eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Ongoing Direct Send Abuse
Bottom Line: Microsoft's Direct Send feature within Microsoft 365 is being exploited by threat actors, enabling spoofed internal phishing emails to be sent to users without requiring account credentials.
On August 6th, 2025, eSentire issued a security advisory detailing how threat actors are abusing Microsoft 365’s Direct Send feature to launch internal-looking phishing attacks, bypassing SPF, DKIM, and DMARC protections. The attacks involve spoofed emails, often disguised as voicemails or faxes, containing QR codes.
Varonis Threat Labs reported this attack technique publicly in June 2025, following the detection of a phishing campaign impacting numerous organizations primarily in the United States. Proofpoint also confirmed similar phishing campaigns exploiting Direct Send to deliver internal-looking emails via unsecured third-party SMTP relays. These emails often ended up in junk folders, even though they were flagged by Microsoft’s composite authentication checks.
Microsoft 365’s Direct Send feature is designed to allow internal devices, such as printers and scanners, to send email using the tenant’s smart host. Notably, this feature does not require sender authentication, and it accepts emails as long as the recipient exists within the organization’s domain. Beginning in May 2025, attackers have targeted over 70 organizations (about 95% in the U.S.) across various industries via this technique. Attackers are exploiting this behavior by using PowerShell scripts or SMTP clients to send spoofed emails directly to these smart hosts. The sender address is crafted to mimic a legitimate internal user, and because the smart host does not verify authentication, the emails are accepted and routed internally. These messages typically contain malicious PDFs with embedded QR codes, a tactic known as “quishing,” which leads recipients to fake Microsoft login portals to harvest credentials. Many phishing messages originated from unusual IP addresses (e.g. Ukrainian IP), but no login events were associated, because the feature bypasses standard authentication tracking.
eSentire Threat Intelligence Analysis:
The exploitation of the Direct Send feature undermines the trust that organizations place in their internal communications. Because the messages appear to originate from legitimate internal sources, recipients are more likely to engage with them, increasing the success rate of phishing attempts. Credential theft via these emails can lead to unauthorized access, lateral movement within the network, and further compromise of organizational assets.
eSentire has observed multiple customers impacted by the Direct Send attack during late July and early August. As attackers move beyond basic credential theft, they are investing in personalized and believable engagement with targets. Organizations are strongly advised to disable Direct Send functionality unless it is absolutely necessary for specific internal devices. It is also recommended to enable the "Reject Direct Send" setting in the Exchange Admin Center or by running the command via PowerShell. Furthermore, organizations should enforce email authentication policies, including SPF, DKIM and DMARC with strict DMARC reject and SPF hard fail policies. Educating users about the risks associated with phishing emails that contain QR codes is essential to improving overall security awareness. Deploying Endpoint Detection and Response (EDR) solutions can enhance the ability to detect and block abuse of this kind. Finally, continuous monitoring and regular auditing of Direct Send usage and email logs are critical to identifying anomalies and potential abuse.
eSentire Threat Response Unit (TRU) has developed detections in MDR for Log to identify potential Direct Send abuse. IP addresses associated with real-world attacks were blocked via the eSentire Global Block List, and relevant Indicators of Compromise (IoCs) have been added to the eSentire Threat Intelligence Feed. eSentire TRU is continually tracking this topic for further information.
SonicWall Exploitation Leads to Ransomware
Bottom Line: Reports of ongoing exploitation of a possible zero-day vulnerability within SonicWall Gen 7 appliances emerged, with attacks leading to the deployment of ransomware. SonicWall later confirmed that the attacks involved the previously disclosed vulnerability, CVE-2024-40766.
Near the end of July 2025, several organizations observed an uptick in attacks targeting SonicWall Gen 7 appliances, including Field Effect. The reports identified similarities within observed attacks, including that impacted devices appeared to involve SonicWall Gen 7 firewalls running SonicOS version 7.2.0-7015, attackers were able to bypass Multi-Factor Authentication (MFA), and that the attacks were resulting in the deployment of Akira ransomware. This led to speculation that a “zero-day vulnerability in SonicWall VPNs is being actively exploited to bypass MFA and deploy ransomware”.
