NVIDIA has issued a critical security bulletin addressing a high-severity vulnerability in its NeMo Curator platform that could allow attackers to execute malicious code and escalate privileges on affected systems.
The vulnerability, designated CVE-2025-23307, affects all versions of NVIDIA NeMo Curator prior to release 25.07 across Windows, Linux, and macOS platforms.
The security flaw stems from improper input validation in the NeMo Curator’s file processing mechanisms, enabling threat actors to craft malicious files that trigger code injection attacks.
Key Takeaways 1. CVE-2025-23307 in NeMo Curator enables local code execution and privilege escalation. 2. Improper input validation impacts confidentiality, integrity, and availability. 3. Upgrade and tighten access controls.
With a CVSS v3.1 base score of 7.8, this vulnerability is classified as high severity and poses significant risks to enterprise AI infrastructure deployments.
Code Injection Vulnerability
The vulnerability is categorized under CWE-94 (Code Injection), indicating that the NeMo Curator fails to properly sanitize user-supplied input when processing certain file types.
The attack vector requires local access (AV:L) with low attack complexity (AC:L) and low privileges (PR:L), making it relatively accessible to attackers who have gained initial system access.
The CVSS vector string AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reveals that successful exploitation requires no user interaction (UI:N) and can result in high impact to confidentiality, integrity, and availability.
Attackers can potentially achieve complete system compromise through code execution, privilege escalation, information disclosure, and data tampering capabilities.
The company emphasizes that local access requirements may limit the vulnerability’s immediate exploitability in properly segmented environments.
The vulnerability was responsibly disclosed to NVIDIA by security researcher D.K., highlighting the importance of collaborative security research in identifying and addressing AI platform vulnerabilities.
Risk Factors
Details
Affected Products
NVIDIA NeMo Curator (all versions < 25.07)
Impact
Code execution; privilege escalation
Exploit Prerequisites
Local access; low attack complexity; low privileges
CVSS 3.1 Score
7.8 (High)
Mitigations
NVIDIA has released Curator version 25.07 to address this security vulnerability, with updates available through the official NVIDIA GitHub repository.
Organizations using earlier branch releases are advised to upgrade to the latest available version within their deployment branch, as all historical versions remain affected by this vulnerability.
The security update implements enhanced input validation mechanisms and file processing safeguards to prevent malicious code injection attacks.
System administrators should prioritize this update, particularly in environments where NeMo Curator processes untrusted or external data sources.
NVIDIA recommends conducting thorough testing of the updated version in staging environments before production deployment to ensure compatibility with existing AI workflows and model training pipelines.
Organizations should also review their access control policies to minimize potential attack surfaces, given the vulnerability’s local access requirements.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Cybersecurity company ESET has disclosed that it discovered an artificial intelligence (AI)-powered ransomware variant codenamed PromptLock.
Written in Golang, the newly identified strain uses the gpt-oss:20b model from OpenAI locally via the Ollama API to generate malicious Lua scripts in real-time. The open-weight language model was released by OpenAI earlier this month.
“PromptLock
CISA released three significant Industrial Control Systems (ICS) advisories on August 26, 2025, alerting organizations to critical vulnerabilities affecting widely-deployed automation systems.
These advisories highlight severe security flaws across INVT Electric’s engineering tools, Schneider Electric’s Modicon controllers, and Danfoss refrigeration systems, with CVSS v4 scores reaching 8.7, indicating high-severity exploitable conditions.
Key Takeaways 1. CISA issued three ICS advisories for critical flaws in INVT VT-Designer/HMITool, Schneider Modicon, and Danfoss systems. 2. Vulnerabilities enable remote code execution or DoS. 3. Apply vendor patches immediately.
INVT VT-Designer and HMITool Flaws
CISA advisory ICSA-25-238-01 exposes nine critical vulnerabilities in INVT Electric’s VT-Designer version 2.1.13 and HMITool version 7.1.011 software platforms.
The vulnerabilities, assigned CVE identifiers CVE-2025-7223 through CVE-2025-7231, primarily involve CWE-787 out-of-bounds write conditions and one CWE-843 type confusion vulnerability.
The affected applications suffer from inadequate input validation when parsing VPM files (in HMITool) and PM3 files (in VT-Designer).
Attackers exploiting these flaws can achieve arbitrary code execution within the current process context, requiring only user interaction such as opening malicious files or visiting compromised web pages.
