--- licence_title: Creative Commons Attribution 4.0 International (CC-BY 4.0) licence_link: https://creativecommons.org/licenses/by/4.0/ licence_restrictions: https://cert.europa.eu/legal-notice licence_author: The Cybersecurity Service for the Union institutions, bodies, offices and agencies --- # Cyber Brief (July 2025) August 4, 2025 - Version: 1

TLP:CLEAR

# Executive summary - We analysed 287 open source reports for this Cyber Brief[^1]. - Relating to **cyber policy and law enforcement**, the EU, UK, and US have imposed sanctions on Russian entities due to their involvement in cyberattacks and disinformation campaigns. Additionally, two more EU countries have banned DeepSeek AI citing security concerns. - On the **cyberespionage** front, China-linked threat actors have been identified as being behind the ToolShell campaign, which exploits vulnerabilities in SharePoint. Meanwhile, the Russia-linked Turla threat actor has targeted diplomats in Moscow. - Relating to **cybercrime**, researchers have discovered malware in trusted Chrome and Edge extensions that have been installed by approximately 2.3 million users while researchers identified a surge in Akira ransomware attacks exploiting SonicWall SSL VPN. - There were **disruptive** incidents causing operational disruptions at two EU-based telecommunications companies. Furthermore, Russia's Aeroflot canceled flights after pro-Ukrainian hackers claimed responsibility for a cyberattack. - As regards **data exposure and leaks** incidents, in Europe, an unsecured server exposed years' worth of data belonging to Swedish citizens. The Swiss healthcare giant AMEOS reported a data breach affecting patients, staff, and partners. Globally, Dell confirmed a breach by an extortion group, and leaked datasets revealed ties between Chinese cyber contractors and the government. - Relating to **information operations**, at least four Russian operations targeting European countries have been identified, highlighting ongoing efforts in information manipulation and disinformation. # Europe ## Cyber policy and law enforcement **EU targets Russian disinformation networks and electronic warfare operations in new sanctions**
On July 15, the EU Council sanctioned nine individuals and six entities, including media groups, think tanks, and a GRU officer linked to Unit 74455, for spreading pro-Russia disinformation and conducting electronic warfare that disrupted civilian aviation. These sanctions reinforce the EU’s commitment to counter Russian hybrid threats amid the ongoing Russia-Ukraine war. `russia` `sanctions` [link](https://www.consilium.europa.eu/en/press/press-releases/2025/07/15/russian-hybrid-threats-eu-lists-nine-individuals-and-six-entities-responsible-for-destabilising-actions-in-the-eu-and-ukraine/) **UK sanctions Russian GRU units and operatives for cyberattacks and disinformation**
On July 18, the UK sanctioned three Russian GRU military units, 18 individuals, and a disinformation outlet for cyberespionage, information operations, and support for Russia’s war in Ukraine, including targeting Yulia Skripal in 2013 and aiding strikes on Ukrainian civilians. `russia` `sanctions` [link](https://www.gov.uk/government/news/uk-sanctions-russian-spies-at-the-heart-of-putins-malicious-regime) **Germany requests removal of DeepSeek AI from app stores**
On June 27, Germany’s data protection commissioner asked Apple and Google to remove DeepSeek AI from German app stores, citing unauthorised transfer of personal data to China without EU-standard safeguards. The move follows similar actions by Italy and the Netherlands. DeepSeek has not demonstrated compliance with GDPR or the Digital Services Act. Apple and Google are currently reviewing the request. `ban` `artificial intelligence` `china` [link](https://www.datenschutz-berlin.de/pressemitteilung/berliner-datenschutzbeauftragte-meldet-ki-app-deepseek-in-deutschland-bei-apple-und-google-als-rechtswidrigen-inhalt/) **Czech Republic bans DeepSeek AI over data security concerns**
On July 9, the Czech government prohibited the use of Chinese AI startup DeepSeek in public administration, citing data security risks and concerns over Chinese government access to stored information. The move follows similar restrictions in Germany, Italy, and the Netherlands. `ban` `artificial intelligence` `china` [link](https://www.reuters.com/world/china/czech-government-bans-deepseek-usage-public-administration-2025-07-09/) **Denmark introduces copyright law to combat Deepfake misuse**
