标签：#hr

STAC4749: Chaos Ransomware in Under 17 Hours via Teams IT Support Scam 1. Basic Information Article Name : Chaos in Teams vishing Publisher : Sophos Publication Date : 2026-07-28 (Detailed report by target site BleepingComputer on 2026-07-30) Original Source : https://www.sophos.com/en-us/blog/chaos-in-teams-vishing Related Source : https://www.bleepingcomputer.com/news/security/microsoft-teams-vishing-attacks-lead-to-chaos-ransomware-attacks/ Related Entities : STAC4749, Chaos ransomware, Quick Assist, RemSupp, DWAgent, AnyDesk, PyInstaller backdoor, reverse SOCKS proxy Severity : High 2. Executive Summary An attacker uses an external Teams account to pose as IT support and tricks the user into allowing remote control. The attacker then deploys PowerShell, a custom loader, multiple RMM tools, and a SOCKS tunnel. This leads from lateral movement to simultaneous encryption in less than 17 hours at the shortest. 3. Attack Flow An external Teams account with an IT-like .top domain starts a chat and a call. The attacker poses as IT support and establishes a remote session using Quick Assist or RemSupp. The attacker runs PowerShell to download a loader from an external server and executes it in AppData\Roaming or similar folders. The loader collects device information, sets persistence via Run keys, and connects to the C2 server. A PyArmor-obfuscated PyInstaller backdoor runs shell commands, loads extra Python modules, and stages collected data. The attacker installs DWAgent and AnyDesk as backup access, enables RDP, and tries to move laterally. The sc5.exe reverse SOCKS proxy relays internal network traffic. The attacker steals data in at least one case, and then encrypts multiple devices with Chaos almost at the same time. 4. Attacker Locations and Execution Sites Initial contact occurs via an external Microsoft 365 tenant. Operations run through legitimate remote support tools on the victim device. Subsequent activities happen on Windows devices and the internal netwo

GTIG: 2026 OSS Supply Chain Compromise, Credential Theft, and Self-Propagation 1. Basic Information Article Title : Batten Down Your Packages: Mitigation Guidance for Supply Chain Compromise Publisher : Google Threat Intelligence Group / Mandiant Publication Date : 2026-07-30 Original URL : https://cloud.google.com/blog/topics/threat-intelligence/mitigation-guidance-for-supply-chain-compromise/ Related Sources : TeamPCP, axios, and WAVESHAPER.V2 investigations within the article Related Entities : UNC6780/TeamPCP, SANDCLOCK, MIDNIGHT NEPTUNE/UNC1069, WAVESHAPER.V2, npm, PyPI, Docker Hub, GitHub Actions, axios Severity : High 2. Executive Summary Attackers are stealing credentials from developers, maintainers, and CI/CD pipelines to tamper with legitimate packages. This attack model is growing on a large scale: it steals cloud secrets from user environments, self-propagates to other packages, and leads to ransomware or extortion. 3. Attack Flow UNC6780 / TeamPCP Attackers gain write permissions by abusing GitHub Actions pull_request_target , compromising maintainer accounts, or publishing malicious packages. They inject malicious code into legitimate and spoofed packages on PyPI, npm, and Docker Hub. Users execute the code during installation on their development devices or in CI/CD pipelines. Tools like SANDCLOCK steal credentials for the cloud, CI/CD, and package registries. Attackers tamper with other packages owned by the victim to spread like a worm. They pivot from AI software into wider enterprise networks. They monetize the stolen credentials by selling them or partnering with ransomware and data extortion groups. axios / MIDNIGHT NEPTUNE Attackers compromise maintainer accounts using social engineering. They add malicious dependencies to the legitimate axios package and publish a new version. Dependency resolution spreads the package to many users and downstream packages. A dropper deploys the WAVESHAPER.V2 backdoor. 4. Attacker Position and Execution Locati

