Sharepoint hack linked to Chinese groups, NGOs targeted with phishing tactics, engineer admits US missile theft

Summary

Cyber Security Headlines – July 23, 2025

Hosted by CISO Series

In the latest episode of Cyber Security Headlines, host Sarah Lane delves into a series of significant developments shaping the information security landscape. This comprehensive summary captures the key points, discussions, insights, and conclusions from the episode, providing a clear overview for those who haven't tuned in.

---

1. Microsoft Attributes SharePoint Toolshell Attacks to Chinese State-Linked Groups

Timestamp: [00:07]

Microsoft has officially linked the widespread exploitation of a SharePoint zero-day vulnerability, known as Toolshell, to Chinese state-affiliated hacking groups, including Linen Typhoon, Violet Typhoon, and Storm 2603. These groups have targeted on-premises SharePoint servers across various sectors.

• Key Points:
  • Toolshell Vulnerability: A critical zero-day flaw in SharePoint that has been actively exploited.
  • Attribution: Microsoft attributes the attacks to state-linked Chinese groups.
  • Affected Sectors: Multiple industries have been impacted, emphasizing the vulnerability’s broad reach.
  • Response: The Cybersecurity and Infrastructure Security Agency (CISA) has issued urgent mitigation guidance for organizations affected by these attacks.

Notable Quote:

“The attacks have targeted on-premises SharePoint servers across multiple sectors,” – Sarah Lane [00:07]

---

2. Russian Threat Actors Employ OAuth Phishing Tactics Against NGOs

Timestamp: [02:15]

Russian-linked threat groups, UTA O3 52 and UTA O3 55, are orchestrating sophisticated OAuth phishing campaigns targeting non-governmental organizations (NGOs) and individuals related to Ukraine. These campaigns exploit Microsoft 365 login flows to gain unauthorized access.

• Key Points:
  • Phishing Method: Attackers impersonate diplomats via messaging apps to deceive victims into providing OAuth codes.
  • Exploitation: Utilization of legitimate Microsoft infrastructure and tools like Visual Studio Code to bypass traditional security defenses.
  • Impact: Access to Microsoft Graph data, including emails and files, poses significant security risks to targeted organizations.

Notable Quote:

“Attackers impersonate diplomats via messaging apps, luring victims into providing OAuth codes,” – Sarah Lane [02:15]

---

3. Silicon Valley Engineer Admits to Stealing US Missile Technology Secrets

Timestamp: [03:45]

Engineer Cheng Wang Gong has pleaded guilty to stealing over 3,600 trade secret files from two US electronics firms. The stolen data includes sensitive missile defense and satellite surveillance technologies.

• Key Points:
  • Theft Method: Gong transferred the files to personal drives before accepting a position with a direct competitor.
  • Intent: Previously pitched similar technologies to Chinese talent programs aimed at acquiring foreign intellectual property.
  • Investigation: The FBI uncovered the theft during a post-employment audit.
  • Consequences: Gong faces up to 10 years in prison for his actions.

Notable Quote:

“Gong transferred the files to personal drives shortly before taking a job with a direct competitor,” – Sarah Lane [03:45]

---

4. Luma Info Stealer Malware Resurges After Law Enforcement Takedown

Timestamp: [04:30]

The Luma Info Stealer malware operation has rebounded following a May law enforcement action that seized 2,300 domains associated with the operation. Demonstrating resilience, the malware operators have swiftly rebuilt their infrastructure.

• Key Points:
  • New Hosting Provider: Transitioned to Russian hosting provider Selectal, moving away from Cloudflare.
  • Distribution Methods: Utilizing fake software cracks, malicious GitHub repositories, fake CAPTCHA pages, and links shared via YouTube and Facebook.
  • Persistence: Highlights the robustness of malware-as-a-service operations when not directly disrupted by arrests.

Notable Quote:

“Luma's operators quickly rebuilt infrastructure and returned to near pre-takedown levels,” – Sarah Lane [04:30]

---

5. Identity Contract Lapse Impacts Cybersecurity at National Lab

Timestamp: [05:15]

A critical contract supporting the DHS's Cyber Sentry program at Lawrence Livermore National Laboratory has expired, resulting in threat detection data from key infrastructure networks remaining unanalyzed.