On June 26, the Danish government announced new copyright legislation to protect citizens from AI-generated deepfakes, allowing individuals to object to the unauthorised use of their bodies, faces, or voices and demand content removal from online platforms. This pioneering law in Europe comes amid a sharp rise in deepfake fraud, which increased by over 1.300% in 2024 and now drives nearly half of global fraud attempts. `regulation` `artificial intelligence` [link](https://www.theguardian.com/technology/2025/jun/27/deepfakes-denmark-copyright-law-artificial-intelligence) **Chinese hacker tied to Silk Typhoon group arrested in Italy**
On July 3, a Chinese national, Xu Zewei, was arrested in Milan on a US warrant for alleged ties to the state-backed Silk Typhoon group. He is accused of cyberattacks targeting US organisations, including 2020 campaigns aimed at stealing COVID-19 vaccine research and public health data. `china` `arrest` [link](https://www.ansa.it/english/newswire/english_service/2025/07/07/ansachinese-spy-arrested-in-italy-on-us-warrant_9f5bbfe6-74ef-4f78-bb1e-fcf01f755652.html) **Europol and Eurojust coordinate takedown of NoName057(16) hacktivist group**
On July 15, Europol and Eurojust coordinated a multinational operation that dismantled the pro-Russia hacktivist group NoName057(16), which conducted DDoS attacks against European infrastructure. Over 100 servers were seized, seven arrest warrants issued, and 4.000 supporters identified. The group’s leaders are believed to reside in the Russian Federation. `russia` `takedown` [link](https://www.eurojust.europa.eu/news/hacktivist-group-responsible-cyberattacks-critical-infrastructure-europe-taken-down) ## Cyberespionage & prepositioning **In September 2024 Houken exploited three Ivanti zero-days to intrude French governmental and telecommunications entities**
On July 1, ANSSI, the French National Cybersecurity Agency, publicly reported that in September 2024, a threat actor dubbed Houken sought to gain initial access through exploitation of zero-days on French entities. Houken specifically exploited three zero-day vulnerabilities on the Ivanti Cloud Service Appliance (CSA) devices of French entities in the governmental, telecommunications, media, finance, and transport sectors. `china` [link](https://www.cert.ssi.gouv.fr/uploads/CERTFR-2025-CTI-009.pdf) **India-linked Patchwork uses Google Drive to target European foreign affairs ministry with spearphishing**
On July 8, Trellix reported that India-linked Patchwork sent spearphishing e-mails impersonating defence officials to a southern European foreign affairs ministry. Victims clicked a Google Drive link delivering a malicious RAR archive that installed the “LoptikMod” backdoor via scheduled tasks, ensuring persistent access. While Patchwork typically targets government and defense entities in South Asia, this operation likely signals an expansion of interest toward European diplomatic entities. `diplomacy` `india` [link](https://www.trellix.com/blogs/research/from-click-to-compromise-unveiling-the-sophisticated-attack-of-donot-apt-group-on-southern-european-government-entities/) ## Cybercrime **North Korean IT experts infiltrate European tech firms under false identities**
On July 10, Le Monde reported on North Korean IT experts, using fake identities and nationalities, are infiltrating Western companies — initially in the US, now in France — to earn salaries that are funnelled back to the regime or used for extortion. One example is US crypto firm Iqlusion, which unknowingly hired such developers, later alerted by the FBI to their ties to North Korea. `north korea` [link](https://www.lemonde.fr/pixels/article/2025/07/10/comment-la-coree-du-nord-infiltre-ses-experts-informatiques-au-c-ur-des-entreprises-occidentales_6620374_4408996.html) ## Disruption & destruction **Dutch Prosecution service disconnected after Citrix breach, operations severely disrupted**
On July 18, the Dutch Public Prosecution Service (Openbaar Ministerie, OM) shut down all internet access after discovering that hackers likely exploited the Citrix Bleed 2 vulnerability, prompting a major operational disruption. The outage may last weeks, severely restricting remote access, e-mail, and digital file editing, raising concerns about the potential impact on ongoing legal proceedings and signalling a serious cybersecurity breach within a critical government institution. `justice` [link](https://www.om.nl/actueel/nieuws/2025/07/21/werk-om-mogelijk-komende-weken-nog-verstoord) **Orange Group suffered a cyberattack impacting some services at France-based enterprises**
On July 25, Orange Group suffered a cyberattack causing service disruptions for some business and consumer clients, mainly located in France. No data breaches have been identified. Services are being progressively restored under enhanced monitoring. A formal complaint has been filed, and authorities are involved. `telecommunications` [link](https://newsroom.orange.com/le-groupe-orange-annonce-avoir-depose-plainte-lundi-28-juillet-pour-atteinte-a-un-de-ses-systemes-dinformation/?lang=fra) **POST Luxembourg outage on July 23 traced to sophisticated cyberattack**
