Europol Busts 'SIMCARTEL' CaaS Network; Everest Ransomware Claims Collins Aerospace Attack

New intelligence from Kaspersky reveals the 'Mysterious Elephant' APT has intensified its cyber espionage in 2025, with Bangladesh emerging as its second most-attacked nation after Pakistan. The group, active since at least 2023, employs a hybrid toolkit, repurposing code from groups like Confucius and Origami Elephant, rather than solely custom tools. A notable focus is intercepting communications on consumer messaging apps like WhatsApp, highlighting a new vector of compromise for government and diplomatic targets in South Asia. This update provides specific target countries and a clearer understanding of their evolving TTPs.

New analysis provides in-depth technical details for CVE-2025-59287, the critical WSUS RCE. The vulnerability stems from unsafe deserialization of an AuthorizationCookie object via the GetCookie() endpoint, leveraging a hardcoded AES-128-CBC key. An unauthenticated attacker can send a crafted cookie to achieve SYSTEM-level RCE. While not yet exploited in the wild, Microsoft assesses exploitation as 'more likely.' Specific detection methods include monitoring IIS logs for GetCookie() requests and EDR for w3wp.exe spawning suspicious processes.