Risky Bulletin: CISA Instructs Federal Agencies to Mitigate On-Prem-to-Cloud Exchange Attack

Podcast Information:

• Title: Risky Bulletin
• Host/Author: risky.biz
• Description: Regular cybersecurity news updates from the Risky Business team.
• Episode: Risky Bulletin: CISA tells federal agencies to mitigate on-prem-to-cloud Exchange attack
• Release Date: August 8, 2025

Introduction

In the August 8, 2025 episode of Risky Bulletin, host Claire Aird delivers a comprehensive overview of the latest cybersecurity threats and responses. Prepared by Catalyn Kimparnu, the episode delves into critical vulnerabilities, significant breaches, and emerging threats within the cybersecurity landscape.

Top Story: CISA's Urgent Directive to Federal Agencies

Timestamp: [00:04]

The episode opens with a pressing announcement from the Cybersecurity and Infrastructure Security Agency (CISA). Federal agencies have been instructed to address a newly identified attack vector targeting Microsoft Exchange email servers.

Claire Aird states:

"CISA has given a deadline of Monday to apply mitigation shared by Microsoft this week."

The vulnerability primarily affects hybrid environments where on-premises Exchange servers synchronize data with Exchange Online. Exploiting this vulnerability allows hackers to transition from compromised on-premises servers to cloud environments by leveraging shared authentication processes.

Key Points:

• Deadline: Federal agencies must implement CISA's mitigation measures by Monday.
• Vulnerability: Affects hybrid Exchange environments, enabling lateral movement from on-premises to cloud.
• Impact: Potential unauthorized access to sensitive federal communications and data.

Significant Cyber Attacks and Data Breaches

US Department of Justice Compromised

Timestamp: [00:04]

A suspected state-sponsored group has infiltrated the US Department of Justice's case management systems, specifically PACER and CMECF, according to reports from Politico. The breach, occurring in early July, exposed data related to ongoing investigations, informants, and witnesses.

Pandora Faces Security Breach

Timestamp: [00:04]

Danish jewelry giant Pandora has notified its customers of a security breach. The breach involved unauthorized access to a third-party platform, resulting in the compromise of Salesforce accounts. Similarly, Google has experienced a breach where hackers, identified as UNC6040 and UNC6240 (collectively operating under the name Shiny Hunters), stole customer data from their Salesforce accounts. The stolen information includes publicly available business data such as company names and contact details. Google reported:

"The group is extorting companies with the stolen data, requesting bitcoin payments within 72 hours."

Airline Data Breaches

Timestamp: [00:04]

Both Air France and Dutch airline KLM have fallen victim to data theft. A third-party customer service platform used by both airlines was compromised, leading to the theft of customer data. However, neither airline reported the loss of sensitive or financial information.

Boiga Telecom Breach

Timestamp: [00:04]

French telecommunications company Boiga Telecom reported a breach affecting 6.4 million customers. The compromised data includes personal information, contractual details, and bank account numbers. Uyghur Telecom clarified that account passwords remained secure and is currently notifying affected customers.

Emerging Threats and Vulnerabilities

Tea on Her App Data Leak

Timestamp: [00:04]

The newly launched Tea on Her app, designed for men to share and find information about women they're dating, is leaking user data due to a security flaw. According to TechCrunch, the leak includes usernames, email addresses, IDs, and selfies. This incident mirrors a similar leak experienced by the Women Only Tea app.

SK Telecom's Financial Loss Due to Breach

Timestamp: [00:04]

South Korea's largest telco, SK Telecom, reported a 37% drop in profits for the second quarter, attributed to a significant security breach in April. Hackers accessed customer SIM data, necessitating the replacement of all SIM cards and resulting in substantial customer loss. The company noted:

"The cost of compensating retailers and replacing SIMs contributed to the reduction in second-quarter profits."

Legal Developments and Law Enforcement Actions

Germany's Court Ruling on Police Spyware Use

Timestamp: [00:04]

Germany's highest court has ruled that police can only employ spyware in investigations of serious crimes, specifically those carrying a potential sentence of at least three years. This decision refines the use of spyware, which has been permissible since 2017, ensuring its application is limited to significant criminal cases.