On July 23, Luxembourg’s POST suffered a nationwide four hour outage affecting mobile, fixed line and internet services—including emergency numbers—due to a targeted, exceptionally advanced and sophisticated cyberattack ground. According to POST and the government crisis unit, malicious actors exploited a software vulnerability to disrupt services. Internal systems weren’t breached, no customer data was compromised, and services were restored by the evening—with investigations ongoing. `telecommunications` [link](https://www.luxtimes.lu/luxembourg/post-luxembourg-outage-caused-by-a-targeted-cyberattack-firm-confirms/80019668.html) ## Information operations **Russia exploited no-confidence vote to undermine EU unity**
On July 22, El País reported that Russia exploited the recent no-confidence vote against European Commission President Ursula von der Leyen to polarise the EU, using pro-Kremlin disinformation networks to frame the motion as a rebellion against corruption. Analysts identified over 20.000 coordinated posts across platforms, revealing a broader effort by Russian-linked actors to distort European democratic processes and amplify anti-EU narratives during politically sensitive moments. `russia` [link](https://english.elpais.com/international/2025-07-22/russia-used-the-vote-of-no-confidence-against-von-der-leyen-to-stir-up-polarization-in-the-eu.html) **Russia-linked Storm-1516 impersonates journalists to spread disinformation across Europe**
On July 7, the Gnida Project reported that Russia-linked network Storm-1516 has impersonated journalists since May to spread disinformation in Moldova, Armenia, France, and Germany. By hijacking real reporters’ identities, the group seeks to boost the credibility of false narratives aligned with Russian interests—such as undermining Western alliances and discrediting leaders—while using fake media sites to amplify these messages. The Gnida Project tracks and analyses disinformation operations. `russia` [link](https://gnidaproject.substack.com/p/disinformation-update-stolen-identities) **Russia-linked "Matryoshka" disinformation campaign intensifies focus on Moldova with evolving tactics**
On July 17, the Institute for Strategic Dialogue (ISD Global), a London-based non-profit countering disinformation, reported that Russia-linked operation "Matryoshka" intensified its focus on Moldova in Q2 2025. It impersonated media outlets and used AI personas to spread English content on TikTok and X. Despite evolving tactics and smear campaigns, the operation saw limited real engagement, as most content was removed by major platforms. `moldova` `russia` [link](https://www.isdglobal.org/digital_dispatches/operation-overloads-underwhelming-influence-and-evolving-tactics/) **Russian disinformation campaign cloned British 999 call with AI**
On July 31, BBC Verify revealed that the voice of a British 999 emergency call handler was cloned using AI for a Russian-linked disinformation campaign. The synthetic voice, lifted from an NHS training video, was used to spread fear ahead of Poland’s May 2025 presidential election. The real call handler, Aaron, was shocked by its realism. `russia` [link](https://www.bbc.com/news/live/ce35ly75ppkt?post=asset%3Ac8d1c46f-1b14-49bc-83d7-7a8b20345eee#post) **China spread disinformation to undermine French Rafale jet sales**
On July 6, French intelligence reported on China using its embassies to spread false claims about Rafale jet performance during India-Pakistan clashes, aiming to hurt French arms sales and promote Chinese alternatives, particularly targeting countries like Indonesia. `china` `defence` [link](https://apnews.com/article/france-china-pakistan-india-defense-rafale-64eec86b6e89718d6a49d8fdedf565f4) ## Data exposure and leaks **Unsecured server exposes years of Swedish citizens' data**
On July 24, Cybernews reported that an unsecured Elasticsearch server exposed over 100 million detailed records on Swedish citizens and companies, including names, ID numbers, tax data, debt history, and address logs from 2019 to 2024. Believed to originate from a third-party client of Nordic firm Risika, the leak offers a comprehensive behavioural and financial profile that poses serious risks for identity theft, phishing, and corporate espionage. [link](https://cybernews.com/security/risika-swedish-data-exposed/) **Swiss healthcare giant AMEOS reports data breach affecting patients, staff, and partners**
On July 21, Swiss hospital group AMEOS announced a security breach affecting its IT systems, potentially exposing sensitive data of patients, employees, and partners across its network of over 100 healthcare facilities in Central Europe. While no evidence of data misuse has emerged yet, AMEOS has shut down systems, notified authorities, and launched a forensic investigation, warning affected individuals to remain alert to possible phishing or fraud attempts. `health` [link](https://www.ameos.eu/datenschutz/datenschutzvorfall-gem-art-34-dsgvo/) **Threat actor threatens to leak 106GB of data allegedly belonging to Telefónica**
