.”
Bill to Safeguard U.S. Communications Networks from National Security Threats U.S. Senators Marsha Blackburn (R-Tenn.) and Ben Ray Luján (D-N.M.) introduce - “ the Removing Our Unsecure Technologies to Ensure Reliability and Security (ROUTERS) Act to safeguard Americans' communications networks from foreign-adversary controlled technology, including routers, modems, or devices that combine both:”
Massive data breaches in 2024: what are the key lessons and measures to take? - Commission nationale de l'informatique et des libertés analyses - and highlights three trends
the login information used for the attack had been compromised;
the intrusions and exfiltrations were not detected by the organization before the data sets were put on sale;
a significant proportion of the incidents involved a subcontractor ;
SMEs consider themselves ‘too small’ to fall victim to cyber-attacks - Association of British Insurers report - “the report makes several recommendations to encourage a greater uptake of cyber protection products amongst SMEs, such as:
Driving awareness though campaigns to help address the lack of understanding about the threats that cyber-attacks pose
The use of clearer and consistent language and terminology to boost understanding and increase uptake of cyber insurance. Take-up is currently hindered by technical language which makes it difficult for SMEs to understand cyber risks and interpret the value that insurance products can offer”
Superintendent Adrienne A. Harris Secures $2 Million Cybersecurity Settlement with PayPal, Inc. - Department of Financial Services, New York announces - “The Department’s investigation also revealed that PayPal failed to implement and maintain written policies that address access controls, identity management, and customer data, and failed to use effective controls to protect against unauthorized access to Nonpublic Information or Information Systems.”
$45M Global Settlement in MGM Data Breach Class Action Preliminarily Approved - Cohen Milstein celebrate - “Class members whose social security number or military identification number were exposed are eligible for a $75 cash payment and those whose passport number or driver’s license were exposed are eligible for a $50 payment. In addition, all settlement class members may elect identity theft protection and credit monitoring.”
First Indian startups picked for Indo-US defence programme, investor says - Reuters reports - including because India is going to be a globally important country when it comes to future technology.
Reporting on/from China
I wont be covering DeepSeek bar the footnotes - we flagged on December 7th that it had arrived and December 27th the claimed development price of v3.
China’s AI industry has almost caught up with America’s - The Economist reports - “Chinese AI is now so close in quality to its American rivals that the boss of OpenAI, Sam Altman, felt obliged to explain the narrowness of the gap. Shortly after DeepSeek released v3, he tweeted peevishly, “It is (relatively) easy to copy something that you know works. It is extremely hard to do something new, risky, and difficult when you don’t know if it will work.” - or fast following…
Japan to vet investments by firms under China state influence - Nikkei Asia reports - “Japan's Ministry of Finance will introduce new regulations for foreign investors that could potentially cooperate with foreign governments in collecting intelligence, particularly Chinese companies, Nikkei has learned”
Chinese Critiques of Large Language Models - Center for Security and Emerging Technology publishes -
Policy support for the data labeling industry - China Talk summarises - “The National Data Administration 国家数据局, a government entity established in 2023, has released “opinions” to foster the growth of the data labeling industry. The policy aims to harness China’s vast data resources and diverse application scenarios to drive this emerging sector forward.
Goals by 2027:
Achieve an average annual growth rate of over 20%.
Build a “relatively complete industrial ecosystem” for data annotation, including the development of influential, innovative enterprises and specialized annotation hubs.”
The Evolution of China’s Semiconductor Industry under U.S. Export Controls - American Affairs Journal - American Affairs Journal reports - “While Huawei holds a license for ARM v9, HiSilicon is likely moving to design more RISC-V based semiconductors that are free of ARM IP”
AI
International AI Safety Report 2025 - UK’s Department for Science, Innovation and Technology and AI Safety Institute publish - “Most experts agree that general-purpose AI is currently not capable of tasks including:
Performing useful robotic tasks such as household work.
Consistently avoiding false statements.
Independently executing long projects, such as multi-day programming or research projects”
Adversarial Misuse of Generative AI - Google Threat Intelligence Group summarises - “This report shares our findings on government-backed threat actor use of the Gemini web application. The report encompasses new findings across advanced persistent threat (APT) and coordinated information operations (IO) actors tracked by GTIG. By using a mix of analyst review and LLM-assisted analysis, we investigated prompts by APT and IO threat actors who attempted to misuse Gemini.”
