Weekly Cybersecurity Intelligence Report Cyber Threats & Breaches July 21-27, 2025

The cybersecurity landscape during July 21-27, 2025, was dominated by widespread exploitation of Microsoft SharePoint vulnerabilities collectively known as “ToolShell,” targeting critical infrastructure worldwide. Chinese state-sponsored actors initiated sophisticated campaigns affecting over 400 organizations, including U.S. nuclear agencies. Simultaneously, ransomware operations intensified with new variants like BQTLOCK and Interlock, while threat actors deployed advanced techniques including BitLocker abuse and OAuth phishing campaigns. The week witnessed the emergence of persistent backdoors in enterprise networking equipment and notable law enforcement actions against cybercriminal groups.

>>Outpace Attackers With AI-Based Automated Penetration Testing

1. BQTLOCK Ransomware Campaign

Date of Incident: Mid-July 2025

Overview

A new ransomware strain called BQTLOCK emerged targeting Windows systems with sophisticated encryption techniques. The malware encrypts files using AES-256 and RSA-4096 encryption, leaving ransom notes demanding payment for decryption keys.

Technical Explanation

BQTLOCK implements a multi-layered encryption approach, combining symmetric and asymmetric cryptography. The malware renames encrypted files with the .BQTLOCK extension and drops ransom notes titled READ_ME-NOW_2526968.txt. The encryption process is irreversible without the attacker’s private key, making recovery extremely difficult without backups.

Technical characteristics:

Encryption: AES-256 for file data, RSA-4096 for key protection
File Extensions: .BQTLOCK appended to encrypted files
Ransom Note: Claims complete network compromise
Communication: Email-based contact with unique victim ID

Impact

Target Systems: Windows workstations and servers
Encryption Scope: Complete file system encryption
Recovery: Impossible without decryption keys or backups
Financial Impact: Undisclosed ransom demands

Technical Details

MITRE ATT&CK Mapping:

T1486 (Data Encrypted for Impact)
T1490 (Inhibit System Recovery)
T1083 (File and Directory Discovery)

Prevention Measures:

Regular offline backups with 3-2-1 strategy
Endpoint detection and response (EDR) deployment
Network segmentation to limit spread
User awareness training on phishing

Takeaway for CISO

Strengthen backup strategies with offline storage and regular restoration testing. Deploy advanced anti-ransomware solutions with behavioral detection capabilities. Implement zero-trust network architecture to prevent lateral movement. Establish incident response procedures specifically for ransomware scenarios.

2. Interlock Ransomware Drive-By Campaign

Date of Incident: Active since September 2024, alert issued July 23, 2025

Overview

CISA issued a joint advisory warning about Interlock ransomware attacks targeting critical infrastructure through drive-by downloads from compromised legitimate websites. The ransomware variant affects both Windows and Linux systems, with specialized encryptors for virtual machines.

Technical Explanation

Interlock employs sophisticated social engineering techniques, including ClickFix and FileFix attacks, to trick users into executing malicious code. The attack chain begins with compromised legitimate websites serving malicious payloads, followed by persistence mechanisms and lateral movement across victim networks.

Attack methodology:

Initial Access: Drive-by downloads from compromised websites
Social Engineering: ClickFix/FileFix techniques
Persistence: RAT deployment in Windows Startup folder
Registry Modification: PowerShell commands for persistence
Encryption: Dual Windows/Linux capabilities with VM targeting

Impact

Geographic Scope: North America and Europe
Target Sectors: Critical infrastructure, businesses, organizations
Platform Coverage: Windows and Linux systems plus VMs
Timeline: Active campaign since September 2024

Technical Details

MITRE ATT&CK Mapping:

T1189 (Drive-by Compromise)
T1204 (User Execution)
T1547 (Boot or Logon Autostart Execution)
T1486 (Data Encrypted for Impact)

Protection Strategies:

Web filtering and DNS security
Browser security hardening
VM backup and recovery procedures
User training on social engineering

Takeaway for CISO

Implement robust web filtering and DNS protection to prevent drive-by compromises. Educate users about ClickFix/FileFix social engineering techniques. Ensure comprehensive backup strategies include virtual machine snapshots. Deploy specialized VM security monitoring tools.

