CTO at NCSC Summary: week ending July 13th
AI its identify and access management challenge.. the next frontier..
Welcome to the weekly highlights and analysis of the blueteamsec subreddit (and my wider reading). Not everything makes it in, but the best bits do.
Operationally this week nothing overly of note..
In the high-level this week:
UK economic security - UK Business and Trade Sub-Committee on Economic Security, Arms and Export Controls takes oral evidence on cyber - videos and transcripts available
Hackers tried to 'destroy' M&S, chair tells MPs - BBC reports
M&S boss says two big UK firms hit by unreported cyber-attacks - The Guardian reports
Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods - National Crime Agency announces - “Two males aged 19, another aged 17, and a 20-year-old female were apprehended in the West Midlands and London this morning (10 July) on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.”
Iran - UK Intelligence and Security Committee of Parliament publishes - “Iran’s intelligence services are “ferociously well-resourced” by comparison with its size and economy, and have significant areas of asymmetric strength – notably cyber. Iranian espionage poses a significant threat to the UK and its interests, albeit as a target the UK appears to remain just below the US, Israel and Saudi Arabia”
DSIT cyber security newsletter - June 2025 - UK Department for Science, Innovation and Technology publishes - summary of the impact our policy peers are having..
Overview of the Cyber Security Charter for Suppliers to the NHS - NHS webinar - on 24 July 2025 2:00pm – 3:00pm UK - “This session will take you through the cyber security charter for suppliers, explaining the context for why this was developed, along with details of how suppliers can sign up to the charter.”
Annual Report of the Security Information Service [of the Czech Republic] - Czech Republic publishes - “After a temporary decrease during the initial invasion of Ukraine, the activity of Russian state and state-supported cyber actors in the Czech Republic returned to pre-war levels”
The new EU Product Liability Directive: Implications for software, digital products, and cybersecurity - Reed Smith LLP analyses - “The PLD explicitly includes software, AI, and digital services within the definition of “products” subject to strict liability. Non-compliance with cybersecurity requirements or failure to provide security updates can constitute a product defect.”
Forging Forward: South Korea’s Proactive Cyber Defense and Strategic Cooperation with the United States - Center for Strategic & International Studies publishes - “In February 2024, then-President Yoon Suk Yeol’s administration made public the second National Cybersecurity Strategy, which shifted South Korea’s approach to an offensive posture. In the 2024 strategy, the country set the “development of offensive cyber defense and response capabilities” as one of three primary objectives crucial to fulfilling its strategic vision of acting as a “global pivotal state.” To that end, South Korea set forth five strategic tasks, one of which is “enhancing offensive cyber defense activities.”
A Cyberattack Severity Classification Framework for the Republic of Korea - Center for Strategic & International Studies publishes -”A national framework for classifying cyberattack severity enhances objectivity, guiding policy decisions and facilitating mutual understanding between nations. Although South Korea has shown strong political will to respond to malicious cyber activities, it lacks a clear legal and policy framework for response procedures. To fill this gap, this paper proposes a Cyberattack Severity Classification Framework (CSCF) to objectively assess and categorize cyberattacks, supporting informed decisionmaking.”
SASC to Pentagon: you need a new cyber-deterrence plan - DefenceOne reports - “In its version of the 2026 National Defense Authorization Act, the Senate Armed Services Committee would require the Pentagon to develop a strategy to “reestablish a credible deterrence against cyberattacks targeting American critical infrastructure using the full spectrum of military operations,” according to an executive summary of the bill that was marked up and passed in closed sessions this week.”
Ontario architect's seal forged by remote worker believed to be North Korean fraudster - CBC News reports - “An imposter, believed to be North Korean, forged the official seal of an Ontario architect, an investigation by The Fifth Estate has found.” - when cyber leads to potentially very real physical implications.
Germany seeks Israeli partnership on cyberdefence, plans 'cyber dome' - Reuters reports - “Germany is aiming to establish a joint German-Israeli cyber research centre and deepen collaboration between the two countries' intelligence and security agencies, German Interior Minister Alexander Dobrindt said on Sunday.” - this is interesting as I was envious of Germany for having the Helmholtz Center for Information Security
War and Law in a Digital World - Carnegie Endowment for International Peace publishes - “The first question is whether data is an “object” for the purposes of the targeting rules of the law of armed conflict. This matters because the principle of distinction only protects civilian objects: if data is not an object, the principle of distinction does not prevent the destruction of potentially vast quantities of data, including of the type held by Russia’s tax authorities. The question is debated in the literature and has not been conclusively answered in state practice.”