How we estimate the risk from prompt injection attacks on AI systems - Agentic AI Security Team at Google DeepMind outline their threat model, before describing three attack techniques they have implemented in their evaluation framework.
Artificial intelligence and economic and financial policymaking A high-level panel of experts’ report to the G7 - Government of Italy publishes - “A significant risk is data breaches, as AI systems handle extensive personal and financial information, making them attractive targets for cybercriminals. Weak encryption, inadequate access controls, and outdated security protocols can lead to unauthorized access and theft. Additionally, adversarial attacks pose a unique threat to AI systems, where malicious actors manipulate models to produce incorrect results or extract proprietary algorithms, compromising their functionality and accuracy.”
The New Frontier of Security: Creating Safe and Secure AI Models - Google outline their recommendations:
If sharing only model weights: Consider formats such as Safetensors. These formats only contain model weights, and are therefore safe from RCE.
If sharing weights and metadata: Consider formats like GGUF, which include weights and additional metadata but not executable code configurations.
For any format, but especially if your model requires custom code: Keep reading to see how to help users verify that they're getting the correct model.
Cyber proliferation
Couple of things covered in other sections this week e.g. the commercial Chinese company allegedly supporting state etc.
Bounty Hunting
Cyber-attacks: three individuals added to EU sanctions list for malicious cyber activities against Estonia - Council of the EU sanctions - “With today’s listings, the EU horizontal cyber sanctions regime now applies to 17 individuals and 4 entities. It includes an asset freeze and a travel ban, and the prohibition for EU persons and entities to make funds available to those listed.” - legal text
5 linked to cyber espionage ring arrested in Türkiye - Daily Sabah publishes - “An investigation led by the Chief Public Prosecutor’s Office in the capital, Ankara, discovered that a software program known as “Avatar” or “Adalet” (Turkish for "justice"), exclusively designed for attorneys, was used by hundreds of lawyers, enabling unlawful access to the personal data of many citizens.”
Why 2025 is a 'pivotal year' for the cyber insurance industry - Insurance Business Magazine reports - “‘Annual Insurance Review’, recently published by RPC, offered stark insights into the key issues shaping the cyber insurance industry today” .. “This effectively means less skilled actors have motivation to hack into systems, increasing the overall number of potential attackers. RPC anticipates this will increase the volume of incidents and result in more 'amateurish' incidents in which it sees issues such as incorrectly installed ransomware and accidental deletion – meaning that when a ransom is paid, encryption keys will not enable data to be re-constituted.”
The review’s cyber highlights - RPC publishes - “Despite the improved security posture of organisations, we are continuing to see an increase in the number of ransomware incidents which have hit an all-time high over the course of 2024" .. “Cohesity's Global Cyber Resilience Report 2024, which polled over 3,100 decision-makers across eight countries and multiple sectors, found 53% of UK-based firms that suffered a ransomware attack in the past year had paid a ransom, up from 38% in 2023.”
No reflections this week, but we are recruiting the next NCSC Deputy Director for the UKs Private Sector Critical National Infrastructure. If you are driven by mission and want to have national impact this is your opportunity to shine bright...
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Friday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
APT28, the long hand of Russian interests
Maverits summarises what they are alleged are the activities by APT28 in Ukraine. Worth noting the tradecraft such as living off the land etc.
Main Targets. Ukraine accounts for 37% of APT28’s attacks, with Europe, Central Asia and Caucasus in the focus. The group employs custom backdoors and stealers, leveraging legitimate internet services and living-off-the-land binaries (LOLBINs) for stealthy operations.
Cooperation with Cybercriminals. APT28 has partnered with non-state actors to exploit compromised network devices, turning them into global espionage platforms.
Zero-Day Exploits. APT28 continues to exploit zero-day vulnerabilities, with one major exploit linked to their preparation for the war in Ukraine.
Targeted Industries. Government entities, foreign affairs, and security sectors are primary targets, alongside international organizations and think tanks, reflecting APT28’s strategic objectives.