3. Fire Ant VMware Infrastructure Campaign

Date of Incident: Early 2025 (ongoing), reported July 25, 2025

Overview

A sophisticated cyber espionage campaign dubbed “Fire Ant” has been targeting VMware ESXi and vCenter environments to establish persistent access to critical virtualization infrastructure. The campaign shows overlaps with China-linked UNC3886 group tactics and techniques.

Technical Explanation

Fire Ant operators exploit VMware vulnerabilities to gain initial access, then deploy sophisticated tools to maintain persistence within hypervisor environments. The attacks target the virtualization layer, allowing attackers to operate beneath traditional endpoint detection thresholds while maintaining access to segmented network assets.

Key technical aspects:

Target Infrastructure: VMware ESXi, vCenter, network appliances
Persistence Mechanisms: Hypervisor-level implants
Detection Evasion: Operating below endpoint controls
Network Access: Bypassing segmentation through virtualization layer

Impact

Infrastructure Type: Virtualization and networking systems
Geographic Scope: Global targeting campaign
Sectors: Critical infrastructure, government, enterprise
Attribution: Links to UNC3886 (China-nexus group)

Technical Details

MITRE ATT&CK Mapping:

T1190 (Exploit Public-Facing Application)
T1078 (Valid Accounts)
T1564 (Hide Artifacts)
T1021 (Remote Services)

Detection Challenges:

Traditional endpoint controls ineffective
Hypervisor-level compromise
Advanced persistence techniques
Multi-layer attack kill chains

Takeaway for CISO

Implement specialized hypervisor security monitoring tools. Regularly update VMware infrastructure with latest patches. Deploy network microsegmentation even within virtualized environments. Consider zero-trust principles for virtualization management interfaces.

4. France Travail Data Breach

Date of Incident: July 12, 2025 (discovered), reported July 23, 2025

Overview

France Travail, the French national employment agency, suffered its second major data breach in two years, exposing personal information of 340,000 job seekers. The breach was caused by infostealer malware compromising a training organization’s user account.

Technical Explanation

The attack targeted the Kairos application platform, which facilitates connections between employers, job seekers, and training organizations. Attackers gained unauthorized access through a compromised user account infected with infostealer malware, bypassing two-factor authentication mechanisms.

Compromised data includes:

Full names and postal addresses
Email addresses and phone numbers
France Travail identification numbers
Job seeker status information

Impact

Affected Users: 340,000 job seekers
Data Types: Personal identifiers, contact information
Risk: Identity theft, phishing campaigns
Response: Immediate portal closure, investigation launched

Technical Details

Attack Vector: Infostealer malware compromising partner account
2FA Bypass: Malware captured authentication tokens
Detection: CERT-FR identified unauthorized access
Timeline: Breach occurred July 12, discovered July 13

Takeaway for CISO

Strengthen partner access controls with additional authentication layers. Implement endpoint protection against infostealer malware across partner networks. Establish continuous monitoring for unusual access patterns in shared platforms. Develop incident response procedures for third-party compromises.

5. UK Scattered Spider Arrests

Date of Incident: July 11, 2025 (arrests)

Overview

UK authorities arrested four individuals linked to the Scattered Spider cybercrime group in connection with attacks on major British retailers including Marks & Spencer, Co-op, and Harrods. The arrests mark a significant law enforcement breakthrough against the notorious group.

Technical Explanation

Scattered Spider employed sophisticated social engineering techniques to breach retail systems, causing estimated damages of £440 million. The group utilized their native English-speaking advantage to conduct convincing impersonation attacks against employees and contractors.

Attack characteristics:

Social Engineering: Employee impersonation
Target Selection: Major retail chains
Financial Impact: £440 million estimated losses
Group Structure: Decentralized teen hackers

Impact

Retail Disruption: Operations crippled at major chains
Financial Losses: Hundreds of millions in damages
Law Enforcement: First major arrests of group members
Arrests: Two 19-year-olds, one 17-year-old, one 20-year-old woman

Technical Details

Investigation: National Crime Agency cybercrime unit
Evidence: Electronic devices seized for forensic analysis
Charges: Computer Misuse Act, blackmail, money laundering
International: Cooperation with overseas partners

Takeaway for CISO

Strengthen social engineering awareness training focusing on voice-based impersonation attacks. Implement callback verification procedures for sensitive requests. Deploy advanced threat detection specifically for insider threat scenarios. Establish clear escalation procedures for suspicious internal communications.