Reporting on/from China
NSB Alerts the Significant Cybersecurity Risks in China-Made Mobile Applications - National Security Bureau, Taiwan publishes - “The 5 China-developed apps selected for inspection, consisting of rednote, Weibo, TikTok, WeChat, and Baidu Cloud, are widely used by Taiwanese nationals”
Cyber Intelligence and the New Cold War in Southeast Asia - Modern Diplomacy asserts - “China emphasizes the importance of data sovereignty as part of its national strategy and technology exports. Among the most crucial is Data Localization where DSR partner countries are encouraged to store critical data domestically, often in data centers built and operated by Chinese companies. This makes it easier for the Chinese government to control and access data if needed. Not to mention access to data obtained from companies even abroad. The digital infrastructure built by China is often equipped with sophisticated surveillance systems, allowing for monitoring of communications, internet activity, and even facial recognition in public spaces.”
Mobilizing Cyber Power: The Growing Role of Cyber Militias in China’s Network Warfare Force Structure - Margin Research analyses “PLA military officials and defense academicians have identified cyber militia forces as a vital supporting force for network operations in specific scenarios, such as a future Taiwan invasion contingency or crisis in the South China Sea. These units’ familiarity with relevant local civilian networks, distributed architecture, and flexibility of employment offer the PLA a means of shoring up over-stretched active-duty units during periods of high demand.”
The [Spanish] government pays 12 million [EUR] to China's Huawei to protect police wiretaps - elLibreral reports - “The system used is the OceanStor 6800 V5 , a line of high-performance storage servers developed by Huawei. This equipment supports the preservation and classification of communications legally intercepted by state security forces, in compliance with the ICT Security Guidelines developed by the National Cryptologic Center (CCN-STIC) and the requirements of the National Security Framework”
Pick Your Innovation Path in AI: Chinese Edition - Natto Team analyse - “The development of the Loongson CPU chip, which based its design on the non-mainstream MIPS architecture by a U.S. fabless semiconductor design company (i.e. one that designs but does not build chips), exemplifies “overtaking on curves,” whereas Sugon’s joint venture deal with U.S. chip developer AMD exemplifies the “re-innovation” approach.”
Chinese chipmaker Sophgo adapts compute card for DeepSeek in Beijing’s self-reliance push - South China Morning Post reports - “Sophgo attributed the progress to several innovations in the FP300 compute card, which was released last year. In particular, it features 256 gigabytes of high-bandwidth memory and offers up to 1.1 terabytes per second of memory bandwidth, enabling faster data transfer during model training and execution.”
Baidu the latest to join open-source movement with Ernie 4.5 models publicly available - South China Morning Post reports - “Baidu open-sourced 10 variants from its Ernie 4.5 multimodal model family, from the 0.3 billion parameter lightweight models to the heavyweight 424 billion parameter ones, according to a statement”
Top OpenAI talent from China joins Meta as Zuckerberg bolsters AI team in tech battle - South China Morning Post reports - “Meta’s hiring of Zhao Shengjia, Ren Hongyu, Yu Jiahui and Bi Shuchao, reported by US tech news outlet The Information, was partially confirmed by Alexandr Wang, head of Meta’s AI unit and former CEO of Scale AI, in a social media post over the weekend.”
AI
Seeking Deeper: Assessing China’s AI Security Ecosystem - Centre for Emerging Technology and Security, The Alan Turing Institute publish - ”Senior scientists hold considerable influence over China’s AI policymaking process, frequently serving on government advisory panels”
Bypassing Meta’s Llama Firewall: A Case Study in Prompt Injection Vulnerabilities - Trendyol Tech publishes - “our findings show that its current implementation can be bypassed with relatively simple techniques. The challenges of defending against prompt injection are significant and require a multi-layered defense that can understand context, different languages, and various forms of obfuscation.”
Cyber Command creates new AI program in fiscal 2026 budget - Defence Scoop reports - “While the budget proposal would allot just $5 million for the effort — a small portion of Cybercom’s $1.3 billion research and development spending plan — the stand-up of the program follows congressional direction to prod the command to develop an AI roadmap.”
Government [of New Zealand] unveils its first-ever national artificial intelligence strategy - RNZ reports “The plan - which was developed with the assistance of AI - positions New Zealand as a "sophisticated adopter" rather than as an inventor of new foundational models.” w
US Plans AI Chip Curbs on Malaysia, Thailand Over China Concerns - Bloomberg reports - “The draft rule from the Commerce Department would pair the new controls with a formal rescission of global curbs from the AI diffusion rule, while maintaining semiconductor restrictions targeting China and over 40 other countries.”
Apple supplier Foxlink banks on Nvidia tools for pivot to robots - Nikkei Asia reports - “Foxlink, a longtime provider of components to Apple, is looking to ride the artificial intelligence boom to transform itself into an AI robotic software supplier by 2030, a company executive told Nikkei Asia.”
