The developers behind the PureHVNC remote access trojan (RAT) have been uncovered using GitHub repositories to host critical components and plugin source code for their Pure malware family. Check Point Research’s recent forensic analysis of an eight-day ClickFix intrusion campaign reveals that PureHVNC’s command-and-control (C&C) server delivered GitHub URLs to infected machines, a practice previously […]
A denial-of-service flaw in the Linux kernel’s KSMBD (SMB Direct) subsystem has raised alarms across the open-source community.
Tracked as CVE-2025-38501, the issue allows a remote, unauthenticated adversary to exhaust all available SMB connections by exploiting the kernel’s handling of half-open TCP sessions.
Key Takeaways 1. CVE-2025-38501 lets attackers exhaust KSMBD connections via half-open TCP handshakes. 2. PoC “KSMBDrain” floods servers with SYN packets to trigger the flaw. 3. Patched in Linux 6.1.15+; upgrade or rate-limit port 445.
A public proof-of-concept exploit, dubbed KSMBDrain, demonstrates how attackers can overwhelm a KSMBD server simply by initiating thousands of TCP three-way handshakes and then failing to complete the session, causing the server to hold sockets indefinitely.
KSMBD DoS Attack
The flaw originates from KSMBD’s default behavior of retaining incomplete connections without an upper limit on pending SYN–ACK sockets. When a client sends a SYN, the kernel replies with a SYN–ACK and awaits the final ACK.
If that ACK never arrives, KSMBD will keep the connection slot open. By repeatedly sending SYN packets from a single IP address, an attacker can saturate the server’s max_connections limit configured in /etc/ksmbd/ksmbd.conf, resulting in a complete denial of subsequent legitimate SMB traffic.
Although administrators can set a handshake_timeout as low as one minute, this only slows the attack rather than preventing it, since an attacker can continuously reopen new half-open sessions.
The publicly available PoC, written in Python, leverages raw sockets to mass-spawn handshake attempts. A snippet from poc.py reveals the simplicity of the exploit:
KSMBD DoS Attack
Running this script against a vulnerable server quickly depletes the connection pool, rendering SMB shares inaccessible and effectively halting file transfers and authentication services.
Risk Factors
Details
Affected Products
Linux Kernel KSMBD subsystem (versions 5.3 and later)
Impact
Denial of Service
Exploit Prerequisites
Network connectivity to target KSMBD server on TCP port 445; No authentication required
CVSS 3.1 Score
Not yet assigned
Mitigations
The vulnerability was introduced in Linux kernel 5.3 when the KSMBD module was merged into the mainline. Upstream maintainers addressed the issue in commit e6bb9193974059ddbb0ce7763fa3882bd60d4dc3, which adds a configurable backlog limit and enforces a shorter tcp_synack_retries threshold for half-open sockets.
Distributions have begun rolling out updated kernel packages; users should apply the fix by upgrading to Linux 6.1.15 or later.
In environments where an immediate kernel upgrade is impractical, network-level rate limiting on TCP port 445 and stricter firewall rules can help mitigate exploitation.
Additionally, security teams are advised to monitor for an abnormal number of SYN packets and to adjust KSMBD’s user-space settings to lower handshake_timeout and limit backlog counts.
As SMB services remain a critical component for file sharing and authentication in enterprise networks, prompt patching is essential.
The KSMBDrain exploit underscores the importance of defending against resource exhaustion attacks that leverage protocol-level quirks rather than code injection or privilege escalation.
Continuous monitoring and maintaining up-to-date kernel versions will mitigate the risk posed by CVE-2025-38501.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
A large-scale supply chain attack dubbed “Shai-Halud” that infiltrated the JavaScript ecosystem via the npm registry.
In total, 477 packages, including packages from CrowdStrike, were found to contain stealthy backdoors and trojanized modules designed to siphon credentials, exfiltrate source code, and enable remote code execution (RCE) on developer machines.
Key Takeaways 1. Obfuscated backdoors hit 477 npm packages via minor version updates. 2. Payload harvested and exfiltrated credentials to a C2 server. 3. Fix by pinning versions, supply-chain scanning, checksum checks, and rotating secrets.
Shai-Halud Supply Chain Attack
The adversary’s campaign began in early August 2025, when compromised maintainer accounts were used to publish malicious updates under minor version bumps (e.g., from 1.2.3 to 1.2.4).
Each update injected a small, obfuscated payload within the module entry file (typically index.js). This loader reached out to a command-and-control (C2) server to fetch a second-stage payload.
Socket reports that the payload searched project directories for .env files, SSH private keys (id_rsa), and Git credentials stored in .git/config, then transmitted them in encrypted form back to the attacker’s infrastructure.
