SharePoint patched, World Leaks hits Dell, $44 million crypto theft

Summary

Cyber Security Headlines – Episode Summary Hosted by CISO Series | Release Date: July 22, 2025

The latest episode of Cyber Security Headlines by CISO Series delves into critical incidents and developments shaping the information security landscape. Hosted by Rich Stroffolino, the episode covers a range of topics from patched vulnerabilities and significant data breaches to substantial cryptocurrency thefts and strategic AI partnerships. Below is a comprehensive summary of the key discussions, insights, and conclusions presented in the episode.

---

1. SharePoint RCE Vulnerabilities Patched and Exploited

Overview: The episode begins with an analysis of recently patched Remote Code Execution (RCE) flaws in Microsoft SharePoint, known as toolshell. These vulnerabilities have been actively exploited by multiple threat actors, primarily originating from China.

Key Points:

• Active Exploitation: Various threat actors are racing to exploit the newly discovered SharePoint RCE flaws.
• Chinese Involvement: Mandiant CTO Charles Carmichael confirmed the involvement of groups operating out of China. He stated, “We fully anticipate that this trend will continue as various other threat actors driven by diverse motivations will leverage this exploit as well” (Rich Stroffolino, 00:06).
• Impact: Mandiant estimates that several hundred organizations are affected, including US Government agencies, educational institutions, and organizations managing critical infrastructure.
• Microsoft’s Response: Microsoft released emergency patches for SharePoint Server Subscription Edition and SharePoint Server 2019, with patches for SharePoint Server 2016 forthcoming.

Conclusion: The swift patching by Microsoft underscores the urgency and severity of the threat, while the ongoing exploitation highlights the need for organizations to apply updates promptly to safeguard their systems.

---

2. Dell Acknowledges World Leaks Data Breach

Overview: Dell recently disclosed a data breach involving the Extortion Group, a rebrand of Hunters International, targeting its Customer Solutions center platform.

Key Points:

• Breach Details: The breach impacted a platform used for commercial customer demos, which Dell claims is separated from customer partner systems and does not affect the provision of services to customers.
• Data Compromised: World Leaks released samples of the stolen data, which appear to be configuration and backup data.
• Dell’s Position: Dell stated it would not release further details until the investigation concludes, emphasizing that the breached platform primarily uses synthetic data and is not linked to customer services.

Conclusion: While Dell maintains that customer services remain unaffected, the breach highlights the ongoing threat to corporate demo environments and the importance of securing all facets of IT infrastructure.

---

3. $44 Million Crypto Theft from CoinDCX

Overview: The Indian cryptocurrency exchange CoinDCX suffered a significant theft, with $44 million worth of stablecoins stolen from an internal operational account.

Key Points:

• Impact on Users: Importantly, user funds were not affected by this breach.
• Source of Theft: The company’s investigation revealed unauthorized access to its account on a partner exchange as the entry point for the theft.
• Response Measures: CoinDCX announced it would cover the losses from its own reserves and is establishing a bug bounty program, offering up to 25% of recovered assets to those who can help retrieve the stolen funds.

Notable Quote: “We will cover its losses from its own reserves,” emphasized Rich Stroffolino (00:06).

Conclusion: CoinDCX’s proactive measures, including covering the losses and launching a bug bounty program, demonstrate a commitment to maintaining trust and enhancing security post-incident.

---

4. UK Government and OpenAI Forge Strategic Partnership

Overview: The UK government has entered into a strategic partnership with OpenAI aimed at advancing AI security research and investing in AI infrastructure within the country.

Key Points:

• Investment: The UK government plans to invest £1 billion in computing infrastructure for AI over the next five years, as announced at the London Tech Summit.
• Collaboration Scope: The partnership will focus on AI security research and expanding OpenAI’s London office to support sectors such as justice, defense, security, and education technology.
• Future Deployments: OpenAI will explore deploying its technology stack across various government and public sector domains to enhance AI capabilities and security measures.

Conclusion: This collaboration signifies a substantial commitment to integrating advanced AI technologies within critical public sectors, aiming to bolster national security and technological resilience.

---

5. Arizona Election Officials’ Cyberattack Response

Overview: Arizona’s Secretary of State office experienced a defacement attack where candidate photos were replaced with images of the late Iranian Ayatollah Khomeini.

Key Points:

• Attack Details: The defacement targeted a legacy election system with no access to voter rolls.
• Response: The state Department of Homeland Security contacted federal agencies like the FBI but did not engage with the Cybersecurity and Infrastructure Security Agency (CISA).
• Government Support: CISO Michael Moore clarified that Arizona currently lacks direct federal cybersecurity advisor support, highlighting a gap in assistance since the end of 2024.
• Official Statement: Secretary of State Adrian Fontes mentioned that initial outreach attempts to Homeland Security were dismissed outright (00:06).