Powering the AI Era (Data Centre Diplomacy) - Goldman Sachs analyses - discusses data centre diplomacy.
Cyber proliferation
Balancing Secrecy and Transparency in Bug Bounty Programs - Communications of the ACM asserts - “BBPs are valuable tools for identifying vulnerabilities, but the current system’s emphasis on secrecy over transparency leaves users and investors in the dark about software security.”
Lawfare Daily: The Offensive Cyber Industry and U.S.-China Relations with Winnona Bernsen - Lawfare podcasts - “They discuss the offensive cyber industry, the private sector and individual players, and the government procurement pipelines in the United States and China. They also discuss the strengths and weaknesses of each country’s offensive cyber procurement ecosystem, what it takes to sell an exploit, Winnona’s findings on the markups that middlemen add to exploit sales, and what it all means for the future of competition and cybersecurity.”
We invested $25 million in the president": The secret arbitration that reveals how Avishai Neriah and Uri Ansbacher divided Mexico between them - The Marker reports - “The most famous of the deals they brokered was the sale of Pegasus, the rogueware of Israeli cyber-attack manufacturer NSO, to several authorities in the country”
Bounty Hunting
Retail cyber attacks: NCA arrest four for attacks on M&S, Co-op and Harrods - National Crime Agency announces - “Two males aged 19, another aged 17, and a 20-year-old female were apprehended in the West Midlands and London this morning (10 July) on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.”
Sanctions Imposed on DPRK IT Workers Generating Revenue for the Kim Regime - US Treasury announces - “Song facilitated an information technology (IT) worker scheme in which individuals, often DPRK nationals working from countries such as China and Russia, were recruited and provided with falsified identities and nationalities to obtain employment at unwitting companies to generate revenue for the DPRK regime.”
Justice Department Announces Arrest of Prolific Chinese State-Sponsored Contract Hacker - US Department of Justice announces - “The Justice Department announced today that Xu Zewei (徐泽伟), 33, of the People’s Republic of China was arrested on July 3 in Italy at the request of the United States. Xu and his co-defendant, PRC national Zhang Yu (张宇), 44, are charged in a nine-count indictment, unsealed today in the Southern District of Texas, for their involvement in computer intrusions between February 2020 and June 2021, including the indiscriminate HAFNIUM computer intrusion campaign that compromised thousands of computers worldwide, including in the United States. Xu was arrested in Milan, Italy”
Moscow demands access to Russian basketball player held in France - Reuters reports - “Russia's embassy in Paris on Thursday demanded consular access to a Russian basketball player, Daniil Kasatkin, whose lawyer said was detained in France at the request of the United States on suspicion of being part of a hacking network.”
UNITED STATES OF AMERICA v CHRISTINA CHAPMAN - US Courts publish - “a total sentence of 111 months of incarceration, 36 months of supervised release, and a special assessment of $300. The government also requests a money judgment in the amount of $176,850 (the amount Defendant charged her co-conspirators for her services in the scheme).” for enabling DPRK IT workers.
Prison sentence for man who shared high-tech company information with a person in Russia - de Rechtspaark reports - “The suspect also committed computer hacking: he intentionally, without permission, and for a purpose other than his work, gained access to ASML and NXP systems. Based on the case file, the court cannot determine exactly when the suspect logged in to copy files from his work databases and assumes this occurred during the period he worked at ASML and NXP.”
2025 State of Cyber Risk Management Report - Fair Institute publish - “Data is foundational. Organizations use a wide variety of telemetry, threat, and compliance data to inform their decisions. Those who can operationalize this data gain a clearer and more defensible picture of their risk exposure.”
Sophisticated impersonation behind £300 million cyber attack - Insurance Business Magazine reports - “Importantly for the insurance community, he noted that M&S had increased its cyber coverage last year – an investment now set to be tested by one of the largest claims of its kind in the UK retail sector.”
Reflections this week are around agentic AI and its future identity and access management challenges..
As we inch closer to the pervasively agentic world where we wrangle agents in our work how or if we allow these systems to assume identity and inherent any finely grained access management on a ephemeral basis for those wrangling is quite the knotty problem..
.. I am not convinced trying to embed into every agent or framework their own discrete identity and access control mechanisms isn’t going to lead to a subpar outcome.
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Saturday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
Unit 29155 - APT28 - GosSOPKA
Treadstone71 detail the alleged operations and structure of this Russian state actor.
