CTO at NCSC Summary: week ending July 27th
“Under the proposals, businesses not covered by the ban would be required to notify the government of any intent to pay a ransom"
Welcome to the weekly highlights and analysis of the blueteamsec subreddit (and my wider reading). Not everything makes it in, but the best bits do.
Operationally this week it has been about SharePoint and the blog SharePoint ToolShell – One Request PreAuth RCE Chain warns “Although the July 2025 patch mitigated this exploit chain, more could be coming because there are thousands of classes and many pages to check.”
In the high-level this week:
UK to lead crackdown on cyber criminals with ransomware measures - Home Office, National Cyber Security Centre and Dan Jarvis MBE MP publish - “Under the proposals, businesses not covered by the ban would be required to notify the government of any intent to pay a ransom. The government could then provide those businesses with advice and support, including notifying them if any such payment would risk breaking the law by sending money to sanctioned cyber criminal groups, many of whom are based in Russia. “
Panorama: Fighting Cyber Criminals - BBC Panorama broadcasts
Weak password allowed hackers to sink a 158-year-old company - BBC reports - "We need organisations to take steps to secure their systems, to secure their businesses," says Richard Horne CEO of the National Cyber Security Centre (NCSC) - where Panorama has been given exclusive access to the team battling international ransomware gangs.
Governor Hochul Announces New Nation-Leading Cybersecurity Regulations, Launches Grant Program and Technical Assistance to Support Water Infrastructure Security and Resilience - New York State publishes - “$2.5 million in the FY26 Budget funds a new cyber grant program, Strengthening Essential Cybersecurity for Utilities and Resiliency Enhancements (SECURE),”
Standards Australia adopts world’s foremost standard for operational technology - Standards Australia announces - “By adopting AS IEC 62443, Australia is taking a proactive step to ensure its critical infrastructure is secure, resilient, and ready for the future.”
Ukrainian hackers wipe databases at Russia's Gazprom in major cyberattack, intelligence source says - The Kyiv Independent reports - "The degradation of Russian information systems to the technological Middle Ages continues," the source within the HUR told the Kyiv Independent.
Partners or Provocateurs? Private-Sector Involvement in Offensive Cyber Operations - Lawfare opines and researches - “The framework is built on three interdependent factors. First, it requires defining clear policy objectives, such as augmenting government capacity or disrupting adversary infrastructure. Second, it addresses the scope of authorized activities, clarifying what actions are permissible, who may be targeted, and where they may be attacked. Finally, it tackles the complex legal and liability considerations, including the potential legal authorities for such actions and the unresolved question of who bears responsibility when operations harm innocent third parties.”
What It Takes to Stop the Next Salt Typhoon - Just Security opines - “Finally, one of the most effective steps the Trump administration can take for U.S. cyber defenses is to apply the same principles used in national air and missile defense to cyberspace: assume attackers will get through the first line of defense and focus on mitigating damage.”
Why it’s time for the US to go on offense in cyberspace - CyberScoop opines - “The cyber threat environment in 2025 is fundamentally different from what it was even five years ago. Operations like China’s Volt Typhoon and Russia’s relentless campaigns against Ukraine’s infrastructure illustrate a broader shift: our adversaries are no longer limiting themselves to espionage or IP theft. They are actively preparing for conflict.”
Binary view of hard and soft skills impedes cyber responses - Australian Strategic Policy Institute think tanks - “Effective cybersecurity requires more than technical expertise. It demands diverse skills, strong leadership and interdisciplinary collaboration. Reducing cybersecurity to a technical-versus-non-technical binary undermines our ability to address complex, evolving threats.”
USCYBERCOM Hosts Cyber Flag 25-2 - US Cyber Command announces - “Cyber Flag is USCYBERCOM’s biannual multinational cyber field training exercise. It is designed to strengthen partnerships and improve the ability of participating nations to detect, respond to, and defend against malicious cyber activity.”
Reporting on/from China
Singapore actively dealing with ongoing cyberattack by UNC3886 on critical infrastructure: Shanmugam (video at end of newsletter) - Channel News Asia reports - “Mr Shanmugam identified the entity as UNC3886, which Mandiant has described as a "China-nexus espionage group" that has targeted prominent strategic organisations on a global scale.”