Conclusion: The incident underscores the challenges states face in securing election infrastructure and the critical need for stronger federal support and coordination in cybersecurity efforts.

---

6. Crush FTP Exploited with Already Patched Flaw

Overview: Crush FTP, a popular file transfer service, issued a warning about ongoing exploitation of a previously patched vulnerability.

Key Points:

• Exploit Details: Hackers reverse-engineered Crush FTP’s code to identify a bug that had already been fixed in the latest version.
• Vulnerable Versions: Only Crush FTP builds prior to July 1, 2025, remain susceptible to attacks over HTTPS.
• Threat Activity: Exploitation began on July 18th, utilizing scripts from previous attacks to compromise servers.
• Research Findings: Shadow Server Foundation identified over 1,000 unpatched servers still exposed online, posing significant security risks.

Conclusion: This situation highlights the importance of keeping software up-to-date and the persistent threat of attackers targeting known vulnerabilities in outdated systems.

---

7. Chinese Linked Groups Target African IT Infrastructure

Overview: Researchers at Kaspersky uncovered that the China-linked group APT41 is targeting IT infrastructure across several African countries.

Key Points:

• Attack Methodology: APT41 utilized a hacked SharePoint server for command and control, harvested credentials for privileged accounts, and deployed Cobalt Strike for further network attacks.
• Target Adaptation: The group, typically not very active in Africa, demonstrated rapid adaptation to new target infrastructures.
• Impact: These sophisticated attacks threaten the stability and security of IT infrastructure within the affected African nations.

Conclusion: APT41’s activities in Africa reveal the expanding geographic scope of Chinese-linked cyber threats, emphasizing the need for robust defensive measures in emerging markets.

---

8. Muddy Water Targets Android with DCHSpy Spyware

Overview: Iranian cyber espionage group Muddy Water has launched a new campaign using the Android-based surveillance tool DCHSpy.

Key Points:

• Disguised as VPN Apps: DCHSpy poses as Earth VPN and Komodo VPN, spoofing locations in Romania and Canada, respectively.
• Distribution Channels: The malicious apps are disseminated through Telegram channels, targeting both English and Farsi speakers with anti-Iranian lures.
• Capabilities: Once installed, DCHSpy can collect account logins, contacts, SMS messages, location data, record audio, and take photos.
• Focus Areas: References to SpaceX's Starlink service in malware samples indicate a potential focus on targeting this platform.

Conclusion: Muddy Water’s exploitation of popular platforms like Telegram and masquerading as legitimate VPN services underscores the evolving tactics of state-sponsored cyber espionage groups in targeting mobile devices.

---

9. Bridging the Gap Between Compliance and Building Resilience

Overview: The episode concludes with a discussion on the disconnect between compliance and building meaningful cybersecurity resilience within organizations.

Key Points:

• Compliance vs. Resilience: While businesses can understand and implement compliance measures, there is a broader range of risks that go beyond mere regulatory adherence.
• CISO Communication: Emphasizing how CISOs can better communicate the importance of comprehensive risk management to stakeholders.
• Upcoming Segment Tease: The episode hints at a future discussion titled “Recovering from the attack once we ace this audit,” exploring strategies to enhance resilience beyond compliance.

Conclusion: The conversation stresses the need for organizations to move beyond tick-box compliance towards a more holistic approach to cybersecurity resilience, ensuring robust protection against a wide array of threats.

---

Final Thoughts: This episode of Cyber Security Headlines provides an insightful overview of recent security incidents and strategic developments in the cybersecurity realm. From addressing exploited vulnerabilities and major data breaches to examining the interplay between compliance and resilience, the discussions offer valuable takeaways for security professionals and organizations aiming to navigate the complex threat landscape effectively.

For more detailed stories and ongoing updates, listeners are encouraged to visit CISOseries.com.

---

Note: All timestamps reference the provided transcript and correspond to specific segments within the episode.

Transcript

[CISO Series Host]

From the CISO series, it's Cybersecurity Headlines.

[Rich Stroffolino]

