Threat Alerts

Microsoft and CISA have issued urgent warnings about CVE-2025-53786 (CVSS 8.0), a high-severity privilege escalation vulnerability affecting hybrid Exchange deployments that could allow attackers to silently compromise cloud environments. The flaw affects Exchange Server and Subscription Edition when configured in hybrid setups with Exchange Online, where both environments share the same service principal for authentication. While no active exploitation has been observed, the vulnerability poses significant risks to organizations running hybrid email infrastructure, prompting CISA to issue Emergency Directive requiring federal agencies to implement mitigations.

The vulnerability exploits the shared service principal architecture in hybrid Exchange deployments, where on-premises servers and Exchange Online use the same identity for authentication between environments. An attacker who has already gained administrative access to an on-premises Exchange server can leverage this shared identity to forge trusted tokens or manipulate API calls that the cloud environment accepts as legitimate. This escalation allows attackers to read, delete, and exfiltrate emails from any mailbox within the organization, auto-forward emails to external accounts, and gain administrative control over the Exchange Online environment. The attack is particularly concerning because it leaves minimal auditable traces, as actions originating from on-premises Exchange don’t generate typical malicious behavior logs in Microsoft audit systems.

Microsoft identified this vulnerability during a security review of changes implemented in April for hybrid deployments and has since released a hot fix along with configuration guidance to replace the shared service principal with a dedicated Exchange hybrid app. The company plans to enforce migration to the new dedicated app by introducing temporary disruptions to Exchange web services traffic starting August, with full mandatory adoption by October.

Security researchers have identified significant changes in the distribution and obfuscation techniques used by DarkCloud Stealer, a malicious information-stealing malware that has evolved its attack methods since early April 2025. The malware’s enhanced capabilities and sophisticated delivery mechanisms pose substantial risks to data security, potentially leading to credential theft, financial information compromise, and unauthorized access to sensitive systems.

The updated attack chain begins with phishing emails containing compressed archives (TAR, RAR, or 7-Zip formats) that house either JavaScript or Windows Script Files as initial payloaders. These scripts download and execute PowerShell files from open directory servers, which then deploy executable files protected by ConfuserEx obfuscation. The malware employs multiple layers of encryption and obfuscation, including Base64 encoding, AES encryption, and RC4 stream cipher algorithms to conceal its operations. The final payload, written in Visual Basic 6, utilizes process hollowing techniques to inject itself into legitimate Windows processes like RegAsm.exe, effectively masking its presence within the system.

The Akira ransomware group has developed a sophisticated method to disable Microsoft Defender and other antivirus solutions by exploiting a legitimate driver from ThrottleStop, an Intel CPU tuning utility. This technique, known as “bring your own vulnerable driver” (BYOVD), allows attackers to gain kernel-level access and terminate security processes without triggering detection systems. The vulnerability in the ThrottleStop driver has been assigned CVE-2025-7771 and represents a significant threat to enterprise security, as it enables ransomware operators to run their encryption routines unimpeded across compromised networks.

The attack begins when threat actors register the legitimate “rwdrv.sys” driver from ThrottleStop as a service on compromised systems, then load a malicious counterpart that manipulates Defender’s settings by flipping the “DisableAntiSpyware” flag. The malicious software exploits vulnerable IOCTL functions in the driver that allow reading from and writing to physical memory addresses, enabling any user with administrative privileges to access these dangerous capabilities. Once kernel access is achieved, the attackers execute their payload with elevated privileges, effectively bypassing endpoint detection and response tools that would normally flag suspicious activity.

In documented incidents, attackers have used this technique as part of larger campaigns involving credential theft through tools like Mimikatz, lateral movement via pass-the-hash attacks, and ultimately the deployment of ransomware variants including MedusaLocker. The AV killer component targets numerous security products from major vendors, continuously terminating their processes even when they attempt to restart, creating a persistent window for malicious activities.

Researchers has uncovered CastleBot, a newly emerging Malware‑as‑a‑Service (MaaS) framework gaining traction since early 2025. CastleBot is notable for its modular, three‑stage architecture—comprising a stager, loader, and core backdoor—used to deploy a variety of payloads ranging from infostealers to sophisticated backdoors such as NetSupport and WarmCookie. The malware is primarily distributed via trojanized installers hosted on fake websites, often amplified through SEO poisoning and impersonating legitimate GitHub repositories—leveraging user trust to trigger installation.

CastleBot’s design enables streamlined management of victims and payload deployment: operators can filter targets, update payloads, and orchestrate multi‑campaign operations with agility. The loader is particularly stealthy, mapping and executing payloads in memory to blend with legitimate processes and avoid detection by EDR tools. This MaaS platform remains under active development, suggesting potential for expanding capabilities and wider distribution across affiliate networks

Security researchers have revealed a critical zero-click exploit targeting ChatGPT’s Connectors feature—used to connect the AI to cloud services like Google Drive, SharePoint, GitHub, and Microsoft 365. In a proof-of-concept named AgentFlayer, a single malicious document uploaded to ChatGPT can trigger an indirect prompt injection. The embedded, hidden instructions cause the AI to search connected storage for sensitive data (e.g., API keys) and exfiltrate it via image-rendering URLs—without any user interaction beyond uploading the file.

A critical zero-day vulnerability in WinRAR (CVE-2025-8088, CVSS 8.4) has been actively exploited by Russia-linked threat actors to deliver RomCom malware in a targeted campaign. The flaw poses a significant risk given WinRAR’s widespread use in both enterprise and personal environments, and highlights the continued targeting of popular file compression utilities for initial access and malware delivery.

The campaign exploits the vulnerability via specially crafted archive files, enabling remote code execution when processed by victims. Attribution links the activity to Russian cybercriminal groups that weaponized the flaw before a patch was available. RomCom, the primary payload, grants remote access and facilitates persistent footholds within compromised systems.