Microsoft 365 - Cybersec Sentinel

Microsoft 365

A collection of 6 posts

CVE-2025-53770 and CVE-2025-53771 Abused in Active Attacks on On-Prem SharePoint

Vulnerabilities

CVE-2025-53770 and CVE-2025-53771 Abused in Active Attacks on On-Prem SharePoint

Threat Group: Linen Typhoon, Violet Typhoon, Storm-2603 Threat Type: Remote Code Execution & Spoofing Exploited Vulnerabilities: CVE-2025-53770 (RCE), CVE-2025-53771 (Spoofing) Malware Used: ToolShell (spinstall0.aspx) Threat Score: 🔴 High (8.0/10) – Active exploitation by nation-state actors, persistent access via cryptographic theft, and potential lateral movement across enterprise networks. Last Threat

Emerging Malware StilachiRAT Targets Digital Assets

Emerging Malware StilachiRAT Targets Digital Assets

Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Unknown Malware Used: StilachiRAT Threat Score: 🔴 High (8.4/10) – Due to its comprehensive data theft capabilities, advanced evasion techniques, and specific targeting of cryptocurrency assets. Last Threat Observation: March 20, 2025 Overview StilachiRAT is a newly discovered Remote Access Trojan (RAT)

Malware Distribution Through Trusted Microsoft Graph API Channels

Malware Distribution Through Trusted Microsoft Graph API Channels

Threat Group: Various Advanced Persistent Threats (APTs) Threat Type: Malware Distribution, Data Exfiltration, Command-and-Control (C2) Exploited Vulnerabilities: Microsoft Graph API Abuse Malware Used: Havoc, FINALDRAFT, BirdyClient, Bluelight, Graphite, Graphican, SiestaGraph Threat Score: High (8.7/10) – Exploitation of trusted Microsoft services, advanced obfuscation, widespread potential data breaches. Last Threat Observation:

FINALDRAFT Malware Abuses Microsoft Services Stay One Step Ahead

FINALDRAFT Malware Abuses Microsoft Services Stay One Step Ahead

Threat Group: REF7707 Threat Type: Remote Access Trojan (RAT) Exploited Vulnerabilities: Abuse of Microsoft Graph API, Credential Theft via NTLM Hashes Malware Used: FINALDRAFT, PATHLOADER Threat Score: High (8.5/10) – Due to its advanced evasion techniques, use of legitimate cloud-based services for C2 communication, and its ability to compromise

The Growing Risk of Sneaky 2FA for Microsoft and Gmail Accounts

The Growing Risk of Sneaky 2FA for Microsoft and Gmail Accounts

Threat Group: Sneaky Log Threat Type: Phishing-as-a-Service (PhaaS) Platform Exploited Vulnerabilities: Two-Factor Authentication (2FA) Mechanisms, User Trust Malware Used: Sneaky 2FA Phishing Kit Threat Score: High (8.5/10) – Due to its sophisticated methods to bypass 2FA and widespread targeting of essential communication platforms. Last Threat Observation: January 18, 2025

FlowerStorm Phishing Service Gains Traction After Rockstar2FA Shutdown

FlowerStorm Phishing Service Gains Traction After Rockstar2FA Shutdown

Threat Group: FlowerStorm Threat Type: Phishing-as-a-Service (PhaaS) Exploited Vulnerabilities: User credentials and session cookies Malware Used: FlowerStorm phishing kit Threat Score: High (8.5/10) – Due to its capability to bypass multi-factor authentication (MFA) and widespread targeting of Microsoft 365 users. Last Threat Observation: December 20, 2024 Overview The cybersecurity