Espionage Objectives. Beside phishing campaigns, attacks on webmail servers, and the use of custom malware, their activities have expanded, suggesting an increasing emphasis on influence alongside traditional espionage.
https://www.maverits.com/post/apt28-the-long-hand-of-russian-interests
UAC-0063: Cyber Espionage Operation Expanding from Central Asia
Martin Zugec detail a campaign that they link with moderate confidence to Russia. The fact that malicious documents still get traction is probably one of the single biggest travesties.
Initial Access: Threat actors exploited previously compromised victims by weaponizing exfiltrated Microsoft Word documents. These weaponized documents were then used to deliver the HATVIBE malware to new targets.
Data Exfiltration: An USB data exfiltrator we named PyPlunderPlug was discovered on a victim's system. This tool was found alongside a keylogger that is believed to be a precursor to the LOGPIE
Malware Payloads: Intensive monitoring has provided a more detailed understanding of the payloads delivered by DownEx (written in C++) and DownExPyer (written in Python, also known as CHERRYSPY) malware.
Ongoing Operations: The continuous use and maintenance of infrastructure and the weaponization of new documents indicates that these espionage operations are active and ongoing.
Reporting on China
Chinese firm behind hacking operations against Uyghurs and Tibetans unveiled
Intelligence Online alleges that a commercial Chinese company is behind the tooling used against certain minorities. The article is free behind a signup flow..
Intelligence Online can reveal, however, that the company is, in reality, a provider of particularly virulent cyber penetration tools, which are being used to target the Tibetans and Uyghurs, two ethnic groups especially reviled by Beijing.
ScatterBrain: Unmasking the Shadow of PoisonPlug's Obfuscator
Nino Isakovic details an alleged Chinese operation which is using a novel obfuscation capability in an attempt to avoid detection.
GTIG assesses that POISONPLUG is an advanced modular backdoor used by multiple distinct, but likely related threat groups based in the PRC, however we assess that POISONPLUG.SHADOW usage appears to be further restricted to clusters associated with APT41.
..
These operations employ a custom obfuscating compiler that we refer to as "ScatterBrain," facilitating attacks against various entities across Europe and the Asia Pacific (APAC) region.
Reporting on North Korea
Operation Phantom Circuit: North Korea’s Global Data Exfiltration Campaign
STRIKE quantifies the scale of this alleged North Korean supply chain attack. This really should be a rally cry for why developer cyber security is critical. Also noteworthy is the South Asia concentration given the amount of global technology which is developed there.
In December 2024, a routine software update concealed a global threat. Attackers from the Lazarus Group, based in North Korea, infiltrated trusted development tools, compromising hundreds of victims worldwide. This sophisticated campaign, code-named “Phantom Circuit,” targeted cryptocurrency and technology developers, employing advanced obfuscation techniques through proxy servers in Hasan, Russia.
Operation Phantom Circuit unfolded in three waves, compromising over 1,500 systems worldwide:
November 2024: Targeted 181 developers, primarily in European technology sectors.
December 2024: Expanded to hundreds of developers globally, with major hotspots in India (284 victims) and Brazil (32 victims).
January 2025: Added 233 more victims, including 110 systems in India’s technology sector alone.
RID Hijacking Technique Utilized by Andariel Attack Group
ASEC detail the use of this Windows technique which should provide detection opportunity for teams.
Andariel attack group using a malicious file to perform an RID Hijacking attack during the breach process.
Create Account and Add to Group (remote desktop users)
Retrieve the RID of the created account and the target account
Access the F key in the registry of the created account and modify it with the RID value of the target account
Extract the registry
Delete the created account
Add to the registry
https://asec.ahnlab.com/en/85942/
Reporting on Iran
Nothing of note this week
Reporting on Other Actors
Operation (Giỗ Tổ Hùng Vương) Hurricane
Chinese reporting on an alleged Vietnamese operation. The translation is a little clunky, but it implies an update mechanism is used.
The new OceanLotus group sends malicious updates to specific terminals in the intranet through 0day vulnerabilities in terminal software to achieve supply chain attacks.
TAG-124’s Multi-Layered TDS Infrastructure and Extensive User Base
Insikt Group® detail an extensive traffic distribution service which is notable for its scale and complexity. Clearly the business model of providing this type of enabling infrastructure to various criminal operations is viable.
