eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
When Hackers Call: Social Engineering, Abusing Brave Support, and EncryptHub’s Expanding Arsena
Bottom Line: A sophisticated campaign by the threat actor EncryptHub is leveraging social engineering and the CVE-2025-26633 vulnerability, referred to as MSC EvilTwin, to deploy malicious payloads through Microsoft Management Console (MMC) files.
On August 13th, 2025, Trustwave SpiderLabs released a report on ongoing campaigns by the threat group EncryptHub (aka LARVA-208, Water Gamayun). The campaign leverages a combination of social engineering, exploitation of the CVE-2025-26633 vulnerability (MSC EvilTwin), and abuse of the Brave Support platform to deliver malicious payloads. The campaign typically begins with social engineering. Threat actors impersonate IT support personnel and contact their targets through Microsoft Teams. Once communication is established, the victim is persuaded to execute a PowerShell command that downloads and runs a malicious Powershell script. The PowerShell script exploits the MSC EvilTwin vulnerability by dropping two .msc files; one benign and one malicious. The malicious file is stored in a deceptive directory and executed via mmc.exe, enabling the attacker to execute their payload.
Once the malicious .msc file is launched, it executes another script which exfiltrates system information, establishes persistence mechanisms, and communicates with a Command-and-Control (C2) server to retrieve AES-encrypted instructions. Among these instructions is the deployment of Fickle Stealer, a tool designed to harvest sensitive files, system information, and cryptocurrency wallet data from infected hosts.
EncryptHub has introduced new tools into its operations. One such tool is the SilentCrystal loader, a Golang-based program that replicates the functionality of the PowerShell loader but leverages the Brave Support platform to host malicious payloads. The loader follows a similar execution chain, including creating the mock directory, downloading the payload from the Brave Support platform, replacing the C2 URI, and executing the payload.
The group also deploys a SOCKS5 proxy backdoor developed in Golang. This backdoor has two operational modes. In client mode, it connects to a C2 server, sends system details via Telegram, and collects the system’s public IP address, ISP, and geolocation. In server mode, it acts as a SOCKS5 relay that uses TLS encryption to manage secure communications between infected machines and attacker-controlled infrastructure.
Additionally, EncryptHub has created a fake video conferencing platform called RivaTalk. The site requires an access code to download a malicious MSI installer. This installer sideloads a malicious DLL through Symantec’s ELAM installer. The malicious DLL launches a PowerShell script that displays a fake "System Configuration" pop-up to distract the user while generating fake browser traffic to conceal malicious communication with the C2 server. It also collects the system’s UUID, maintains a persistent C2 connection, and executes AES-encrypted commands.
eSentire Threat Intelligence Analysis:
EncryptHub operates with a well-structured attack chain that combines social engineering with technical exploitation, reflecting a high level of planning and coordination. By hosting malicious payloads on Brave Support and leveraging Microsoft Teams for initial contact, the group reduces suspicion and increases the likelihood of evading traditional security controls. The impersonation of IT support personnel and the development of a convincing fake conferencing platform, highlight the group’s reliance on user deception as the primary infection vector. As of February 2025, EncryptHub is confirmed to have compromised at least 618 organizations worldwide.
It is important to note that CVE-2025-26633 was added to CISA’s Known Exploited Vulnerabilities Catalog on 11th March 2025, the same day that it was disclosed by Microsoft. According to Trend Micro, EncryptHub exploited this vulnerability as a zero-day, in attacks that involved the EncryptHub stealer, DarkWisp and SilentPrism backdoors, the MSC EvilTwin loader, as well as the Stealc and Rhadamanthys stealer.
Comparing past reports with the latest ones indicates that the campaign led by the EncryptHub threat actor is actively testing new techniques to gain access to victim networks and deploy malicious payloads. To defend against similar attacks, it is critical that users are trained to recognize and report unsolicited IT support messages, particularly those delivered through Microsoft Teams. This risk can be further minimized by restricting Microsoft teams calls from users outside the organization, if not required for legitimate business purposes. Organizations should prioritize patching systems affected by CVE-2025-26633 to eliminate the MSC EvilTwin attack vector. Security teams should monitor for unusual PowerShell execution patterns, suspicious .msc file activity, and unauthorized file downloads from Brave Support. Integrating the known Indicators of Compromise (IoCs) into SIEM or SOAR systems will help detect and block related activity. In cases where vulnerabilities are being exploited, Endpoint Detection and Response (EDR) can identify known techniques and tools employed post-compromise.
