# Summer cybersecurity news catch up
Paris Natural History Museum and hosting provider Francelink paralyzed, Google victim of an attack documented by their own services, urgent CISA directive for Exchange and 5 new KEV vulnerabilities, Microsoft Patch Tuesday with 111 vulnerabilities patched, Alltricks and Manpower compromised, Dell laptops hacked with vegetables 🤯, etc.
There are also some cool articles and cool tools.
Content in french but most of the articles are in english.
Chapter #1
Reward : $100
This challenge is part of ongoing research at Malwation examining the potential of abusing foundation model via manipulation for malware development. We are currently preparing a comprehensive paper documenting the scope and implications of AI-assisted threat development.
The ZigotRansomware sample was developed entirely through foundation model interactions without any human code contribution. No existing malware code was mixed in or given as source code sample, no pre-built packer were integrated, and no commercial/open-source code obfuscation product were applied post-generation.
Research Objectives
This challenge demonstrates the complexity level achievable through pure AI code generation in adversarial contexts. The sample serves as a controlled test case to evaluate:
\- Reverse engineering complexity of AI-generated malware
\- Code structure and analysis patterns unique to AI-generated threats
\- Defensive capability gaps against novel generation methodologies
A new ransomware family called Charon has been identified, targeting the Middle East's public sector and aviation industry. The attack employs sophisticated APT-style techniques, including DLL sideloading, process injection, and anti-EDR capabilities. Charon uses a multistage payload extraction technique and a hybrid cryptographic scheme combining Curve25519 with ChaCha20 cipher. The ransomware exhibits network propagation capabilities and includes a dormant anti-EDR component. The campaign demonstrates a concerning trend of ransomware operators adopting APT-level techniques, posing an elevated risk to organizations. Defending against Charon requires a multilayered approach, including hardening against DLL sideloading, limiting lateral movement, strengthening backup capabilities, and reinforcing user awareness.
A new variant of RoKRAT malware used by APT37 has been identified, employing a two-stage encrypted shellcode injection method and steganography to conceal malicious code in image files. The malware uses shortcut files with embedded commands to execute its attack, distributed via compressed archives. It utilizes a complex decoding process involving XOR operations and injects itself into legitimate Windows processes. The threat actor abuses cloud storage services as command and control channels, using Dropbox access tokens. The malware's stealthy nature, including fileless techniques, makes it difficult to detect with traditional security solutions, highlighting the importance of EDR-based defense strategies for real-time monitoring and analysis of abnormal behaviors.
ReVault flaws let hackers bypass Windows login on Dell laptops
Source: https://www.bleepingcomputer.com/news/security/revault-flaws-let-hackers-bypass-windows-login-on-dell-laptops/
Over 100 Dell Laptop Models Plagued by Vulnerabilities Impacting Millions
Source: https://hackread.com/dell-laptop-models-vulnerabilities-impacting-millions/
ToolShell under siege: Check Point analyzes Chinese APT Storm-2603
Source: https://securityaffairs.com/180657/apt/toolshell-under-siege-check-point-analyzes-chinese-apt-storm-2603.html
LameHug: first AI-Powered malware linked to Russia’s APT28
Source: https://securityaffairs.com/180092/apt/lamehug-first-ai-powered-malware-linked-to-russias-apt28.html
A sophisticated backdoor targeting Exchange servers of high-value organizations in Asia has been discovered. The malware, named GhostContainer, is a multi-functional backdoor that can be dynamically extended with additional modules. It leverages several open-source projects and employs various evasion techniques to avoid detection. The backdoor grants attackers full control over the Exchange server and can function as a proxy or tunnel. The malware is believed to be part of an APT campaign targeting government and high-tech companies in Asia. It includes components for C2 parsing, virtual page injection, and web proxy functionality. The attackers demonstrated expertise in exploiting Exchange systems and assembling sophisticated espionage tools.
This analysis examines Advanced Persistent Threat (APT) attacks targeting South Korea in June 2025. Spear phishing emerged as the primary attack vector, with LNK files being the most prevalent method, followed by an increase in HWP file-based attacks. The report details two types of spear phishing attacks: Type A, which uses CAB files containing malicious scripts for information exfiltration and additional malware downloads, and Type B, which deploys RAT malware like XenoRAT and RoKRAT using cloud storage APIs. Both types often include decoy documents to appear legitimate. The attacks targeted various sectors, using carefully crafted emails and malicious attachments to exploit victims.
Salt Typhoon breach: Chinese APT compromises U.S. Army National Guard network
Source: https://securityaffairs.com/180018/intelligence/salt-typhoon-breach-chinese-apt-compromises-u-s-army-national-guard-network.html
DoNot APT Hits European Ministry with Fake Diplomacy Emails and LoptikMod Malware
Source: https://hackread.com/donot-apt-hits-european-ministry-loptikmod-malware/
The APT-C-55 (Kimsuky) group, a North Korean threat actor, has launched a new attack campaign targeting South Korea. They used a disguised Bandizip installation package to deliver malicious code and a VMP-protected HappyDoor trojan for espionage activities. The attack involves remote script loading, multi-stage malware deployment, and information theft. The malware collects sensitive data, including user information, system details, and files from specific directories. It also implements keylogging, screen capture, and mobile device monitoring functionalities. The attack methodology and infrastructure align with Kimsuky's historical patterns, including the use of similar scripts, backdoor families, and domain naming conventions.
Pakistan’s APT36 Transparent Tribe Targets Indian Defense Sector with New Linux Malware
Source: https://hackread.com/pakistan-transparent-tribe-indian-defence-linux-malware/
NightEagle APT Exploits Microsoft Exchange Flaw to Target China's Military and Tech Sectors
Source: https://thehackernews.com/2025/07/nighteagle-apt-exploits-microsoft.html
Throughout 2024, Gamaredon focused exclusively on targeting Ukrainian governmental institutions with spearphishing campaigns and weaponized USB drives. The group developed six new tools and significantly updated existing ones, improving stealth and evasion capabilities. Gamaredon increased the scale of its spearphishing campaigns, especially in the second half of the year. The group also made efforts to bypass network-based blocking, hiding most of its command and control infrastructure behind Cloudflare tunnels. Notable updates include enhancements to PteroLNK for weaponizing network drives, improvements in file exfiltration techniques, and the introduction of new downloaders. Despite these advancements, Gamaredon showed signs of operational limitations, occasionally abandoning or infrequently updating certain tools.