6. Russian OAuth Phishing Campaign

Date of Incident: March-July 2025 (ongoing)

Overview

Russian threat actors UTA0352 and UTA0355 have been conducting sophisticated OAuth phishing campaigns targeting NGOs and human rights organizations. The attacks exploit Microsoft 365 OAuth workflows to steal authentication tokens and gain persistent access to victim accounts.

Technical Explanation

The campaign uses highly personalized social engineering, with attackers impersonating European diplomats and Ukrainian officials through Signal and WhatsApp communications. Victims are directed to legitimate Microsoft OAuth pages but provide authentication codes to attackers, enabling token theft.

Attack methodology:

Social Engineering: Diplomatic impersonation
Communication Channels: Signal, WhatsApp messaging
Technical Approach: OAuth workflow abuse
Persistence: Microsoft Graph API access

Impact

Target Sectors: NGOs, human rights organizations
Geographic Focus: Europe, organizations supporting Ukraine
Access Gained: Email, calendar, document access
Attribution: Russian state interests

Technical Details

MITRE ATT&CK Mapping:

T1566 (Phishing)
T1528 (Steal Application Access Token)
T1114 (Email Collection)

IOCs:

Redirect URLs: vscode-redirect.azurewebsites.net
Malicious domains: insiders.vscode.dev

Takeaway for CISO

Monitor OAuth application permissions and suspicious authentication patterns. Train users to verify diplomatic communications through official channels. Implement conditional access policies for OAuth applications. Deploy advanced email security to detect impersonation attempts.

7. SonicWall Overstep Backdoor Campaign

Date of Incident: October 2024-July 2025 (ongoing)

Overview

Google’s Threat Intelligence Group discovered a persistent backdoor campaign targeting end-of-life SonicWall SMA 100 series appliances. The UNC6148 threat group deployed the OVERSTEP malware to maintain access even after security updates.

Technical Explanation

OVERSTEP operates as both a backdoor and user-mode rootkit, hijacking system libraries through /etc/ld.so.preload modification. The malware monitors web server logs to receive commands while hiding its presence from system administrators.

Technical capabilities:

Persistence: Boot process modification
Stealth: Library hijacking, log manipulation
Command Execution: Web request-based C2
Data Exfiltration: Sensitive file theft

Impact

Target Devices: End-of-life SMA 100 series appliances
Geographic Distribution: US, Europe, Canada
Attack Duration: October 2024-present
Vulnerability: CVE-2025-40599 (CVSS 9.1)

Technical Details

MITRE ATT&CK Mapping:

T1542 (Pre-OS Boot)
T1055 (Process Injection)
T1070 (Indicator Removal)

Malware Characteristics:

32-bit ELF shared object
x86 architecture targeting
Standard library function hooking

Takeaway for CISO

Replace end-of-life networking equipment immediately. Implement network segmentation to isolate critical infrastructure devices. Deploy network monitoring to detect unusual traffic patterns from security appliances. Establish hardware refresh cycles to avoid extended EOL exposure.

8. UK Ransomware Payment Ban

Date of Incident: July 22, 2025 (announcement)

Overview

The UK government announced plans to ban ransomware payments by public sector bodies and critical national infrastructure operators, including the NHS, local councils, and schools. Private organizations will be required to notify the government of intended payments.

Technical Explanation

The policy aims to disrupt the ransomware business model by removing payment incentives for attacks against critical services. The ban covers public sector entities while requiring private sector notification for payment intentions.

Policy framework:

Public Sector: Complete payment prohibition
Critical Infrastructure: Payment ban implementation
Private Sector: Mandatory payment notification
Support: Government advice and assistance

Impact

Deterrent Effect: Reduced targeting of banned entities
Risk Transfer: Potential increased private sector targeting
Compliance: New regulatory requirements
International: Potential model for other nations

Technical Details

Covered Entities: NHS, councils, schools, CNI operators
Compliance Deadline: Implementation timeline TBD
Enforcement: Sanctions law violations for banned payments
Support Systems: Government incident response assistance

Takeaway for CISO

Prepare for potential policy implementation in other jurisdictions. Strengthen backup and recovery capabilities to reduce payment dependencies. Develop incident response procedures that assume no payment options. Invest in prevention and detection technologies as primary defense strategy.