On July 4, BleepingComputer reported about a threat actor, affiliated with the Hellcat ransomware group, threatening to leak 106GB of data allegedly stolen from Telefónica Spanish telecommunications company. In fact, the threat actor alleges they breached the company through a Jira misconfiguration, similar to the January cyberattack. However, there are currently no indications that the leaked data is recent, and the company is denying the threat actor’s claims. `telecommunications` [link](https://www.bleepingcomputer.com/news/security/hacker-leaks-telef-nica-data-allegedly-stolen-in-a-new-breach/) # World ## Cyber policy and law enforcement **Microsoft used China-based engineers to support the US Department of Defense**
On July 25, the non-profit investigative journalism organisation ProPublica revealed that Microsoft had relied on engineers based in China to support US Department of Defense and other federal systems, supervised by US-based “digital escorts,” who reportedly, often lacked technical expertise. In response, Microsoft announced it will no longer use China-based engineering teams for support of US government cloud services—a practice now ceased amid mounting US national security scrutiny. `china` `united states` [link](https://www.propublica.org/article/microsoft-tech-support-government-cybersecurity-china-doj-treasury) **US sanctions Russian hosting company Aeza Group for aiding cybercrime and disinformation**
On July 1, the US Department of the Treasury sanctioned Russian hosting company Aeza Group and four of its operators for providing bulletproof hosting services to cybercriminals, including ransomware gangs, infostealer platforms, and darknet drug markets. The sanctions target Aeza’s involvement with groups like BianLian and RedLine, its role in Russian disinformation campaigns, and bar US entities from doing business with the group or its affiliates. `russia` `sanctions` `united states` [link](https://home.treasury.gov/news/press-releases/sb0185) **Interpol’s Operation Secure disrupts major infostealer networks across Asia-Pacific**
On June 11, Interpol announced that Operation Secure, a coordinated effort with 26 Asia-Pacific nations, dismantled over 20.000 malicious assets and seized 41 servers used by infostealer networks, uncovering more than 200.000 victims. Despite these successes, including multiple arrests and the takedown of 79% of identified infrastructure, officials warn that cybercriminals are likely to rebuild operations using alternative platforms due to the continued profitability of corporate fraud and stolen data. `arrests` `seizure` `takedown` [link](https://www.interpol.int/News-and-Events/News/2025/20-000-malicious-IPs-and-domains-taken-down-in-INTERPOL-infostealer-crackdown) ## Cyberespionage & prepositioning **Microsoft links China-linked APTs to ToolShell campaign exploiting SharePoint vulnerabilities**
On July 22, Microsoft confirmed that a portion of malicious activity exploiting SharePoint vulnerabilities in the ToolShell campaign has been attributed to China-linked groups APT27 (Linen Typhoon), APT31 (Violet Typhoon), and Storm-2603. APT27 and APT31 focused on espionage and data theft, while Storm-2603 deployed ransomware using the same vulnerabilities. `china` [link](https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/) **China-linked hackers escalate cyberattacks on Taiwan’s semiconductor sector amid US-China tensions**
On July 16, Proofpoint revealed that at least three China-linked hacking groups have intensified cyberespionage campaigns targeting 15–20 Taiwanese semiconductor firms and financial analysts, including those at a US-headquartered bank, between March and June 2025. The campaigns, ranging from phishing e-mails to malware-laced PDFs, coincide with US-China tensions over chip exports and highlight China’s persistent interest in disrupting and exploiting Taiwan’s semiconductor supply chain and supporting industries. `china` `semiconductor industry` `taiwan` [link](https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting) **Chinese state-backed hackers breach US Nuclear Agency via Microsoft SharePoint zero-day**
On July 23, the US National Nuclear Security Administration (NNSA) confirmed it was breached through a Microsoft SharePoint zero-day vulnerability chain, in a widespread cyberattack attributed to Chinese state-sponsored actors. While the Department of Energy reported minimal disruption and no classified data exposure, the incident is part of a broader campaign affecting over 400 servers and 148 global organisations. `china` `united states` [link](https://www.bleepingcomputer.com/news/security/us-nuclear-weapons-agency-hacked-in-microsoft-sharepoint-attacks/) **China-linked campaign infiltrated US National Guard network for nine months**