• Key Points:
  • Consequences: Cybersecurity monitoring of operational technology (OT) environments is hindered.
  • Expert Warnings: Under-resourcing of OT security, compounded by recent federal budget cuts, poses significant national cybersecurity risks.
  • House Hearing Insights: The lapse was revealed during a congressional hearing, underscoring the vulnerability of critical infrastructure.

Notable Quote:

“Under-resourcing of OT security compounded by recent federal budget cuts poses a significant risk,” – Sarah Lane [05:15]

---

6. FBI Warns Against Interlock Ransomware Group Targeting Healthcare

Timestamp: [05:50]

The FBI and other federal agencies have issued warnings regarding the Interlock ransomware group, which has been actively targeting critical infrastructure and healthcare organizations in the US and Europe since September 2024.

• Key Points:
  • Attack Methods: Utilizes drive-by downloads and fake browser updates to infiltrate victim systems.
  • Targets: Notable victims include DaVita and a major Ohio healthcare provider.
  • Ransom Demands: Ransom notes lack payment instructions but demand Bitcoin, complicating traceability.
  • Suspected Ties: Potential connections to race data ransomware activities.

Notable Quote:

“Interlock uses tactics like drive-by downloads and fake browser updates to gain access,” – Sarah Lane [05:50]

---

7. Cisco Reports Active Exploitation of ISE and ISE PIC Vulnerabilities

Timestamp: [06:10]

Cisco has confirmed that attackers are actively exploiting multiple critical vulnerabilities in its Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE PIC). These flaws allow unauthenticated remote access with root-level control.

• Key Points:
  • Vulnerability Severity: These flaws are particularly dangerous for enterprises relying on ISE for network access policy enforcement.
  • Response: Cisco has released patches and is urging customers to update immediately to mitigate the risks.
  • Attack Details: The company has not disclosed specific technical details or identified the attackers involved in the exploitation.

Notable Quote:

“The flaws allow unauthenticated remote access with root-level control,” – Sarah Lane [06:10]

---

8. UK to Prohibit Public Sector Organizations from Paying Ransomware Demands

Timestamp: [06:25]

In a strategic move to disrupt ransomware operations, the UK government plans to ban public sector and critical infrastructure organizations—including the NHS, schools, and local councils—from paying ransoms following cyberattacks.

• Key Points:
  • Targeted Sectors: Public sector entities and critical infrastructure organizations.
  • Objective: To disrupt the ransomware business model and reduce the attractiveness of targeting essential public services.
  • Regulatory Measures: Businesses outside the public sector remain exempt but must notify the government before making any ransom payments to comply with sanctions laws.
  • Reporting System: A mandatory reporting framework is being developed to aid law enforcement in tracing attacks and supporting victims effectively.

Notable Quote:

“The move is meant to disrupt the ransomware business model and reduce the appeal of targeting essential public services,” – Sarah Lane [06:25]

---

Conclusion

The episode underscores the evolving landscape of cybersecurity threats, highlighting state-sponsored attacks, sophisticated phishing tactics, insider threats, and the resilience of malware operations. Insights into regulatory responses, such as the UK’s ban on ransom payments for public sectors, reflect ongoing efforts to bolster defenses and mitigate risks. Additionally, the discussions on vulnerabilities in widely used platforms like SharePoint and Cisco's ISE emphasize the critical need for timely patch management and robust security practices.

For more detailed stories and continuous updates, listeners are encouraged to visit CISOseries.com.

---

Stay informed and protected with the latest cybersecurity insights from CISO Series.