In response to these reports, SonicWall published an advisory on August 4th, 2025, confirming that they were actively investigating to determine if the attacks were related to an undisclosed zero-day vulnerability within SonicWall appliances. The Canadian Centre for Cyber Security (CCCS) published an advisory on August 5th, 2025, warning organizations about a possible zero-day vulnerability within SonicWall Gen 7 firewalls. On August 6th, 2025, SonicWall updated their advisory to state that they had determined “that the recent SSLVPN activity is not connected to a zero-day vulnerability”, but that there was “significant correlation” between the observed attacks and a previously disclosed vulnerability, CVE-2024-40766.
CVE-2024-40766 (CVSS: 9.3) is an improper access control vulnerability within SonicWall SonicOS management access, that could potentially lead to unauthorized resource access and firewall crashes. SonicWall initially disclosed the vulnerability on August 22nd, 2024, stating that it impacted SonicOS versions up to and including 5.9.2.14-12o, 6.5.4.14-109n, and 7.0.1-5035. SonicWall indicated that along with applying the relevant patches, resetting the passwords for all users with locally managed SSLVPN accounts was also advised. In their most recent advisory, SonicWall indicates that they were investigating less than 40 incidents relating to the recent attacks, and that “many of the incidents relate to migrations from Gen 6 to Gen 7 firewalls, where local user passwords were carried over during the migration and not reset”. SonicWall's updated guidance includes ensuring that SonicWall Gen 7 devices are updated to version 7.3.0, and that all local user account passwords for any account with SSLVPN access is reset, especially if “they were carried over during migration from Gen 6 to Gen 7”.
eSentire Threat Intelligence Analysis:
Vulnerabilities within SonicWall appliances are considered to be critical, due to the potential impacts that possible exploitation can have. SonicWall claims to have over 500,000 customers globally, highlighting the popularity of its products. Due to this popularity, and the exposure of these devices to the Internet, SonicWall appliances are highly targeted by threat actors as a means for initial access into an organization's network. This criticality is highlighted by the urgency generated from various vendors reporting about the observed attacks, and the possibility of a zero-day SonicWall vulnerability being under active exploitation.
Ransomware groups and affiliates are known to target vulnerabilities within SonicWall devices as a means for initial access, with an example being from April 2021, where the financially motivated threat actor UNC2447 exploited a zero-day vulnerability within SonicWall to deploy FiveHands ransomware. Another example of SonicWall vulnerabilities being targeted is from September 2024, involving threat actors leveraging CVE-2024-40766 (the vulnerability identified by SonicWall as the source of the current attacks), to deploy both Akira and Fog ransomware. This demonstrates that affiliates of Akira ransomware are known to target vulnerabilities within SonicWall appliances. Huntress indicates within their report that they observed almost 30 incidents relating to this campaign, identifying some similarities within the attacks. Huntress notes that the attackers “have at least part of the same playbook”, suggesting similarities in the attack methods of Akira ransomware affiliates.
It is important to note that CVE-2024-40766 was initially disclosed and patched in August 2024 and appears to still be targeted in ongoing attacks. Older SonicWall vulnerabilities are known to be targeted by threat actors, with an example being from May 2025, where CISA added a vulnerability initially disclosed in December 2023 (CVE-2023-44221) to its Known Exploited Vulnerabilities (KEV) catalog, indicating its exploitation almost 1.5 years later. Threat actors will target older vulnerabilities within their attacks likely due to better documented Proof-of-Concept (PoC) exploit code, and poor patching practices of organizations. As such, organizations should implement a robust patch management strategy, which can enable critical vulnerabilities to be identified, and apply relevant security patches within a timely manner.
eSentire's MDR for Network has detections in place to identify exploitation attempts relating to CVE-2024-40766, and eSentire's Managed Vulnerability Service has plugins in place to identify devices vulnerable to CVE-2024-40766. eSentire's Threat Response Unit (TRU) published an advisory for the recent SonicWall attacks on August 5th, 2025, and for CVE-2024-40766 on September 11th, 2024. IP addresses associated with real-world attacks were blocked via the eSentire Global Block List. eSentire's Threat Intelligence team is continuing to track this topic for additional information and detection opportunities.
CISA Released Emergency Directive Addressing CVE-2025-53786
Bottom Line: CISA’s emergency directive mandates that federal agencies address the recently disclosed Microsoft Exchange vulnerability (CVE-2025-53786) within an accelerated timeframe. Given Microsoft’s assessment that exploitation is “more likely” and enables privilege escalation to full control of cloud environments, the vulnerability remains a serious concern although no exploitation is reported.