These are the cybersecurity headlines for Tuesday, July 22, 2025. I'm Rich Stroffolino. SharePoint RCE flaws patched and Exploited from China we reported yesterday on the active attacks on newly discovered SharePoint RCE flaws known as toolshell. Multiple threat actors are racing to exploit these flaws and Mandiant CTO Charles Carmichael confirmed it's seen in involvement from groups operating out of China. He further said, we fully anticipate that this trend will continue as various other threat actors driven by diverse motivations will leverage this exploit as well. Mandiant estimates several hundred organizations are impacted, reportedly across US Government agencies, educational institutions and organizations that manage critical infrastructure. According to the Washington Post, Microsoft released Emergency patches for SharePoint Server Subscription Edition and SharePoint Server 2019, with patches for SharePoint Server 2016 in the works. Dell acknowledges world Leaks data breach the company disclosed the Extortion Group, a rebrand of Hunters International, breached a Customer Solutions center platform which is the frontend it uses for commercial customer demos. However, Dell said this platform is intentionally separated from customer partner systems as well as Dell's network and is not used for the provision of services to Dell customers. It uses primarily synthetic data. Dell said it would not release details about the breach while it was still investigating. After Bleeping Computer published Dell's acknowledgement of the breach. World Leaks released samples of the stolen data, which appear to be configuration and backup data. 44 million stolen from crypto Exchange the co founders of the Indian cryptocurrency exchange CoinDCX confirmed that threat actors stole $44 million worth of stablecoins. This theft occurred from an internal account used for operational liquidity and did not impact user funds. The company will cover its losses from its own reserves. The company's initial investigation found the theft stemmed from unauthorized access to its account on a partner exchange. The company stated that it's performing a full investigation into the incident, but it will create a bug bounty program in response and is offering up to 25% of the recovered assets to anyone who can retrieve the pilfered goods. UK government signed strategic partnership with OpenAI the UK government announced the deal, which will see it further work with OpenAI on AI security research as well as looking into further AI infrastructure investments in the country. For its part, OpenAI will expand its London office and look at ways to deploy its tech stack across justice, defense, security and education technology. At the London Tech Summit last week, the UK government announced plans to invest £1 billion in computing infrastructure for AI over the next five years. And now, thanks to today's episode sponsor Nudge Security who's using AI tools in your org? Find out today with Nudge Security. Nudge Security discovers every gen AI tool ever used by anyone in your org, and even those you've never heard of. For each tool, you'll see who introduced it, who else is using it, where it's integrated into other tools and a vendor security profile. Visit nudgesecurity.com AI to get your free Genai inventory today. That's N-U-D G-E-S-E-C-U-R-I-T-Y.com AI Arizona election officials avoided CISA after attack On June 23, Arizona's Secretary of State's office became aware of a defacement attack against its election site, with candidate photos replaced with images of the late Iranian Ayatollah Khomeini. The attack impacted a legacy system with no access to voter rolls. Through its state Department of Homeland Security office, Arizona officials contacted federal agencies like the FBI about the attack, but this did not include outreach to cisa. Secretary of State Adrian Fontes said initial attempts to establish a relationship with Homeland Security Secretary Kristi Noem earlier this year were dismissed outright. CISO for Arizona's Secretary of State Michael Moore clarified the state has no direct level of support from CISO since the end of 2024, saying right now in 2025 we have no federal cybersecurity advisors. Crush FTP exploited with already patched flaw the popular file transfer company issued an advisory stating that hackers apparently reverse engineered our code and found some bug which we had already fixed. The current version of Crush FTP is not impacted, however. Builds prior to July 1, 2025 are vulnerable to an attack over HTTPs. The company said it saw threat actors beginning exploitation on July 18th release reusing scripts from previous exploits to deploy things on crush FTP servers. Researchers at Shadow Server foundation found over 1,000 unpatched servers still exposed online. Chinese linked groups target African IT infrastructure Researchers at Kaspersky found that the China linked group APT41 was targeting an unnamed IT infrastructure company that spanned across several countries in Africa. This used a hacked SharePoint server for command and control. Once gaining access to a host, the threat actors would harvest credentials for privileged accounts and deploy Cobalt Strike. From there, they would perform further attacks on machines on the network deemed valuable. After initial reconnaissance, the Researchers noted that APT41 is typically not very active in Africa and that it proved quick to adapt to the infrastructure of new targets. Muddy Water makes Android sing the blues Researchers at the firm Lookout revealed details about a new campaign by the Iranian cyber espionage group Muddy Water. This utilizes the Android based surveillance tool DCHSpy, a tool that's been active on the platform since at least last year. Based on new malware samples, Muddy Water is deployed by posing as two spoofed VPN apps, Earth VPN and Komodo vpn, supposedly based in Romania and Canada, respectively. These are disseminated through Telegram channels to English and Farsi speakers with lures that heavily feature anti Iranian themes. Samples also show references to SpaceX's Starlink service, indicating that it may be a focus of the campaign as well. Once installed, DCHSPY collects account logins, contacts, SMS messages, location data, records audio, and can take photos. How can we bridge the disconnect between compliance and building meaningful resilience? The business can understand compliance, so the focus is at least understandable. But how can CISOs better communicate that there's a much wider range of risks that need to be accounted for? That's one of the segments we'll dig into on this week's episode of the CISO series podcast. Look for the episode we'll worry about recovering from the attack once we ace this audit. Wherever you get your podcasts and if you have any thoughts about the news of the day or about the show in general, we'd love to hear from you. Feedbackisoseries.com is how you get in touch. Reporting for the CISO series, I'm Rich Stroffolino, reminding you to have a super sparkly day.

[CISO Series Host]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories behind the headlines.

[Sam]

Sam.