Cyber Intelligence Weekly (March 16, 2025): Our Take on Three Things You Need to Know // Echelon Risk + Cyber

Welcome to our weekly newsletter where we share some of the major developments on the future of cybersecurity that you need to know about. Make sure to follow my LinkedIn page as well as Echelon’s LinkedIn page to receive updates on the future of cybersecurity!

To receive these and other curated updates to your inbox on a regular basis, please sign up for our email list here: https://echeloncyber.com/ciw-subscribe

Before we get started on this week’s CIW, I’d like to highlight our continuous penetration service.

🔁 Continuous Penetration Testing: Stay Ahead of Threats

Traditional pentests are snapshots in time — our Continuous Penetration Testing service gives you real-time visibility into your evolving attack surface. We act like real attackers, all year round, so you’re never caught off guard.

Key Benefits:

🕵️♂️ Ongoing offensive testing tailored to your environment
🚨 Immediate alerting and reporting of critical findings
🔁 Frequent retesting to validate remediation
📊 Executive-level dashboards & analyst-ready reports
🛡️ Reduce risk exposure between annual testing cycles

Learn more here: https://echeloncyber.com/services/offensive-security-and-testing/continuous-penetration-testing

Learn more here:

Away we go!

1. Silent Commits, Big Impact: How a GitHub Action Was Hijacked

Palo Alto Unit 42 recently reported a significant breach of the open-source supply chain, whereby attackers recently compromised popular GitHub actions to target thousands of repositories, including one associated with Coinbase. The incident began with a silent infiltration of the reviewdog/action-setup GitHub action. From there, the attacker was able to manipulate a widely-used action, tj-actions/changed-files, which had been integrated into over 23,000 public repositories.

The compromise enabled the attacker to quietly inject malicious code that harvested sensitive secrets from CI/CD pipeline runners. Investigators believe the campaign initially aimed to target Coinbase’s open-source repository, agentkit, by manipulating GitHub workflows to expose environment variables during pipeline execution. The attackers exploited GitHub’s forking and tagging mechanisms to introduce “shadow commits” — a stealth tactic that left minimal traces and avoided triggering audit logs.

Once the attacker secured write-level access to critical repositories, they began altering Git tags to point at malicious commits, triggering automatic execution across any pipeline using the affected actions. In the process, secrets and credentials were exposed in logs, although it appears the campaign avoided deeper damage such as remote execution or persistent access. Coinbase swiftly responded after being notified and confirmed no harm to their systems or projects.

This incident underscores the growing risks posed by insecure third-party GitHub actions, especially those integrated into automation workflows. It’s a stark reminder that default configurations, unpinned dependencies, and excessive pipeline permissions remain a soft target for threat actors. Developers and DevSecOps teams must adopt rigorous controls, such as commit pinning, restricted permissions, and vigilant monitoring, to better defend against these increasingly sophisticated threats.

APT43 Using Dropbox to Spread Malware

In February 2025, cybersecurity researchers from Securonix uncovered an ongoing cyber-espionage campaign, dubbed DEEP#DRIVE, orchestrated by the North Korean threat actor known as Kimsuky, or APT43. This campaign primarily targets South Korean business, government, and cryptocurrency sectors. The attackers employ sophisticated techniques, leveraging PowerShell scripts and cloud services like Dropbox to infiltrate systems and exfiltrate data.

Attack Vector and Methodology

The DEEP#DRIVE campaign initiates with highly tailored phishing emails crafted in Korean, masquerading as legitimate documents. These emails contain attachments in formats such as .HWP, .XLSX, and .PPTX, disguised as work logs, insurance documents, or cryptocurrency-related files. Upon opening, these attachments trigger a multi-stage infection process.

The initial payload is a ZIP archive containing a Windows shortcut (.LNK) file that appears as a genuine document. When executed, this shortcut runs embedded PowerShell code designed to retrieve and display a decoy document hosted on Dropbox. Simultaneously, it establishes persistence on the victim's system by creating a scheduled task named "ChromeUpdateTaskMachine."