Transcript

[A]

From the CISO series, it's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Wednesday, July 23, 2025. I'm Sarah Lane. Microsoft links SharePoint toolshell attacks to Chinese hackers Microsoft formally attributed the widespread exploitation of a SharePoint zero day chain dubbed tool Shell to Chinese state linked hacking groups including Linen Typhoon, Violet Typhoon and Storm 2603. The attacks have targeted on premise SharePoint servers across multiple sectors but with a proof of concept exploit now public and active exploitation ongoing. CISA has issued urgent mitigation guidance for affected organizations. Russian Threat actors target NGOs with new OAuth phishing tactics Russian linked threat groups UTA O3 52 and UTA O3 55 are targeting NGOs and Ukraine related individuals with OAuth phishing campaigns that exploit Microsoft 365 login flows. Veloxity says the attackers impersonate diplomats via messaging apps. They lure victims into providing OAuth codes and then use them to access Microsoft graph data including emails and files. These attacks bypass traditional defenses by abusing legitimate Microsoft infrastructure and and tools like Visual Studio code. Silicon Valley engineer admits theft of US Missile tech secrets Engineer Cheng Wang Gong has pleaded guilty to stealing more than 3,600 trade secret files from two US electronics firms including sensitive missile defense and satellite surveillance tech. Gong transferred the files to personal drives shortly before taking a job with with a direct competitor and had previously pitched similar technologies to Chinese talent programs aimed at acquiring foreign intellectual property. The FBI uncovered the theft during a post employment audit. Gong now faces up to 10 years in prison. Luma Info Stealer malware returns after law enforcement disruption the Luma Info Stealer malware operation has resumed activity after a May law enforcement takedown the that seized 2,300 domains. Despite that disruption, Llama's operators quickly rebuilt infrastructure and returned to near pre takedown levels, now using Russian hosting provider selectal instead of Cloudflare. Distribution methods include fake software cracks, malicious GitHub repos, fake CAPTCHA pages and links shared via YouTube and Facebook, highlighting the resilience of malware as a service operations when no arrests are made. Huge thanks to our Sponsor Nudge Security Day 3 Secure your critical business apps Attackers no longer break in, they log in and your software as a service footprint is now their prime target. Nudge security discovers every SaaS app used in your org, secures configurations, enforces MFA and manages app to app access so you can prevent identity based attacks. Startup free 14 day trial [e-mail] Identity contract lapse leaves critical infrastructure cybersecurity sensor data unanalyzed at national lab A critical contract supporting DHS's Cyber Sentry program at Lawrence Livermore National Laboratory expired, leaving threat detection data from key infrastructure networks unanalyzed, the lapse revealed during a House hearing on operational technology. Cybersecurity hinders monitoring of emerging threats on OT environments. Experts warned that under resourcing of ot, security compounded by recent federal budget cuts poses a significant risk to national cybersecurity. FBI urges vigilance against Interlock ransomware group behind recent healthcare attacks the FBI and other federal agencies are warning about a ransomware group known as Interlock, which has recently targeted critical infrastructure and health care organizations in the US and Europe. First observed back in September of 2024, Interlock uses tactics like drive by downloads and fake browser updates to gain access to victim systems. The group has attacked DaVita and a major Ohio health care provider, among others. Ransom notes lack payment instructions but demand Bitcoin. Authorities suspect ties to race data ransomware Cisco confirms active exploitation of ISE and ISE PIC flaws Cisco confirmed that attackers are actively exploiting multiple critical vulnerabilities in its Identity Services Engine, or ise, and ISE Passive Identity Connector, or iscpic. The flaws allow unauthenticated remote access with root level control, making them especially dangerous for enterprises relying on ISE for network access policy enforcement. Cisco detected the exploitation this month and has since released patches urging customers to update immediately. The company hasn't identified the attackers or shared technical details about how the flaws are being used. UK to ban public sector orgs from paying ransomware gangs the UK government plans to prohibit public sector and critical infrastructure organizations, including the nhs, schools and local councils, from paying ransoms after cyber attacks. The move is meant to disrupt the ransomware business model and reduce the appeal of targeting essential public services. Businesses outside the public sector won't be banned from paying, but they will be required to notify the government before doing so to to avoid violating sanctions laws. A mandatory reporting system is also in development to help law enforcement trace attacks and better support victims. Make sure to keep up with us at the ciso series on LinkedIn and YouTube. And if you have thoughts on the news from today or about the show in general, be sure to reach out to [e-mail] we would love to hear from you. I'm Sarah Lane reporting for the CISO series. Thanks for stopping by. Oh and stay classy.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories. Behind the headlines.