BoardDocs: Potential Security Issue
(Alert from K12six)
The Philadelphia Inquirer reported today about a security incident involving the use of BoardDocs - a popular application to help manage the work of school boards - by a PA school district. Specifically, internal records from the “executive” section of the BoardDocs site had at some point become accessible to the public. The district only learned about the issue on April 10, when it was contacted by a member of the public about the contents of an internal document.
The district's legal counsel said BoardDocs “eventually acknowledged there was a bug or defect in the system” that led to the breach.
According to the reporting, it remains unclear exactly how many internal documents were publicly accessible and for how long. Nor is it known whether the apparent bug could have impacted other school districts that use BoardDocs.
If your organization relies on BoardDocs, K12 SIX recommends:
• You review and validate permissions for access to documents intended for internal use only
• Search for evidence of public access to internal documents
• Consider informing legal counsel/school board management, especially if evidence of improper access is found
• Contact BoardDocs support for more information on issue and to receive assurances it has been addressed
• Share findings with K12 SIX, so we may update our guidance and take other steps, as warranted
(The Hacker News) (Alert from K12six)
ConnectWise, the developer behind the remote access and support tool ScreenConnect, disclosed on May 28, 2025, that it had been targeted in a cyberattack believed to have been carried out by a sophisticated nation-state actor. The company confirmed that only a small subset of its ScreenConnect customer base was affected. While it did not provide specifics regarding the number of impacted customers, the date of the breach, or the identity of the attacker, the incident highlights the persistent targeting of remote access tools by advanced threat groups.
To investigate the breach, ConnectWise enlisted the help of cybersecurity firm Google Mandiant and has begun notifying affected customers. The company has yet to establish whether the attack is related to any specific vulnerability, including one patched in late April 2025. That flaw, tracked as CVE-2025-3935, had a CVSS score of 8.1 and involved a ViewState code injection vulnerability affecting older versions of ScreenConnect. Microsoft had previously warned in February 2025 that this technique was being actively exploited.
Although the vulnerability was resolved in version 25.2.4 of ScreenConnect, ConnectWise has not confirmed any direct connection between it and the recent attack. In response, the company has fortified its internal defenses with improved monitoring and hardening measures to minimize the risk of future incidents. It also reassured customers that no further suspicious activity has been detected in any of their environments since the initial breach.
Analyst Note: This incident follows previous compromises of ScreenConnect in early 2024, where vulnerabilities (CVE-2024-1708 and CVE-2024-1709) were exploited by various threat actors, including state-sponsored groups from China, North Korea, and Russia. Those attacks were used to distribute malware and conduct espionage, underlining the platform’s attractiveness to both cybercriminals and nation-state actors. The recurrence of such incidents underscores the ongoing security challenges faced by companies offering remote access technologies.
(GB Hackers)
Security researchers at BeyondTrust have uncovered a critical, yet intentional, vulnerability in Microsoft Entra ID (formerly Azure Active Directory) that can be exploited by external guest users. These Entra B2B guest accounts, commonly used to facilitate collaboration across organizations, can manipulate billing roles to create and transfer Azure subscriptions into a tenant they are invited to—even if they lack administrative permissions within that tenant. This is possible due to Microsoft’s design of billing and subscription management, which separates billing privileges from role-based access control (RBAC).
When a guest user holds a billing role like “Billing Account Owner” or “Account Owner” in their home tenant, they can generate Azure subscriptions and move them into any tenant where they have guest access. As a result, they automatically receive “Owner” privileges for those subscriptions within the target tenant. This level of access enables a wide range of attack scenarios, from reconnaissance of privileged users to tampering with security policies and establishing persistent access via managed identities—actions that effectively bypass traditional administrative controls and expectations.
BeyondTrust details several potential exploits enabled by this loophole. A malicious guest with owner-level access can conduct reconnaissance by reviewing IAM settings to identify high-privilege accounts. They can also disable or alter security policies, obscure alerts, and register Azure virtual machines to bypass device trust policies. Moreover, they can create persistent service principals (user-managed identities) that survive even after the guest account is deleted, allowing long-term infiltration or escalation opportunities.
Analyst Note: Although Microsoft acknowledges this behavior as part of Entra’s intended functionality to support multi-tenant collaboration, the configuration poses a significant risk if left unmonitored. Organizations are urged to apply strict subscription policies, audit guest accounts regularly, and closely monitor for unusual subscription activity. Strengthening conditional access policies and enforcing a Zero Trust approach are also recommended to minimize the risk of unauthorized access. Companies using Entra B2B should reassess their guest governance frameworks to ensure they’re not leaving a backdoor open to potential attackers.
(Info Security Magazine)
A malicious campaign has emerged involving a spoofed Bitdefender website designed to distribute malware, including VenomRAT, StormKitty, and SilentTrinity. The fake site mimics Bitdefender’s official antivirus download page but directs users to malicious files hosted on platforms like Bitbucket and Amazon S3. The downloaded file, named StoreInstaller.exe, triggers a multi-stage infection process, providing attackers with extensive control over the victim’s system.