Cryptocurrency Mixer Operators Convicted

Timestamp: [00:04]

The founders of Samurai Wallet, a cryptocurrency mixer, have pleaded guilty to money laundering charges. CEO Keon Rodriguez and CTO William Lonigan Hill were arrested following an FBI-led shutdown of the service. Authorities revealed that Samurai Wallet facilitated the laundering of over $200 million in crypto assets from various illicit activities, including hacks and drug trafficking.

Additionally, Roman Storm, co-founder of Tornado Cash, was acquitted of money laundering but faces charges related to operating an unlicensed money transmitting business. Tornado Cash was dismantled by the FBI in 2022 after laundering more than $1 billion.

Malware and Exploits

Malicious Firefox Extensions

Timestamp: [00:04]

Over 150 Firefox extensions in the browser's official add-ons store have been found to contain malicious code. Initially benign, these extensions were later updated to harvest crypto wallet credentials. Koi Security reports that the group behind these extensions also operates malware delivery portals and fake crypto investment and phishing sites, generating over $1 million through these activities.

North Korean Espionage Linked to Ransomware

Timestamp: [00:04]

A North Korean espionage group, identified as Chinopunk and a subgroup of Scarcraft APT, has been linked to ransomware attacks utilizing the VCD ransomware. This operation marks a shift from Scarcraft's traditional espionage focus, incorporating backdoors and information stealers before deploying ransomware to extort victims.

Security Patches and Vulnerability Mitigations

Trend Micro's Patch for Zero-Day Exploit

Timestamp: [00:04]

Trend Micro has released a patch for an actively exploited zero-day vulnerability in its Apex1 detection and response platform. The vulnerability, a pre-authentication command injection, allows remote attackers to execute code on on-premises versions of the management console. Trend Micro has issued a hotfix disabling the remote install agent functionality, with a more comprehensive update scheduled for later this month.

Sonicwall's Firewall Security Update

Timestamp: [00:04]

Sonicwall has confirmed that recent attacks on its firewalls did not involve any new zero-day exploits. Instead, attackers exploited a vulnerability from the previous year, targeting customers who upgraded to Gen 7 firewalls without resetting their account passwords. Sonicwall is monitoring approximately 40 incidents related to this attack wave.

Retbleed Attack Enhancement

Timestamp: [00:04]

Google security researchers have enhanced the Retbleed CPU side-channel attack, originally disclosed in 2022. The improved variant can now leak data three times faster, at a rate of 13 kilobytes per second. Efforts are ongoing to adapt this attack to function effectively within restrictive virtual machine and cloud environments.

New HTTP Desync Attacks Unveiled

Timestamp: [00:04]

Portswigger researcher James Kettle has introduced two novel HTTP desynchronization (desync) attacks targeting the HTTP 1.1 protocol. These attacks exploit weak boundaries between individual requests, enabling the exposure of user credentials transmitted over the internet by manipulating proxies and Content Delivery Networks (CDNs). Kettle estimates that tens of millions of sites are currently vulnerable and recommends migrating to the more secure HTTP 2 protocol to mitigate these risks.

AI Agent Vulnerabilities

Hijacking Gemini AI Agents

Timestamp: [00:04]

Security researchers have discovered a method to hijack Gemini AI agents through modified Google Calendar invites. These malicious invites conceal harmful prompts that instruct the agents to perform unauthorized actions, such as geolocating victims, stealing emails, conducting spam and phishing attacks, and remotely controlling users' Google accounts.

Industry Insights

Smart Home Appliances Security Flaw

Timestamp: [00:04]

SafeBreach presented findings at the Black Hat Security Conference revealing that smart home appliances are vulnerable due to a security flaw. Google addressed these issues earlier in the year, highlighting the ongoing challenges in securing interconnected home devices against emerging threats.

Conclusion

The August 8, 2025 episode of Risky Bulletin underscores the dynamic and evolving nature of cybersecurity threats. From federal agencies grappling with sophisticated Exchange server vulnerabilities to widespread data breaches affecting major corporations, the landscape demands vigilant and proactive measures. Legal developments and enhanced security patches indicate ongoing efforts to mitigate risks, while emerging threats like AI agent hijacking and advanced side-channel attacks highlight the need for continuous innovation in cybersecurity defenses.

Stay informed and secure by following the latest updates from the Risky Bulletin team.

Note: This summary excludes promotional content and focuses solely on the informative segments of the podcast.