Cyber Threat Intelligence Digest: Week 36

Executive Summary -
Highlights of Cyber Threat Intelligence Digest

Vulnerabilities

Cisco Patches CVE-2025-20127 Affecting Secure Firewall ASA and FTD Software - On September 3, 2025, Cisco released security patches addressing CVE-2025-20127, a high-severity vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software, particularly for Firepower 3100 and 4200 Series devices. This issue originates from the improper handling of the TLS_CHACHA20_POLY1305_SHA256 cipher during Transport Layer Security (TLS) 1.3 operations. If left unpatched, the flaw could be exploited by attackers to exhaust system resources, which would prevent the firewall from accepting new SSL/TLS or VPN connections. Such an attack could cause serious disruptions, essentially creating a denial-of-service condition for organizations relying on these devices for secure connectivity.

Cisco has addressed the vulnerability by issuing fixes in updated software releases, ensuring that affected products can now handle the cipher correctly. The company emphasized that administrators should promptly apply the patches to maintain security and stability in their environments. While the vulnerability poses a significant risk if exploited, Cisco has confirmed that there are currently no reports of active exploitation in the wild. This suggests that organizations still have a window of opportunity to remediate before potential attackers attempt to take advantage of the weakness.

CVE-2025-9519 allows Remote Code Execution in the Easy Timer WordPress plugin - A high-severity security vulnerability has been designated as CVE-2025-9519 in the Easy Timer plugin for WordPress, impacting all releases up to and including version 4.2.1. The issue stems from inadequate restrictions on shortcode attributes, which creates an opportunity for authenticated attackers with Editor-level privileges or higher to exploit the weakness. By submitting specially crafted shortcodes, an attacker could execute arbitrary code directly on the server, potentially leading to full site compromise, data manipulation, or further malicious activity within the affected environment.

The vendor has issued a fix to address this flaw, and users are strongly encouraged to update without delay. Upgrading to version 4.2.2 or any newer patched release ensures that the plugin enforces proper restrictions and closes off the identified attack vector. At the time of this publication, the patch is available, and no additional complications have been reported, making prompt remediation a straightforward and effective step for administrators who rely on the plugin for WordPress functionality.

Adobe Patches Improper Input Validation Vulnerability, CVE-2025-54236, Affecting Its Commerce and Magento Open Source Platforms - On September 9, 2025, Adobe released security patches for CVE-2025-54236, a critical-severity improper input validation vulnerability impacting its Commerce, Commerce B2B, and Magento Open Source platforms. This flaw resides in the Commerce REST API and, if successfully exploited, could allow attackers to bypass built-in security mechanisms. Such an attack would give malicious actors the ability to compromise customer accounts, potentially leading to unauthorized access, data theft, or further manipulation of sensitive e-commerce environments. While the vulnerability is rated as critical due to the potential impact on online merchants, Adobe has stated that there are currently no known reports of active exploitation in the wild.

To mitigate the risk, Adobe has released hotfixes for a range of affected versions, including Commerce versions 2.4.4-p15, 2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2 and earlier; Commerce B2B versions 1.3.3-p15, 1.3.4-p14, 1.4.2-p7, 1.5.2-p2, 1.5.3-alpha2 and earlier; and Magento Open Source versions 2.4.5-p14, 2.4.6-p12, 2.4.7-p7, 2.4.8-p2, 2.4.9-alpha2 and earlier. Organizations are strongly urged to apply the patches as soon as possible to ensure protection against potential exploitation attempts. Timely deployment of these updates is essential for maintaining secure online operations and safeguarding both merchants and customers from the risks posed by this vulnerability.

Potential Threats

New China-Aligned Threat Actor GhostRedirector Targets Global Windows Servers for SEO Manipulation - On September 4, 2025, ESET reported a new China-aligned threat actor called GhostRedirector, which compromised about 65 Windows servers across South America and Asia. Active since at least August 2024, the group targeted healthcare, insurance, education, retail, transportation, and technology sectors. GhostRedirector uses a mix of custom malware and public exploits, including the Rungan C++ backdoor, the Gamshen IIS trojan, and privilege escalation tools based on EfsPotato and BadPotato, to conduct large-scale search engine optimization (SEO) fraud. Attribution to China is based on linguistic markers in tooling and a digital certificate tied to a Chinese company.

The attackers gain initial access through SQL injection, executing PowerShell commands to download payloads from staging servers. They use GoToHTTP for remote access, EfsPotato and BadPotato for privilege escalation, and webshells for persistence. Final payloads Rungan and Gamshen enable command execution and manipulate search engine results by injecting backlinks into Googlebot responses, promoting gambling sites without disrupting normal traffic. While GhostRedirector’s activity overlaps with targeting seen in the DragonRank campaign, ESET found no direct technical links between the two threat groups.

