eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
PoC Release and Observed Exploitation for Critical Windows Vulnerability
Bottom Line: Proof-of-Concept (PoC) exploit code was released for the critical Windows vulnerability CVE-2025-59287 on October 17th. Following emergency patches released by Microsoft on October 23rd, the vulnerability has been observed being exploited in the wild.
On October 17th, 2025, HawkTrace published Proof-of-Concept (PoC) exploit code for a critical vulnerability impacting Windows Server Update Service (WSUS), tracked as CVE-2025-59287 (CVSS: 9.8). This vulnerability was first disclosed on October 14th, within Microsoft's October 2025 Patch Tuesday release, where Microsoft initially indicated that no exploitation had been observed, but assessed that exploitation was “More Likely”. The vulnerability involves a deserialization of untrusted data, which can allow an unauthorized attacker to execute code over a network.
Within their analysis of the vulnerability, HawkTrace demonstrates that the vulnerability stems from the unsafe deserialization of AuthorizationCookie objects that are sent to the GetCookie() endpoint, which are “subsequently deserialized through BinaryFormatter without proper type validation”, leading to Remote Code Execution (RCE) with System privileges. On October 23rd, Microsoft pushed an out-of-band emergency update to fully address the vulnerability that supersedes the “previous, incomplete fix from the October Patch Tuesday release”. Microsoft updated their page on the vulnerability, confirming the release of PoC exploit code, the new patches, and confirming that Windows servers are not impacted if they do not have the WSUS Server Role enabled. Microsoft also provided workaround steps if patching was not immediately possible, which involve disabling the WSUS Server Role if it is enabled on the server, and blocking inbound traffic to ports 8530 and 8531 on the host firewall, which will render WSUS non-operational.
Following the emergency patches, a report published by Eye Security on October 24th confirmed that exploitation of CVE-2025-59287 has been observed in the wild, after receiving an alert for an attack involving reconnaissance and suspected Hands-on Keyboard activity. Investigating the activity further led to Eye Security researchers identifying HawkTrace's report and PoC exploit code of CVE-2025-59287, leading to their determination that this attack stemmed from the successful exploitation of CVE-2025-59287. Based on their observations of the available exploit code, Eye Security suspects that “adversaries have picked up on this and are getting ready to exploit servers, presumably gearing up for ransomware”.
eSentire Threat Intelligence Analysis:
The release of PoC exploit code for CVE-2025-59287 is notable, as PoC exploit code allows for threat actors of all skill levels to make use of the code within their attacks. The release of PoC exploit code also reduces the timeframe of attacks by using readily available code, as threat actors do not have to develop their own exploits to target a vulnerability, with examples showing that PoC exploit code has been used in attacks within minutes of being published. As noted in Eye Security's analysis, the PoC exploit code published by HawkTrace “popped a calc, and does not directly allow arbitrary command execution”, which indicates that threat actors will have to modify the code in order to complete their objective, rather than using it as is.
CVE-2025-59287 is notable, as the patch was initially released on October 14th, but Microsoft later issued an emergency patch, indicating that the initial release was not sufficient in addressing the vulnerability. Since the emergency patch release and Eye Security's report, other organizations have also published reports confirming observed exploitation of the vulnerability, along with the Netherland's National Cyber Security Centrum (NCSC) publishing an advisory, warning of ongoing exploitation. The vulnerability was also added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on October 24th, giving federal agencies the standard three-week timeframe to apply relevant patches. Exploitation attempts of the vulnerability were observed hours following Microsoft's emergency patch release, hinting at a possible link between the disclosure that the initial patch was not effective at mitigating the vulnerability, and observed exploit attempts. eSentire's Threat Intelligence team assesses with high confidence that exploitation attempts of CVE-2025-59287 will become more widespread in the near future.
