Cyber Security Headlines – July 23, 2025

Hosted by CISO Series

In the latest episode of Cyber Security Headlines, host Sarah Lane delves into a series of significant developments shaping the information security landscape. This comprehensive summary captures the key points, discussions, insights, and conclusions from the episode, providing a clear overview for those who haven't tuned in.

1. Microsoft Attributes SharePoint Toolshell Attacks to Chinese State-Linked Groups

Timestamp: [00:07]

Microsoft has officially linked the widespread exploitation of a SharePoint zero-day vulnerability, known as Toolshell, to Chinese state-affiliated hacking groups, including Linen Typhoon, Violet Typhoon, and Storm 2603. These groups have targeted on-premises SharePoint servers across various sectors.

• Key Points:
  • Toolshell Vulnerability: A critical zero-day flaw in SharePoint that has been actively exploited.
  • Attribution: Microsoft attributes the attacks to state-linked Chinese groups.
  • Affected Sectors: Multiple industries have been impacted, emphasizing the vulnerability’s broad reach.
  • Response: The Cybersecurity and Infrastructure Security Agency (CISA) has issued urgent mitigation guidance for organizations affected by these attacks.

Notable Quote:

“The attacks have targeted on-premises SharePoint servers across multiple sectors,” – Sarah Lane [00:07]

2. Russian Threat Actors Employ OAuth Phishing Tactics Against NGOs

Timestamp: [02:15]

Russian-linked threat groups, UTA O3 52 and UTA O3 55, are orchestrating sophisticated OAuth phishing campaigns targeting non-governmental organizations (NGOs) and individuals related to Ukraine. These campaigns exploit Microsoft 365 login flows to gain unauthorized access.

• Key Points:
  • Phishing Method: Attackers impersonate diplomats via messaging apps to deceive victims into providing OAuth codes.
  • Exploitation: Utilization of legitimate Microsoft infrastructure and tools like Visual Studio Code to bypass traditional security defenses.
  • Impact: Access to Microsoft Graph data, including emails and files, poses significant security risks to targeted organizations.

Notable Quote:

“Attackers impersonate diplomats via messaging apps, luring victims into providing OAuth codes,” – Sarah Lane [02:15]

3. Silicon Valley Engineer Admits to Stealing US Missile Technology Secrets

Timestamp: [03:45]

Engineer Cheng Wang Gong has pleaded guilty to stealing over 3,600 trade secret files from two US electronics firms. The stolen data includes sensitive missile defense and satellite surveillance technologies.

• Key Points:
  • Theft Method: Gong transferred the files to personal drives before accepting a position with a direct competitor.
  • Intent: Previously pitched similar technologies to Chinese talent programs aimed at acquiring foreign intellectual property.
  • Investigation: The FBI uncovered the theft during a post-employment audit.
  • Consequences: Gong faces up to 10 years in prison for his actions.

Notable Quote:

“Gong transferred the files to personal drives shortly before taking a job with a direct competitor,” – Sarah Lane [03:45]

4. Luma Info Stealer Malware Resurges After Law Enforcement Takedown

Timestamp: [04:30]

The Luma Info Stealer malware operation has rebounded following a May law enforcement action that seized 2,300 domains associated with the operation. Demonstrating resilience, the malware operators have swiftly rebuilt their infrastructure.

• Key Points:
  • New Hosting Provider: Transitioned to Russian hosting provider Selectal, moving away from Cloudflare.
  • Distribution Methods: Utilizing fake software cracks, malicious GitHub repositories, fake CAPTCHA pages, and links shared via YouTube and Facebook.
  • Persistence: Highlights the robustness of malware-as-a-service operations when not directly disrupted by arrests.

Notable Quote:

“Luma's operators quickly rebuilt infrastructure and returned to near pre-takedown levels,” – Sarah Lane [04:30]

5. Identity Contract Lapse Impacts Cybersecurity at National Lab

Timestamp: [05:15]

A critical contract supporting the DHS's Cyber Sentry program at Lawrence Livermore National Laboratory has expired, resulting in threat detection data from key infrastructure networks remaining unanalyzed.

• Key Points:
  • Consequences: Cybersecurity monitoring of operational technology (OT) environments is hindered.
  • Expert Warnings: Under-resourcing of OT security, compounded by recent federal budget cuts, poses significant national cybersecurity risks.
  • House Hearing Insights: The lapse was revealed during a congressional hearing, underscoring the vulnerability of critical infrastructure.

Notable Quote:

“Under-resourcing of OT security compounded by recent federal budget cuts poses a significant risk,” – Sarah Lane [05:15]

6. FBI Warns Against Interlock Ransomware Group Targeting Healthcare

Timestamp: [05:50]

The FBI and other federal agencies have issued warnings regarding the Interlock ransomware group, which has been actively targeting critical infrastructure and healthcare organizations in the US and Europe since September 2024.

• Key Points:
  • Attack Methods: Utilizes drive-by downloads and fake browser updates to infiltrate victim systems.
  • Targets: Notable victims include DaVita and a major Ohio healthcare provider.
  • Ransom Demands: Ransom notes lack payment instructions but demand Bitcoin, complicating traceability.
  • Suspected Ties: Potential connections to race data ransomware activities.

Notable Quote:

“Interlock uses tactics like drive-by downloads and fake browser updates to gain access,” – Sarah Lane [05:50]

7. Cisco Reports Active Exploitation of ISE and ISE PIC Vulnerabilities

Timestamp: [06:10]

Cisco has confirmed that attackers are actively exploiting multiple critical vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE PIC). These flaws allow unauthenticated remote access with root-level control.

• Key Points:
  • Vulnerability Severity: These flaws are particularly dangerous for enterprises relying on ISE for network access policy enforcement.
  • Response: Cisco has released patches and is urging customers to update immediately to mitigate the risks.
  • Attack Details: The company has not disclosed specific technical details or identified the attackers involved in the exploitation.

Notable Quote:

“The flaws allow unauthenticated remote access with root-level control,” – Sarah Lane [06:10]

8. UK to Prohibit Public Sector Organizations from Paying Ransomware Demands

Timestamp: [06:25]

In a strategic move to disrupt ransomware operations, the UK government plans to ban public sector and critical infrastructure organizations—including the NHS, schools, and local councils—from paying ransoms following cyberattacks.

• Key Points:
  • Targeted Sectors: Public sector entities and critical infrastructure organizations.
  • Objective: To disrupt the ransomware business model and reduce the attractiveness of targeting essential public services.
  • Regulatory Measures: Businesses outside the public sector remain exempt but must notify the government before making any ransom payments to comply with sanctions laws.
  • Reporting System: A mandatory reporting framework is being developed to aid law enforcement in tracing attacks and supporting victims effectively.

Notable Quote:

“The move is meant to disrupt the ransomware business model and reduce the appeal of targeting essential public services,” – Sarah Lane [06:25]

Conclusion

The episode underscores the evolving landscape of cybersecurity threats, highlighting state-sponsored attacks, sophisticated phishing tactics, insider threats, and the resilience of malware operations. Insights into regulatory responses, such as the UK’s ban on ransom payments for public sectors, reflect ongoing efforts to bolster defenses and mitigate risks. Additionally, the discussions on vulnerabilities in widely used platforms like SharePoint and Cisco's ISE emphasize the critical need for timely patch management and robust security practices.

For more detailed stories and continuous updates, listeners are encouraged to visit CISOseries.com.

Stay informed and protected with the latest cybersecurity insights from CISO Series.