CTO at NCSC Summary: week ending May 11th
CyberUK 2025 bonus edition.. Transforming resilience... Countering threat.. through Market Incentives and other ways..
Welcome to the weekly highlights and analysis of the blueteamsec subreddit (and my wider reading). Not everything makes it in, but the best bits do.
Operationally this week the UK retail incidents continue to be a focus.. read the advice we released last Sunday - Incidents impacting retailers – recommendations from the NCSC
In the high-level this week:
NCSC CEO urges fresh perspective on cyber security as a contest - UK NCSC CEO speech - “China remains the pacing threat in the cyber realm. The Chinese Communist Party’s strategic approach to capability, legislation and data, means they have a whole – vast – ecosystem, entirely at their disposal. And the continued activity that we’re seeing come from the Chinese system remains a cause for profound and profuse concern.”
UK pioneering global move away from passwords - UK NCSC publishes - “Government to roll out passkey technology across digital services as an alternative to SMS-based verification.” - we also joined the FIDO alliance.
Software Security Code of Practice - Department for Science, Innovation and Technology and Feryal Clark MP publish - “This Code of Practice sets out expectations for the security and resilience of software.”
Software Security Code of Practice - Implementation Guidance - UK NCSC publishes
Impact of AI on cyber threat from now to 2027 - UK NCSC publishes - “An NCSC assessment highlighting the impacts on cyber threat from AI developments between now and 2027”
New assurance initiatives to help boost confidence in cyber resilience - UK NCSC announces -
“A new ecosystem of assured Cyber Resilience Test Facilities will allow vendors to demonstrate the cyber resilience of their products”
“A Cyber Adversary Simulation scheme will launch in summer to help organisations test their defences”
Assured Cyber Security Consultancy - Post-quantum cryptography (PQC) pilot - UK NCSC pilots - “The pilot assures consultancies that meet the scheme Standard for post-quantum cryptography.” - this is how we are doing market demand signalling, capacity building whilst ensuring only competent advice is given..
Preparing for post-quantum threat will make "fixing the Millennium Bug look easy" - UK NCSC summarises from CyberUK
New Cyber Security Certification Scheme to improve resilience throughout UK Defence supply chain - IASME and the UK Ministry of Defence announce - “The scheme aims to strengthen the cyber resilience of UK’s Defence supply chain, introducing a comprehensive cyber security framework for defence suppliers, enhancing the security, resilience, and future prosperity of the UK.”
Britain to warn companies cyber security must be 'absolute priority' - Reuters reports - “It said McFadden will highlight moves to “bolster our national defences” including new legislation - the Cyber Security Bill.”
Cyber is a poster child for growth - The Rt Hon Pat McFadden MP as delivered at CyberUK
Government cyber resilience - UK Committee of Public Accounts reports - “It is positive that the Cabinet Office is now independently verifying the resilience of departments’ ‘critical’ IT systems. However, this has shown that departments’ cyber resilience is lower than expected and has fundamental weaknesses.”
NSC official: Trump administration will ‘change the script’ on offensive side - The Record reports - “You need to find some way to communicate this is not acceptable.”
Russian-linked APT29 behind recent cyberattacks on Azerbaijani media - Trend News Agency reports - “Speaking at a public hearing organized by the commission under the theme "Cyberattacks on Azerbaijan’s Media Resources," Namazov said forensic analysis confirmed that both the technical methods and behavioral patterns used in the attack were characteristic of APT29, which is also known by other aliases including Midnight Blizzard and the Dukes.”
What’s broken with supply chain security is the demand chain - World Economic Forum ponders - “The supply chain is already complex and fragile, but the demand chain could strengthen it, if there’s alignment, collaboration and strong requirements for the supply chain.”
Software Fast Track Initiative - US Department of Defence announces - “This action directs the OCIO to undertake a 90-day sprint to develop a framework and implementation plan to define clear, specific: (1) cybersecurity and SCRM requirements; (2) rigorous software security verification processes; (3) secure information sharing mechanisms; and (4) Federal Government-led risk determinations to expedite the cybersecurity authorizations for secure, rapid software adoption.”