TA488 OWAReaper: A "Half-Click" Attack that Adds Persistence Inside OWA Just by Opening an Email 1. Basic Information Article Name : Cleaning Out Inboxes: TA488 Comes for Outlook with Another Half-Click Exploit Publisher : Proofpoint Threat Insight Publication Date : 2026-07-29 Original Source : https://www.proofpoint.com/us/blog/threat-insight/cleaning-out-inboxes-ta488-comes-outlook-another-half-click-exploit Related Source : https://www.bleepingcomputer.com/news/security/russian-hackers-exploit-exchange-owa-zero-day-for-long-term-mailbox-access/ Related Entities : TA488, Void Blizzard, Laundry Bear, OWAReaper, ZimReaper, CVE-2026-42897, Microsoft Exchange Outlook Web Access Severity : Emergency Target Period : 2026-07-30T08:10:34+09:00 to 2026-07-31T08:06:06+09:00 2. One-Line Summary This is an attack where viewing a crafted email in OWA runs JavaScript, leaves no file on the device, achieves persistence in both the browser and Exchange, and steals saved credentials, OAuth tokens, and mailbox permissions. 3. Attack Flow A compromised account sends a normal informational email with no URLs or attachments. The victim opens the email in the OWA reading pane. CVE-2026-42897 triggers an onload event, and reconstructs Base64 JavaScript from image fragments in the email body. OWAReaper runs in the OWA browser context and deletes the malicious parts from the original email. It collects browser autofill IDs and passwords using an invisible DOM input field. It hides its encrypted self inside OWA settings to run again when OWA syncs and restores. It steals OAuth tokens via a privileged Outlook add-in. It gives Owner permissions to the Default principal on all mail folders, allowing continuous access from another authenticated account in the same organization. It embeds an iframe into the IndexedDB offline mail cache to reinfect it. It receives commands from GitHub commit messages or attacker emails, and sends data through multiple paths. 4. Attacker Position and Execution L

KindaRails2Shell (CVE-2026-66066): Arbitrary File Read and RCE via Active Storage Uploads 1. Basic Information Article Title : Alert on Vulnerability in Ruby on Rails Active Storage Leading to Remote Code Execution Publisher : JPCERT/CC Publication & Update Date : 2026-07-30 Original Article : https://www.jpcert.or.jp/at/2026/at260021.html Related Sources : https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm Related Entities : CVE-2026-66066, KindaRails2Shell, Ruby on Rails, Active Storage, libvips, ruby-vips Severity : Critical 2. One-Sentence Summary This is a vulnerability that combines Active Storage direct uploads and variant processing by libvips, allowing attackers to upload a crafted file without authentication, read files and credentials on the server, and potentially execute code under the Rails process permissions depending on the conditions. 3. Attack Flow The attacker discovers or guesses that the target Rails app uses Active Storage. The attacker registers a crafted file to the unauthenticated direct upload feature. The attacker triggers variant processing, which is handled by the vulnerable Active Storage and default builds of libvips. The attacker reads arbitrary files on the server. The attacker retrieves Rails secrets, cloud credentials, database credentials, and other sensitive data. The attacker may achieve remote code execution by using the retrieved secrets or the processing chain. The attacker may move laterally to databases, storage, cloud environments, or CI/CD pipelines as a next step (Inference). 4. Attacker Position and Execution Location The attacker uploads files from the external network via HTTP. The processing happens on the Rails application server and the libvips process. Remote code execution runs with the OS permissions of the Rails or variant processing service. 5. What Victims and Administrators See Even without a user-facing upload screen, apps can be vulnerable if Active Storage is enabled. Administrators m

In a review triggered by OpenAI’s Hugging Face incident, Anthropic discovered three of its AI models had breached real organizations during third-party evaluations.

After OpenAI's models broke into Hugging Face, Anthropic checked its own history and found three similar incidents

The former OpenAI researcher’s fund was forced to unwind public equities after leveraged public bets plummeted. But he still has cards to play.

A federal judge said the Trump administration has not presented enough evidence to justify labeling Anthropic a supply-chain risk, casting doubt on the government's ban on its AI technology.

The last two versions of Chrome have included more patches than the previous 23 combined.

As experts have warned for the last two years, some companies — like Microsoft and now Google — are finding and patching an exponential number of bugs in their products, thanks to the use of LLMs and AI tools.

The two Chrome updates in June patched more bugs than the 23 updates before them. Now, Google is ramping up its patching schedule thanks to AI-assisted vulnerability discovery.