Given the publicly available PoC exploit code and reports of ongoing exploitation, organizations should immediately perform a business impact review to determine if they are vulnerable to CVE-2025-59287 and apply relevant security patches or mitigation steps as soon as possible. eSentire's Managed Vulnerability Service (MVS) has plugins in place to identify devices that are vulnerable to CVE-2025-59287. eSentire's Threat Response Unit (TRU) has created detections for both MDR for Network and MDR for Endpoint for the vulnerability and reported post-exploitation activity, and eSentire is publishing an advisory for CVE-2025-59287. eSentire's Threat Intelligence team initially covered Microsoft's October 2025 Patch Tuesday release within the Weekly Threat Briefing - October 13 - October 17 and is continuing to track this topic for additional information.
Lazarus APT Group Targets the UAV Sector
Bottom Line: A recent report details an observed instance of Operation DreamJob targeting organizations in the Unmanned Aerial Vehicle (UAV) sector. The activity is linked to the North Korean-aligned Lazarus group and is aimed at acquiring information on UAV manufacturing and design.
On October 23rd, 2025, ESET published a report on recent observations of Operation DreamJob led by North Korean threat actor group Lazarus. The campaign targeted European defense organizations specifically involved in Unmanned Ariel Vehicle (UAV) sector.
In late March 2025, ESET identified instances of Operation DreamJob targeting three European companies: a metal engineering firm, an aircraft component manufacturer, and a defense company. The attackers gained initial access through social engineering, tricking victims into running a malicious program disguised as a fake job offer. The victims received a decoy document and a trojanized PDF reader to view it. ESET observed trojanized versions of TightVNC Viewer and MuPDF used as downloaders and a malicious version of End-of-Life (EoL) libpcre v8.45 library for Windows used as a loader. The attackers leveraged open-source projects and plugins such as DirectX Wrappers, Sample IME, WinMerge, and Notepad++ to build loaders and downloaders. Using DLL side-loading, the loaders and downloaders were deployed on the victim’s system. ScoringMathTea, a sophisticated Remote Access Trojan (RAT) was observed as the final payload. The RAT enables attackers to gain complete control over the compromised system.
ESET's investigation suggests that the primary objective of the threat actors was likely the theft of proprietary information and manufacturing expertise, connected to North Korea's interest in boosting its drone capabilities. This assessment was partly based on the discovery of a DLL named DroneEXEHijackingLoader.dll, coupled with the fact that the targeted victims belonged to the defense sector.
eSentire Threat Intelligence Analysis:
Lazarus (aka HIDDEN COBRA, APT38, Labyrinth Chollima) group is a state-sponsored North Korean Advanced Persistent Threat (APT) group and is attributed to Democratic People's Republic of Korea (DPRK) People's Army’s Reconnaissance General Bureau. The group has been active since 2007 and has been consistently involved in financially motivated and information gathering cyber-attacks to support the North Korean regime. Operation DreamJob was first reported by ClearSky in late 2020, where the Lazarus group threat actors posed as recruiters from leading defense and aerospace companies in the U.S. to target employees within defense and government organizations. The main objective of this campaign was cyber espionage. ESET’s report emphasizes the ongoing nature of Operation DreamJob, noting that attackers are employing similar social engineering tactics as observed in past activities to deceive victims and gather sensitive information.
According to an open-source report, North Korea is actively working to expand its drone program, with plans to mass-produce drones after observing the benefits of drone capabilities in warfare, as demonstrated in the Russia-Ukraine conflict. It is noteworthy that their flagship reconnaissance drone, the Saetbyol-4, closely resembles the U.S.'s Northrop Grumman RQ-4 Global Hawk. This resemblance indicates that North Korea relies on intellectual property theft to advance its domestic UAV capabilities.
Recent Operation DreamJob activity further underscore North Korea's efforts to acquire advanced UAV technology.
Another facet of Operation DreamJob pertains to North Korea's support for Russia in the ongoing Russia-Ukraine war. ESET noted that the targeted defense organizations were operating in Ukraine, suggesting that the campaign might be focused on gathering information about the weapons used by Ukraine. Operation DreamJob campaigns may be driven by various intelligence-gathering objectives, with the collected information being utilized in different ways. In the past, Operation DreamJob was also observed engaging in activities for financial gain, using the gathered intelligence to carry out Business Email Compromise (BEC) attacks against employees in targeted organizations.