TAG-124 comprises a network of compromised WordPress sites, actor-controlled payload servers, a central server, a suspected management server, an additional panel, and other components. The threat actors behind TAG-124 demonstrate high levels of activity, including regularly updating URLs embedded in the compromised WordPress sites, adding servers, refining TDS logic to evade detection, and adapting infection tactics, as demonstrated by their recent implementation of the ClickFix technique.
[We] identified multi-layered infrastructure linked to a TDS tracked as TAG-124. This infrastructure includes a network of compromised WordPress sites, likely actor-controlled payload servers, a central server, a suspected management server, and an additional panel, among other components.
The threat actor(s) associated with TAG-124 appear highly active, regularly updating URLs on compromised WordPress sites to evade detection, adding new servers to their infrastructure, and improving TDS-linked conditional logic and infection tactics.
Multiple threat actors are assessed to incorporate TAG-124’s service into their initial infection chains, including operators of Rhysida ransomware, Interlock ransomware, TA866/Asylum Ambuscade, SocGholish, D3F@CK Loader, TA582, and others.
While Rhysida and Interlock ransomware have been associated with each other due to similarities in tactics, tools, encryption behaviors, ransom note themes, overlaps in code, and data exfiltration techniques, the shared use of TAG-124 reinforces this connection.
https://www.recordedfuture.com/research/tag-124-multi-layered-tds-infrastructure-extensive-user-base
Campaign Exploiting SimpleHelp RMM Software for Initial Access
Arctic Wolf flag some initial access techniques, but do not have the fidelity to ascertain specifically if the vulnerabilities are the root cause, which is interesting.
On January 22, 2025, Arctic Wolf began observing a campaign involving unauthorized access to devices running SimpleHelp RMM software as an initial access vector. Roughly a week prior to the emergence of this campaign, several vulnerabilities had been publicly disclosed in SimpleHelp by Horizon3 (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728). On affected SimpleHelp servers, these vulnerabilities could allow threat actors to download arbitrary files, upload arbitrary files as an administrative user, and escalate privileges to administrative users. If a threat actor chains these vulnerabilities together and gains administrative access to a SimpleHelp server, they could theoretically use it to compromise devices running the SimpleHelp client software.
While it is not confirmed that the recently disclosed vulnerabilities are responsible for the observed campaign, Arctic Wolf strongly recommends upgrading to the latest available fixed versions of the SimpleHelp server software where possible.
New TorNet backdoor seen in widespread campaign
Chetan Raghuprasad details a campaign which highlights the detection opportunity if you focus on scheduled tasks on Windows.
Cisco Talos discovered an ongoing malicious campaign operated by a financially motivated threat actor since as early as July 2024 targeting users, predominantly in Poland and Germany, based on the phishing email language.
The actor has delivered different payloads, including Agent Tesla, Snake Keylogger, and a new undocumented backdoor we are calling TorNet, dropped by PureCrypter malware.
The actor is running a Windows scheduled task on victim machines—including on endpoints with a low battery—to achieve persistence.
The actor also disconnects the victim machine from the network before dropping the payload and then connects it back to the network, allowing them to evade detection by cloud antimalware solutions.
We also found that the actor connects the victim’s machine to the TOR network using the TorNet backdoor for stealthy command and control (C2) communications and detection evasion.
https://blog.talosintelligence.com/new-tornet-backdoor-campaign/
Discovery
How we find and understand the latent compromises within our environments.
A Network Threat Hunter’s Guide to C2 over QUIC
Faan Rossouw does some exquisite work here on detection tradecraft. There will be some aspects of this which are generically applicable.
Using RITA, we consistently detected Merlin’s C2 over QUIC activity owing to its persistent connection pattern. This demonstrates RITA’s protocol-agnostic strength – whether traffic flows over HTTP/1.1, HTTP/2, or HTTP/3, RITA focuses on the universal characteristic that matters most: connection duration.
..
Our third discovery was Merlin’s distinctive abbreviated handshake pattern. This unique signature, visible in Zeek’s quic.log, can be detected through simple pattern matching, providing an additional method for identifying Merlin’s C2 traffic.
https://www.activecountermeasures.com/a-network-threat-hunters-guide-to-c2-over-quic/
Defence
How we proactively defend our environments.