HAFNIUM-Linked Hacker Xu Zewei: Riding the Tides of China’s Cyber Ecosystem - Natto Thoughts researches - “This post aims to clarify the ambiguities surrounding Xu’s professional affiliations, which illustrate the interconnected nature of China’s cyber ecosystem, where talent may simultaneously pursue personal, business, and state interests.”
Microsoft to stop using engineers in China for tech support of US military, Hegseth orders review - Reuters reports - “On Friday, Microsoft spokesperson Frank Shaw said on social media website X the company changed how it supports U.S. government customers "in response to concerns raised earlier this week ... to assure that no China-based engineering teams are providing technical assistance" for services used by the Pentagon.”
National Guard hacked by Chinese 'Salt Typhoon' campaign for nearly a year, DHS memo says - NBC News reports - “A Department of Homeland Security memo from June, describing the Pentagon’s findings, said that the group, publicly known by the nickname Salt Typhoon, “extensively compromised a U.S. state’s Army National Guard network” from March 2024 through December.”
China is using cyber attribution to pressure Taiwan - Binding Hook reports - “So far, this campaign has included the release of three sets of information on Taiwanese cyberattacks. All three attributed intrusion activity to Taiwan’s cyber command, the Information, Communications, and Electronic Force Command (ICEFCOM), and each included typical Chinese government rhetoric criticising ‘secessionist’ elements in Taiwan.”
China warns of data theft via ‘back doors’ in imported chips, smart gadgets - South China Morning Post reports - “The Ministry of State Security said on its official social media page on Monday that imported chips, software and smart devices for critical sectors might feature embedded “exploits” or access points at the initial design stage. These would allow malicious actors to bypass security controls and gain unauthorised access to systems, potentially causing severe data breaches, it cautioned.”
Before Vegas: The “Red Hackers” Who Shaped China’s Cyber Ecosystem - ETH Zurich researches - “This CSS Cyberdefense report traces how a core cohort of red hackers from the 1990s and 2000s laid the foundations for China’s modern cyber capabilities. At a time when formal training mechanisms—such as hacking contests, bug bounties, and attack-defense exercises—had yet to take hold, and the country’s cybersecurity industry remained immature and offered few opportunities, early Chinese hackers honed their skills through self taught communities organized within informal hacker groups.”
China’s Exploitation of Scam Centers in Southeast Asia - US China Economic and Security Review Commission states - “The Chinese criminals behind scam centers have built ties—some overt, some deniable—to the Chinese government by embracing patriotic rhetoric, supporting China’s Belt and Road Initiative (BRI), and promoting pro-Beijing propaganda overseas. As a result, Chinese crime syndicates have expanded across Southeast Asia with, at a minimum, implicit backing from elements of the Chinese government.”
Shanghai brain tech breakthrough translates thoughts into fluent Chinese - XINHUANET reports - “In just 100 minutes of training on average, their custom-built intelligent system decoded brain activities associated with the intended speech of 54 Chinese characters in real-time.”
Emposat, the Chinese telecoms group closely watched by European intelligence services - Intelligence Online reports - “French military security, Czech intelligence... European services are increasingly concerned about the satellite communication stations of Chinese group Emposat”
China’s shift towards ‘organized research’: how can coordination and innovation co-exist? - Nature reports - “At the national level, more than 300 state key laboratories (SKLs) — the country’s top research centres — have been restructured since 2022 to promote cross-institutional collaboration.” .. “This collaboration aims to harness the complementary strengths of academia and industry to drive innovation in solar technology.”
China’s open-source AI models ‘very advanced’, says Nvidia CEO, as H20 chip sales resume - South China Morning Post reports - “DeepSeek’s models, Alibaba Group Holding’s Qwen and Chinese start-up Moonshot’s Kimi were “the best open reasoning models in the world today,” and were “very advanced”, Huang said during a fireside chat”
Top Republican on China panel objects to resumption of Nvidia H20 chip shipments - Reuters reports
Nvidia’s China Restart Faces Production Obstacles - The Information reports
Nvidia AI chips worth $1bn smuggled to China after Trump export controls - Financial Times Reports
China’s Autonomous Driving Firms Step Up Global Push With Uber Deals - Caixan Global reports - “Among the latest deals is Baidu Inc. teaming up with Uber Technologies Inc. to roll out the Chinese tech giant’s Apollo Go robotaxis in Asia and the Middle East later this year, the companies announced on Tuesday.”