Each vulnerability carries a CVSS v3.1 score of 7.8 and a CVSS v4 score of 8.5, with attack vectors characterized as AV:L/AC:L/PR:N/UI:R.
The vulnerability researcher Kimiya, working with Trend Micro’s Zero Day Initiative, reported these security flaws to CISA.
Notably, INVT Electric has not responded to CISA’s coordination attempts, leaving users without vendor-provided patches.
The affected systems span multiple critical infrastructure sectors, including Commercial Facilities, Critical Manufacturing, Energy, Information Technology, and Transportation Systems worldwide.
Schneider Electric Modicon Controllers Flaws
Advisory ICSA-25-238-03 addresses CVE-2025-6625, an improper input validation vulnerability (CWE-20) affecting Schneider Electric’s Modicon M340 controllers and associated communication modules.
The flaw enables remote attackers to trigger denial-of-service conditions through specially crafted FTP commands, earning a CVSS v4 score of 8.7 due to its network-accessible attack vector AV:N/AC:L/AT:N/PR:N/UI:N.
Affected products include all versions of the Modicon M340 controller, BMXNOR0200H Ethernet/Serial RTU modules, BMXNGD0100 M580 Global Data modules, and BMXNOC0401 communication modules.
However, Schneider Electric has released firmware updates for the BMXNOE0100 (version 3.60) and BMXNOE0110 (version 6.80) modules, requiring system reboots for implementation.
CyManII researchers discovered the vulnerability and its impacts on the Critical Manufacturing and Energy sectors globally.
Danfoss Refrigeration Systems Flaws
The updated advisory ICSA-25-140-03 reveals three distinct vulnerabilities in Danfoss AK-SM 8xxA Series refrigeration controllers.
CVE-2025-41450 represents an improper authentication vulnerability (CWE-287) caused by datetime-based password generation, enabling authentication bypass in versions prior to R4.2.
CVE-2025-41452 addresses external control of system settings (CWE-15), potentially causing denial-of-service through improper exception handling.
These vulnerabilities affect versions prior to 4.3.1, with Claroty Team82 researcher Tomer Goldschmidt credited for the discoveries.
Danfoss has released remediation updates, including release R4.2 and release R4.3.1, available through their official software upgrade process.
The vulnerabilities primarily impact Commercial Facilities infrastructure, though their high attack complexity requirements reduce immediate exploitation risks.
CISA emphasizes implementing defense-in-depth strategies across all affected systems, including network segmentation, firewall deployment, and VPN-secured remote access protocols.
Organizations should prioritize immediate patching where available and implement comprehensive monitoring for suspicious activities targeting these industrial automation platforms.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Apple has issued emergency security updates across its entire ecosystem to address CVE-2025-43300, a critical zero-dayvulnerability in the ImageIO framework that has been actively exploited in sophisticated targeted attacks.
This represents the seventh zero-dayvulnerability that Apple has patched in 2025, underscoring the persistent and escalating threat landscape facing iOS and macOS devices.
The vulnerability’s addition to CISA’s Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 11, 2025, emphasizes the urgent operational risk it poses to organizations and individual users alike.
Vulnerability ExploitationMechanics
CVE-2025-43300 is an out-of-bounds write vulnerability affecting Apple’s ImageIO framework, specifically targeting the JPEG lossless decoding logic for Adobe DNG (Digital Negative) files.
The vulnerability stems from a critical inconsistency between metadata declarations in TIFF subdirectories and the actual component count in JPEG SOF3 (Start of Frame 3) markers.
The exploit mechanism involves manipulating just two bytes in a legitimate DNG file to create a dangerous metadata mismatch.
Security researchers have demonstrated that by modifying the SamplesPerPixel value from 1 to 2 in the TIFF SubIFD at offset 0x2FD00, while simultaneously changing the SOF3 component count from 2 to 1 at offset 0x3E40B, attackers can trigger memory corruption during image processing.
When Apple’s DNG decoder processes this malformed file, it allocates memory based on the SamplesPerPixel metadata (expecting 2 components) but processes data according to the SOF3 component count (only 1 component), resulting in a heap buffer overflow that enables arbitrary code execution.
This zero-click exploitation occurs automatically when the device processes the malicious image through iMessage, email attachments, AirDrop transfers, or web content.