Series on Active Directory Hardening by Microsoft
Jerry Devore delivers the wisdom from inside Redmond..
https://techcommunity.microsoft.com/tag/adhardening
seccomp diff
Mark Manning releases a work aid which will help the more sophisticated end of the spectrum in terms of security engineering.
Analyze binaries and containers to extract and disassemble seccomp-bpf profiles. This tools is designed to help you determine whether or not a given seccomp-bpf profile is more or less constrained than others as well as give you the ground truth for the filters applied to a process.
https://github.com/antitree/seccomp-diff
AttackRuleMap
Burak Karaduman provides a resource for those seeking to understanding their detection coverage. Great to satisfy management/auditors that the blueteam have it covered..
This repository provides a mapping of Atomic Red Team attack simulations to open-source detection rules, such as Sigma and Splunk ESCU.
The goal of this project is to bridge the gap between Atomic Red Team's adversary simulations and open-source detection rules. By doing so, this project aims to help security professionals simulate attacks and evaluate their detection strategies more effectively.
https://github.com/krdmnbrk/AttackRuleMap
Trail Discover
Adan Álvarez releases a thing of wonder here with a magic decoder ring for AWS cloud trail events..
An evolving repository of CloudTrail events with detailed descriptions, MITRE ATT&CK insights, real-world incidents references, other research references and security implications.
https://github.com/adanalvarez/TrailDiscover
Incident Writeups & Disclosures
How they got in and what they did.
The Phemex Exchange Exploit: A Deep Dive into the $37 Million Hack
Fascinating write up of when smart contracts bite and cost millions..
The vulnerability that allowed this hack was primarily due to inadequate access control within Phemex’s hot wallet management system. The specific weaknesses included:
Weak Access Controls: The attackers exploited flaws in how permissions were managed within the smart contracts governing the hot wallets. This lack of stringent access controls enabled unauthorized withdrawals.
Cross-Chain Exploitation: The attackers demonstrated sophisticated techniques by executing over 125 suspicious transactions across various networks. This multi-chain approach not only obscured their actions but also complicated recovery efforts.
Vulnerability
Our attack surface.
RANsacked
Nathaniel Bennett, Weidong Zhu, Benjamin Simon, Ryon Kennedy, William Enck, Patrick Traynor and Kevin R. B. Butler show the value of domain-informed fuzzing in 2025. Note none of the implementations affected are the big commercial end, likely due to access. But I would be shocked if this did not find implementation flaws in those as well.
A Domain-Informed Approach for Fuzzing LTE and 5G RAN-Core Interfaces
..
In this work, we devise a fuzzing framework that performantly fuzzes cellular interfaces accessible from a base station or user device, overcoming several challenges in fuzzing specific to LTE/5G network components. We also introduce ASNFuzzGen, a tool that compiles ASN.1 specifications into structure-aware fuzzing modules, thereby facilitating effective fuzzing exploration of complex cellular protocols. We run fuzzing campaigns against seven open-source and commercial cores and discover 119 vulnerabilities, with 93 CVEs assigned. Our results reveal common implementation mistakes across several cores that lead to vulnerabilities, and the successful coordination of patches for these vulnerabilities across several vendors demonstrates the practical impact ASNFuzzGen has on hardening user-exposed cellular systems.
https://nathanielbennett.com/publications/ransacked.pdf
https://cellularsecurity.org/ransacked.html
SLAP and FLOP
Jason Kim, Jalen Chuang, Daniel Genkin and Yuval Yarom present two speculative execution attacks on Apple silicon. A reminder that the performance gains we have seen in CPUS has in part caused these types of issues to manifest.
We present SLAP, a new speculative execution attack that arises from optimizing data dependencies, as opposed to control flow dependencies. More specifically, we show that Apple CPUs starting with the M2/A15 are equipped with a Load Address Predictor (LAP), which improves performance by guessing the next memory address the CPU will retrieve data from based on prior memory access patterns.
..
We present FLOP, another speculative execution attack that results from recent Apple CPUs predicting the outcome of data dependencies. Here, we demonstrate that Apple's M3/A17 generation and newer CPUs are equipped with a Load Value Predictor (LVP). The LVP improves performance on data dependencies by guessing the data value that will be returned by the memory subsystem on the next access by the CPU core, before the value is actually available.