Google is working on a way to apply Chrome updates without requiring you to restart your browser. In a post on Thursday, Google outlines its approach to bug fixes in the age of AI, while noting that it's trying to make updates less disruptive by "investing in 'dynamic patching' that will eliminate the need for […]

Plus, a new deprecation policy ensures features aren't removed suddenly.

When Microsoft reported killer fourth-quarter earnings for its fiscal 2026 year (which ended June 30), it tucked in an interesting little tidbit about how its investments in the two biggest, and competing, AI labs are doing.

Microsoft is on a mad dash behind the scenes to patch exploits before hackers find them.

When The Atlantic published a searchable dataset of works used to train AI, Kirk Wallace Johnson, like a lot of artists, looked for his name out of curiosity. And, like a lot of artists, he found it. Essentially, his books, like The Feather Thief and The Fishermen and the Dragon - nonfiction tomes that he […]

Cisco Talos IR Q2 2026: Observed Attack Chains of M365 Token Compromise and RMM-Disguised Ransomware 1. Basic Information Article Title : IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains Publisher : Cisco Talos Blog Publication Date : July 28, 2026 Original Article : https://blog.talosintelligence.com/ir-trends-q2-2026/ Related Sources : ARToken technical analysis and Talos IR observations within the article Related Entities : UAT-11764, ARToken, EvilTokens, Sinobi, Warlock/Storm-2603, MeshAgent/MeshCentral, Zoho Assist, Microsoft 365, SharePoint, OneDrive, RDP, WinRM, rclone Severity : High 2. Executive Summary Talos IR identified real-world attack chains from recent incidents. The first chain steals M365 tokens using QR code PDFs and OAuth device-code phishing, then self-propagates through inbox rules, SharePoint, and mass internal emails. The second chain uses modified and abused legitimate RMM tools to achieve SYSTEM persistence, lateral movement, and domain-wide ransomware deployment via GPO. 3. Attack Flows Chain A: UAT-11764 QR Phishing The attacker sends targeted PDFs from a compromised M365 account. The victim scans the PDF's QR code using a mobile device. Credentials are stolen on a fake M365 login page. The attacker signs in to the Microsoft account. Inbox rules are created to hide warnings and replies. Malicious documents are placed in SharePoint. The attacker uses contacts to resend phishing emails internally and externally. Chain B: M365 Token Compromise via ARToken Lures pretending to be trusted vendors are presented. The user is redirected to the Microsoft OAuth device authorization flow. The user approves the attacker's device code on a legitimate Microsoft screen. Access tokens are obtained without stealing passwords, bypassing MFA. ARToken manages tokens using over 80 APIs. Persistence is achieved via PRT, followed by email/BEC, inbox rule manipulation, and OneDrive/SharePoint management and exfiltration. Toke

Fastjson 1.x CVE-2026-16723: Unauthenticated RCE Targeting Default Spring Boot Fat-Jars 1. Basic Information Article Title : Unpatched Fastjson Vulnerability Exploited in Attacks Publisher : SecurityWeek Publication Date : July 28, 2026 Original Source : https://www.securityweek.com/unpatched-fastjson-vulnerability-exploited-in-attacks/ Related Sources : Alibaba Security Advisory: https://github.com/alibaba/fastjson2/wiki/Security-Advisory:-Remote-Code-Execution-in-fastjson-1.2.68%E2%80%931.2.83 Imperva: https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-16723-critical-fastjson-1-x-zero-day-rce/ FearsOff Technical Analysis: https://fearsoff.org/research/fastjson-1-2-83-rce Related Entities : CVE-2026-16723, Fastjson 1.2.68 to 1.2.83, Spring Boot executable fat-jar, Alibaba, Imperva, ThreatBook Severity : Critical 2. Summary This is an actively exploited vulnerability in end-of-life Fastjson 1.x used within Spring Boot fat-jars. If an attacker sends a crafted JSON request without authentication, it can reach remote code execution (RCE) with Java process permissions via external resource lookups, even when AutoType is not explicitly enabled. 3. Attack Flow The attacker scans for publicly exposed JSON-receiving endpoints. The attacker sends a crafted JSON payload containing @type . Fastjson 1.x type resolution logic treats the @JSONType annotation as a trust signal. The application bypasses AutoType restrictions and triggers a lookup to an attacker-controlled resource. Vulnerable Spring Boot fat-jar configurations reach the code execution path without external gadgets. Arbitrary code runs with the execution permissions of the Java application user. Inference : The attack may proceed to drop webshells, search for credentials, access cloud metadata, and deploy lateral movement tools. 4. Attacker Position and Execution Location The attacker sends HTTP(S) requests from the internet or an accessible internal network. The vulnerability is processed by