Baidu joins Uber to deploy robotaxis in Asia, Middle East as Tesla expands service in US - South China Morning Post reports
AI
Artificial Exploits, Real Limitations: How AI Cyber Attacks Fall Short - Forescout research -”We studied 50 current AI models from commercial, open source, and underground sources to see its ability to perform vulnerability research (VR) and exploit development (ED).” … ”Vibe hacking hasn’t caught up to vibe coding — yet.
Failure rates were high:
48% failed the first VR task, 55% failed the second
66% failed the first ED task, 93% failed the second”
Architectural Backdoors in Deep Learning: A Survey of Vulnerabilities, Detection, and Defense - The Alan Turing Institute, UK publishes - “Despite recent progress, scalable and practical defenses remain elusive. We conclude by outlining open challenges and proposing directions for strengthening supply-chain security, cryptographic model attestations, and next-generation benchmarks.”
Hacker Plants Computer 'Wiping' Commands in Amazon's AI Coding Agent - 404 Media reports - “Amazon told 404 Media: “Security is our top priority. We quickly mitigated an attempt to exploit a known issue in two open source repositories to alter code in the Amazon Q Developer extension for VS Code and confirmed that no customer resources were impacted. We have fully mitigated the issue in both repositories”
China’s Guangxi province launches ‘AI super league’ to nurture Asean-facing start-ups - South China Morning Post reports - “The competition, titled “AI for All”, will run through September and features 17 tracks, including automobile, tourism, cross-border e-commerce, smart agriculture, and market regulation.”
Chinese AI agent firms lag US, but seek to close gap amid OpenAI’s latest push - South China Morning Post reports - “In 2024, the US had 100 million users of AI agents, representing a market penetration rate of 40 per cent. China, with 250 million AI agent users last year, had only a 17.7 per cent adoption rate, CICC said.”
China Is Spending Billions to Become an A.I. Superpower - New York Times reports - “China is applying state support across the entire A.I. tech stack, from chips and data centers down to energy,” said Kyle Chan, an adjunct researcher at the RAND Corporation, a think tank.
Microsoft likely to sign EU AI code of practice, Meta rebuffs guidelines - Reuters reports - "Our goal is to find a way to be supportive and at the same time one of the things we really welcome is the direct engagement by the AI Office with industry," he said, referring to the EU's regulatory body for AI.
Cyber proliferation
Spyware trial set to resume in September - Kathimerini reports - “The trial of four company executives linked to Greece’s Predator spyware scandal is scheduled to resume on September 24 after a long postponement during which the case files were translated into English.”
Wartime Cyber Crackdown and the Emergence of Mercenary Spyware Attacks - Miann Group publishes - “detailing the escalation of cyber threats and digital repression in Iran, particularly targeting civil society, women, and ethnic minorities.”
Bounty Hunting
Arizona Woman Sentenced for $17M Information Technology Worker Fraud Scheme that Generated Revenue for North Korea - US Department of Justice announces - “An Arizona woman was sentenced today to 102 months in prison for her role in a fraudulent scheme that assisted North Korean Information Technology (IT) workers posing as U.S. citizens and residents with obtaining remote IT positions at more than 300 U.S. companies. The scheme generated more than $17 million in illicit revenue for Chapman and for the Democratic People’s Republic of Korea (DPRK or North Korea).”
Suspect linked to Russian language cybercrime forum arrested in Ukraine - Bloomberg reports - “A person suspected of being the administrator for the Russian language cybercriminal forum XSS.is was arrested in Ukraine this week, the French public prosecutor's office and the pan-European police body Europol said on Wednesday.”
After $380M hack, Clorox sues its “service desk” vendor for simply giving out passwords - ARS Technia reports - In the words of a new Clorox lawsuit, Cognizant's behavior was "all a devastating lie," it "failed to show even scant care," and it was "aware that its employees were not adequately trained."
"Cognizant was not duped by any elaborate ploy or sophisticated hacking techniques," says the lawsuit, using italics to indicate outrage emphasis. "The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox’s network, and Cognizant handed the credentials right over. Cognizant is on tape handing over the keys to Clorox’s corporate network to the cybercriminal—no authentication questions asked."