This triad of intelligence reports presents a comprehensive exploration of Russia’s integrated cyber warfare doctrine, where digital intrusion, kinetic disruption, and state-controlled defense architecture operate in concert. The strategic analysis of APT28, or Fancy Bear, charts the rise of one of the most formidable GRU-affiliated cyber units, detailing its global operations against political institutions, military entities, and democratic processes. In parallel, the updated review of GRU Unit 29155 unveils a hybrid threat actor that merges sabotage, disinformation, and offensive cyber capabilities, exposing both operational successes and internal vulnerabilities. Contrasting these offensive vectors is GosSOPKA, Russia’s national cybersecurity defense system, whose visuals and architecture diagrams reveal a centralized, surveillance-oriented infrastructure managed by the FSB. By examining these elements together, the reports decode a Janus-faced cyber strategy—one side wielding disruption abroad, the other enforcing digital sovereignty at home. Together, they offer a rare window into the structural logic, inter-agency dynamics, and evolving priorities behind Moscow’s asymmetric campaigns across the information domain.
https://treadstone71.com/index.php/unit-29155-apt28-gossopka
Reporting on China
State Secrets for Sale: More Leaks from the Chinese Hack-for-Hire Industry
SpyCloud Labs Research Team details alleged data leaks from alleged Chinese threat actors. No ability to confirm, but will be of potential interest to some if true..
The documents that piqued our interest the most were the three spreadsheets towards the top of the post, which appear to contain details on Chinese government contracts and offensive services. The selected portions of the spreadsheets don’t contain column headers, complicating interpretations of the data, but two of them (Image 2 and Image 3) appear to contain detailed line items of collections targets and already hacked organizations.
..
The next sample advertised by ChinaBob appears to show IP addresses of routers that were allegedly hacked by Salt Typhoon and associated usernames. The post indicates that the full dataset for sale will contain information on 242 hacked routers, including their passwords.
https://spycloud.com/blog/state-secrets-for-sale-chinese-hacking/
Reporting on North Korea
Analysis of HappyDoor backdoor attack based on VMP strong shell by APT-C-55 (Kimsuky) organization
Chinese reporting on a alleged North Korean operation which is not really noteworthy but does give insight into their approach and why mitigations against malicious email payloads pays dividends.
Kimsuky launches phishing attacks by forging Bandizip installation packages. When users run the installation package, the normal Bandizip program will be released and installed on the surface to reduce suspicion, but the script will be loaded remotely in the background, and multiple layers of malicious scripts will be downloaded and executed in stages. At the same time, a malicious payload packed with vmp will be released and run to steal sensitive information.
https://mp.weixin.qq.com/s/fDan8ihUQEAF5Kf_6fXATQ
Reporting on Iran
Cyber threat bulletin: Iranian cyber threat to Canada from Israel-Iran conflict
Our friends at the Canadian Centre for Cyber Security have published this analysis which highlights the risk of conflict spillover in the technological domain.
It is very unlikely that Canada’s critical infrastructure and other Canadian networks are a priority target for retaliatory Iranian cyber threat activity. Canada was not a party to the U.S. and Israeli strikes against Iran. However, we assess that Canada would likely be an indirect or collateral victim of Iranian cyber threat activity that is intended to target the U.S. In addition, Iran will likely continue to engage in cyber-enabled transnational repression against individuals in Canada that the Iranian regime considers a threat, especially those advocating for regime change in Iran.
Leaked materials came from previously reported cyberattacks, Iran International confirms
Iran International details this alleged Iranian operation with some very specific alleged attribution..
The attacks were carried out by the cyber group known as Banished Kitten (also referred to as Storm-0842 and Dune). The group operates under the Cyber Threat Countermeasures Unit of the Domestic Security Directorate of Iran’s Ministry of Intelligence, under the supervision of Yahya Hosseini Panjaki, whose
identity was first exposed by Iran International.
https://www.iranintl.com/en/202507084950
Reporting on Other Actors
Phishing Attack : Deploying Malware on Indian Defense BOSS Linux
CYFIRMA details an alleged Pakistani campaign which is noteworthy for targeting a specific Linux distribution and who uses it coupled. Also the fact that tradecraft we are well experienced of in relation to other operating systems appears to have transitioned and been effective in the Linux eco-system…
This campaign specifically targets personnel within the Indian defense sector. In a notable shift from previous methodologies, APT36 has adapted its tactics to focus on Linux-based environments, with a particular emphasis on systems running BOSS Linux, a distribution extensively utilized by Indian government agencies.