The Russian Open Source Project That We Can’t Live Without - Hunted Labs identifies - “we found a suspicious component known as easyjson. This component is used across U.S. Government systems, Fortune 500 enterprises, and serves as the cornerstone of Cloud Native Computing Foundation projects that underpin the entire cloud-native ecosystem.”
Reporting on/from China
Innovation is gaining momentum and moving forward vigorously - People’s Daily reports - “When science and technology prosper, the nation prospers; when science and technology are strong, the country is strong.”
Satellite images reveal Huawei’s advanced chip production line in China - Financial Times reports - “The third site is Huawei’s self-operated facility, which will include manufacturing lines for its smartphone and Ascend AI chips, as well as technology related to its autonomous driving business, said two people.”
China’s Tsinghua University snags top American AI researcher from Microsoft - South China Morning Post reports - ”Alex Lamb, a senior researcher at the New York lab of Microsoft Research, will be joining Beijing-based Tsinghua University’s College of AI (CAI) as an assistant professor in the coming fall term, according to two people familiar with the matter.”
AI
The Automation Advantage in AI Red Teaming - Dreadnode publish - “We demonstrate that automated approaches excel in systematic exploration and pattern matching challenges, while manual approaches retain speed advantages in certain creative reasoning scenarios, often solving problems 5.2× faster when successful”
Anthropic Economic Index: AI's impact on software development - Anthropic publishes - “79% of conversations on Claude Code were identified as “automation”—where AI directly performs tasks—rather than “augmentation,” where AI collaborates with and enhances human capabilities (21%). In contrast, only 49% of Claude.ai conversations were classified as automation.”
DeepSeek’s Prover maths-solving model fuels speculation about next-gen R2 progress - South China Morning Post reports - “On Wednesday, DeepSeek quietly open-sourced a new 671-billion-parameter AI model called Prover-V2, an upgrade to its specialised model designed to handle maths proofs.”
Nvidia raises concerns about Huawei’s growing AI chip capabilities with US lawmakers - South China Morning Post reports -”The issues were raised during a closed-door meeting between Nvidia executives and the US House of Representatives Foreign Affairs Committee on Thursday. Among the topics discussed were Huawei’s AI chips and how restrictions on Nvidia’s chips in China could make Huawei’s chips more competitive.”
Cyber proliferation
Winning the Fight Against Spyware Merchant NSO - Meta publish - “Finally, we’re publishing (unofficial) transcripts of deposition videos that were shown in open court so that these records are available to researchers and journalists studying these threats and working to protect the public. We intend to add official court transcripts once they become available.”
Spyware maker NSO ordered to pay $167 million for hacking WhatsApp - Washington Post reports - “Tuesday’s award was for $167,256,000 in punitive damages and $440,000 in compensatory damages, the largest blow ever dealt to the burgeoning spyware industry.”
Supreme Court asks what’s wrong if country using Pegasus against ‘anti-nationals’, agrees to examine if private citizens were hacked - The Hindu reports - “What is wrong if the country used that spyware for security reasons against anti-national elements? There is nothing wrong with having spyware. Against whom it is used, is the point,” Justice Surya Kant, heading a Bench with Justice N. Kotiswar Singh, addressed petitioners, who include senior journalist N. Ram.”
Bounty Hunting
Yemeni Man Charged in Federal Indictment Alleging He Sent ‘Black Kingdom’ Malware to Extort Businesses, Schools, and Medical Clinics - US Department of Justice announces - “A Yemeni national was charged today in a three-count federal grand jury indictment alleging he deployed the so-called “Black Kingdom” ransomware against computer servers owned organizations worldwide, including businesses, schools, and hospitals in the United States, including a medical billing services company in the San Fernando Valley.”
Santa Clarita Man Agrees to Plead Guilty to Hacking Disney Employee’s Computer, Downloading Confidential Data from Company - US Department of Justice announces - “A Santa Clarita man has agreed to plead guilty to hacking the personal computer of an employee of The Walt Disney Company last year, obtaining login information, and using that information to illegally download confidential data from the Burbank-based mass media and entertainment conglomerate via the employee’s Slack online communications account.”
