August Cyber Threat Download™

Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. 

DFIR insights

The digital forensics and incident response (DFIR) team is seeing an increase in compromises on multiple sites that use WordPress, Joomla, and ColdFusion. The team discussed two specific cases.

In the first case, a client had not updated Joomla since 2021, and 14 webshells — pieces of code that allow a threat actor to access the backend of a website without having to log in to the actual infrastructure — were present. Some webshells dated back as far as 2019, and six webshells appeared this year following a June 5 announcement that an improper access control vulnerability in Joomla's JCE editor extension allows for the creation of new editor profiles for unauthenticated users, resulting in PHP code being uploaded and executed. A proof-of-concept code was posted on GitHub on June 8, and the Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on June 10. The team saw one threat actor compromise the system six different times using six different webshells. Ultimately, the threat actor changed the administrator password and redirected the site.

In the second case, a client website had 10 vulnerable WordPress plug-ins that required updates. However, for unknown reasons, the third-party vendor had not made those updates. On June 9, administrator-level users were created on a WordPress site via authentication bypass. Then, on June 10, an unauthenticated bypass vulnerability in UpdraftPlus was announced, but the client was already compromised. On June 21, one of the new administrator accounts added a ClickFix captcha to the site, and on June 22, when internal users logged in to the website, they executed the ClickFix captcha. As a result, several computers were compromised, and the threat actor attempted to execute ransomware. The team recommends that clients using third-party hosts for their websites review their contracts to ensure that plug-ins are receiving prompt updates.

Notable vulnerabilities

As many as 8,002 newly disclosed vulnerabilities were reported in July — by far, the highest number of vulnerabilities ever reported. Of those 8,002 vulnerabilities, there was known exploitation of 59 of them, which included 36 impacted vendors. More than 40% of these 59 exploits were remote code execution vulnerabilities. Online proof-of-concept codes were made available for 53 of the vulnerabilities, which is a whopping 90% of them, increasing the likelihood that threat actors will exploit the products. The dramatic increase in proof-of-concept codes stems from an increased use of artificial intelligence (AI). Researchers are using AI to assist in finding new vulnerabilities and help them write the proof-of-concept codes that explain how to exploit the vulnerabilities.

The team spotlighted the many vulnerabilities that impacted Google Chrome in July. On July 1, Google announced updates to address 382 vulnerabilities that impacted the Google Chrome browser. Fifteen of the vulnerabilities were ranked as critical severity and 67 were ranked as high severity, but there were no known exploitations. 

The team showed the enhanced vulnerability management program (eVMP) data that they use to track vulnerabilities, which included the ones for Google Chrome. The eVMP data shows real-time information so that the team can see patching activity, new vulnerabilities as they occur, and how clients are reacting to the vulnerabilities. Typically, the team sees spikes in data when the Microsoft Patch Tuesday vulnerabilities are reported, but this instance was the first time the team had seen such a large spike for non-Microsoft product vulnerabilities. At the time of the spike, the team sent a notice to eVMP clients to explain what was happening, why it was present in their data, and how to address it. 

During Microsoft Patch Tuesday in June, 206 reported vulnerabilities were disclosed, including 37 critical vulnerabilities and three zero days. The zero days included privilege elevation, security feature bypass and denial-of-service vulnerabilities. Then, during the Microsoft Patch Tuesday in July, as many as 622 reported vulnerabilities were addressed — a record number that was three times the number reported in June. Of those 622 reported vulnerabilities, there were 62 critical vulnerabilities and two zero days, both of which were privilege escalation vulnerabilities.

SOC insights

Threat actors are clever at convincing users that they are a trusted source available to help with computer issues. The security operations center (SOC) team has recently seen an uptick in such social engineering scams, particularly impersonation attacks using Microsoft Teams. The team discussed the basic steps of a social engineering attack, offered red flags for identifying an attack, and recommended actions to take.

1. Email bombing. To start a social engineering attack, threat actors flood a user's inbox with unwanted emails, such as marketing subscriptions or sales pitches. When unusual emails appear in a short time frame, the user should calmly assess the situation and report it directly to the IT or security team.

2. Fake IT support. Threat actors impersonate internal help desk agents using spoofed corporate aliases to address fake security updates, technical issues, or urgent support requests. If someone claiming to be a support person with the IT department makes initial contact, the user should verify the situation with the known help desk. 

3. Remote access request. Threat actors request remote access to the user's computer using desktop tools such as Quick Assist and AnyDesk. If the support person instructs the user to ignore warnings and download software from an unfamiliar link, the user should not do it. Users should never share credentials or grant remote access during an unsolicited interaction.

4. Device compromise. Once the threat actor has the user's credentials or has been granted remote access, the device has been compromised. If the support person asks the user to approve security prompts, disclose credentials, or provide a multifactor authentication (MFA) code, the user should report the incident to the security team.

5. Attacker activity. After a compromise, the user may experience activity such as the opening of unexpected command windows, sensitive file access, or loading of unusual software on the device. The user should safely disconnect the device to minimize the amount of exfiltration, and the IT or security team should immediately reset the credentials.

Users can be tricked by social engineering scams, but organizations can proactively implement measures to protect users against attacks. The team recommends that all organizations use hardening and allowlists to restrict external access to Teams. Also, organizations should implement training to teach users to recognize external chat warnings and suspicious IT support requests and learn the process for how the internal help desk verifies its identity to users. If an organization does not have a process in place, the team recommends establishing one.

GentleKiller activity

The detection engineering team discussed how threat actors are using multiple techniques to terminate and disable endpoint detection and response (EDR) and antivirus (AV) products. Of particular interest, the team discussed how The Gentlemen, a financially motivated threat actor group, manages the ransomware-as-a-service platform known as GentleKiller, and the group's affiliates carry out the attacks.

The attacks consistently begin at the internet-exposed edge infrastructure. The group targets Fortinet FortiGate and Cisco devices using credential brute-force attacks, exploitation of known vulnerabilities, and access purchased from initial-access brokers. The group actively tracks a few newly disclosed vulnerabilities, then pivots specifically to CVE-2025-7771. 

EDRs operate in user mode and kernel mode, but the Windows kernel, which is Ring 0, has the highest level of privilege. The attack method uses bring your own vulnerable driver (BYOVD), which abuses a legitimately signed yet vulnerable kernel driver to execute the attacker-controlled code in Ring 0. EDRs are not able to defend against malicious code executing in Ring 0, making BYOVD an effective attack technique. Once in Ring 0, the attacker can bypass operating system protections, manipulate kernel memory, and disable or terminate the EDR and AV drivers and protected processes before executing ransomware. Organizations can check to see if BYOVD policies are enabled by running PowerShell. If the result is 1, the policies are enabled. If the result is 0, the policies are not enabled.

The team discussed several ways organizations can harden against GentleKiller attacks including patching edge devices, using allowlists for administration, implementing internal network segmentation, using the best authentication possible on internet-reachable remote desktop protocols and remote workstations, not allowing users to be local administrators, using phishing-resistant MFA, and backing up and testing data. 

About the Pondurance threat intelligence team

The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our SOC, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape.