Daily Brief

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed the use of BRICKSTORM by PRC-backed hackers to maintain long-term access in U.S. systems, specifically targeting VMware and Windows environments. BRICKSTORM, written in Golang, allows threat actors to execute commands, manipulate files, and maintain stealthy access, utilizing protocols like HTTPS and DNS-over-HTTPS for secure command-and-control. The malware has been linked to Chinese groups UNC5221 and Warp Panda, targeting U.S. legal, technology, and manufacturing sectors, with intrusions detected in VMware vCenter environments. Initial access often involves exploiting internet-facing devices, with attackers moving laterally to domain controllers via Remote Desktop Protocol (RDP) and exfiltrating cryptographic keys. CrowdStrike identified Warp Panda's sophisticated operations, including the deployment of additional Golang implants, Junction and GuestConduit, to facilitate network traffic tunneling and command execution. The attackers have accessed sensitive data in cloud environments, exploiting Microsoft Azure to access OneDrive, SharePoint, and Exchange, indicating a focus on intelligence collection aligned with PRC interests. The Chinese embassy in Washington denied the accusations, asserting that the Chinese government does not support cyber attacks. The ongoing activity reflects a tactical evolution in Chinese cyber operations, emphasizing the need for robust defenses against state-sponsored threats.

JPCERT/CC has reported active exploitation of a command injection vulnerability in Array Networks AG Series gateways, affecting systems with the 'DesktopDirect' feature enabled. The vulnerability, lacking a CVE identifier, was patched on May 11, 2025, but has been actively exploited since August 2025, primarily in Japan. Attackers have leveraged the flaw to execute arbitrary commands, deploying web shells on compromised devices, with attacks traced back to IP address "194.233.100[.]138." While a prior authentication bypass flaw in the same product was linked to China-based MirrorFace, no current evidence connects them to the recent attacks. The vulnerability impacts ArrayOS versions 9.4.5.8 and earlier, with users urged to update to version 9.4.5.9 to mitigate risks. As an interim measure, disabling DesktopDirect services and applying URL filtering to block semicolon-containing URLs are recommended. Organizations should prioritize patch management and review remote access configurations to prevent exploitation of similar vulnerabilities.

Anthropic has launched SCONE-bench, a benchmark to evaluate AI's capability in identifying vulnerabilities in blockchain smart contracts, highlighting the growing sophistication of AI in cybersecurity. The benchmark dataset includes 405 smart contracts from Ethereum-compatible blockchains, derived from DefiHackLabs, showcasing real-world exploitation scenarios between 2020 and 2025. Tests revealed that AI models like Claude Opus 4.5 and GPT-5 could generate exploit code valued at $4.6 million, emphasizing the potential financial impact of AI-driven attacks. In a simulation with 2,849 newly deployed contracts, AI agents identified zero-day vulnerabilities, demonstrating the feasibility of autonomous exploitation with a net profit margin. The cost efficiency of using AI for vulnerability detection is improving, with the average cost per vulnerable contract identified at $1,738, potentially increasing the attractiveness of such attacks. Anthropic's initiative stresses the necessity for proactive AI defense strategies to counteract the risks posed by increasingly capable AI models in cybersecurity. The development of SCONE-bench serves as a warning to industries relying on blockchain technology, urging them to reassess their security measures against AI-driven threats.

Hackers are exploiting a command injection vulnerability in Array AG Series VPN devices, allowing them to plant webshells and create rogue users within targeted systems. Despite a security update in May, Array Networks has not assigned an identifier to the flaw, complicating tracking and patch management efforts. Japan's CERT has issued a warning, noting that attacks have been ongoing since August, primarily affecting organizations within Japan. The vulnerability impacts ArrayOS AG 9.4.5.8 and earlier, affecting both hardware and virtual appliances with the 'DesktopDirect' feature enabled. Macnica's security research indicates 1,831 ArrayAG instances globally, with significant concentrations in Asia, particularly Japan, China, and the U.S. The lack of global awareness and attention from security vendors outside Japan increases the risk of exploitation in other regions. Array Networks has yet to respond regarding the publication of a CVE-ID or an official advisory, leaving organizations at risk without a standardized tracking mechanism.

The UK's National Cyber Security Center (NCSC) has initiated the Proactive Notifications service to alert organizations about vulnerabilities in their systems using public data and internet scanning. Partnering with Netcraft, the service identifies unpatched vulnerabilities and recommends software updates, focusing on UK domains and IP addresses from local Autonomous System Numbers (ASNs). Proactive Notifications will not cover all systems or vulnerabilities, and organizations are advised to use it alongside NCSC's Early Warning service for comprehensive security alerts. The service aims to improve cybersecurity posture by notifying organizations of risks before a direct threat is detected, helping to harden systems and mitigate potential attacks. Emails from this service are sent from netcraft.com addresses, ensuring no attachments or requests for personal information, maintaining compliance with the Computer Misuse Act. While in the pilot phase, the timeline for the broader rollout of Proactive Notifications remains unspecified, but it is part of a layered security strategy with the Early Warning service. Early Warning offers alerts on potential cyberattacks and vulnerabilities by cross-referencing threat intelligence feeds with enrolled organizations' domains and IP addresses.

Chinese cyber operatives infiltrated critical US networks, maintaining access for years using the sophisticated Brickstorm malware, affecting at least eight government and IT organizations. The malware operates across Linux, VMware, and Windows environments, enabling long-term access, data theft, and potential sabotage, posing significant risks to US infrastructure. Google Threat Intelligence and Mandiant identified the intrusions, attributing them to UNC5221, a suspected Chinese group, and recommended using open-source tools to detect the backdoor. CrowdStrike linked Brickstorm to a new group, Warp Panda, which exploits edge devices and VMware environments to access Microsoft 365 data and other sensitive information. The attackers used advanced techniques like session replay and multifactor authentication manipulation to maintain persistence and exfiltrate data from compromised networks. Security agencies, including CISA and NSA, issued warnings and are actively monitoring the situation, emphasizing the ongoing threat from state-sponsored cyber activities. The extended dwell time and persistent access complicate detection and response efforts, highlighting the need for enhanced cybersecurity measures and vigilance across affected sectors.

A Pentagon Inspector General report revealed that Defense Secretary Pete Hegseth used Signal to share sensitive information, breaching DoD communication protocols. The incident involved sharing operational details about airstrikes in Yemen, which were initially marked as secret, with a Signal group that included a journalist. While Hegseth claimed to have declassified the information, the use of a personal device and non-approved app violated Pentagon rules, risking potential data compromise. The Inspector General identified this as part of a broader issue within the DoD, where personnel frequently fail to comply with electronic messaging and records retention policies. Recommendations include mandatory cyber training for senior officials and the development of a secure, DoD-controlled messaging service. The report highlights systemic challenges in maintaining operational security and protecting classified information within the Department of Defense.

Predator spyware, developed by Intellexa, employs a zero-click infection method named "Aladdin," targeting users through malicious advertisements, as revealed by a joint investigation. This new vector, operational since 2024, uses the commercial mobile advertising system to deliver malware, exploiting public IP addresses to target specific individuals. The ads redirect targets to Intellexa’s exploit servers without user interaction, making detection and prevention challenging for cybersecurity defenses. The investigation involved leaked documents and technical analysis from Amnesty International, Google, and Recorded Future, uncovering the global network of shell companies involved. Additional delivery vectors, such as 'Triton,' exploit Samsung Exynos devices through baseband vulnerabilities, highlighting Intellexa's extensive zero-day exploitation capabilities. Despite sanctions and investigations, Intellexa remains active, prompting recommendations for enhanced mobile security measures like Advanced Protection on Android and Lockdown Mode on iOS. The complexity of defending against such sophisticated attacks emphasizes the need for robust ad-blocking and IP-hiding strategies to protect user privacy and security.

Twin brothers, Muneeb and Sohaib Akhter, were indicted for allegedly deleting nearly 100 government databases after being terminated from a federal contractor position. The databases included sensitive information related to the Department of Homeland Security and Freedom of Information Act matters. The brothers allegedly used artificial intelligence tools to assist in covering their tracks by deleting system logs and other evidence. The incident occurred within minutes of their termination, exploiting lingering access due to insufficient deactivation measures. Opexus, the contractor involved, has stated its commitment to strengthening security measures following the breach. The brothers had prior convictions for hacking-related offenses, raising questions about vetting and access control for sensitive roles. Legal proceedings are underway, with potential penalties including significant prison time for both individuals if convicted. The case underscores the critical need for robust access management and immediate revocation of credentials upon employee termination.

Russia's Roskomnadzor has blocked FaceTime and Snapchat, citing their use in coordinating terrorist activities and recruiting criminals. The ban reflects ongoing tensions between Russia and foreign tech platforms, impacting millions of users within the country. FaceTime, preinstalled on Apple devices, and Snapchat, with over a billion downloads, are significant communication tools now restricted. The move is part of a broader Russian strategy to control digital communications, having previously banned other platforms like Viber and Signal. Roskomnadzor's actions align with national security measures, emphasizing the regulation of foreign messaging services under anti-extremism laws. The ban raises questions about the balance between national security and digital freedom, affecting international tech companies' operations in Russia. Apple and Snap have not yet commented on the restrictions, leaving uncertainty about potential responses or negotiations.