Botnet Dismantled in International Operation, Russian and Kazakhstani Administrators Indicted - US Department of Justice announces - “Russian nationals, Alexey Viktorovich Chertkov, 37, Kirill Vladimirovich Morozov, 41, Aleksandr Aleksandrovich Shishkin, 36, and Dmitriy Rubtsov, 38, a Kazakhstani national, were charged with Conspiracy and Damage to Protected Computers for conspiring with others to maintain, operate, and profit from botnet services known as Anyproxy and 5socks.”
ICC Office of the Prosecutor launches public consultation on policy on cyber-enabled crimes under the Rome Statute - International Criminal Court announces - “The Office of the Prosecutor of the International Criminal Court is pleased to invite public comments on its draft policy on cyber-enabled crimes under the Rome Statute.”
Enhancing Cyber Resilience through Insurance: Revisiting Anti-Bundling Regulation - Institute for Security and Technology publishes - “This paper examines the strategic potential of cyber insurers, who ultimately share a long-term goal with policyholders: reducing the impact and frequency of cyber incidents. “
Reflections this week build the technical plenary from CyberUK which includes the keynote I gave and then a panel on market incentives.
The market incentives panel was a good debate (it didn’t agree - so not beige). The statement that the market will ensure poor software won’t succeed is noteworthy..
You will see at the end of the panel I did take away an action for us to explore and detail what good transparency for cyber security looks like. This is with the aim of addressing the information asymmetry between the buy and sell sides of technology.
I have previously shared how we think about this at NCSC back in September which included transparency. As such it was great to be given such a clear demand signal..
If you are interested in other content from CyberUK 2025 you can find the videos here.
Finally a quick shoutout to the Cyber Den (like Dragons Den) companies. We had ten British cyber start-ups pitch, the top three of which were 🥁:
🥇 Mindgard - 1st - solution for Red Teaming AI systems
🥈 SCI Semiconductor - 2nd - producing CHERI enabled semiconductors
🥉 Hacktivity Cyber Security Labs - 3rd - a hacking labs platform from UK academia which is being used at Batchelor’s degree level
I said in the closing it was wonderful to see Britain’s brilliance and innovation in cyber security solutions on show..
Not getting this via email? Subscribe:
Think someone else would benefit? Share:
All attribution is by others and not the UK Government unless specifically stated as such, please see the legal text at the end.
Have a lovely Saturday..
Ollie
Cyber threat intelligence
Who is doing what to whom and how allegedly.
Reporting on Russia
Russian cyber operations: automation of attacks, espionage against the defense industry and new tactics
State Service for Special Communications and Information Protection of Ukraine publish their summary showing the alleged evolution in Russian approaches. Noteworthy is level co-ordination in the operations and focus on the supply chain..
Among the trends of the second half of 2024 is a 48% increase in the number of incidents compared to the previous half of the year. The CERT-UA team notes a significant increase in the complexity of attacks and the level of sensitivity of the objects they were aimed at.
Russian hackers are actively implementing automation, using supply chain attacks to penetrate software suppliers, and combining espionage and sabotage techniques.
The main vector of attacks is the collection of intelligence that can affect the operational situation at the front. In particular, the enemy is targeting situational awareness systems and specialized defense enterprises.
2024 demonstrated the transition of Russian cyber strategy to a new phase: larger, more complex, and better coordinated operations involving automated tools and a focus on the supply chain.
COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs
Wesley Shields details what can only be described as a Darwinian initial access mechanism..
LOSTKEYS is delivered at the end of a multi-step infection chain that starts with a lure website with a fake CAPTCHA on it. Once the CAPTCHA has been “verified,” PowerShell is copied to the users clipboard and the page prompts the user to execute the PowerShell via the “run” prompt in Windows
Reporting on China
SAP Vulnerability Exploited in the Wild by Chinese Threat Actor
Sai Molige and Luca Barba detail the alleged exploitation of this vulnerability by a Chinese threat actor. Given that these will be large enterprises this will be of concern if true.