The eSentire product suite includes a variety of detections for tools used by EncryptHub, and the BlueSteel machine-learning powered PowerShell classifier, identifies malicious PowerShell usage. eSentire Managed Vulnerability Service (MVS) has plugins in place to identify devices vulnerable to CVE-2025-26633. The eSentire Threat Intelligence team is performing threat hunts based on related IoCs and is actively tracking this topic for additional details and detection opportunities.
Critical Vulnerability within FortiSIEM Disclosed
Bottom Line: A critical vulnerability (CVE-2025-25256) in Fortinet FortiSIEM allows unauthenticated attackers to execute unauthorized code or commands. Proof-of-Concept exploit code is available and the eSentire Threat Intelligence team assesses that it is probable real-world exploitation will occur in the immediate future.
On August 12th, Fortinet disclosed the existence of a critical vulnerability in multiple versions of Fortinet FortiSIEM. FortiSIEM is a multi-tenant Security Information and Event Management (SIEM) solution that provides visibility into infrastructure and user activity for on-premise and cloud environments. The vulnerability, tracked as CVE-2025-25256 (CVSS: 9.8), is a remote unauthenticated command injection vulnerability due to improper neutralization of special elements used in an OS command. Exploitation could allow an unauthenticated threat actor to execute code, leading to the theft of sensitive data, malware deployment, and potentially enterprise-wide compromise.
According to Fortinet, “practical exploit code for this vulnerability was found in the wild”. The company does not share any additional details, and there are no reports of exploitation in the wild at the time of writing. On August 15th, Watchtowr Labs released their own Proof-of-Concept (PoC) exploit, along with a long form technical report explaining the vulnerability and exploit process.
Security patches to address CVE-2025-25256 are available. If patches cannot be applied, organizations are encouraged to restrict access to the phMonitor port (7900).
eSentire Threat Intelligence Analysis:
The eSentire Threat Intelligence team assesses that given the widespread use of Fortinet FortiSIEM, the impact of exploitation, and the availability of PoC code, threat actors are likely to target vulnerable FortiSIEM instances in the immediate future. It is critical for organizations to apply the recommended workaround or security patches promptly to avoid the risk of exploitation.
Notably, the company GreyNoise identified a surge in brute-force attacks targeting Fortinet SSL VPNs on August 3rd, 2025. According to GreyNoise, such spikes often precede the disclosure of new vulnerabilities affecting the same vendor. It is unclear at this time if there is any connection between the increased scanning for Fortinet products and CVE-2025-25256, but the scanning activity does indicate an interest by threat actors in Fortinet appliances.
Exploit code for CVE-2025-25256 has been available since at least the date of vulnerability disclosure, and likely earlier. eSentire identified an exploit for the vulnerability being sold privately, but as of August 15th, exploits are widely available at no cost. The disclosure of exploit code significantly increases the likelihood of rapid adoption by threat actors, as it removes the time and technical skills otherwise required to create their own. Vulnerabilities known to have publicly available PoC code should be prioritized for rapid remediation.
eSentire released an advisory addressing CVE-2025-25256 on August 14th, 2025, and the Threat Response Unit (TRU) is actively developing new detections based on the available PoC exploit code. eSentire Managed Vulnerability Service (MVS) has plugins in place to identify vulnerable devices.
ShinyHunters Targets Salesforce Amid Clues of Scattered Spider Collaboration
Bottom Line: ShinyHunters, a financially motivated threat actor, has been seen adopting the techniques of Scattered Spider in their recent phishing campaign targeting Salesforce, hinting at a potential collaboration between the two groups.
On August 12th, 2025, ReliaQuest published a report on the resurgence of the financially motivated threat actor group ShinyHunters. The group’s latest operation involved a coordinated set of ticket-themed phishing domains and pages designed to capture Salesforce credentials impacting organizations like Google. The report notes that the campaign’s tactics and infrastructure closely resemble those of another financially motivated threat actor group Scattered Spider, with indications of potential collaboration dating back to July 2024.
