November Cyber Threat Download™

Each month, the Pondurance team of experts in threat intelligence, incident response, security operations, vulnerability management, and compliance share insights with our clients and partners to help them stay on top of recent trends in cybersecurity and take action to prevent harm to their organizations. Please feel free to share this information with colleagues and other interested parties on social media. 

DFIR insights

The digital forensics and incident response (DFIR) team discussed a social engineering-based ransomware case it recently investigated. In the attack, the threat actor registered a targeted privileged user at an organization for thousands of online subscriptions, which resulted in thousands of emails being sent within a short time frame, known as subscription bombing, and created considerable confusion for the user. Then, the threat actor contacted the user through Microsoft Teams and impersonated someone from the organization's help desk. The threat actor convinced the user to quickly establish a remote access session using Quick Assist. Through the session, the threat actor gained remote access to the user's system.

Because the user believed the threat actor was from the organization's help desk, the user didn't report the incident to the IT team. Therefore, the initial compromise remained undetected. The threat actor maintained persistence, and there was dormant access for four months, which is a lengthy dormant period since most threat actors are very financially motivated. Typically, threat actors enter the network, exfiltrate and encrypt as quickly as possible, and immediately demand a ransom. After that four-week dormant period, threat actors returned through the previously established access, exfiltrated data (though they didn't encrypt), and left a ransomware note, which the organization later found. 

The team presented three specific takeaways from the investigation that organizations should review with employees:

• Social engineering means more coordination. Subscription bombing isn't simply a nuisance activity. It often functions as the first stage of a broader social engineering attack. Employees need to know that threat actors may immediately follow disruptive activity by impersonating the internal IT team using Teams calls or messages.

• Privileged users increase the impact. Accounts with privileged access can significantly expand the potential scope of an attack, so organizations should limit privileged access based on business need. Also, IT teams should regularly monitor such accounts for unusual activity.

• Reporting speed matters. Organizations should encourage employees to report subscription bombs, unexpected help desk contact, unsolicited Teams communications, and unexpected remote support requests, even if the technical issue was supposedly resolved.

Notable vulnerabilities

In August, 12,728 newly disclosed vulnerabilities were reported — the highest number of vulnerabilities ever reported. Of those vulnerabilities, there was known exploitation of 73 of them, impacting 45 vendors, including Microsoft, Google Chrome, WordPress, PaperCut, and Apple. Thirty-four of the 73 known exploitations were remote code execution vulnerabilities and two were known artificial intelligence (AI)-assisted operations. Online proof-of-concept codes were made available for 41 of the newly disclosed vulnerabilities, increasing the likelihood that threat actors will exploit the products. 

During Microsoft Patch Tuesday in August, 415 reported vulnerabilities were addressed, including 62 critical vulnerabilities and one zero day. During Microsoft Patch Tuesday in September, 972 reported vulnerabilities were addressed. Of those 972 reported vulnerabilities, there were 113 critical vulnerabilities and two zero days that were both privilege elevation vulnerabilities. The team recommends that organizations pay particular attention to critical patches for devices and software that employees use every day.

This month, the team looked at the impacts the elevated number of vulnerabilities are having on employees and government agencies. As background, the team explained that there were less than 20,000 newly disclosed vulnerabilities assigned a common vulnerabilities and exposures (CVE) number each year in 2017 and 2018, which amounts to approximately 1,500 vulnerabilities per month. Since then, that number of vulnerabilities has risen to the current high number of nearly 13,000 for the month, which is a significant rise. AI can be tied to some of the recent increase in the number of vulnerabilities discovered, the types of exploits performed, and the speed of the attacks.

For employees, the rise in monthly numbers means more to do: more vulnerabilities to track, more frequent patching required, and more patches to apply. As patching becomes increasingly important, IT teams may experience fatigue from applying patches and running scans. Also, the faster AI-enabled attacks mean organizations need to plan ahead and have an accurate inventory. IT teams need to know what software is running on their networks, what kind of networking equipment is exposed to the internet, and whether the organization has virtual private networks (VPNs) or firewalls. In addition, organizations must train employees on phishing emails and, in particular, teach them to refrain from clicking on suspicious links or opening files from unknown sources. 

For government agencies, the increasing number of newly disclosed vulnerabilities has changed the process for how vulnerabilities are handled. The team briefly explained how CVEs are numbered by a CVE Numbering Authority (CNA), which is typically a large software or technology manufacturing company. Currently, approximately 550 CNAs assign CVE numbers and preliminary Common Vulnerability Scoring System scores. The CNA submits the information to the National Institute of Standards and Technology (NIST) and the National Vulnerabilities Database, and NIST enriches the vulnerability, meaning it reanalyzes the information and possibly adjusts the score. Early on, all submissions were enriched, but with the increase in vulnerabilities, that is no longer the case. Since 2025, NIST uses an executive order from 2021 to determine which vulnerabilities to enrich, primarily software and devices used by federal government agencies.  