As part of our investigation into active exploitation of this vulnerability, we uncovered malicious infrastructure likely belonging to a Chinese threat actor, which we are currently tracking as Chaya_004 – following our convention for unnamed threat actors. The infrastructure includes a network of servers hosting Supershell backdoors, often deployed on Chinese cloud providers, and various pen testing tools, many of Chinese origin.
Reporting on North Korea
How we identified a North Korean hacker who tried to get a job at Kraken
Kraken document what some of the tells are when contending with this alleged North Korean operation which involves trying to get jobs with firms..
The candidate used remote colocated Mac desktops but interacted with other components through a VPN, a setup commonly deployed to hide location and network activity.
Their resume was linked to a GitHub profile containing an email address exposed in a past data breach.
The candidate’s primary form of ID appeared to be altered, likely using details stolen in an identity theft case two years prior.
Reporting on Iran
Iranian Cyber Actors Impersonate Model Agency in Suspected Espionage Operation
Unit 42 detail an alleged Iranian operation which is noteworthy for the apparent phased operation and down selection of their victims.. that and using a model agency as a cover!
[We] identified suspected covert Iranian infrastructure impersonating a German model agency. This infrastructure hosted a fraudulent website designed to mimic the authentic agency’s branding and content.
Visitors unknowingly triggered obfuscated JavaScript designed to capture detailed visitor information, such as:
Browser languages
Screen resolutions
IP addresses
Browser fingerprints
Attackers likely collected these data points to enable selective targeting.
https://unit42.paloaltonetworks.com/iranian-attackers-impersonate-model-agency/
Analysis of the latest attack activities of APT-C-51 (APT35) organization
Chinese analysis of an alleged Iranian operation, noteworthy for the fact they are using Telegram as their C2 coupled with extensive obfuscation/encryption of their payloads. They are really trying..
During the execution process, the malicious component interfered with the analysis by adding a large amount of invalid code, and at the same time showed a strong anti-killing ability, making it significantly resistant to detection, and finally achieved the purpose of stealing user information through layer-by-layer loading.
https://mp.weixin.qq.com/s/nY2Hyg6ZsM7ViXW1lhO2Ag
Reporting on Other Actors
Venom Spider Uses Server-Side Polymorphism to Weave a Web Around Victims
Arctic Wolf Labs detail a campaign which is noteworthy as it targets hiring managers..
[We] observed a recent campaign by the financially motivated threat group Venom Spider targeting hiring managers with spear-phishing emails.
The group abuses legitimate messaging services and job platforms to apply for real jobs using fake malicious resumes that drop a backdoor called More_eggs.
The backdoor can be used for a wide scope of malicious activities, from credential theft to stealing sensitive customer payment data, intellectual property or trade secrets.
Our research found several upgrades that the threat actor made to this malware to infect victims more effectively, and to evade automated analysis techniques like sandboxing.
From Callback Phishing to Extortion: Luna Moth Abuse Reamaze Helpdesk and RMM Tools Against U.S. Legal and Financial Sectors
Arda Büyükkaya details an alleged bit of tradecraft which will require endpoint controls in order to mitigate.
Luna Moth campaigns typically begin with phishing emails that lure victims into calling fake helpdesk numbers. Once connected, live operators posing as IT staff deceive victims into installing legitimate remote monitoring and management (RMM) tools. The attackers also registered typosquatted domains via GoDaddy, impersonating U.S. firms to collect contact details and enable targeted social engineering.
Discovery
How we find and understand the latent compromises within our environments.
Okta Security Detection Catalog
Okta have released this repo to help detect things which go bump in the night.
a collection of detection rules for security monitoring and detailed descriptions of log fields used for threat analysis within Okta environments.
https://github.com/okta/customer-detections
Robust Detection of Malicious Encrypted Traffic via Contrastive Learning
Meng Shen; Jinhe Wu; Ke Ye; Ke Xu; Gang Xiong; and Liehuang Zhu show the promise of being able to detect to encrypted malicious traffic with this work using a contrast learning approach. The fact it uses unlabled data is interesting..
Existing malicious encrypted traffic detection methods rely on large amounts of labeled samples for training, limiting their ability to quickly respond to new attacks. These methods also are vulnerable to traffic obfuscation strategies, such as injecting dummy packets. In this paper, we propose SmartDetector, a robust malicious encrypted traffic detection method via contrastive learning.