No reflections this week.. but you’ll see that there continues to be a lot going on in almost every aspect.. including Singapore actively dealing with ongoing cyberattack by UNC3886 on critical infrastructure as stated by to minister Shanmugam.
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Saturday…
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
Analysis of the suspected attack actions of APT-C-53 (Gamaredon) targeting government departments
Reporting out of China on alleged Russian activity against Ukraine. Tradecraft on show is basic which should be remediable.
The Gamaredon organization often uses docx documents as bait to induce users to click and view. Once the file is opened, it will remotely load malicious files with macros. When executed, it will decrypt and release the vbs script file and load it. The main function of the script is to upload basic user information and download subsequent payloads by parsing the domain name and splicing the URL.
Hive0156 continues Remcos campaigns against Ukraine
IBM details this alleged Russian operation against Ukraine. The tradecraft is not notable other than the intended victims..
Hive0156 continues to deliver Remcos RAT throughout Ukraine
Decoy document themes are highly relevant to Ukraine’s military personnel
Access to Ukrainian infrastructure remains a key priority for Russian-aligned actors
https://www.ibm.com/think/x-force/hive0156-continues-remcos-campaigns-against-ukraine
Decoding Secrets Through Symbols: How Military Insignia Revealed Russia's Hidden SIGINT Network
CheckFirst breaks down what they allege are parts of the organisational structure behind some of the alleged Russians state cyber activities.
The FSB’s 16th Center inherited the KGB’s signals intelligence capabilities and is reportedly behind some of Russia’s most sophisticated cyber operations, including the Turla and Energetic Bear groups. Until now, its structure remained largely opaque to public scrutiny.
Our methodology, treating military memorabilia as structured data sources, demonstrates how unconventional OSINT techniques can penetrate even the most secretive organisations. From a badge depicting a facility in Sochi to insignia revealing the 1918 origins of Moscow’s oldest listening post, each piece contributed to an unprecedented picture of Russia’s intelligence infrastructure.
Russia Leveraging Kyrgyzstan’s Crypto Ecosystem to Evade Sanctions
TRM Labs details part of the crypto system which is an enabler for a wide range of alleged Russian activity. It highlights the challenge as the worlds financial system becomes more federated across various technologies / eco-systems.
Russia has increasingly turned to Kyrgyzstan as a conduit for sanctions evasion and to procure dual-use goods since the outset of its war in Ukraine
Kyrgyzstan is also serving as a registration hub for services likely linked to high-risk Russian exchange Garantex, with some entities potentially operated by the same individuals behind the original platform
Many Kyrgyz-registered VASPs display clear indicators of shell company behavior, including repeated use of the same residential addresses, founders, and contact information across multiple entities
Reporting on China
Disrupting active exploitation of on-premises SharePoint vulnerabilities
Microsoft detail alleged Chinese origin in exploitation of the SharePoint vulnerability. The fact that multiple groups all allegedly piled in is noteworthy..
As of this writing, Microsoft has observed two named Chinese nation-state actors, Linen Typhoon and Violet Typhoon exploiting these vulnerabilities targeting internet-facing SharePoint servers. In addition, we have observed another China-based threat actor, tracked as Storm-2603, exploiting these vulnerabilities to deploy ransomware. Investigations into other actors also using these exploits are still ongoing.
Illusory Wishes: China-nexus APT Targets the Tibetan Community
Roy Tay details an alleged Chinese operation against an interesting victimology. The tradecraft is however well worn..
ThreatLabz observed targeted malware intrusions that employed social engineering tactics, leveraging the Dalai Lama’s 90th birthday through strategic web compromises to lure Tibetan community members and redirect them to attacker-controlled sites.
Operation GhostChat and Operation PhantomPrayers, respectively, relied on multi-stage infection chains to deploy Ghost RAT and PhantomNet backdoors. These chains included DLL sideloading, shellcode injections, and encrypted payloads to execute their attacks.
The campaigns employed evasion techniques like code injection, using low-level APIs, and overwriting user mode API hooks to evade endpoint security solutions.
Based on the victimology targeting the Tibetan community, the use of Ghost RAT and PhantomNet, and the deployment of tailored TTPs, we attribute these campaigns with high confidence to a China-nexus APT group.