ShinyHunters rose to prominence in 2020 following a series of large-scale data breaches and extortion campaigns aimed at major global brands. Following nearly a year of inactivity, the group reemerged with a shift in tactics. New tactics observed by ReliaQuest include impersonating IT support staff, leveraging legitimate platforms like Salesforce to steal sensitive data, conducting vishing attacks to direct victims to Okta-themed phishing pages, and using Mullvad VPN for data exfiltration.
Scattered Spider (also known as UNC3944, Octo Tempest, Storm-0875, and Muddled Libra) has been active in data extortion and deployment of ransomware across industries such as retail, finance, and technology since 2022. The group employs social engineering tactics alongside phishing campaigns, with English-speaking members impersonating helpdesk staff to gain access to organizational networks. Their campaigns often involve registering domains that mimic those of target organizations.
The investigation into the Salesforce phishing campaign uncovered multiple domains registered in 2025 using naming conventions typically associated with Scattered Spider. ReliaQuest suggests a potential collaboration between ShinyHunters and Scattered Spider, citing overlapping social engineering tactics such as IT support impersonation during vishing attacks and phishing attacks that employ similarly formatted domains. In addition to these domain similarities, the groups shared registration details and targeted similar industries within overlapping timeframes in 2025. Supporting ReliaQuest’s theory, a threat actor known as “Sp1d3rhunters,” active on Telegram and BreachForums (an underground forum), claimed that the two groups have always been the same.
eSentire Threat Intelligence Analysis:
If the speculated collaboration between ShinyHunters and Scattered Spider proves accurate, it would significantly challenge researchers, who may expend considerable time attributing malicious campaigns to a specific threat actor. However, as the ReliaQuest report notes, the evidence is circumstantial, meaning it cannot be conclusively stated that the two groups are operating together. This phishing campaign marks ShinyHunters’ reemergence since 2024 and may also indicate the group’s swift adoption of Scattered Spider’s successful techniques, which have been effective in breaching major organizations. Similarly, any claims made by a threat actor should be carefully assessed for authenticity and not accepted as definitive unless verified. While similarities in tactics and infrastructure can arise for many reasons, it is important to remember that threat actors continually adopt effective attack methods and rapidly rotate their infrastructure. As such, organizations are advised to prioritize detecting malicious activity within their networks over dedicating significant analyst time to identifying the specific perpetrators.
ShinyHunters group experienced a decline in activity in 2024 following law enforcement action against individuals reportedly linked to the group. In June 2025, Google Threat Intelligence Group (GTIG) published a report highlighting a similar Salesforce phishing campaign reported by ReliaQuest. GTIG attributed the campaign to the threat cluster UNC6040, whose associated actor claimed affiliation with the ShinyHunters group. GTIG also reported that ShinyHunters is planning to launch a Data Leak Site (DLS) to pressure victims linked to UNC6040’s Salesforce-related data breach. ReliaQuest’s report provides more insights into the campaign targeting Salesforce accounts of major organizations.
In early 2025, the Scattered Spider leveraged DragonForce ransomware services to target retail brands in the United Kingdom. Between June and July 2025, Scattered Spider was reportedly behind attacks on several airlines, including WestJet, Hawaiian Airlines, and Qantas. eSentire has been actively tracking Scattered Spider’s activity and on March 7th, 2024, eSentire’s Threat Response Unit (TRU) published a blog detailing an observed incident along with the associated Scattered Spider’s Tactics, Techniques, and Procedures (TTPs). Threat actor groups such as ShinyHunters and Scattered Spider have reportedly focused on high-value organizations, and this trend is expected to continue. ReliaQuest indicates that organizations in the banking, finance, and insurance sectors are likely to be targeted next in 2025. Also, the groups are likely to continue focusing on cloud and technology providers such as Salesforce and Okta, given their widespread use among high-value organizations and the valuable business data they hold.
Drawing from ShinyHunters’ Salesforce phishing campaign and Scattered Spider’s previous operations, raising awareness of emerging social engineering tactics remains a key security measure for organizations. Conducting regular Phishing Awareness and Security Trainings (PSATs) is recommended as an effective step toward mitigating the risks posed by such campaigns. Further, implementing security controls around user accounts such as enabling Multi-Factor Authentication (MFA) for all profiles, disabling dormant and/ or compromised accounts, and enforcing strict password policy throughout the organization can help avoid credential theft.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