The attack vector involves the dissemination of phishing emails containing a ZIP file attachment that houses a malicious .desktop file, which serves as a Linux shortcut. Upon execution by the victim, the file triggers a dual-action mechanism: it downloads and opens a legitimate PowerPoint (.pptx) file to create a facade of authenticity and divert the user’s attention, while simultaneously downloading and executing a malicious ELF (Executable and Linkable Format) binary in the background.
https://www.cyfirma.com/research/phishing-attack-deploying-malware-on-indian-defense-boss-linux/
From Click to Compromise: Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities
Aniket Choukde, Aparna Aripirala, Alisha Kadam, Akhil Reddy, Pham Duy Phuc and Alex Lanstein details an alleged campaign which is noteworthy due to its victimology.
Trellix Advanced Research Center's ongoing hunting efforts have uncovered a sophisticated campaign attributed to the DoNot APT group targeting a European foreign affairs ministry highlighting the evolving tactics of the group. The attackers impersonated European defense officials mentioning their visit to Bangladesh and lured their targets to click on a malicious Google Drive link. This delivered a malicious RAR archive, ultimately deploying malware consistent with the group's known toolset.
GoldMelody’s Hidden Chords: Initial Access Broker In-Memory IIS Modules Revealed
Tom Marsden and Chema Garcia report on an alleged criminal operation which is noteworthy for a degree of forensic avoidance.
[We] uncovered a campaign by an initial access broker (IAB) to exploit leaked Machine Keys — cryptographic keys used on ASP.NET sites — to gain access to targeted organizations. IABs breach organizations and then sell that access to other threat actors.
..
The IAB used these leaked keys to sign malicious payloads that provide unauthorized access to targeted servers, in a technique called ASP.NET View State deserialization. This technique enabled the IAB to execute malicious payloads directly in server memory, minimizing their on-disk presence and leaving few forensic artifacts, making detection more challenging.
https://unit42.paloaltonetworks.com/initial-access-broker-exploits-leaked-machine-keys/
Malvertising Campaign Delivers Oyster/Broomstick Backdoor via SEO Poisoning and Trojanized Tools
Andres Ramos details a criminal campaign which shows all that glitters isn’t gold in the advertising and search engine eco-systems in terms of ensuring they aren’t being misused.
[We] observed a search engine optimisation (SEO) poisoning and malvertising campaign promoting malicious websites hosting Trojanized versions of legitimate IT tools such as PuTTY and WinSCP.
These fake sites aim to trick unsuspecting users—often IT professionals—into downloading and executing Trojanized installers. Upon execution, a backdoor known as Oyster/Broomstick is installed. Persistence is established by creating a scheduled task that runs every three minutes, executing a malicious DLL (twain_96.dll) via rundll32.exe using the DllRegisterServer export, indicating the use of DLL registration as part of the persistence mechanism. While only Trojanized versions of PuTTY and WinSCP have been observed in this campaign, it is possible that additional tools may also be involved.
Discovery
How we find and understand the latent compromises within our environments.
Suspicious Browser Child Process
Bert-Jan Pals does what he does best with this KQL to detect the ‘filefix’ exploitation technique.
This detection detects when a browser has a suspicious child process, this child process can execute/install commands and is often used to install malware on systems.
Potential secretsdump remoteSSMethod - SAM, SECURITY and SYSTEM Accessed Remotely
Aura is back with more KQL to identify adversarial behaviour..
This query looks for Event ID 5145 where one of the accessed file is the SAM, SECURITY or SYSTEM Registry Hive. Which means, Audit Detailed File Share must be enabled on the target system for these events to be logged.
Defence
How we proactively defend our environments.
Turning incident response challenges into scalable solutions
Zawadi Done shows some innovation in incident response for others to learn from.
In addition, we showcased these advantages at the SANS DFIR summit 2024, demonstrating how incident response can be performed scalable and fast within minutes. We achieve this by applying an automated incident response strategy that combines the investigative prowess of a digital detective with a DevOps mindset, enabling fast and scalable investigations.
As a result of this strategy, we built an innovative cloud-based incident response lab, as shown in Figure 1, that can initiate investigations within 15 minutes.
https://www.huntandhackett.com/blog/turning-incident-response-challenges-into-scalable-solutions
Cacography based Ransomware Email Phishing Attack Prevention using Language Pack Tuned Transformer Language Model
S. Abiramasundari and V. Ramaswamy shows the value of AI when applied to a unique set of phishing challenges..
This paper proposes a Language Pack-based Tuned Transformer Language (LPTTL) framework for email body text analysis, which prevents REP attacks. LPTTL framework consists of cacography algorithms such as (i) Language Pack Tuned Bidirectional Encoder Representation Transformer (LPT-BERT), (ii) Text-Text Transfer Transformer (LPT-T5) algorithms for detecting REP attacks through tokenizing the words and embedded email body words. Next, the proposed classification algorithms are (i) Lyrebird Optimization Algorithm—Long Short-Term Memory (LOA-LSTM), (ii) Hippopotamus Optimization (HO)-Gated Recurrent Neural Network (HO-GRU) and (iii) Meerkat Optimization Algorithm-Bidirectional Long Short-Term Memory (MOA-BiLSTM) which are used for REP classification based on tokenized text. LPTTL framework has an accuracy of about 95.47%, precision of 96.8%, recall of 95.63% and F1-score of 96.21% compared to existing methods.
https://www.nature.com/articles/s41598-025-06530-8
Frontdoor WAF
nyxgeek provides a script to detect this insecure configuration is Azure and which highlights a cloud trip hazard.