With the state facing numerous global sanctions, including those from the U.S. and Canada, that hinder technological progress, cybercriminal campaigns emerge as an alternative means to steal sensitive information and generate revenue. This stolen information can be used to further develop sectors such as information technology, defense, and healthcare. Previously, North Korea was accused of compromising the U.S. pharmaceutical company Pfizer to steal COVID-19 vaccine technology. Similarly, a Chinese national was charged with stealing designs for advanced stealth fighters like the F22 and F35, demonstrating that North Korean threat actors are not the only ones engaging in such cyberespionage campaigns.
Social engineering remains a relevant tactic for initial access used by attackers, underscoring the importance of educating employees about threats from campaigns like Operation DreamJob. At the same time, implementing robust Endpoint Detection and Response (EDR) tools can help identify and contain malicious tools used throughout the infection chain.
Salt Typhoon Targets Telecoms
Bottom Line: The Chinese APT group Salt Typhoon continues to target telecoms around the globe, with a recent campaign against a European organization. Chinese APT groups have been noted to target Internet facing applications for initial access into victim organizations.
On October 20th, 2025, researchers from Darktrace disclosed a recent attack against a European telecommunication organization, that is attributed with medium confidence to the Chinese state-sponsored APT group Salt Typhoon (aka. Earth Estries, GhostEmperor, UNC2286). According to Darktrace, in June 2025, Salt Typhoon exploited an unspecific vulnerability, in a Citrix NetScaler Gateway appliance, to gain access to the organization. The threat actors went on to deploy a backdoor malware, tracked as SNAPPYBEE (Deed RAT), to Citrix VDA hosts.
At this point in the attack, Salt Typhoon activity was identified, and the compromise was remediated. As such, the final actions on objectives were not observed. As the group is affiliated with the Chinese government, it is almost certain that the activity was carried out for espionage related purposes.
eSentire Threat Intelligence Analysis:
Chinese state-sponsored threat actors at large, and specifically Salt Typhoon, have shown persistent interest in compromising telecommunication organizations across the globe. Telecoms are high-value targets for espionage-oriented groups, as they store sensitive communication information and data that can be used to track high-profile individuals. In at least one case, Salt Typhoon was able to compromise the “lawful wiretapping systems”, used by US law-enforcement, posing a direct threat to national security. As of late 2024, Salt Typhoon was confirmed to have compromised at least nine separate US based telecoms; the recent Darktrace report shows continued interest in these organizations. The eSentire Threat Intelligence team assesses that it is almost certain the group will continue to launch attacks against telecommunication organizations. Based on past attacks, other industries including government, travel, military, Internet Service Providers (ISPs), and technology are also at risk.
Salt Typhoon is a highly advanced threat actor group known to use custom malware and exploit both known and zero-day vulnerabilities in Internet-facing applications. They have operated since at least 2019, and in this time, the group is reported to have compromised organizations in over 80 countries, across North America, Europe, the Middle East, and Africa. Notably, Salt Typhoon is reported to receive direct support from various semi-private Chinese companies that supply both technology and expertise to the group, increasing their overall capabilities. In January 2025, the US Treasury department responded to Salt Typhoon activity with sanctions against “Sichuan Juxinhe Network Technology Co., LTD., a Sichuan-based cybersecurity company with direct involvement in the Salt Typhoon”.
As Salt Typhoon is known to exploit vulnerabilities in Internet-facing applications, such as VPNs and firewalls, it is critical that organizations rapidly identify and remediate vulnerabilities in edge appliances. Managed vulnerability services can greatly assist organizations in identifying these vulnerabilities and ensuring that security patches are deployed.
The eSentire Threat Response Unit (TRU) tracks Salt Typhoon, and other Chinese state-sponsored APT groups, to enable ongoing threat hunting and detection engineering. For additional mitigation and hardening recommendations, refer to the September 2025 CISA report, Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage Systems.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