Attack Sophistication and Implementation
Apple’s characterization of the attacks as “extremely sophisticated,” targeting “specific individuals,” indicates the involvement of advanced threat actors with significant technical capabilities.
The vulnerability’s exploitation requires a deep understanding of both the ImageIO framework and DNG file format specifications, suggesting attackers possess extensive reverse engineering expertise and resources.
The proof-of-concept code released by security researcher b1n4r1b01 demonstrates the exploit’s reproducibility, showing how the memory corruption manifests within Apple’s RawCamera.bundle component.
Detection tools like ELEGANT BOUNCER have been developed to identify exploitation attempts by validating consistency between TIFF metadata and JPEG stream parameters.
Apple has not provided specific details about the attacking groups or targeted victims, limiting public understanding of the threat actors’ identity and motivations.
This contrasts sharply with well-documented campaigns like BLASTPASS and FORCEDENTRY, which have been definitively linked to NSO Group’s Pegasus spyware operations.
The sophisticated nature of the attack, combined with its highly targeted deployment, suggests involvement of either nation-state actors or advanced commercial spyware developers.
However, the absence of concrete attribution evidence complicates threat landscape assessment and defensive planning for security professionals.
The historical progression of iOS zero-click attacks reveals an escalating arms race between Apple’s security improvements and adversary capabilities.
Operation Triangulation (2019-2023) demonstrated unprecedented technical complexity by exploiting undocumented hardware features in Apple’s A12-A16 processors, requiring intimate knowledge of chip architecture that “very few, if any, outside of Apple and chip suppliers” could possess.
NSO Group’s FORCEDENTRY exploit showcased remarkable innovation by using JBIG2 bitmap operations to construct a “virtual computer” within iOS memory, creating logical gates and computational circuits to bypass Apple’s BlastDoor protections.
This technique, described by Google Project Zero as “one of the most technically sophisticated exploits we’ve ever seen,” elevated commercial spyware capabilities to rival nation-state operations.
BLASTPASS further demonstrated the evolution of zero-click attacks by exploiting WebP image vulnerabilities through PassKit attachments, circumventing Apple’s security improvements while maintaining the zero-interaction requirement critical for surveillance operations.
Commercial Spyware and Nation-State Connections
NSO Group has established itself as the dominant commercial spyware provider, with Pegasus deployed across at least 60 government agencies in 40 countries worldwide.
The Israeli company’s business model requires government approval for all exports, as Pegasus is classified as a weapon under Israeli law. This regulatory framework creates a controlled market where NSO selectively provides advanced surveillance capabilities to authorized government clients.
Recent legal developments have significantly impacted NSO’s operations, with a U.S. federal court finding the company liable for violating the Computer Fraud and Abuse Act in WhatsApp’s lawsuit.
This ruling represents the first time any commercial spyware company has been held accountable in U.S. courts, potentially setting a precedent for future litigation against surveillance technology vendors.
NSO Group’s Pegasus platform has evolved from requiring user interaction (click-based exploits) in 2016 to sophisticated zero-click capabilities by 2020.
The spyware’s technical features include comprehensive device compromise, enabling the collection of messages, calls, photos, location data, and real-time microphone/camera access.
The targeting patterns across Pegasus campaigns reveal a consistent focus on high-value individuals, including journalists, human rights activists, political dissidents, and government officials.
This targeting methodology aligns with CVE-2025-43300 reported use against “specific targeted individuals,” suggesting similar operational priorities among advanced threat actors.
Security Recommendations
Organizations and individuals must prioritize immediate patching across all Apple devices to iOS 18.6.2, iPadOS 18.6.2, and corresponding macOS versions.
The vulnerability’s confirmed active exploitation elevates the urgency beyond standard patch management timelines, particularly for high-risk users in journalism, activism, and government sectors.
Apple’s Lockdown Mode provides additional protection against sophisticated zero-click attacks, though it significantly restricts device functionality. For users facing elevated threat levels, enabling this feature offers enhanced security at the cost of user experience.
The persistent threat from commercial spyware and nation-state actors requires adaptive defense strategies that extend beyond traditional vulnerability management.
Organizations should implement enhanced monitoring for image processing anomalies, deploy advanced endpoint detection and response (EDR) solutions, and maintain current threat intelligence feeds focused on mobile device exploitation.
Proactive threat hunting becomes essential given the stealth characteristics of zero-click attacks, requiring security teams to analyze device behavior patterns, network communications, and system integrity indicators that may reveal compromise before traditional security tools detect malicious activity.