The SOC files: Rumble in the jungle or APT41’s new target in Africa
Denis Kulik details interesting alleged Chinese regional targeting. The fact that Africa warranted such attention from Chinese is noteworthy given relative cyber maturity and ability to withstand..
The attackers used hardcoded names of internal services, IP addresses, and proxy servers embedded within their malware. One of the C2s was a captive SharePoint server within the victim’s infrastructure.
During our incident analysis, we were able to determine that the threat actor behind the activity was APT41. This is a Chinese-speaking cyberespionage group known for targeting organizations across multiple sectors, including telecom and energy providers, educational institutions, healthcare organizations and IT energy companies in at least 42 countries. It’s worth noting that, prior to the incident, Africa had experienced the least activity from this APT.
https://securelist.com/apt41-in-africa/116986/
Reporting on North Korea
Nothing overly of note this week..
Reporting on Iran
The Amnban Files: Inside Iran's Cyber-Espionage Factory Targeting Global Airlines
Nariman Gharib alleges that APT39 is in fact a commercial outfit with government connections.
The breach cracked open their entire operation. Behind the legitimate facade of penetration testing and security consulting lurks something sinister. These aren't consultants—they're cyber mercenaries working for APT39, the notorious hacking group tied directly to Iran's Ministry of Intelligence and Security (MOIS).
The evidence is overwhelming: systematic attacks on Royal Jordanian, Turkish Airlines, Rwanda Airlines, Wizz Air, and nearly a dozen other carriers. This isn't security research. It's preparation for digital warfare.
https://blog.narimangharib.com/posts/2025%2F07%2F1752917718209?lang=en
MuddyWater Leveraging DCHSpy For Israel-Iran Conflict
Lookout details an alleged Iranian operation against Iranians..
Lookout discovered four new samples of DCHSpy one week after the start of the Israel-Iran conflict.
DCHSpy is an Android surveillanceware tool leveraged by Iranian cyber espionage group MuddyWater.
DCHSpy collects WhatsApp data, accounts, contacts, SMS, files, location, and call logs, and can record audio and take photos.
It appears that new targeting could be using lures centered around StarLink, which offered internet access to Iranians during the imposed internet outage.
About a week after Israel launched its initial strikes on Iranian nuclear infrastructure, Lookout acquired four new samples of DCHSpy. These new samples show that MuddyWater has continued to develop the surveillanceware with new capabilities - this time exhibiting the ability to identify and exfiltrate data from files of interest on the device as well as WhatsApp data.
The Telegram channels advertise the malicious VPN applications to English and Farsi speakers, and feature themes and language consistent with views contrary to the Iranian regime. I
https://www.lookout.com/threat-intelligence/article/lookout-discovers-iranian-dchsy-surveillanceware
Reporting on Other Actors
Hacker Com: Cyber Criminal Subset of The Community (Com) is a Rising Threat to Youth Online
FBI warns
Hacker Com involves a broad community of technically sophisticated cyber criminals, some of whom are linked to ransomware-as-a service (RaaS) groups. Members of Hacker Com often sell technical services for a profit and use their technical capabilities to steal cryptocurrency to fund other criminal activity. Computer-related criminal activity within Hacker Com includes, but is not limited to, distributed denial-of-service (DDOS) attacks, compromise of personally identifiable information, sale of government email accounts, ransomware attacks, phishing, malware development and deployment, cryptocurrency theft, computer intrusions, and subscriber identity module (SIM) swapping
https://www.ic3.gov/PSA/2025/PSA250723
https://www.ic3.gov/PSA/2025/PSA250723-2
https://www.ic3.gov/PSA/2025/PSA250723-3
Discovery
How we find and understand the latent compromises within our environments.
Up the Garden Path: Applying Cyber Deception to the Attack Lifecycle
Defence
How we proactively defend our environments.
Privileged Access Workstations; Part 2: Connectivity
ETSI publishes the second part of the standard around Privileged Access Workstations. PAWs is one of the most single effective security controls to stop entire environments getting rolled.