On July 15, US authorities confirmed that the cyberespionage group Salt Typhoon infiltrated a US state's Army National Guard network from March to December 2024. The campaign accessed network diagrams, geographic data, and personal data of service members, raising concerns about further compromise of state-level cybersecurity partners and law enforcement fusion centres. `china` `united states` [link](https://www.documentcloud.org/documents/25998809-20250611-dhs-salt-typhoon/) **Russia-linked threat actor Turla conducts adversary-in-the-middle campaign targeting diplomats in Moscow**
On July 31, Microsoft Threat Intelligence reported on a cyberespionage campaign by the Russia-linked threat actor Secret Blizzard, also known as Turla. This campaign targets embassies located in Moscow using an adversary-in-the-middle (AiTM) position to deploy their custom ApolloShadow malware. ApolloShadow installs a trusted root certificate to trick devices into trusting malicious actor-controlled sites, enabling Turla to maintain persistence on diplomatic devices, likely for intelligence collection. `russia` [link](https://www.microsoft.com/en-us/security/blog/2025/07/31/frozen-in-transit-secret-blizzards-aitm-campaign-against-diplomats/) **North Korea-linked threat actor delivers XORIndex malware via 67 npm packages**
On July 15, researchers revealed that North Korean actors uploaded 67 malicious packages to the npm repository, delivering the new XORIndex loader to developer systems. The campaign, linked to the Contagious Interview operation, used postinstall scripts to deploy payloads like BeaverTail and InvisibleFerret. Over 17.000 downloads were recorded before takedown reports were filed. `north korea` [link](https://www.bleepingcomputer.com/news/security/north-korean-xorindex-malware-hidden-in-67-malicious-npm-packages/) ## Cybercrime **Hackers exploit leaked Shellter Elite tool to spread infostealers as vendor responds with secured update**
On July 3, Elastic Security Labs revealed that hackers have been abusing a leaked copy of Shellter Elite v11.0, a red team AV/EDR evasion tool, to deploy infostealers like Rhadamanthys and Lumma via phishing e-mails and YouTube comments. Shellter confirmed the misuse stemmed from a recently licensed customer, criticised Elastic for delayed disclosure, and released a secured v11.1 update, restricting future access to vetted clients only. [link](https://www.elastic.co/security-labs/taking-shellter) **Researchers uncover malware in trusted Chrome and Edge extensions installed by 2,3 million users**
On July 8, KOI security researchers reported a widespread malware campaign named “RedDirection,” involving 18 malicious extensions on Google Chrome and Microsoft Edge. Trusted by both companies and installed by over 2,3 million users, the extensions secretly hijacked browser traffic, harvested URLs, and redirected users via command-and-control servers—often long after installation and store verification. [link](https://blog.koi.security/google-and-microsoft-trusted-them-2-3-million-users-installed-them-they-were-malware-fb4ed4f40ff5) **Cybercrime threat actor UNC3944 pivots to vSphere for stealthy ransomware deployment**
On July 23, a Google report detailed a campaign conducted by cybercrime threat actor UNC3944 (a.k.a Scattered Spider) targeting retail, airline and transportation organisations in the US using social engineering to access VMware vSphere via compromised Active Directory accounts. The threat actor hijacked vCenter, exfiltrated data from domain controllers using hypervisor-level disk swaps, sabotaged backups, and deployed ransomware from ESXi hosts. [link](https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944) **Fake Cloudflare verification screen used to deliver undetected malware**
On July 4, unknown threat actors launched a malware campaign using fake Cloudflare CAPTCHA screens to deceive users into running malicious PowerShell commands. The page injected code via the clipboard and contacted a Command and Control server using embedded webhooks. It fetched payloads from pastesio[.]com and axiomsniper[.]info, with evasion checks for virtual machines. The final BAT file showed zero detections on VirusTotal at the time of discovery. [link](https://cybersecuritynews.com/hackers-use-fake-cloudflare-verification-screen/) **Akira ransomware exploits SonicWall SSL VPN in July 2025 surge**