Packages compromised
Shai-Halud’s use of version-range hijacking allowed attackers to maintain persistence: downstream projects specifying dependencies with loose semver ranges (e.g., “^1.2.0”) automatically pulled in the trojanized release.
Many high-profile libraries, ranging from development tools and CLI utilities to UI component frameworks, were affected, amplifying the blast radius. Detection strategies include:
Integrate tools like npm audit, Snyk, or OWASP Dependency-Check into CI pipelines to flag anomalous version releases.
Validate package integrity against known good SHA-256 hashes via npm ci –prefer-offline –hash-checksums. Employ runtime monitoring (e.g., Sysmon on Windows, auditd on Linux) to detect unexpected network calls or use of eval().
Mitigations
Lock Dependency Versions: Pin to specific package versions and avoid wide semver ranges.
Rotate Secrets: Revoke and regenerate any exposed API tokens, SSH keys, and environment variables.
Audit Your Dependencies: Run npm ls –prod –depth=0 to see direct dependencies and cross-check against advisories.
As open-source ecosystems remain a prime target, securing the software supply chain through rigorous validation and continuous monitoring is more critical than ever.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
A sophisticated Python-based information stealer named XillenStealer has emerged as a significant threat to Windows users, designed to harvest sensitive system data, browser credentials, and cryptocurrency wallet information. XillenStealer operates through a comprehensive builder framework called “XillenStealer Builder V3.0,” featuring a Python-based Tkinter GUI that enables threat actors to configure and customize their attacks with […]
American First Finance, LLC, a Dallas-based financial services firm, suffered a significant insider breach when a recently terminated employee exploited unauthorized access to its production database.
The incident, dubbed the FinWise insider breach, resulted in the exfiltration of sensitive customer records nearly 689,000 names, Social Security numbers, and other personal identifiers via direct SQL queries and unmonitored API endpoints.
The company discovered the breach on June 18, 2025, following anomalous activity flagged by its SIEM system, which detected unusually high volumes of data exports encoded in Base64 and transferred over SSH tunnels to an external IP address.
Key Takeaways 1. 689K records exposed via insider database access. 2. Notifications sent July 29, 2025; 24-month IDX protection offered. 3. Incident contained; moving to JIT access, AWS KMS, and analytics.
American First Finance Data Breach
American First Finance’s data environment included customer data stored in Amazon RDS instances within a Virtual Private Cloud (VPC) segmented by strict security groups.
Despite multi-factor authentication (MFA) and role-based access controls (RBAC), the former employee leveraged residual privileges left in an archived service account.
Once authenticated, the insider executed automated SELECT statements across multiple schema tables, extracting PII in CSV format. The extracted dataset contained:
Full names and mailing addresses
Social Security numbers and dates of birth
Financial account numbers and credit histories
According to a filing with the Maine Attorney General’s office, a total of 689,000 individuals were affected, including 208 Maine residents. Under Maine’s Data Breach Notification Law, consumer reporting agencies have been notified, as the Maine resident count exceeded 1,000.
American First Finance promptly engaged Mandiant for forensic analysis, confirming no evidence of lateral movement beyond the compromised account and no additional exploitation of externally facing systems.
Mitigations
On July 29, 2025, American First Finance issued electronic notifications to all affected customers, adhering to Section 5B of the Gramm-Leach-Bliley Act.
Maine residents received a tailored breach notification consistent with regulatory guidelines, including a copy of the official notice.
The firm offered 24 months of complimentary identity theft protection and credit monitoring through IDX, featuring real-time credit alerts, identity restoration services, and dark web scanning.
Associate General Counsel Jason Griggs, who submitted the notification, emphasized that the breach was contained through rapid account revocation, log analysis, and password resets across all internally used credentials.
“Our security operations center (SOC) moved swiftly to isolate the compromised credential and ensure no further unauthorized access,” stated Griggs.
Moving forward, American First Finance plans to implement just-in-time (JIT) access provisioning, enhance database encryption with AWS KMS, and deploy user behavior analytics (UBA) to detect anomalous insider activities. These measures aim to fortify their security posture and prevent future insider threats.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
A critical vulnerability in Windows Boot Manager, known as bitpixie, enables attackers to bypass BitLocker drive encryption and escalate local privileges on Windows systems.
The vulnerability affects boot managers from 2005 to 2022 and can still be exploited on updated systems through downgrade attacks, posing significant risks to enterprise security.
Key Takeaways 1. Bitpixie lets attackers bypass BitLocker and escalate privileges. 2. Admin access is possible if a BitLocker PIN is known. 3. Patch KB5025885 is required to mitigate.
The BitPixie vulnerability stems from a flaw in the PXE (Preboot Execution Environment) soft reboot feature of the Windows Boot Manager, where the BitLocker Volume Master Key (VMK) is not properly erased from memory during the boot process.