CVE-2025-43300 exemplifies the continuing evolution of mobile device threats, where sophisticated adversaries leverage complex technical vulnerabilities to achieve persistent surveillance capabilities.
The vulnerability’s technical sophistication, combined with its integration into the broader landscape of commercial spyware and nation-state cyber operations, underscores the critical importance of comprehensive mobile security strategies that address both technical vulnerabilities and operational threat models.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
A sophisticated global cybercrime campaign dubbed “ShadowCaptcha” has emerged as a significant threat to organizations worldwide, leveraging fake Google and Cloudflare CAPTCHA pages to trick victims into executing malicious commands.
Discovered by researchers at the Israel National Digital Agency in August 2025, this large-scale operation has been active for at least one year, exploiting hundreds of compromised WordPress websites to deliver multi-stage malware payloads.
The campaign employs a deceptive technique known as ClickFix, where attackers inject malicious JavaScript into compromised WordPress sites that redirect users to attacker-controlled infrastructure hosting fake CAPTCHA verification pages.
These convincingly designed pages mimic legitimate Cloudflare or Google security checks, prompting unsuspecting users to copy and execute PowerShell commands under the guise of completing a security verification process.
Retrospective analysis has revealed the campaign’s extensive reach, with over 100 compromised WordPress sites serving as initial infection vectors and hundreds of malware samples spanning multiple families and variants.
Gov.li analysts identified the campaign’s opportunistic nature, targeting organizations across all sectors regardless of size or industry vertical.
The attack operates through a sophisticated multi-stage delivery mechanism that combines social engineering with living-off-the-land binaries (LOLBins) to maintain persistence while evading detection.
Once victims execute the disguised malicious commands, the malware establishes a foothold within targeted systems and proceeds with its primary objectives.
Multi-Faceted Monetization Strategy
ShadowCaptcha’s infection mechanism demonstrates remarkable versatility in its monetization approach.
The malware focuses on three primary revenue streams: credential harvesting and browser data exfiltration for identity theft, deployment of cryptocurrency miners to generate illicit profits from infected systems, and potential ransomware deployment for immediate financial gain.
Fake captcha (Source – Gov.li)
This multi-pronged strategy maximizes the attackers’ return on investment while creating sustained unauthorized access to compromised networks.
The campaign’s ability to adapt its payload based on system characteristics and security posture makes it particularly dangerous, as it can pivot between different attack modes to avoid detection while maintaining persistent access to valuable corporate resources.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
Cybersecurity researchers at Huntress identified a novel ransomware variant dubbed Cephalus, deployed in two separate incidents targeting organizations lacking robust access controls. This emerging threat, which claims its name from Greek mythology symbolizing inevitable tragedy, leverages exposed Remote Desktop Protocol (RDP) endpoints as its primary initial access vector, exploiting compromised credentials without multi-factor authentication (MFA). […]
President Donald Trump insisted Tuesday he has unlimited power, and that includes the power to send the military to any state or city he chooses, he told reporters at the White House.
“I have the right to do anything I want to do. I'm the president of the United States,” Trump said during a televised cabinet meeting that ran for more than three hours Tuesday. (Here’s a transcript, via Roll Call.)
Trump was reacting to public tension over the Pentagon’s reported plans to send troops into Chicago, which U.S. military officials have been planning for several weeks as a White House response to “crime, homelessness and undocumented immigration” in Illinois’ largest city, according to the Washington Post. If the governor of Illinois requests the Guard troops, the process would likely proceed somewhat quickly. But Democratic Gov. JB Pritzker has been especially vocal about declining Trump’s desired Guard deployment to Chicago, saying at a Monday press conference on the matter, “Do not come, Donald Trump. You are neither wanted nor needed here in Illinois.”
Additional context: Trump has “attacked the counterweights to his own authority in government, particularly focusing on Democratic governors and cities governed by Democratic mayors,” the New York Times reminds readers, and points out, “The president has not suggested sending troops to cities with higher crime in states that lean Republican.”
Also worth noting: “Although high crime rates have persisted for decades in Chicago, violent crime there has dropped since the pandemic, and murders are down by 50 percent since 2021,” the Times reports. And “Over the last year, crime has fallen in nearly every major category tracked by the Chicago Police Department.”