Script to check Azure Front Door WAF for insecure RemoteAddr variable
..
Azure Front Door WAF has an option to perform "IP Matching" with the RemoteAddr variable. If configured this way, the WAF is vulnerable to bypass by supplying an X-Forwarded-For header with an appropriate (approved) IP addres
https://github.com/nyxgeek/frontdoor_waf_wtf
‘It's Not Paranoia If They're Really After You’: When Announcing Deception Technology Can Change Attacker Decisions
Andrew Reeves and Debi Ashenden published this in January and I missed it. Shows the value of announcing the presence of deception technology.
We present an ongoing mixed method study to better understand how attackers move through a network when they are aware of the presence of deception. Thematic analysis of think-aloud sessions revealed three key decision-making themes. Themes suggest that several industry heuristics for the use of decoys may be inaccurate and impact the efficacy of decoy placement strategies. In addition, effect sizes indicate that awareness of deception leads attackers to take longer paths through the network, although no more decoys were required to detect them.
https://scholarspace.manoa.hawaii.edu/items/88cd00a5-914f-456e-a322-01c22fd5b7d7
Kanvas
WithSecure release this lightweight incident response case management tool which will be useful to low resource environments who lack anything..
KANVAS is an IR (incident response) case management tool with an intuitive desktop interface, built using Python. It provides a unified workspace for investigators working with SOD (Spreadsheet of Doom) or similar spreadsheets, enabling key workflows to be completed without switching between multiple applications.
https://github.com/WithSecureLabs/Kanvas
Clickfix mitigation
Alfie Champion provides a security / usability tradeoff to mitigate..
ClickFix mitigation of ‘disabling’ the Win+R shortcut
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
NoRun
DWORD 1also prevents exploitation of the address bar FileFix technique
https://x.com/ajpc500/status/1941443569199481134?t=7lc8e3PyZuZKqJSS_lImeA&s=19
Incident Writeups & Disclosures
How they got in and what they did.
Ingram Micro Holding Corp Cybersecurity Incident
Ingram disclose they had an incident but not the detail..
Ingram Micro recently identified ransomware on certain of its internal systems. Promptly after learning of the issue, the Company took steps to secure the relevant environment, including proactively taking certain systems offline and implementing other mitigation measures. The Company also launched an investigation with the assistance of leading cybersecurity experts and notified law enforcement.
Ingram Micro is working diligently to restore the affected systems so that it can process and ship orders, and the Company apologizes for any disruption this issue is causing its customers, vendor partners, and others.
Vulnerability
Our attack surface.
Recurring Vulnerability Detection: How Far Are We?
Yiheng Cao, Susheng Wu, Ruisi Wang, Bihuan Chen, Yiheng Huang, Chenhao Lu, Zhuotong Zhou and Xin Peng welcome us to a free vulns era due to code propagation..
we conduct a large-scale empirical study using a newly constructed RV dataset containing 4,569 RVs, achieving a 953% expansion over prior RV datasets. Our study analyzes the characteristics of RVs, evaluates the effectiveness of the state-of-the-art RVD approaches, and investigates the root causes of false positives and false negatives, yielding key insights. Inspired by these insights, we design AntMan, a novel RVD approach that identifies both explicit and implicit call relations with modified functions, then employs inter-procedural taint analysis and intra-procedural dependency slicing within those functions to generate comprehensive signatures, and finally incorporates a flexible matching to detect RVs. Our evaluation has shown the effectiveness, generality and practical usefulness in RVD. AntManhas detected 4,593 RVs, with 307 confirmed by developers, and identified 73 new 0-day vulnerabilities across 15 projects, receiving 5 CVE identifiers.
https://dl.acm.org/doi/10.1145/3728901
their related paper I covered last week On the Effectiveness of Function-Level Vulnerability Detectors for Inter-Procedural Vulnerabilities
https://arxiv.org/abs/2401.09767
Unauthenticated SQL injection in GUI
Patch patch patch..