Subsequent stages involve additional PowerShell scripts fetched from Dropbox. These scripts perform reconnaissance by collecting system information and active processes, which are then exfiltrated back to the attacker's Dropbox repository using OAuth token-based authentication. This method allows seamless data transfer while evading traditional security measures.

Attack Path

Source:

Use of Cloud Services for Stealth and Evasion

A notable aspect of this campaign is the strategic use of cloud services, particularly Dropbox, for both payload distribution and data exfiltration. By utilizing OAuth tokens for authentication, the attackers can interact with Dropbox's API, facilitating covert data transfers. This approach enables the threat actors to bypass conventional IP or domain-based blocklists, enhancing the stealth and persistence of their operations.

The attackers demonstrate operational security by dynamically managing their infrastructure. Key links and resources are rapidly removed after initial stages of the attack, complicating analysis and incident response efforts. This tactic suggests active monitoring and adaptation by the threat actors to maintain the campaign's effectiveness and evade detection.

Implications and Recommendations

The DEEP#DRIVE campaign underscores the evolving tactics of nation-state actors in leveraging legitimate cloud services to conduct malicious activities. Organizations, especially those within the targeted sectors, should implement robust security measures, including:

Enhanced Email Security: Deploy advanced phishing detection and prevention tools to identify and block malicious emails before they reach end-users.
PowerShell Activity Monitoring: Continuously monitor and analyze PowerShell script executions within the network to detect anomalous or unauthorized activities.
Cloud Service Usage Auditing: Regularly audit and monitor interactions with cloud services like Dropbox to identify unauthorized access or data transfers.
User Education and Awareness: Conduct regular training sessions to educate employees about phishing attacks and safe handling of email attachments.

By adopting these proactive measures, organizations can enhance their defenses against sophisticated threats posed by adversaries like Kimsuky and mitigate potential risks associated with such cyber-espionage campaigns.

2. Shadows in the Network: Chinese-Linked APT Targets Taiwan’s Infrastructure

Cisco Talos has highlighted an advanced cyber espionage campaign, allegedly orchestrated by threat actor group UAT-5918, is targeting Taiwan’s critical infrastructure in what experts suspect to be a state-backed operation linked to China. Security researchers from Cisco Talos have uncovered a multi-year effort by the group to infiltrate and maintain access to systems across vital sectors, including telecom, healthcare, and information technology. The tactics and tools used show strong overlap with operations known to be associated with groups like Volt Typhoon, Flax Typhoon, and Earth Estries.

The attackers reportedly gain initial access by exploiting known vulnerabilities in unpatched internet-facing servers. Once inside, they deploy an arsenal of open-source tools to map internal networks, steal credentials, install backdoors, and pivot laterally across systems. These include tools like Mimikatz, Earthworm, FRPC, and In-Swor. Their objective appears to be long-term access and intelligence gathering, with stealthy use of web shells and administrative account creation to remain persistent and undetected.

Interestingly, the campaign’s signature closely resembles those of Volt Typhoon and Flax Typhoon—two groups previously linked to China's cyber operations. These threat actors have been implicated in attacks beyond Taiwan, spanning Southeast Asia and even the U.S., where the FBI has actively dismantled malware tied to similar campaigns. Analysts note that while UAT-5918 employs familiar playbooks, it also uses custom tooling not publicly seen before, suggesting a distinct and possibly more specialized unit.

This revelation arrives amid heightened tensions between Taiwan and China, with cybersecurity becoming a front-line concern. Parallel research from ESET also points to another Chinese-linked effort, dubbed “Operation FishMedley,” further emphasizing the scale and persistence of campaigns targeting Taiwanese institutions. These discoveries spotlight the urgent need for bolstered cyber defenses, timely patching, and rigorous monitoring across public and private sector networks.

Red Teaming 100 GenAI Products: Lessons from Microsoft’s AI Red Team

Microsoft’s AI Red Team recently published key findings from red teaming over 100 generative AI (GenAI) products, including applications, features, copilots, plugins, and models, offering critical insights for security practitioners and AI safety leaders. Their comprehensive white paper introduces a novel threat model ontology that combines canonical security frameworks like MITRE ATT&CK with emerging AI-specific attack vectors to provide a cohesive approach to analyzing both security risks and responsible AI gaps.