…
We conduct extensive experiments with five public datasets to evaluate the performance of SmartDetector. The results demonstrate that it outperforms the state-of-the-art (SOTA) methods in three typical scenarios. Specifically, in the evasion attack detection scenario, SmartDetector achieves an F1 score and AUC above 93%, with average improvements of 19.84% and 18.17% over the SOTA method, respectively.
https://ieeexplore.ieee.org/abstract/document/10964328
AWS Honey Tokens: The Good, the Bad, and the Ugly
Rad details some learning of implementing honey tokens in AWS where latency was observed in some cases..
CloudWatch strikes a good balance between reducing complexity and managing log processing latency. However, delays typically range from 2 to 5 minutes, depending on the region, based on our experiments with the service.
..
Our team has been developing an AWS honey token system with near real-time alerts, spending a significant amount of time exploring the intricacies of CloudTrail, CloudWatch, and EventBridge.
To illustrate the low latency of our highly scalable service, we’ve leveraged EventBridge to process logs in near real-time.
https://www.deceptiq.com/blog/aws-honey-tokens-good-bad-ugly
A Systematic Review of Honeypot Data Collection, Threat Intelligence Platforms, and Ai/Ml Techniques
Ahmed Kubba, Qassim Nasir, Omnia Elmutasim and Manar Abu Talib share their findings for this paper based review. Clearly value but the reality is maybe a little more of a journey…
the findings of this study demonstrate the transformative potential of integrating artificial intelligence with honeypots and threat intelligence platforms and emphasize the need for continued research to address existing limitations and advance the development of adaptive, automated, and resilient cybersecurity solutions.
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5242873
A Multi-modal Learning-Based Behavior Identification Scheme for Obfuscated Tunneling Traffic
Yong Zhou, Weiwei Liu and Jinsheng Sun show the power of machine learning in being able to differentiate different encrypted traffic types..
In this framework, Convolutional Neural Pre-Normalized Transformer (CNPT) is utilized to learn multi-dimensional flow-level statistical features and Bi-directional State Space Model (BiSSM) is used to process the windowing packet length sequences. The overall latent representation of the traffic is then fed into an output layer to get the decision. Experiments were conducted on a real-world captured dataset containing 60,923 samples, encompassing five common types of data: E-mail, music, video, web, and live streaming. The experimental results show that the proposed scheme can achieve an average identification accuracy of 93.54%, outperforming existing state-of-the-art encrypted traffic classification methods.
https://dl.acm.org/doi/abs/10.1145/3703187.3703285
Defence
How we proactively defend our environments.
How AuthZEN, and Shared Signals & CAEP complement each other
Atul Tulshibagwale and Omri Gazitt show how identity management protocols are going to get even more complex. The risk of it going wrong/vulnerabilities is going to material.
Transaction Tokens is an upcoming standard in the IETF that addresses all of these concerns and doesn’t require each microservice to call the PDP. It helps applications bind the decisions received from a PDP to a cryptographically signed ephemeral token, so that a decision issued by the PDP can be captured in a TraT and passed down to all microservices in a call chain.
https://openid.net/how-authzen-and-shared-signals-caep-complement-each-other/
Hotpatching for Windows Server
Microsoft announce they will be charging for hotpatching..
starting in July with the subscription launch, hotpatching for Windows Server 2025 will be offered at a subscription of $1.50 USD per CPU core per month.
Qtap
QPoint show a defensive use case of eBPF which also has malicious use cases..
An eBPF agent that captures traffic flowing through the Linux kernel. By attaching to TLS/SSL functions, data is intercepted before and after encryption and then passed to flexible plugins with full visibility along with all of the available context - process/container/host/user/protocol/etc. Qtap makes it possible to understand what's happening with your egress traffic, without modifying apps, installing proxies, or managing certs.
https://github.com/qpoint-io/qtap
What keeps kernel shadow stack effective against kernel exploits?
Satoshi Tanda details how this powerful mitigation works in practice..