Trump’s deputy chief of staff Stephen Miller: “The Democrat Party is not a political party. It is a domestic extremist organization,” the president’s top immigration advisor told TV personality Sean Hannity of Fox on Monday. “It is an entity devoted exclusively to the defense of hardened criminals, gangbangers, and illegal, alien killers and terrorists,” he said, and insisted—using patriotic “purity” rhetoric of autocrats and dictators throughout history—the “Democrat Party does not fight for, care about, or represent American citizens.”
ICYMI: Every state in the National Guard already has “quick reaction forces,” Randy Manner, a retired Army two-star who has served as acting vice chief of the National Guard Bureau, told ABC News this week.
But the new, specialized Guard troops Trump is demanding for each state in an executive order signed Monday? “They're going to be there to police Americans,” Manner said.
Coverage continues below…
Welcome to this Wednesday edition of The D Brief, a newsletter dedicated to developments affecting the future of U.S. national security, brought to you by Ben Watson with Bradley Peniston. Share your tips and feedback here. And if you’re not already subscribed, you can do that here. On this day in 1776, Revolutionary troops were flanked and defeated by a far larger British force in Brooklyn, but Gen. George Washington saved his army with a retreat to Manhattan.
Update: National Guard troops sent to the nation’s capital for “out of control” crime are now picking up trash and spreading mulch,NBC4 Washington and the Washington Postreported Tuesday and Wednesday, respectively.
“Normally the Park Service does that, but the administration laid off the workers,” Brad Heath of Reuters noted on social media. Additional video confirmed the troops’ activity, which Pentagon officials said two weeks ago would be a possibility.
“Today here, we are right outside the waterfront. Had everyone with gloves and trash bags and all the materials they needed, and instructions to head out and pick up the trash,” a Guard soldier said in a video posted to social media over the weekend.
“The joint task force had 2,234 members as of Monday morning, including 929 members of the D.C. National Guard and 1,305 members of the Louisiana, Mississippi, Ohio, South Carolina, Tennessee and West Virginia National Guards,” NBC4 reports.
Worth noting: “About half of U.S. adults, 53%, say they approve of Trump’s handling of crime…even as statistics show violent crime is down in Washington and across the nation following a coronavirus pandemic-era spike,” the Associated Press reported Wednesday, citing a survey of 1,182 U.S. adults conducted between August 21 and 25.
Caveat: “The poll shows there is less public support for federal takeovers of local police departments, suggesting opinions could shift over the coming weeks or months, depending on how aggressively Trump pursues his threats.” Read more, here.
Follow-up: Pentagon chief Pete Hegseth said he agrees with Trump that the Defense Department’s name should be changed to the “War Department” because “George Washington started the Department of War because he wanted us to win our wars,” and “It's not just about words; it's about the warrior ethos,” he said during Trump’s three-hour cabinet meeting Tuesday.
In case you missed it, Trump said Monday he wants to officially change the name “over the next week or so,” during remarks at the White House. “We're just going to do it,” Trump said when asked if he has considered lawmakers’ opinions on the matter. ABC News has more from Hegseth’s remarks at the cabinet meeting.
Balky booms: The refueling boom on the Air Force’s KC-46 tankers has been involved in three accidents that have cost tens of millions of dollars to repair. Two took place in 2022 and another last year, according to investigation reports released by the Air Force on Monday.
During the most recent of the mishaps described in the reports, a tanker’s boom got stuck in the fuel receptacle of a F-15E, then released with enough recoil to strike the tanker. The boom broke apart, resulting in $14 million in damages. That mishap was primarily caused by the boom operator’s control inputs, investigators found. Defense One’s Audrey Decker has more, here.
Navy “looking forward” to F/A-XX builder decision. Now that Congress is moving to restore funding for the sixth-generation fighter jet, the service is waiting for Pentagon leaders to pick a company to build it, according to Vice Adm. Daniel Cheever, commander of Naval Air Forces, speaking Tuesday at a CSIS event.
Background: In March, the Navy was reportedly close to picking a company to build F/A-XX, but an announcement never came, and the service ended up gutting funding for the aircraft in its 2026 budget request, throwing the program into limbo. But Congress is on track to reverse those cuts: Senate appropriators added $1.4 billion to F/A-XX in their draft defense spending bill and House appropriators added $972 million to their version. Decker has more, here.