This vulnerability is linked to CVE-2023-21563, which affects the boot manager’s handling of network boot operations.
Exploit bitpixie Windows Boot Manager Vulnerability
SySS Tech details that the exploitation process involves a sophisticated two-stage attack that targets the boot configuration and memory extraction mechanisms.
Attackers first craft a malicious Boot Configuration Data (BCD) file that specifies a recovery boot process loading from their controlled TFTP server.
This modified BCD file redirects the normal boot sequence to trigger a PXE soft reboot, which loads an attacker-controlled Linux environment while preserving the VMK in system memory.
The attack leverages the Trusted Platform Module (TPM) and Platform Configuration Registers (PCRs) used in the Windows Measured Boot process.
During normal operation, BitLocker relies on PCR registers 7 and 11 to validate boot integrity before unsealing the VMK from the TPM.
However, the bitpixie vulnerability allows attackers to circumvent this protection by exploiting the memory persistence during PXE soft reboot operations.
To extract the VMK from memory, attackers scan for the specific byte pattern -FVE-FS- (hex: 2d 46 56 45 2d 46 53 2d) which marks the beginning of the BitLocker metadata area.
The VMK itself is identified by the byte signature 03 20 01 00 followed by the 32-byte encryption key. Once extracted, this key can be used to unlock the entire BitLocker-encrypted partition, granting administrative access to the system.
Even systems protected with BitLocker Pre-Boot Authentication (PBA) and PIN requirements remain vulnerable to privilege escalation attacks.
Research demonstrates that malicious insiders with knowledge of the BitLocker PIN can exploit bitpixie to gain local administrative privileges on their assigned systems.
BitPixie Prerequisites
The attack succeeds because the PIN validation occurs before the vulnerable memory handling, allowing the VMK to be extracted even from PIN-protected systems.
Attackers can then modify Windows registry files, such as the Security Account Manager (SAM) database, to add low-privilege user accounts to the Administrators group.
This technique enables lateral movement and persistent access within corporate environments.
Privilege escalation
The vulnerability affects multiple VMK protection types, with different byte signatures observed for various configurations:
Standard TPM protection: 03 20 01 00
TPM with PIN protection: 03 20 11 00 or 03 20 05 00
Recovery password protection: 03 20 08 00
Mitigations
Microsoft has released KB5025885 as the primary mitigation for bitpixie and related boot manager vulnerabilities.
This update replaces the vulnerable Microsoft Windows Production PCA 2011 certificate with the new Windows UEFI CA 2023 certificate, preventing downgrade attacks to vulnerable boot managers.
The patch adds new certificate authorities to the UEFI Secure Boot database and revokes the 2011 certificate by adding it to the Database of eXcluded signatures (DBX).
Organizations should implement comprehensive defense strategies, including mandatory BitLocker PBA with strong PINs, updated PCR validation configurations, and network segmentation to prevent PXE boot attacks.
The Microsoft certificate update becomes mandatory in 2026 when the current certificates expire, making early deployment critical for identifying compatibility issues before the forced transition.
Security teams should monitor for unauthorized PXE boot attempts, implement physical security controls for workstations, and ensure BitLocker recovery keys are securely managed through enterprise key management systems.
The vulnerability demonstrates the importance of hardware-based security controls and the ongoing evolution of boot-level attack techniques targeting modern encryption implementations.
Free live webinar on new malware tactics from our analysts! Learn advanced detection techniques -> Register for Free
The U.S. Department of Justice (DoJ) on Tuesday resentenced the former administrator of BreachForums to three years in prison in connection with his role in running the cybercrime forum and possessing child sexual abuse material (CSAM).
Conor Brian Fitzpatrick (aka Pompompurin), 22, of Peekskill, New York, pleaded guilty to one count of access device conspiracy, one count of access device
A sophisticated new campaign that represents the first documented real-world deployment of FileFix attacks beyond proof-of-concept demonstrations. This campaign marks a significant evolution in social engineering tactics, combining advanced steganographic techniques with multilayered obfuscation to deliver the StealC information stealer through an innovative attack vector that builds upon the notorious ClickFix methodology. Researchers from Acronis’ […]
A major supply chain attack dubbed “Shai-Halud” has impacted the JavaScript ecosystem by targeting over 477 NPM packages, raising serious concerns among developers and organizations relying on software from the Node Package Manager (NPM) registry. This incident reveals both the scale and sophistication of modern threats to open-source software and highlights the urgent need for […]
The cybersecurity landscape has witnessed a dramatic escalation in API-targeted attacks during the first half of 2025, with security researchers documenting over 40,000 API incidents across more than 4,000 monitored environments. This surge represents a fundamental shift in how cybercriminals approach digital infrastructure, with APIs becoming the primary gateway for sophisticated attack campaigns designed to inject malicious […]