Shadow stack, also referred to as SHSTK, is a backward-edge code flow integrity protection feature available in both Intel and AMD processors. Shadow stack detects the corruption of a return address in the stack by pushing a return address into the secondary stack in addition to the normal stack on the
CALLinstruction, and verifying return addresses in both the secondary and normal stacks match on the(I)RETinstruction. If they do not, it indicates stack corruption and #CP is raised to abort the program or kernel.This secondary stack is called shadow stack, and shadow stack used for kernel-mode
CALLand(I)RETis called supervisor shadow stack (SSS)...
Shadow stack enhances backward-edge code flow integrity but faces challenges in kernel-mode, where privileged attackers can manipulate page tables. Making SSS pages read-only with SLAT may not be viable protection against such attacks. Supervisor shadow stack restrictions (SSSCheck) on AMD and supervisor shadow-stack control on Intel address these issues. These features allow secure supervisor shadow stack enforcement with minimal performance impact.
https://tandasat.github.io/blog/2025/04/02/sss.html
Foundation-sec-8b: Cisco Foundation AI’s First Open-Source Security Model
Paul Kassianik , Baturay Saglam , Alexander Chen , Blaine Nelson , Anu Vellore , Massimo Aufiero , Fraser Burch , Dhruv Kedia , Avi Zohary , Sajana Weerawardhena , Aman Priyanshu , Adam Swanda , Amy Chang , Hyrum Anderson , Kojin Oshiba , Omar Santos , Yaron Singer and Amin Karbasi detail a smaller model which they claim is as performant in the cyber security domain as larger..
In this work, we introduced Foundation-Sec, a cybersecurity-specialized large language model built upon Llama 3.1. Addressing key limitations that have hindered LLM adoption in cybersecurity, we curated a high-quality cybersecurity dataset and demonstrated significant improvements in taskspecific performance. Our evaluations show that Foundation-Sec achieves capabilities competitive with much larger models, such as Llama 3.1-70B, without compromising general-purpose functionality.
We highlight several promising directions for further research and development:
Scale up Foundation-Sec by increasing its parameter count and expanding the training corpus.
Extend Foundation-Sec to handle cybersecurity-related coding tasks.
Integrate Foundation-Sec into tool-calling and agentic systems for more interactive applications.
https://blogs.cisco.com/security/foundation-sec-cisco-foundation-ai-first-open-source-security-model
https://huggingface.co/fdtn-ai/Foundation-Sec-8B/blob/main/Technical_Report.pdf
Incident Writeups & Disclosures
How they got in and what they did.
Intrusion into Middle East Critical National Infrastructure
Mark Robson, John Simmons, Faisal Abdul Malik Qureshi, Said Wali, Xiaopeng Zhang, Fred Gutierrez and Hossein Jazi detail what a real alleged Iranian APT intrusion looks like.
The intrusion persisted from at least May 2023 to February 2025, with signs of compromise dating back as far as May 2021. Attackers initially gained access via stolen VPN credentials and established persistence through multiple web shells and backdoors, including Havoc, HanifNet, HXLibrary, and NeoExpressRAT. They bypassed network segmentation using open-source proxying tools like plink, Ngrok, glider proxy, and ReverseSocks5.
Key insights from the investigation include:
The attack unfolded in waves, with the adversary deploying new malware and infrastructure over time. They used custom loaders to execute Havoc and SystemBC in memory.
In addition to publicly available tools, the adversary deployed novel backdoors such as HanifNet, HXLibrary, and NeoExpressRAT, enabling command execution, file operations, and system discovery.
The adversary avoided U.S.-based infrastructure, instead relying on non-U.S. VPS providers.
Persistence was maintained through scheduled tasks designed to blend in with legitimate Windows processes.
Virtualization infrastructure was actively targeted, with the adversary conducting reconnaissance to understand network configurations.
After containment efforts, the adversary attempted to regain access by exploiting ZKTeco ZKBioTime software vulnerabilities, which had not been previously reported in the wild. They also launched targeted phishing attacks, using compromised third-party emails to steal administrator credentials.
Vulnerability
Our attack surface.
.xrm-ms File Type
John Page details a vulnerability which can lead to NTLM hash leakage across the network.