The present document, Part 2 of the ETSI PAWs series, focuses on the connectivity between the device (covered in ETSI TS 103 994-1) and the PAWs system (which will be covered in Part 3). The present document explores the various types of connectivity that a PAW system could incorporate, the threats in relation to the MITRE framework, and outlines the specific technical standards that should be applied to each connectivity type. This instalment also covers third party involvement in PAW systems, both from an administrative level and in the usage by third parties for the management of their own equipment.
https://www.etsi.org/deliver/etsi_ts/103900_103999/10399402/01.01.01_60/ts_10399402v010101p.pdf
Configure Microsoft Entra Private Access for Active Directory domain controllers (preview)
Microsoft details how enable conditional access to on-premises where Kerberos is still kicking around..
This guide describes how to configure Microsoft Entra Private Access for Active Directory Domain Controllers (DCs). This capability helps strengthen secure access for on-premises users by enforcing conditional access/MFA to on-premises applications that use Kerberos authentication with the DCs.
https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-domain-controllers
Strengthen identity threat detection and response with linkable token identifiers
Microsoft enabling the joining of dots across their eco-system to work out what that adversary did with that session..
We’re announcing the general availability of linkable token identifiers, which let you trace a user’s session across workloads from a specific authentication event. This feature improves incident response and anomaly detection, helping mitigate threats like remote phishing and malware attacks. Linkable token identifiers are now available for:
Microsoft Entra sign-in logs
Microsoft Exchange Online audit logs
Microsoft Graph activity logs
Microsoft Teams audit logs
Microsoft SharePoint Online audit logs
Protecting against typosquatting with website typo protection in Microsoft Edge
Peter van der Woude details a capability I wasn’t aware existed and would be useful across all browsers..
With website typo protection, Microsoft Edge will warn the user when misspelling or mistyping a common domain name. This post will look closer at the configuration, followed with the user experience.
Changes to [Chrome] remote debugging switches to improve security
Google tighten up this feature post misuse.. It did make me wonder if you could deploy Chrome for Testing to get the behaviour..
Since App-Bound Encryption was enabled we've seen an increase in attackers using Chrome Remote Debugging to extract cookies. Using this method to steal Chrome cookies has been discussed since 2018. However, recent blog posts covering this use of the remote debugging port, and tools to extract cookies support our internal data showing its increased popularity. We remain committed to disrupting these techniques, and constraining attackers further—increasing the cost of these attacks and protecting the security of Chrome users.
Therefore, from Chrome 136 we're making changes to the behavior of
--remote-debugging-portand--remote-debugging-pipe. These switches will no longer be respected if attempting to debug the default Chrome data directory. These switches must now be accompanied by the--user-data-dirswitch to point to a non-standard directory. A non-standard data directory uses a different encryption key meaning Chrome's data is now protected from attackers.
https://developer.chrome.com/blog/remote-debugging-port
Understanding Apple enrollment methods in Microsoft Intune
Rishita Sarin provides an overview to get Apple enrolled into Intune..
During enrollment, Intune installs a mobile device management (MDM) certificate on the enrolling device. The MDM certificate communicates with the Intune service, and enables Intune to start enforcing your organization's policies, like:
Enrollment policies that limit the number or type of devices someone can enroll.
Compliance policies that help users and devices meet your organization’s requirements.
Configuration profiles that configure work-appropriate features and settings on devices.
This blog aims to provide an overview of Microsoft Intune’s enrollment methods for Apple devices to help you make informed decisions about device management.
I just wanted to see what SSSO looks like
Sapir details and comes to some start recommendations..
Two years ago, I found myself reading about Seamless SSO (SSSO).
I understood the concept, but I always wanted to see what it actually looks like – and today is the day!This post doesn’t present any new attack or groundbreaking concept.
It’s just me playing with SSSO, documenting the process, and sharing a mini abuse idea that (obviously) didn’t work...
Stop using Seamless SSO.
Join or register your devices to Azure, work with PRTs — it’s much safer.And if you still have
AZUREADSSOACCin your environment…
please, make sure it’s protected, okay? (:
https://sapirxfed.com/2025/07/23/i-just-wanted-to-see-what-ssso-looks-like/
Protecting the Core: Securing Protection Relays in Modern Substations
Seemant Bisht, Chris Sistrunk, Shishir Gupta, Anthony Candarini, Glen Chason and Camille Felx Leduc make the case for privileged access workstations and seperate management planes.
Protection relays are high-value devices, and prime targets for cyber-physical attacks targeting substation automation systems and grid management systems. Securing protection relays is no longer just a best practice; it's absolutely essential for ensuring the resilience of both transmission and distribution power grids.
