In today’s cybersecurity news…
SharePoint RCE flaws patched and exploited from China
We reported yesterday on the active attacks on newly discovered SharePoint RCE flaws, known as “ToolShell.” Multiple threat actors are racing to exploit these flaws, and Mandiant CTO Charles Carmakal confirmed its seen involvement from groups operating out of China. He further said, “We fully anticipate that this trend will continue, as various other threat actors, driven by diverse motivations, will leverage this exploit as well.” Mandiant estimates several hundred organizations impacted, reportedly across U.S. government agencies, educational institutions, and organizations that manage critical infrastructure, according to the Washington Post. Microsoft released emergency patches for SharePoint Server Subscription Edition and SharePoint Server 2019, with patches for SharePoint Server 2016 in the works.
Dell acknowledges World Leaks data breach
The company disclosed the extortion group, a rebrand of Hunters International, breached a Customer Solution Centers platform, which is the front end it uses for commercial customer demos. However Dell said that this platform “is intentionally separated from customer and partner systems, as well as Dell’s networks and is not used in the provision of services to Dell customers,” and uses primarily synthetic data. Dell said it would not release details about the breach while it was still investigating. After Bleeping Computer published Dell’s acknowledgement of the breach, World Leaks released samples of stolen data, which appear to be configuration and backup data.
$44 million stolen from crypto exchange
The co-founders of the Indian cryptocurrency exchange CoinDCX confirmed that threat actors stole $44 million worth of stablecoins. This theft occurred from an internal account used for operational liquidity and did not affect user funds, and it will cover its losses from its reserves. The company’s initial investigation found the theft stemmed from unauthorized access to its account on a partner exchange. The company stated that it is performing a full investigation into the incident, will create a bug bounty program in response, and is offering up to 25% of the recovered assets to anyone who can retrieve the pilfered assets.
UK government signs strategic partnership with OpenAI
The UK government announced the deal, which will see it further work with OpenAI on AI security research, as well as looking into further AI infrastructure investments in the country. For it’s part OpenAI will expand its London office and look at ways to deploy it’s tech stack across justice, defence, security and education technology. At the London Tech Summit last week, the UK government announced plans to invest 1 billion pounds in computing infrastructure for AI over the next five years.
(Reuters)
Huge thanks to our sponsor, Nudge Security
Arizona election officials avoided CISA after attack
On June 23rd, Arizona’s Secretary of State’s office became aware of a defacement attack against its election site, with candidate photos replaced with images of the late Iranian Ayatollah Khomeini. The attack impacted a legacy system with no access to voter rolls. Through its state Department of Homeland Security office, Arizona officials contacted federal agencies like the FBI about the attack, but this did not include outreach to CISA. Secretary of State Adrian Fontes said initial attempts to establish a relationship with Homeland Security Secretary Kristi Noem earlier this year were “dismissed outright.” CISO for Arizona’s Secretary of State, Michael Moore clarified the state has no “direct level of support” from CISA since the end of 2024, saying “right now, in 2025, we have no [federal] cybersecurity advisors.”
CrushFTP exploited with already patched flaw
The popular file transfer company issued an advisory, stating that “hackers apparently reverse engineered our code and found some bug which we had already fixed.” The current version of CrushFTP is not impacted; however, builds prior to July 1, 2025, are vulnerable to an attack over HTTPS. The company said it saw threat actors beginning exploitation on July 18th, “re-using scripts from prior exploits to deploy things on CrushFTP servers.” Researchers at Shadowserver Foundation found over 1,000 unpatched servers still exposed online.
Chinese-linked group targets African IT infrastructure
Researchers at Kaspersky found that the China-linked group APT41 was targeting an unnamed IT infrastructure company that spanned across several countries in Africa. This used a hacked SharePoint server for command and control. Once gaining access to a host, the threat actors would harvest credentials for privileged accounts and deploy Cobalt Strike. From there, they would perform further attacks on machines on the network deemed valuable in after initial reconnaissance. The researchers noted that APT41 is typically not very active in Africa, and that it proved quick to adapt to the infrastructure of new targets.
MuddyWater makes Android sing the blues
Researchers at the firm Lookout revealed details about a new campaign by the Iranian cyber espionage group MuddyWater. This utilizes the Android-based surveillance tool DCHSpy, a tool that has been active on the platform since at least last year. Based on new malware samples, MuddyWater is deployed by posing as two spoofed VPN apps, EarthVPN and ComodoVPN, supposedly based in Romania and Canada, respectively. These are disseminated through Telegram channels to English and Farsi speakers, with lures that heavily feature anti-Iranian themes. Samples also show references to SpaceX’s Starlink service, indicating that it may be a focus of the campaign as well. Once installed, DCHSpy collects account logins, contacts, SMS messages, location data, records audio, and can take photos.