An "xrm-ms" digital license file opens default (times a tickin) in Internet Explorer (MSIE) and on later OS versions switches to MS Edge.
The ".xrm-ms" file format allows injecting XML stylesheets that will then get processed, when a user opens it.
Adversaries can reference UNC paths for the stylesheet HREF tag that points to LAN network share or attacker controlled infrastructure.
Right-Click Execution - A Tale of Windows LNK NTLM Leak
Nafiez details a behaviour which needs Mark of the Web to be unavoidable to mitigate.
I recently identified and responsibly disclosed a potential security issue affecting Windows LNK files (shortcuts). This issue impacts multiple versions of the Windows operating system, including Windows 10 and Windows 11 up to the latest releases. Despite providing a proof of concept demonstrating the security implications, Microsoft has declined to address this vulnerability through a patch, stating it “does not meet their security bar for servicing.”
Microsoft’s justification centers on their Mark of the Web (MOTW) protection mechanism. According to their response, the issue I identified doesn’t present a significant security risk because MOTW protections would be applied to LNK files downloaded from the internet, supposedly mitigating the exploit vector demonstrated in my proof of concept.
https://zeifan.my/Right-Click-LNK/
BinPool: A Dataset of Vulnerabilities for Binary Security Analysis
Sima Arasteh, Georgios Nikitopoulos, Wei-Cheng Wu, Nicolaas Weideman, Aaron Portnoy, Mukund Raghothaman and Christophe Hauser detail a dataset which will have some application in the machine learning domain.
In this paper, we describe a new publicly available dataset which we dubbed Binpool, containing numerous samples of vulnerable versions of Debian packages across the years. The dataset was automatically curated, and contains both vulnerable and patched versions of each program, compiled at four different optimization levels. Overall, the dataset covers 603 distinct CVEs across 89 CWE classes, 162 Debian packages, and contains 6144 binaries. We argue that this dataset is suitable for evaluating a range of security analysis tools, including for vulnerability discovery, binary function similarity, and plagiarism detection.
https://arxiv.org/abs/2504.19055
Offense
Attack capability, techniques and trade-craft.
ProxyBlobing into your network
Alexandre Nesic shows that tunnel opportunities present themselves in marvelous ways..
During an assumed breach ops via a virtual desktop interface, we discovered a wildcard allow firewall rule for the Azure Blob Storage service. We proved that even with restrictions in place, it was still possible to reach the Internet. Afterwards, we thought of abusing this firewall misconfiguration (recommended by Microsoft) in a much more useful way. To demonstrate that I built a SOCKS5 proxy that uses blobs to tunnel traffic to the target's internal network.
https://blog.quarkslab.com/proxyblobing-into-your-network.html
Bolthole
Steve Borosh packages up an attack technique we can expect will inspire some adversaries.
Dig your way out of networks like a Meerkat using SSH tunnels via ClickOnce.
..
A proof-of-concept ClickOnce payload for Red Teams to establish initial access in authorized penetration tests.
https://github.com/rvrsh3ll/Bolthole
Exploitation
What is being exploited..
Play-linked attackers targets the CVE-2025-29824 zero-day vulnerability
Symantec detail exploitation of a zero-day by a criminal attack in a previously targeted component.
Attackers linked to the Play ransomware operation deployed a zero-day privilege escalation exploit during an attempted attack against an organization in the U.S. The attack occurred prior to the disclosure and patching of a Windows elevation of privilege zero-day vulnerability (CVE-2025-29824) in the Common Log File System Driver (clfs.sys) on April 8, 2025.
https://www.security.com/threat-intelligence/play-ransomware-zero-day
Cyber Criminal Proxy Services Exploiting End of Life Routers
FBI warns of end-of-life routers being exploited to build a proxy network.