Incident Writeups & Disclosures
How they got in and what they did.
Security Update for Amazon Q Developer Extension for Visual Studio Code
Amazon summarize..
AWS is aware of and has addressed an issue in the Amazon Q Developer Extension for Visual Studio Code (VSC). Security researchers reported a potentially unapproved code modification was attempted in the open-source VSC extension that targeted Q Developer CLI command execution. This issue did not affect any production services or end-users.
Once we were made aware of this issue, we immediately revoked and replaced the credentials, removed the unapproved code from the codebase, and subsequently released Amazon Q Developer Extension version 1.85 to the marketplace.
https://aws.amazon.com/security/security-bulletins/rss/aws-2025-015/
Vulnerability
Our attack surface.
Customer guidance for SharePoint vulnerability CVE-2025-53770
Microsoft release 7 updates over the course of the week of exploitation..
Microsoft is aware of active attacks targeting on-premises SharePoint Server customers by exploiting vulnerabilities partially addressed by the July Security Update.
Cisco Identity Services Engine Unauthenticated Remote Code Execution Vulnerabilities
Cisco detail..
Multiple vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an unauthenticated, remote attacker to issue commands on the underlying operating system as the root user.
Pre-disclosure: Upcoming coordinated security fix for all Matrix server implementations
Matrix go on a journey for this upgrade..
Over the last 6 months a major project has been underway by the Element server team and the Matrix.org Foundation security team to investigate “state resets”: scenarios where Matrix’s state resolution algorithm can give unexpected results. As part of this work we’ve identified two high severity protocol vulnerabilities (CVE-2025-49090; the other not yet allocated a CVE).
This has been an exceptionally complicated project to coordinate and its security implications required us to deviate from our usual MSC process and develop the changes under embargo. This and the expedited release of a new stable room version are exceptional choices that are far from ideal, which we’re having to take to keep the ecosystem secure.
https://matrix.org/blog/2025/07/security-predisclosure/
WhoFi: Deep Person Re-Identification via Wi-Fi Channel Signal Encoding
Danilo Avola, Daniele Pannone, Dario Montagnini and Emad Emam detail a rather novel approach..
Person Re-Identification is a key and challenging task in video surveillance. While traditional methods rely on visual data, issues like poor lighting, occlusion, and suboptimal angles often hinder performance. To address these challenges, we introduce WhoFi, a novel pipeline that utilizes Wi-Fi signals for person re-identification. Biometric features are extracted from Channel State Information (CSI) and processed through a modular Deep Neural Network (DNN) featuring a Transformer-based encoder. The network is trained using an in-batch negative loss function to learn robust and generalizable biometric signatures. Experiments on the NTU-Fi dataset show that our approach achieves competitive results compared to state-of-the-art methods, confirming its effectiveness in identifying individuals via Wi-Fi signals.
https://arxiv.org/abs/2507.12869v1
Offense
Attack capability, techniques and trade-craft.
“Evil VM”: From Guest Compromise To Entra Admin In 9 Easy Steps
Simon Maxwell-Stewart details a default escalation path as well as a set of system hardening which teams will want to pay attention to..
a novel attack path in Microsoft Entra ID (formerly Azure AD) that leverages a little-known Azure VM feature to escalate privileges from guest access to full Entra admin. By combining device identity abuse with phishing techniques to steal Primary Refresh Tokens (PRTs), attackers can bypass traditional security controls and perform stealthy lateral movement. Building on our previous Restless Guests research, we unpack each stage of the “Evil VM” attack chain and provide practical guidance for defenders to detect and mitigate these risks.
..
The above attack chain leverages default settings at each stage, so preventing attacks of this nature requires careful systems hardening.
https://www.beyondtrust.com/blog/entry/evil-vm
Sinister VSIx
Debjeet Banerjee details how to do it.. a whole new world to go threat hunting in..
How to backdoor VSCode extensions
Though this technique started as an experiment - I believe this can be a good vector for social engineering. We can further the evasions and make it more stealthy by doing things like downloading the addon at runtime, trying more experiments with the
vscode://handler and much more - which all can be excellent exercises for someone willing to further this technique.
https://github.com/whokilleddb/sinister-vsix
Netescape
Nikola Blagojevic release an implant for detection engineers to go after..