The U.S. CISA, NSA, and Canada's Cyber Security Centre released a report on BrickStorm malware, targeting VMware vSphere servers to create rogue virtual machines and steal data. BrickStorm uses advanced encryption methods, including HTTPS, WebSockets, and nested TLS, to secure communications and evade detection. The malware facilitates lateral movement through compromised networks using a SOCKS proxy and DNS-over-HTTPS, maintaining persistence with a self-monitoring function. Chinese hackers exploited a web server in a DMZ, moving laterally to compromise VMware vCenter servers and domain controllers, stealing cryptographic keys and credentials. CISA advises organizations to use YARA and Sigma rules to detect BrickStorm activity and block unauthorized DNS-over-HTTPS providers to mitigate risks. CrowdStrike linked these attacks to the Chinese group Warp Panda, which also deployed Junction and GuestConduit malware in VMware environments. The advisory follows a Google Threat Intelligence Group report connecting BrickStorm to UNC5221, known for exploiting Ivanti zero-days against U.S. government agencies. Critical infrastructure and government organizations are urged to report detected BrickStorm activity to comply with legal and policy requirements.

Silver Fox, a threat actor, is conducting a campaign using fake Microsoft Teams installers to spread ValleyRAT malware targeting Chinese-speaking users and Western organizations in China. The campaign employs SEO poisoning to redirect users to a counterfeit website, where a trojanized Teams setup file is downloaded, initiating the malware infection process. ValleyRAT, a variant of Gh0st RAT, enables remote control of infected systems, data exfiltration, and execution of arbitrary commands, posing significant risks to targeted networks. The malware uses Russian linguistic elements in its files to mislead attribution efforts, complicating the identification of the true source of the attacks. The attack chain also involves manipulating Microsoft Defender settings and using a vulnerable driver to bypass security measures, ensuring persistence and stealth. Silver Fox's operations aim for financial gain and intelligence collection, maintaining plausible deniability by mimicking Russian threat groups. Organizations are advised to enhance vigilance around software downloads and implement robust security measures to detect and mitigate such sophisticated malware campaigns.

Two Virginia brothers, former federal contractors, face charges for conspiring to delete 96 government databases and steal sensitive information after their employment termination. The databases contained critical U.S. government information, including Freedom of Information Act records and sensitive investigative documents from multiple federal agencies. Muneeb Akhter allegedly used an AI tool to seek guidance on erasing system logs post-deletion, indicating a sophisticated approach to covering their tracks. Both brothers are accused of wiping company laptops and discussing plans to eliminate evidence from their home, anticipating law enforcement action. Charges include computer fraud, destruction of records, and aggravated identity theft, with potential sentences ranging from six to 45 years. The incident underscores the risks posed by insider threats, particularly from individuals with prior criminal records rehired into sensitive positions. This breach has disrupted government operations and highlighted the need for stringent vetting and monitoring of contractors handling sensitive data.

Operational Technology (OT) systems, crucial to infrastructure like energy plants, face unique cybersecurity challenges due to outdated hardware and software. The integration of IT and OT systems increases the risk of cyberattacks through exploited user credentials and reused passwords. Password security is vital in OT environments, given the potential life-threatening consequences of system failures. Shared accounts and remote access by third parties further complicate OT security, introducing additional vulnerabilities. Implementing robust password policies, including multi-factor authentication, can significantly enhance OT security. Continuous monitoring for compromised passwords in Active Directory is essential to mitigate risks in OT environments. Specops Software offers tools to enforce strong password policies and block compromised passwords, enhancing OT system resilience.

A severe vulnerability, "React2Shell," allows remote code execution in React and Next.js applications due to insecure deserialization in the RSC 'Flight' protocol. The flaw has a maximum severity score of 10/10 and affects React versions 19.0 to 19.2.0 and Next.js experimental releases from 14.3.0-canary.77 to 16.x. Security researcher Lachlan Davidson discovered the vulnerability, which can be exploited by sending a crafted HTTP request to React Server Function endpoints. React and Next.js are widely used in cloud environments, with 39% of observed instances running vulnerable versions, according to Wiz researchers. Organizations are urged to apply patches in React versions 19.0.1 and above and Next.js versions 15.0.5 and above to mitigate the risk. The vulnerability potentially affects other libraries implementing React Server, such as Vite RSC plugin and RedwoodSDK, necessitating a comprehensive audit of environments. Davidson cautions against fake proof-of-concept exploits that misuse functions not genuinely needed for exploitation, emphasizing the importance of proper validation.