Cisco and Microsoft Grapple with Actively Exploited Zero-Days; Foxconn Hit by Major Ransomware Attack

The new report details Mustang Panda's (aka Twill Typhoon) continued espionage, now using fake CDN sites impersonating Apple and Yahoo for initial access. This campaign, active since September 2025, targets organizations in the Asia-Pacific and Japan, including the finance sector. Attackers leverage DLL sideloading to deploy an updated FDMTP modular backdoor (v3.2.5.1), which is heavily obfuscated and provides remote command execution and data theft capabilities. This represents an evolution in their initial access and malware toolset for ongoing intelligence gathering.

The Nitrogen ransomware group has provided further evidence of the alleged 8TB data exfiltration from Foxconn's North American operations by posting screenshots of stolen files. These screenshots reportedly include hardware schematics and confidential project details from clients like Apple, Google, Intel, and Nvidia. Foxconn has confirmed the attack and operational disruption but has not yet verified the extent of the data theft claims. This development strengthens the credibility of the attackers' claims regarding intellectual property theft.

Further technical details have been released for the YellowKey and GreenPlasma Windows zero-days. YellowKey, a BitLocker bypass, is confirmed to affect Windows 11, Server 2022, and Server 2025, leveraging the Windows Recovery Environment (WinRE) with specially crafted FsTx files. GreenPlasma, a local privilege escalation, exploits the CTFMON service by manipulating memory-section objects to achieve SYSTEM-level privileges. Both vulnerabilities now include MITRE ATT&CK mappings (T1553 for YellowKey, T1068 for GreenPlasma), providing clearer context for detection and mitigation strategies. Updated hunting hints and remediation steps, such as monitoring WinRE reboots and enforcing BitLocker pre-boot authentication, have also been provided.

This update reinforces the NCC Group's findings on the industrial sector being the primary target for ransomware. It expands on the technical analysis of IT-to-OT lateral movement, explicitly mentioning initial access via VPN vulnerabilities (MITRE T1133) and network service scanning (MITRE T1046) for discovery. The mitigation recommendations are also further detailed, highlighting the critical importance of immutable backups for both IT systems and OT configurations to ensure recovery post-attack.