An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPs requests.
https://fortiguard.fortinet.com/psirt/FG-IR-25-151
Especially given this walk through on how to exploit..
eSIM security
Details of an eSIM vulnerability which will likely run for a bit..
The attack against Kigen eUICC relies both on physical access to sample card along knowledge of the keys used for malicious Java app installation. The remote over-the-air (OTA) vector can't be excluded - our Proof of Concept code mimics a malicious applet installation over OTA SMS-PP protocol (Short Message Service Point to Point) on a target Kigen eUICC. In that context, knowledge of the keys is a primary requirement for target card compromise.
https://security-explorations.com/esim-security.html
AMD Transient Scheduler Attacks
AMD discloses a side channel..
AMD discovered several transient scheduler attacks related to the execution timing of instructions under specific microarchitectural conditions while investigating a Microsoft® report titled “Enter, Exit, Page Fault, Leak: Testing Isolation Boundaries for Microarchitectural Leaks”.
AMD has debugged these patterns and identified a speculative side channel affecting AMD CPUs . In some cases, an attacker may be able to use this timing information to infer data from other contexts, resulting in information leakage.
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.html
Offense
Attack capability, techniques and trade-craft.
Use aipy to develop exclusive knockknock
Chinese research details their experience of implementing port knocking..
https://nobb.site/2025/06/06/0x94/
ShellcodeLoader framework
Capability out of China which was successful in subverting various EDR solutions..
Function hash randomization: Some static data such as function hash and key/iv are randomized to ensure that the static data of each generated loader is non-unique.
Shellcode encryption encoding: aes encryption uuid/ipv4 encoding.
ollvm obfuscation: Use the clang compiler to support ollvm obfuscation.
Dynamic obfuscation strategy: The open source syscall tool hell's gate is used. Combined with this project, its detailed functions are as follows:
Dynamically resolve the SSN number: traverse the ntdll export table. (Dynamically resolve the SSN number to prevent the source code from embedding the SSN number and extracting static features.)
Direct syscall: dynamically get the nt function address and do a 0x12 offset to extract multiple syscall addresses.
Project expansion: support generating dll files based on export tables.
https://github.com/LilDean17/ShellcodeLoader2025
Related (in Chinese)
DreamWalkers
Max brings a degree subtly which will catch a number of EDR solutions out that are leveraging stack spoofing..
Unlike traditional call stack spoofing, which often fails within reflectively loaded modules due to missing unwind metadata, DreamWalkers introduces a novel approach that enables clean and believable call stacks even during execution of reflectivly loaded modules. By parsing the PE structure and manually registering unwind information via
RtlAddFunctionTable, our loader restores proper stack unwinding — a capability that I didn’t see achieved in reflective loading contexts. This allows our shellcode to blend in more effectively, even under the scrutiny of modern EDR and debugging tools.
https://maxdcb.github.io/DreamWalkers/
Identifying and abusing Azure Arc for hybrid escalation and persistence
Dave Cossa walks through the threat in detail and helpfully provides some mitigation advice. Once again highlights some cloud trip hazards..
Ensure Service Principals have their access appropriately restricted to only assign them explicitly required roles; basically, don’t grant a deployment Service Principal the Azure Connected Machine Resource Administrator role
By default, Arc assigns permissions at the Resource Group level, but privileged role assignments impacting Arc could also be made at the upstream subscription and management group (if enabled in your tenant) levels as well. Perform periodic access reviews to ensure assignments of roles with the ability to execute code via Arc (as noted in the above Gaining Access to Arc section) are appropriate. An example of this access on two Service Principals can be seen below:
https://www.ibm.com/think/x-force/identifying-abusing-azure-arc-for-hybrid-escalation-persistence
Exploitation
What is being exploited..
How I Scanned all of GitHub’s “Oops Commits” for Leaked Secrets
Sharon Brizinov reminds us low hanging fruit is indeed very low hanging..
GitHub Archive logs every public commit, even the ones developers try to delete. Force pushes often cover up mistakes like leaked credentials by rewriting Git history. GitHub keeps these dangling commits, from what we can tell, forever. In the archive, they show up as “zero-commit”
PushEvents.I scanned all zero-commit force push events since 2020 and uncovered secrets worth $25k in bug bounties.
Exploiting Trust: How Signed Drivers Fuel Modern Kernel Level Attacks on Windows
Group-IB gives a sense of the scale of the challenge here, although half a decade is a long time and a nearer sense of time would have been valuable.
Kernel-level attacks remain highly attractive to threat actors despite Microsoft’s improved defenses, due to the highest level of privileges on the compromised system and control they offer to attackers.