In July 2025, Arctic Wolf observed a surge in Akira ransomware attacks exploiting SonicWall SSL VPN connections for initial access, including on fully patched devices—suggesting a likely zero‑day vulnerability. These breaches began around 15 July, often leading to rapid encryption following VPN logins, sometimes within hours. Credential-based attacks (e.g. brute force) remain possible vectors per Arctic Wolf’s ongoing investigation. [link](https://arcticwolf.com/resources/blog/arctic-wolf-observes-july-2025-uptick-in-akira-ransomware-activity-targeting-sonicwall-ssl-vpn/) ## Data exposure and leaks **Dell confirms breach of demo platform by World Leaks extortion group, no sensitive data exposed**
On July 21, Dell confirmed that the World Leaks extortion group, formerly Hunters International, breached its Customer Solution Centers, a test environment isolated from core systems, stealing mostly synthetic and non-sensitive data. Although 1.3 TB of data was leaked, Dell states no sensitive customer or corporate data was involved, while World Leaks continues its shift toward data extortion over ransomware, citing profitability and risk concerns. [link](https://www.bleepingcomputer.com/news/security/dell-confirms-breach-of-test-lab-platform-by-world-leaks-extortion-group/) **Leaked datasets expose Chinese cyber contractors’ government ties**
On July 1, SpyCloud reported that leaked data from VenusTech and Salt Typhoon, posted in May on DarkForums, expose their offensive cybersecurity work for Chinese state entities. The samples reveal intelligence targets across Asia and Europe, and link three Chinese companies to Salt Typhoon operations, highlighting China’s expanding offensive cyber contractor ecosystem. `china` [link](https://spycloud.com/blog/state-secrets-for-sale-chinese-hacking/) ## Disruption & destruction **Russia's Aeroflot cancels flights after pro-Ukrainian hackers claim cyberattack**
On July 28, Russia’s flag carrier Aeroflot had to cancel around 42–50 flights from Moscow’s Sheremetyevo due to a massive cyberattack on its IT systems. The pro‑Ukraine hacker groups “Silent Crow” and “Cyber Partisans BY” claimed responsibility, saying they infiltrated and destroyed about 7.000 servers, dumping flight databases and communications data. Russian prosecutors have since launched a criminal investigation into the breach. Flying and booking services remain disrupted while recovery efforts continue. `russia` `ukraine` [link](https://www.theguardian.com/business/2025/jul/28/russia-aeroflot-cancels-flights-pro-ukraine-hackers-cyber-attack) ### Opportunistic **Patches available for critical vulnerabilities in SharePoint exploited in global ToolShell campaign**
On July 20, Microsoft published guidance for CVE‑2025‑53770, a critical deserialisation vulnerability in on‑premise SharePoint Server rated 9.8/10. Eye Security reported large‑scale exploitation beginning July 18 via a chain dubbed ToolShell, enabling remote code execution and cryptographic key theft. Proof‑of‑concept exploits and active campaign exploiting the ToolShell chain have been confirmed. Emergency patches for Subscription Edition, Server 2019, and Server 2016 are now available. [link](https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/) **CrushFTP vulnerability exploited to gain unauthorised administrative access**
On July 18, CrushFTP observed exploitation of a previously patched vulnerability affecting versions below 10.8.5 and 11.3.4_23. Activity likely began on July 17, following possible reverse engineering of code changes. The flaw enabled unauthenticated administrative access via HTTP(S). Indicators include modified user.XML files and unauthorised admin accounts. Unpatched systems remain exposed to compromise. [link](https://www.crushftp.com/crush11wiki/Wiki.jsp?page=CompromiseJuly2025) **Cisco Identity Services Engine vulnerabilities exploited in the wild**
On July 21, Cisco updated an advisory related to critical vulnerabilities affecting its Identity Services Engine, for which they have observed exploit attempts in the wild. The vulnerabilities (CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337) allow for remote code execution by an unauthenticated attacker, issuing commands as root user. Patches have been released for the affected products (versions 3.3 and 3.4). [link](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-unauth-rce-ZAd2GnJ6) **Google fixes Chrome zero-day exploited for sandbox escape**
On July 15, Google released a patch for CVE-2025-6558, a high-severity vulnerability actively exploited to escape Chrome’s sandbox. The flaw, caused by insufficient input validation in ANGLE and GPU components, allowed remote code execution via crafted HTML pages. Users are urged to update Chrome to version 138.0.7204.157 or later. [link](https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html) [^1]: Conclusions or attributions made in this document merely reflect what publicly available sources report. They do not reflect our stance.