Main takeaways from the research include:

AI systems amplify traditional security risks while introducing new attack vectors. Organizations should maintain robust security hygiene while developing AI-specific security capabilities.
Human expertise remains irreplaceable in AI security testing, especially for evaluating complex scenarios involving subject matter expertise, cultural nuances, and psychosocial impacts.
Effective AI security requires a defense-in-depth approach combining continuous red teaming, best-practice security controls, and AI-specific safeguards in iterative “break-fix cycles”.

The research underscores a crucial reality: GenAI systems do not just introduce new attack surfaces—they amplify existing security risks. The team’s findings reveal what while prompt injections and model evasion techniques remain prominent exploits, traditional vulnerabilities like Server-Side Request Forgery (SSRF) remain equally compromising to AI systems. The diagram below shows how the well-known SSRF vulnerability can be exploited in a GenAI system. This dual threat landscape requires security teams to evolve their assessment methodologies while maintaining rigorous coverage of fundamental security practices.

Figure 1: Process Flow of SSRF Vulnerability in GenAI Application

Most notably, the research challenges the notion that AI security can be fully automated. Although the Microsoft team leveraged sophisticated automation tools like PyRIT (i.e., their open-source Python Risk Identification Toolkit), they found that human expertise is irreplaceable for evaluating content risks, contextual harms, and human-AI interactions. This human expertise spans subject matter knowledge, cultural competence, and emotional intelligence. Their case studies demonstrate how technical vulnerabilities often intersect with nuanced psychosocial and cultural factors that automated tools currently cannot meaningfully assess.

The team’s findings highlight a defense-in-depth strategy that combines traditional security hardening, AI-specific safeguards, and continuous red teaming that adjusts to novel harms in a “break-fix cycle”, also known as purple-teaming. This research provides both a strategic framework and tactical guidance for securing AI systems, highlighting the importance of cross-functional expertise in robust AI security programs. Fo detailed case studies and technical recommendations on developing AI security strategies, reference the full report.

3. ZDI-CAN-25373: How Nation-State Hackers Weaponize Windows Shortcuts

Security researchers at Trend Micro have uncovered a persistent and sophisticated campaign involving the abuse of Windows shortcut files (.lnk) by nation-state actors. The issue, which dates back to at least 2017, involves the manipulation of how Windows displays shortcut files — making it nearly impossible for victims to detect malicious content hidden in plain sight. The vulnerability, labeled ZDI-CAN-25373 by Trend Micro’s Zero Day Initiative (ZDI), allows attackers to embed commands inside shortcut files that trigger hidden payloads when opened.

Despite the severity of the issue, Microsoft has not issued an immediate patch, classifying it as a low-priority bug. In the meantime, threat groups from North Korea, China, Iran, and Russia — including APT37 and Kimsuky — have capitalized on the flaw, primarily for espionage and data theft. Some of these attackers camouflage malicious shortcuts as seemingly innocent PDF files, complete with matching icons, to deceive their targets. Nearly 1,000 malicious samples have been identified, with many more likely undetected.

The bulk of attacks observed have targeted critical sectors such as government agencies, military entities, energy providers, and cryptocurrency firms. Most victims are located in North America, but reports of exploitation span across Europe, Asia, and South America. One notable detail is the level of collaboration seen among North Korean groups, suggesting internal coordination and resource sharing.

This growing trend of zero-day exploitation reflects the escalating stakes in cyber warfare. As these threats evolve, organizations are urged to be hyper-vigilant with their endpoint and network defenses, review shortcut file handling policies, and proactively hunt for suspicious .lnk activity — especially in environments tied to sensitive infrastructure.

Thanks for reading!

About us: Echelon is a full-service cybersecurity consultancy that offers wholistic cybersecurity program building through vCISO or more specific solutions like penetration testing, red teaming, security engineering, cybersecurity compliance, and much more! Learn more about Echelon here: https://echeloncyber.com/about