APT28 Executes NotDoor Campaign Using Outlook Macros and DLL Sideloading to Target NATO Entities - On September 3, 2025, LAB52 researchers reported that APT28, overlapping with activity tracked as BlueDelta, had deployed a previously unobserved Visual Basic for Applications (VBA) backdoor dubbed “NotDoor” in a campaign targeting organisations in NATO countries via Microsoft Outlook. The report assessed with moderate confidence that the threat actor demonstrated an evolution in tradecraft, leveraging signed binaries, macro-enabled implants, and covert email-based exfiltration to support espionage objectives. This campaign highlights the continued sophistication of APT28’s operations and its focus on compromising trusted software to maintain stealth.

The malware persists by installing itself within Outlook and modifying configuration settings to ensure execution whenever the application starts or receives new messages. It monitors incoming communications for specific triggers to carry out its tasks, which include exfiltrating data and responding to commands. All communications and data transfers are encrypted, and additional obfuscation techniques are employed to hinder detection and analysis. While the backdoor supports multiple functions for command execution and file transfers, its design reflects a clear intent to operate covertly within targeted environments, maintaining both persistence and stealth over extended periods.

Security Researcher Discloses Zero-Day RCE Vulnerability in TP-Link Routers - On September 2, 2025, researcher Mehrun (ByteRay) disclosed an unpatched zero-day in TP-Link Archer AX10 and AX1500 routers, with EX141, Archer VR400, and TD-W9970 models also potentially affected. The flaw lies in TP-Link’s CWMP/TR-069 implementation and can allow remote code execution. Internet scans revealed over 4,200 exposed devices, but at the time of disclosure, the issue had no CVE identifier and no evidence of active exploitation.

The bug occurs in the CWMP routine handling SOAP SetParameterValues messages, where unchecked input overflows a 3,072-byte stack buffer. Mehrun demonstrated exploitation by redirecting devices to a rogue CWMP server and delivering a malicious SOAP message, achieving full remote control. While TP-Link has released a patch for European firmware, updates for US and global versions remain pending, leaving many devices at risk until fixes are issued.

General News

Cyberattack on Jaguar Land Rover threatens to hit British economic growth - A cyberattack on Jaguar Land Rover (JLR) has severely disrupted production and forced thousands of employees and supply-chain workers to stay home, raising alarms about the wider economic impact. JLR is responsible for around 4% of UK goods exports, and experts warn that prolonged disruption could undermine Britain’s growth targets. Analysts argue the incident highlights the risks of the government’s light-touch approach to cybersecurity regulation, which has delayed the long-promised Cyber Security and Resilience Bill despite repeated intelligence warnings. Insiders say last year’s technology secretary was briefed in a classified session about Chinese activity targeting British infrastructure, but legislative progress has stalled as ministers cite fears of over-regulation.

Cyber experts and think-tank researchers are calling for stronger supply chain controls, a clear cyber policy agenda, and faster adoption of secure-by-design principles to close systemic gaps. While the government has issued voluntary codes of practice, the lack of binding rules is fueling frustration within the UK’s cybersecurity agency. Critics argue that policymakers prioritize only catastrophic threats, leaving below-threshold attacks like the JLR breach to inflict major economic harm with little intervention. As one expert put it, “a country that can’t keep its factories running can’t keep its growth pledge,” warning that crises like this must finally push Parliament into action.

Qualys Confirms Limited Salesforce Data Exposure From Salesloft Drift Supply Chain Incident - On September 6, 2025, US cybersecurity firm Qualys reported being affected by the Salesloft Drift (SalesDrift) supply chain incident, which exposed OAuth tokens linking Drift to Salesforce. This allowed unauthorized access to certain Salesforce data, including lead and contact records. Qualys quickly disabled all Drift–Salesforce integrations and contained the incident. No customer data from Qualys Cloud Platform, Cloud Agent, or Vulnerability Scanner was impacted.

All production systems remained fully operational, and neither the codebase nor infrastructure was affected. Qualys engaged Mandiant for forensic analysis and continues monitoring for further activity. The compromise of the SalesDrift platform increases the risk of phishing, business email compromise, and pretexting attacks targeting affected employees and customers.

Hackers hijack npm packages with 2 billion weekly downloads in supply chain attack - On September 8, 2025, a significant supply chain attack compromised npm packages with over 2.6 billion weekly downloads. The threat actor gained control of developer Josh Junon's npm account through a phishing campaign using a fake npmjs.help domain. Malicious versions of popular packages, including debug and chalk, were published, containing malware designed to steal cryptocurrency wallet credentials. The malicious code was active for approximately two hours before being removed.

The attack's rapid spread was facilitated by the widespread use of the compromised packages in cloud-based environments. Researchers observed that during the brief exposure window, the malicious code reached 1 in 10 cloud environments. This incident underscores the vulnerability of the open-source ecosystem to targeted supply chain attacks and highlights the need for enhanced security measures to protect developers and users from such threats.

Threat Actor Weekly Graph

Over the past 7 days, we have been tracking the following intent and opportunity changes within our Threat Actor Landscape.

Intent represents the potential targets of a group. When a group is observed attacking a different organisation or entity, their intent will increase.

Opportunity represents the various methods and technologies these groups may use. For example, if a group started using a new attack vector, such as a new kind of ransomware, their opportunity would increase.

Both intent and opportunity are scored out of 100 and are responsible for scoring the group's severity. These updates can be seen below.