Offense
Attack capability, techniques and trade-craft.
Exploring WinRM plugins for lateral movement
Arnau Ortega highlights a lateral movement technique which in the context of living off the land teams will want to ensure detection coverage of.
we explore how to leverage WinRM plugins to perform lateral movement to other systems. We also take a look at how the
CIM_LogicFileWMI class can be used to bypass some tricky detections by Microsoft Defender. Finally, we put all the logic in a Cobalt Strike BOF.
https://medium.com/falconforce/exploring-winrm-plugins-for-lateral-movement-12da506b44c1
Windows Exploitation Tricks: Trapping Virtual Memory Access (2025 Update)
James Forshaw evolves this technique which detection teams will want to ensure coverage of.
The solutions proposed in the blog post were to either map an SMB file on a remote server, or abuse the Cloud Filter API. This blog isn't going to provide new solutions, instead I wanted to highlight a new feature of Windows 11 24H2 that introduces the ability to abuse the SMB file server directly on the local machine, no remote server required.
https://googleprojectzero.blogspot.com/2025/01/windows-exploitation-tricks-trapping.html
Exploitation
What is being exploited..
Hackers Actively Exploiting Fortinet Firewalls: Real-Time Insights from GreyNoise
Noah Stone gives a sense of the scale of the activity against these devices..
Malicious (35 IPs): Actively scanning, probing, or delivering malicious payloads.
Suspicious (45 IPs): Abnormal or pre-malicious behavior flagged under GreyNoise’s new “Suspicious” classification, designed to provide early warnings.
Unknown (286 IPs): Activity that doesn’t match known tags but is inherently suspect, as Fortinet firewalls shouldn’t scan or probe networks. This suggests the devices are being leveraged for malicious purposes.
WMI virus
Pulpocaminante delivers something which apparently includes a zero-day.
Proof of concept WMI virus. Does what it looks like it does. Virus isn't stored on the filsystem (in any way an AV would detect), but within the WMI. Contains PoC code for extracting it from the WMI- which can also be achieved at boot from within the WMI itself using powershell. So, self-extracting WMI virus that never touches the disk.
https://github.com/pulpocaminante/Stuxnet/
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers…
Introducing sealed types
or why CHERI is awesome by David Chisnall … if the value of CHERI was not clear enough.
Sealing is one of the most important parts of CHERI because it enables usable compartmentalised interfaces. Sealing lets you build type-safe opaque types that are safe in the presence of mutual distrust and delegation. In the most recent updates to the compiler and RTOS, we’ve made this even more friendly for programmers.
https://cheriot.org/sealing/compiler/2025/01/30/introducing-sealed-types.html
NT Load Order
Colin Finck is back with part 2 and again shows the value of deeply understanding systems..
However, Windows is a different breed and loads a fourth hardcoded driver, namely the CPU microcode updater
mcupdate.dll. This driver is different depending on the detected CPU, which is why it’s actually calledmcupdate_AuthenticAMD.dllin the filesystem of my machine. Nevertheless, theBaseDllNameset in theKLDR_DATA_TABLE_ENTRYstructure is alwaysmcupdate.dll.
https://colinfinck.de/posts/nt-load-order-part-2/
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Aggregate reporting
Nothing of note this week
The Professional Development Framework for all-source intelligence assessment - UK Government
The rise of open-source intelligence - European Journal of International Security
Ads on X spoofing Canadian news part of growing disinformation trend: analyst - CTV publishes
Building a ‘honeypot’ of fake cameras, networks to deceive military adversaries
Australian Researchers Detect Fast Radio Bursts and Other Space Phenomena
Artificial intelligence
GenAI Red Teaming Guide - OWASP Top 10 for LLM & Generative AI Security
7B Model and 8K Examples: Emerging Reasoning with Reinforcement Learning is Both Effective and Efficient - replicates DeepSeek-R1-Zero and DeepSeek-R1 training on small models with limited data - blog on it.
Books
Grassroots Governance in China - “Presents the first comprehensive empirical analysis of China's six core grassroots social governance strategies”
Events
Nothing of note this week
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.