Cross-Sector Threat Briefing
Software distribution, identity access and exposed management systems recur across this period’s actionable reporting. Separate incidents show why recovery needs to address stolen credentials and persistent access as well as the original entry point.
Key developments
Trusted software channels distribute credential-stealing code
Compromised cPGuard updates collected Linux server secrets, while LiteLLM’s release takeover followed an unrevoked key and privileged GitHub token theft. A separate tampered Claude Code extension in Cursor attempted SSH persistence; official distribution channels were not affected. [1] [2] [3]
Help-desk impersonation leaves durable certificate access
Microsoft investigated attackers using external Teams contacts and Quick Assist to reach Windows workstations, then abusing misconfigured AD CS to obtain privileged login certificates. One intrusion led to data theft; certificate access could survive password resets, making this conditional on the organisation’s identity stack. [4]
Exploited web components expose industrial management
Researchers observed malicious Node-RED flows deploying bots and persistent command endpoints on exposed instances, linked to a Siemens IoT2050 advisory. Separately, industrial vendors identified PHP2Shell exposure in selected products; relevance depends on installed equipment, not the sector label alone. [5] [6] [7]
What needs attention
- Check cPGuard, LiteLLM and Cursor extension versions against the linked advisories. On affected hosts, remove persistence and rotate reachable secrets; updating or uninstalling alone may not remove the attacker’s access. [1] [2] [3]
- Verify unsolicited support requests independently and restrict remote assistance. Where AD CS is used, assess ESC1/ESC8 exposure and revoke attacker-issued certificates alongside passwords and sessions during containment. [4]
- Inventory relevant Node-RED, Siemens and PHP-based industrial deployments against current vendor advisories. Restrict management interfaces and inspect Node-RED flows for unexpected exec nodes or HTTP command endpoints before restoring normal access. [5] [6] [7]
Sources
- Hackers hijack cPGuard autoupdate to deploy backdoor, steal data ↗
- Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline ↗
- Malicious Claude Code Extension Served in Cursor Supply Chain Attack ↗
- Attackers Pose as IT Support on Microsoft Teams, Abuse AD CS to Steal Company Data ↗
- Attackers Exploit Critical Siemens IoT2050 Flaw to Plant Remote Command Backdoors ↗
- Critical Node-RED Flaw Exploited in Attacks ↗
- Industrial Vendors Check Products for PHP2Shell Vulnerabilities ↗