On August 6th, 2025, Microsoft disclosed a privilege escalation vulnerability affecting on-premises Exchange server in an Exchange hybrid deployment. The flaw, tracked as CVE-2025-53786, enables an attacker with administrator access to the on-premises Exchange server to potentially escalate privileges within the organization’s connected cloud environment and remain undetected. CVE-2025-53786 is due to the same service principal shared between Exchange Server and Exchange Online in hybrid deployments.
Microsoft has not yet observed exploitation of the vulnerability in the wild but has assessed it as “Exploitation More Likely”. The disclosure of the vulnerability follows Microsoft's identification of security issues linked to the Exchange Server Security Changes for Hybrid Deployments released in April 2025. Microsoft recommends that organizations apply the April 2025 Hot Fix associated with the changes to mitigate the vulnerability. The company also advises to refer to the configuration instructions provided in the Deploy dedicated Exchange hybrid app and resetting the service principal’s keyCredentials.
CISA also published an alert on August 6th, 2025, outlining mitigations for CVE-2025-53786 and recommending that organizations disconnect public-facing End-of-Life (EoL) Exchange and SharePoint from the Internet. On August 7th, 2025, CISA issued an emergency directive requiring the federal agencies to mitigate the vulnerability by 9 AM EDT, Monday, August 11th, 2025. The emergency directive provides steps to mitigate the vulnerability, including assessing the current Exchange server, followed by application of the April 2025 Hot Fix. Further, federal organizations are required to migrate to the Dedicated Exchange Hybrid Application. Following all the mitigation steps, federal agencies must submit a report to CISA by 5 PM EDT on Monday, August 11th, 2025.
eSentire Threat Intelligence Analysis:
CVE-2025-53786 is particularly significant as CISA issued an emergency directive before any reports of exploitation, setting a short deadline for federal agencies to mitigate the flaw and report back. Although exploiting the vulnerability requires the attacker to have administrative privileges for the on-premises Exchange server, CISA emphasizes that the simplicity with which threat actors can escalate privileges and gain complete control of the cloud environment makes CVE-2025-53786 serious.
It is important to note that Microsoft Exchange 2016 and 2019 will reach the end of extended support in October 2025. CVE-2025-53786 affects both of these versions, and as support for the older versions ends, threat actors are likely to carry out opportunistic attacks. Vulnerabilities in Internet-facing applications represent a significant risk to an organization’s network, serving as direct gateways for threat actors. The public accessibility of these instances makes them attractive targets for initial compromise and infiltration. Compounding the risk, threat actors deliberately seek out EoL systems, recognizing that the lack of vendor support and security patches renders them substantially more susceptible to compromise.
In March 2021, on-premises Microsoft Exchange Server was affected by multiple zero-day vulnerabilities that were actively exploited by the Chinese state-sponsored threat actor group known as HAFNIUM. The group successfully gained unauthorized access to email accounts and deployed additional malicious payloads to establish persistent access within targeted environments. Given the widespread use of on-premises Microsoft Exchange across various industries worldwide, it is critical that organizations implement appropriate mitigation measures to prevent potential exploitation of CVE-2025-53786. Proactive action is essential to avoid a large-scale exploitation campaign similar to the one observed in 2021.
At Black Hat USA 2025, security researcher Dirk-Jan Mollema of Outsider Security presented a detailed demonstration of how the shared service principal, central to hybrid Microsoft Exchange deployments, can be exploited in post-exploitation scenarios. He reported CVE-2025-53786 to Microsoft, and his research revealed that attackers with administrative access to on-premises Exchange servers could manipulate authentication tokens to escalate privileges within connected Microsoft 365 cloud environments. These tokens, once compromised, remain valid for up to 24 hours and cannot be revoked, posing a significant risk to enterprise security. Mollema’s findings underscore the urgency for organizations to transition to a dedicated service principal following application of the April 2025 Hot Fix.
To effectively safeguard against vulnerabilities, specifically in Internet-facing systems, organizations should adopt a proactive, layered security approach. This includes maintaining a comprehensive asset inventory to identify and monitor all exposed systems, ensuring timely application of security patches and updates, and decommissioning or upgrading EoL software. The eSentire Threat Intelligence team is continuously tracking the developments around CVE-2025-53786 for additional information. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-53786.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