According to DomainTools, the attack uses a modular malware structure, with each component serving a specific purpose. VenomRAT enables persistent remote access and control, StormKitty focuses on harvesting sensitive data such as credentials and cryptocurrency wallet contents, and SilentTrinity allows stealthy data exfiltration and long-term system manipulation. This layered approach suggests a campaign aimed at sustained exploitation rather than quick data theft.
The attackers demonstrate technical consistency, with malware samples sharing command-and-control IPs and remote desktop configurations, suggesting a single, organized threat actor behind the operation. VenomRAT, which originates from the Quasar RAT project, supports advanced features like keylogging, credential theft, and remote command execution. The campaign's infrastructure has been mapped through overlapping malware configurations and reuse of hosting services.
Analyst Note: Researchers also uncovered additional phishing sites tied to this operation, including fake banking and Microsoft login portals, further indicating a financially motivated and coordinated cybercrime network. The attackers’ use of open-source malware frameworks underscores the ease with which threat actors can launch powerful campaigns. DomainTools urges users to stay vigilant by verifying download links, avoiding credential input on suspicious websites, and being cautious with email-based threats.
(Bleeping Computer)
A newly identified botnet dubbed "AyySSHush" has compromised over 9,000 ASUS routers, and appears to be targeting additional small office/home office (SOHO) routers from Cisco, D-Link, and Linksys. Discovered by GreyNoise in March 2025, the campaign exhibits characteristics of a nation-state operation, although no definitive attribution has been made. The attackers gain access using a combination of brute-force credential attacks, authentication bypasses, and exploitation of known vulnerabilities, primarily affecting ASUS router models RT-AC3100, RT-AC3200, and RT-AX55.
The attackers exploit a known vulnerability, CVE-2023-39780, to insert their own SSH public key and enable SSH access on a non-standard port (53282). Notably, the attackers use official ASUS configuration features to ensure that the backdoor persists even after firmware upgrades. By disabling security logging and ASUS’s AiProtection service, they avoid detection and maintain stealthy control over the devices without deploying traditional malware. Despite minimal visible activity, only 30 malicious requests observed over three months, more than 9,000 routers have already been compromised.
The campaign appears to overlap with another operation called "Vicious Trap", tracked by French cybersecurity firm Sekoia. That effort also involved exploiting SOHO devices and other network infrastructure such as DVRs and BMC controllers, but used a different vulnerability (CVE-2021-32030). While the operational purpose of AyySSHush remains unclear, there’s currently no evidence of typical botnet behavior like DDoS attacks or malicious traffic routing. However, in some breaches, attackers were seen rerouting traffic through third-party systems, suggesting potential future infrastructure use.
Analyst Note: ASUS has issued firmware updates addressing CVE-2023-39780. Users are urged to update immediately, check for suspicious SSH keys in the authorized_keys file, and block the four known malicious IP addresses. If compromise is suspected, the best course of action is a factory reset, followed by secure reconfiguration using strong, unique credentials. As this campaign continues to silently grow a network of compromised routers, proactive defensive measures are essential.
(Bleeping Computer)
A new malicious campaign uncovered by security researchers involves over 100 deceptive Chrome browser extensions masquerading as legitimate tools like VPNs, AI assistants, and cryptocurrency utilities. While these extensions may offer some genuine features, they secretly connect to a command-and-control server operated by threat actors. This connection allows the attackers to steal sensitive browser data, like cookies, and execute remote scripts. Beyond stealing data, these extensions can also modify network traffic to inject ads, redirect users, or proxy web requests for further exploitation.
DomainTools researchers discovered the campaign by identifying more than 100 fraudulent domains used to promote the malicious tools, often through techniques like malvertising. These sites impersonate both well-known and fabricated brands such as Fortinet, YouTube, and Calendly. The deceptive websites encourage users to install extensions through “Add to Chrome” buttons, which link directly to harmful extensions hosted on the Chrome Web Store, lending them an air of credibility.
Although Google has removed several of the malicious extensions, some still remain active on the Chrome Web Store, highlighting a gap in detection and removal. The researchers warn that the malicious extensions ask for powerful permissions, enabling them to access browser cookies, inject scripts, and perform phishing attacks. For instance, the fake "fortivpn" extension can extract cookies and send them to a remote server, while also acting as a proxy to route user traffic through malicious infrastructure.
Analyst Note: The implications of this campaign are severe. By stealing session cookies, attackers could hijack accounts or penetrate corporate networks via compromised VPN access. Users are urged to be cautious when installing Chrome extensions and to prioritize those from trusted developers with strong reputations. Despite outreach efforts, Google has yet to publicly comment on its response to this specific threat, leaving open questions about the platform's ability to manage ongoing extension-based attacks.
The "TAKE IT DOWN Act," signed into law on May 20, 2025, criminalizes non-consensual intimate image-sharing, including deepfakes, and requires online platforms to remove such content within 48 hours of a verified survivor's request. The Act aims to protect individuals from the harm caused by the dissemination of non-consensual intimate imagery, including deepfakes, by creating a federal legal framework for addressing this issue.
|