Set of algorithms which can be used as a library to obfuscate malware communication traffic and therefore bypass EDR and other defensive capabilities.
https://github.com/zarkones/netescape
Stealing Secrets with Management Point Relays
Garrett Foster highlights once again how SCCM security is paramount to not loose control of an estate..
TL;DR Network Access Account, Task Sequence, and Collection Settings policies can be recovered from SCCM by relaying a remote management point site system to the site database server.
BloodfangC2
Nikola Blagojevic releases an implant for detection engineers to also go after..
Bloodfang is a modern implant with position independent code that compiles to 64 & 32 bit Windows systems. Compiled implant shellcode is about 6 KB (Kilobytes). Its execution in memory has very little footprint.
https://github.com/zarkones/BloodfangC2
Exploitation
What is being exploited..
Active exploitation of vulnerability affecting Microsoft Office SharePoint Server products in the UK
NCSC UK alerts..
The NCSC is encouraging UK organisations to take immediate action to mitigate a vulnerability (CVE-2025-53770) affecting Microsoft SharePoint Server products.
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers…
LudusHound
Beyviel David provides a very useful capability which will have many applications…
LudusHound is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory replica environment via Ludus for controlled testing.
https://github.com/bagelByt3s/LudusHound
Vendetect
Evan Sultanik and William Tan release this which will have a wide set of use cases..
Vendetect helps identify copied or vendored code between repositories, making it easier to detect when code has been copied with or without attribution. The tool uses similarity detection algorithms to compare code files and highlight matching sections.
https://github.com/trailofbits/vendetect
Introducing OSS Rebuild: Open Source, Rebuilt to Last
Matthew Suozzo provides a tool which will be of use to those who are high up on the maturity curve.
The project comprises:
Automation to derive declarative build definitions for existing PyPI (Python), npm (JS/TS), and Crates.io (Rust) packages.
SLSA Provenance for thousands of packages across our supported ecosystems, meeting SLSA Build Level 3 requirements with no publisher intervention.
Build observability and verification tools that security teams can integrate into their existing vulnerability management workflows.
Infrastructure definitions to allow organizations to easily run their own instances of OSS Rebuild to rebuild, generate, sign, and distribute provenance.
https://security.googleblog.com/2025/07/introducing-oss-rebuild-open-source.html
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual, quarterly and monthly reports
Building a Trustworthy Digital Future: Digital Identity in the Land of the Free
Exploring the meaning and challenges of early warning - “This article focuses on the meaning of early warning, arguing that it should be explicitly separated from the terms strategic and timely. Next, it employs a strategic, operational, and tactical early warning framework, discussing the meaning of providing early warning at each level.”
Reverse engineering and hacking Ecovacs robots: the bad and the really bad - from 2024 but a warning for our robotics and autonomy future
Artificial intelligence
Architectural Backdoors in Deep Learning: A Survey of Vulnerabilities, Detection, and Defense
subwiz: A lightweight GPT model, trained to discover subdomains.
A Robust and Efficient Machine Learning Framework for Enhancing Early Detection of Android Malware
Subliminal Learning: Language models transmit behavioral traits via hidden signals in data
How MCP Inspector Works: A Simple Look at Its Architecture and Setup
Books
The Next War: Indications Intelligence in the Early Cold War - “The Next War is the first full account of the development of the allied indications network. Timothy Andrews Sayle dives deeply into recently declassified documents to explore this previously hidden history. He traces the decisions and choices made by intelligence organizations in Canada, the United States, and the United Kingdom to coordinate their assessments despite different, sometimes conflicting, national agendas, ideological positions, and levels of trust.”
A Primer on Russian Cognitive Warfare - Institute for the Study of War
Events
Offensive AI Con - October 5th to 8th 2025
OBITS v8 - October 15th to 17th 2025
State of Statecraft - October 28, 2025 in Brussels, Belgium - “State of Statecraft is a security and intelligence conference that brings together multiple disciplines, backgrounds, and nationalities to share research into covert activities of nation-states and other malign actors.”
USENIX Security '26 Preliminary Call for Papers - August 12–14, 2026
Videos of the week - Fully Operational Stuxnet 15 Years Later & the Evolution of Cyber Threats to Critical Infrastructure
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.