ELECOM Wireless LAN Devices JVN#56870912: OS Command Injection in Management Screen and Configuration Restoration 1. Basic Information Article Title : Multiple Vulnerabilities in ELECOM Wireless LAN Routers and Access Points (July 2026) Source : JVN Publication Date : July 28, 2026 Original URL : https://jvn.jp/jp/JVN56870912/index.html Related Source : ELECOM Notice (Linked from JVN) Related Entities : CVE-2026-44387 (Reflected XSS) CVE-2026-59764 (Management Screen OS Command Injection) CVE-2026-61376 (Configuration Restoration OS Command Injection) WAB-M1775-PS, WAB-S1775, WAB-M2133, WAB-I1750-PS, WAB-S1167-PS, WRC-X3000GS3-B, WRC-X3000GS3A-B Severity : Medium 2. Executive Summary An attacker with administrator privileges can pass crafted inputs to the management screen or configuration restoration function of ELECOM wireless routers and access points, leading to arbitrary OS command execution on the device. A separate XSS vulnerability can serve as a stepping stone to target management sessions via users on an adjacent network. 3. Attack Flow Chain A: Attacker Already Has Administrator Credentials The attacker reaches the management screen. The attacker logs in as an administrator. The attacker sends vulnerable configuration input for CVE-2026-59764 or crafted configuration restoration data for CVE-2026-61376. Arbitrary commands execute on the device OS. Inference : Modify DNS, forwarding, administrator settings, and firmware-related settings to use the device for traffic monitoring or as a foothold for internal intrusion. Chain B: Reflected XSS An attacker on the same or an adjacent network prepares a crafted URL. The attacker tricks a user who can access the management screen into opening the URL. A script executes in the management screen origin via CVE-2026-44387. Inference : If a management session exists, it may chain into unintended management actions. 4. Attacker Position and Execution Location XSS requires adjacent network reachability and user interact

vBulletin CVE-2026-61511: Unauthenticated RCE via Public AJAX Template to eval() 1. Basic Information Article Title : vBulletin fixes critical pre-auth RCE flaw with public exploit Publisher : BleepingComputer Publication Date : July 28, 2026 Original URL : https://www.bleepingcomputer.com/news/security/vbulletin-fixes-critical-pre-auth-rce-flaw-with-public-exploit/ Related Sources : NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-61511 Researcher Technical Analysis: https://karmainsecurity.com/ SSD Secure Disclosure: https://ssd-disclosure.com/ Related Entities : CVE-2026-61511, vBulletin 5.x/6.x, vB5_Template_Runtime::runMaths() , ajax/render/pagenav , phpfuck Severity : High 2. Executive Summary Sending a crafted pagenav[pagenumber] to vBulletin's public AJAX template rendering bypasses the weak validation of the math function runMaths() using phpfuck. It reaches PHP's eval() without authentication to execute arbitrary code. A public PoC with a known fix exists, and scanning activity is expected to increase. 3. Attack Flow The attacker searches for public sites running vBulletin 5.x/6.x. They send a request to a public template rendering endpoint like ajax/render/pagenav . They insert a PHP expression into pagenav[pagenumber] to bypass math validation. Template execution reaches vB5_Template_Runtime::runMaths() . The input goes to PHP eval() , executing arbitrary PHP code. OS commands start under the PHP/web server user permissions. Inference : Leads to web shell installation, database credential theft, forum database exfiltration, defacement, and persistence. 4. Attacker Position and Execution Location The attacker sends HTTP(S) requests from the internet without authentication. The vulnerable processing happens inside the vBulletin template runtime. PHP code runs with Web/PHP-FPM/Apache user permissions. 5. Visibility for Victims and Administrators No user action or login is needed. Web access logs may show ajax/render/pagenav and an unusual pagenumber parameter