Trump-linked “covert operation” in Greenland? Officials in Denmark are reportedly aware that “at least three people with connections to President Donald Trump have been carrying out covert influence operations in Greenland,” the Associated Press reported Wednesday, relaying reporting from Danish public broadcaster DR.
BBC: “DR's report on Wednesday gave details of a visit by one American to Greenland's capital Nuuk, saying he was seeking to compile a list of Greenlanders who backed US attempts to take over the island. The aim would be to try to recruit them for a secession movement.”
Danish Foreign Minister Lars Lokke Rasmussen has summoned America’s top diplomat in Denmark, Mark Stroh, the U.S. charge d'affaires in Copenhagen, over the matter. “Any attempt to interfere in the internal affairs of the Kingdom [of Denmark] will of course be unacceptable,” Rasmussen told Time magazine.
“It is important for us to speak out very clearly against the United States,” Rasmussen told reporters Wednesday, according to Reuters. He called the allegations “completely unacceptable,” and added, “If anyone thinks they can influence it by creating a ‘fifth column’ or that type of activity, then it is contrary to the way states cooperate.”
Anthropic on Wednesday revealed that it disrupted a sophisticated operation that weaponized its artificial intelligence (AI)-powered chatbot Claude to conduct large-scale theft and extortion of personal data in July 2025.
“The actor targeted at least 17 distinct organizations, including in healthcare, the emergency services, and government, and religious institutions,” the company said. “
A newly observed variant of the Zip Slip vulnerability has emerged, enabling threat actors to exploit path traversal flaws in widely used decompression utilities.
Exploits leveraging this vulnerability craft malicious archives containing specially constructed file names with relative paths.
When an unsuspecting user or automated system extracts these archives, files are written outside the intended extraction directory, potentially overwriting critical system or application binaries.
Early reports indicate that attackers are weaponizing this technique to implant backdoors and escalate privileges on both Windows and Unix targets.
Unlike traditional archives that restrict file locations to a subfolder, the malicious ZIP files contain entries.
Upon decompression, these entries bypass inadequate path sanitization and deposit payloads directly into system directories.
Initial incidents were spotted in internal penetration tests, but more sophisticated campaigns recently attributed to the RomCom APT group have demonstrated live-fire exploitation in enterprise environments.
ASEC analysts identified that the variant takes advantage of the general purpose bit flag in the ZIP header to encode path separators that evade detection by signature-based scanners.
In one case, a compromised email attachment delivered a ZIP archive that, when opened with an outdated decompression tool, silently overwrote a legitimate startup script.
Examination of the archive structure reveals that the filename field beginning at offset 0x1E contains path segments separated by percent-encoded slashes, which are decoded only during file creation.
ZIP file containing the path to the unzipped file (Source – ASEC)
Subsequent reverse engineering uncovered that the malicious archive leveraged Python’s zipfile module to insert relative paths directly into the filename field.
Major vulnerabilities exploited by this technique include:-
CVE-2025-8088 – It affects WinRAR prior to version 7.13 and allows bypass of path validation via Alternate Data Stream traversal.
CVE-2025-6218 – A remote code execution flaw in WinRAR versions before 7.12 that sidesteps relative path filters when spaces are used.
CVE-2022-30333 – It targets RARLAB Unrar before 6.12 to overwrite SSH authorized_keys via "../../example" paths.
CVE-2018-20250 – This abuses ACE format extraction in WinRAR pre-5.61 by bypassing UNACEV2.dll filtering logic.
In addition to simple file overwrite, this variant supports embedding executable scripts and DLLs designed to maintain persistence.
By writing payloads to startup folders or systemd service directories, attackers ensure execution upon reboot. Detection is complicated by the fact that many decompression utilities do not normalize or validate canonical paths before writing.
Cybersecurity teams are advised to employ decompression libraries with built-in path traversal checks, enforce extraction within sandboxed environments, and update tools to patched versions released after August 2025 that include strict directory validation routines.
Boost your SOC and help your team protect your business with free top-notch threat intelligence: Request TI Lookup Premium Trial.
A threat activity cluster known as ShadowSilk has been attributed to a fresh set of attacks targeting government entities within Central Asia and Asia-Pacific (APAC).
According to Group-IB, nearly three dozen victims have been identified, with the intrusions mainly geared towards data exfiltration. The hacking group shares toolset and infrastructural overlaps with campaigns undertaken by threat
.webp)
.webp)