Most common threats

The volume of threats is increasing, so the security operations center (SOC) team wanted to make clients aware of the most common threats it has seen over the past six months — unauthorized access, potentially unwanted software, and malware — and how to protect against them. 

• Unauthorized access. The SOC team had 5,889 threat tickets involving unauthorized access published within Scope in the past six months. Reducing that risk starts with controlling who can sign in, what users can access, and how quickly the SOC can spot misuse. The team recommends using phishing-resistant multifactor authentication for emails, VPNs, and administrative portals. Also, organizations should limit privileged access, giving access only to employees who need it. The team reminded organizations to review privileged groups and unused third-party application grants each quarter and enforce policies that limit access across devices. In addition, organizations should prepare for a fast response to an incident by keeping contact lists up to date.

• Potentially unwanted software. Any unwanted software adds risk, so the team suggests organizations only allow IT-approved software, deploy using trusted installers, and investigate repeat detections, such as if a toolbar returns after removal or if there are multiple detections for an app across a specific team.

• Malware. The team offered recommendations for organizations to follow to prevent malware. Organizations need to cover every endpoint and check protection coverage weekly. They should limit what can be run by blocking unapproved installers from downloading apps and limiting local administrative rights. Also, the team recommends that organizations be ready to contain by having policies in place that designate who can isolate a device. 

Detection engineering insights

Interesting and newsworthy events occur in cybersecurity every day, and the detection engineering team shared a few of the noteworthy happenings. 

• Retirement for SMS first factor. For security enhancement, Microsoft is retiring its SMS first-factor sign-in for Microsoft Entra ID workforce tenants starting Feb. 1, 2027. Organizations need to identify which users are affected by this change, migrate them to phishing-resistant methods, and update company policies to avoid sign-in disruptions.

• AI use. The team briefly explained how to audit what employees are doing with AI on their laptops and computers. An endpoint detection and response (EDR) tool with the right SKU can help an organization audit for AI use, and an EDR with an add-on SKU can help lock down or prevent non-sanctioned AI use. The team discussed how AI EDR products require hooks into the browser and into the command line or shell access to see what users are doing and how AI is replying. Also, AI EDR products require network data hooks to see which sites users visit, which vendors are visited, and which model versions and session IDs are used. The team suggests that each organization should decide which AI product it wants to use and block all other AI websites and API calls. 

• Microsoft Teams file extension blocking. In November, Microsoft will be expanding the administrative controls for Teams including which extensions and files users can block. With the change, administrators can customize the types of files that can be blocked in Teams to improve file protection while still allowing for collaboration.

• ClickFix phishing. Starting Sept. 14, a breach affecting Brevo infrastructure pushed malicious JavaScript to more than 100,000 websites — including hbomaxx[.]us, hbomax-macos[.]com, microsoftupdater[.]info, and promo-chatgpt[.]com — through Brevo-hosted widgets and scripts. The links to these sites were also seen from seemingly reputable sources such as the HBO Max subreddits. In the breach, threat actors leveraged a compromised Cloudflare API key that had been hard coded into the company's application source code. Threat actors published 108 malicious ads over a 48-hour period using the compromised account.

Scope updates

The product management team receives valuable feedback from clients and strives to make enhancements based on that feedback. The team learned that clients want email notifications with content they can understand at a glance, before opening a ticket in Scope, so the team delivered. 

Now, clients can update to a new email design and format for a clearer view of ticket notifications. The modern template design offers updated organization and presentation of ticket information, and the HTML format provides a more visual email experience. The new emails allow clients to find priority, category, and timestamps more easily and review a clearly separate summary before opening a ticket. For clients who prefer the email notifications as is, the original email format and template design remain available.

The team encourages clients to provide feedback on the new email design and format and offer any suggestions that might enhance their experiences working with Pondurance.

About the Pondurance threat intelligence team

The Pondurance threat intelligence team consists of cybersecurity experts across our organization dedicated to providing exceptional threat intelligence research and insights to optimize the efficacy of proactive threat prevention efforts, as well as threat detection and response. By monitoring emerging cybersecurity trends and collaborating with our SOC, we provide real-time insights and actionable intelligence. Through knowledge sharing and advisory posts, we empower organizations to strengthen their cybersecurity posture and foster a more secure digital landscape.