Recently, some routers at end of life, with remote administration turned on, were identified as compromised by a new variant of TheMoon malware. This malware allows cyber actors to install proxies on unsuspecting victim routers and conduct cyber crimes anonymously.
https://www.ic3.gov/PSA/2025/PSA250507
Tooling and Techniques
Low level tooling and techniques for attack and defence researchers…
The Future of Crash Analysis: AI Meets WinDBG
Sven Scharmentke details setting up an MCP server with WinDBG to vibe-debug..
it combines the best of both worlds - AI's ability to quickly process and analyze large amounts of data with your human expertise in interpreting what truly matters for your specific application. Think of it as having a brilliant but occasionally confused intern who can do incredible things but sometimes needs you to point them in the right direction. "No, not that pointer... the OTHER pointer."
https://svnscha.de/posts/ai-meets-windbg/
Precise Microarchitectural Attacks with Page-Granular Massaging
Matej Bolcskei, Patrick Jattke, Johannes Wikner, and Kaveh Razavi detail a new technique which I suspect whilst interesting will have limited real-world implications due to the x86 focus and the caveats around value in the cloud..
This paper introduces Rubicon, a novel technique for page-granular physical memory massaging within the Linux kernel’s Zoned Buddy Allocator (ZBA). Rubicon leverages three new primitives that enable placing a page frame at the head of any chosen ZBA free list, ensuring it is prioritized for allocation regardless of its initial state or per-CPU freelist association. Using Rubicon, we build the first deterministic privilege escalation Rowhammer exploit on x86 with a success rate of 100%. Our integration of Rubicon into a recent Spectre attack shows that the root hash of /etc/shadow can now be leaked in 27.8 and 9.5 seconds on AMD and Intel systems — a 6.8× and 284× speedup over the original attack, respectively. We also propose and evaluate practical mitigations for Rubicon, which limit page movement between ZBA lists with negligible performance and fragmentation impact.
..
Rubicon in the cloud. The cloud represents a highvalue target for Rubicon, as it hosts critical data and services. While the primitives outlined in Section 6 remain applicable in the cloud scenario, they require alternative implementations. Such implementations, however, are challenging as hypervisors employ specialized resourcesharing mechanisms to manage physical memory, which influence how memory is allocated and deallocated. Large contiguous memory blocks cannot be easily exhausted due to resource limit enforcement, and memory management techniques such as balloon drivers complicate deallocation for guest machines
https://comsec.ethz.ch/wp-content/files/rubicon_eurosp25.pdf
https://github.com/comsec-group/rubicon
Azurevelo
Eric Mannon releases a useful work aid for IR teams..
deploys a Velociraptor container on Azure App Service for Incident Response investigations.
https://github.com/msdirtbag/azurevelo
Footnotes
Some other small (and not so small) bits and bobs which might be of interest.
Annual report
Nothing of note this week
UK-Taiwan Cooperation in Cyber Security: Challenges and Opportunities - “This research examines UK and Taiwan cyber security strategies, assessing shared challenges and exploring opportunities for bilateral and multilateral cooperation to mitigate cyber risks and enhance resilience”
Cyber Resilience in the Indo-Pacific - “This Asia Policy roundtable examines how four Indo-Pacific countries—India, Indonesia, Japan, and South Korea—fare on three aspects of cyber resilience: resistance, recovery, and adaptation.”
Artificial intelligence
Books
The AI City - “This open access book presents the concept of AI Cites for the first time. It includes the theoretical basis, development frontier, and different application scenarios of artificial intelligence cities. The book is accompanied by rich practical cases to conduct in-depth and detailed discussions on the proposition of artificial intelligence cities.”
Events
CyberUK - videos
SO-CON 2025 - videos
UNDIR Cyber Stability Conference 2025, May 12th
CyCon 2025, May 27-30, 2025
As a bonus this was the intro video from CyberUK
Unless stated otherwise, linked or referenced content does not necessarily represent the views of the NCSC and reference to third parties or content on their websites should not be taken as endorsement of any kind by the NCSC. The NCSC has no control over the content of third party websites and consequently accepts no responsibility for your use of them.
This newsletter is subject to the NCSC website terms and conditions which can be found at https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions and you can find out more about how will treat your personal information in our privacy notice at https://www.ncsc.gov.uk/section/about-this-website/privacy-statement.
Fantastic reading list! Right in time for my Sunday morning coffee.
It looks like the World Economic Forum link on supply chain is broken. Anyone else getting that?