The scale of malicious activity involving signed kernel drivers is growing: Since 2020, more than 620 drivers, 80+ certificates, and 60+ Windows Hardware Compatibility Program (WHCP) accounts have been associated with threat actor campaigns.
https://www.group-ib.com/blog/kernel-driver-threats/
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers…
Post-Quantum Cryptography Scanner
Vincent Berg releases the first of no doubt manner as we go on this journey..
pqcscan is a small utility, written in Rust, that allows users to scan SSH and TLS servers for their stated support of Post-Quantum Cryptography algorithms. Scan results are written to JSON files.
https://github.com/anvilsecure/pqcscan
Automating MS-RPC vulnerability research
Remco van der Meer walks through how to industrialise MS-RPC fuzzing..
This white paper will describe how MS-RPC security research can be automated using a fuzzing methodology to identify interesting RPC interfaces and procedures. It will explain how MS-RPC works, why NtObjectManager is such a fantastic tool, what problems this automated approach overcomes, how to do efficient fuzzing, how to handle complex parameter types, and how to analyze the fuzzing results by showing their relations in Neo4j.
https://www.incendium.rocks/posts/Automating-MS-RPC-Vulnerability-Research/
PEVuln: a benchmark dataset for using machine learning to detect vulnerabilities in PE malware
Nathan Ross, Oluwafemi Olukoya, Jesús Martínez del Rincón and Domhnall Carlin released this in February which is a valuable dataset for those who don’t otherwise have one.
we present a benchmark dataset for training and evaluating static PE malware machine learning models, specifically for detecting known vulnerabilities in malware. Our goal is to enable further research in defense against malware by exploiting their bugs or weaknesses. After recognising limitations in current malware datasets regarding exploitable malware, our dataset addresses these gaps by utilizing the malware vulnerability database Malvuln, and software vulnerability database ExploitDB to create a new malware dataset with 684 vulnerable malware samples, 35,241 non-vulnerable malware samples, 1,425 vulnerable benign samples, and 7,905 non-vulnerable benign samples, detailed with timestamps, families, threat mapping, vulnerability mapping, and obfuscation analysis. This 4-class dataset lays the foundation for advancing future research in analysis and vulnerability exploitation in malware using machine learning.
BamExtensionTableHook
Dor releases an novel technique which shows there is still opportunity for hooks to exist in the kernel even with PatchGuard present..
Proof-of-concept kernel driver that hijacks the Windows kernel extension table mechanism to preserve process notify callbacks even when attackers disable standard process notify callbacks.
..
To demonstrate the persistence of the extension table mechanism, I developed a driver that targets the
nt!PspBamExtensionHostdata structure. The driver locates this structure and overwrites the pointer tobam!BampCreateProcessCallback, redirecting it to our custom callback function ProcessNotifyCallbackEx2.Unlike the standard callbacks that can be disabled by clearing the
nt!PspCreateProcessNotifyRoutinearray, this approach targets the extension table mechanism itself...
Based on current observations, Patch Guard does not seem to monitor modifications to the extension table mechanism, leaving this technique undetected.
https://github.com/Dor00tkit/BamExtensionTableHook
Process Monitor 2.1 for Linux, Sysmon 1.4 for Linux, and SysinternalsEBPF 1.5
Alex Mihaiuc releases this update..
This release includes Azure Linux 3.0 support across Procmon for Linux, Sysmon for Linux and SysinternalsEBPF, expanding compatibility with the latest version of Microsoft’s Linux distribution.
NVIDIA GPU Confidential Computing Demystified
Zhongshu Gu, Enriquillo Valdez, Salman Ahmed, Julian James Stephen, Michael Le, Hani Jamjoom, Shixuan Zhao and Zhiqiang Lin undertake some excellent foundational research which will enable and inspire others to go further. Also highlights the level of investment needed for close analysis whilst showing that a determined adversary will make progress.
In this paper, we aim to demystify the implementation of NVIDIA GPU-CC system by piecing together the fragmented and incomplete information disclosed from various sources. Our investigation begins with a high-level discussion of the threat model and security principles before delving into the low-level details of each system component. We instrument the GPU kernel module -- the only open-source component of the system -- and conduct a series of experiments to identify the security weaknesses and potential exploits.
https://arxiv.org/abs/2507.02770
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual report
Nothing overly of note this week
Instagram uses expiring certificates as single day TLS certificates
Understanding Your Adversary: The Human Side of Threat Intelligence
N-day Vulnerabilities: Detection, Bisection, and Measurement
The GPS Leak No One Talked About: Uffizio’s Silent Exposure - log files for a SaaS
Agents of change: The rise of autonomous AI in cybersecurity - high-level consultancy view
Artificial intelligence
Books
Events
x33fcon Europe - videos
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.