Zero-Days in Microsoft Defender & Oracle PeopleSoft Exploited; Ransomware Hits Australian Sugar Giant

The UNC6508 campaign's duration has been refined to over two years (September 2023 to November 2025), indicating a longer period of compromise. Crucially, a novel exfiltration technique was identified: the threat actor manipulated Google Workspace email forwarding rules to automatically send sensitive emails containing specific keywords to attacker-controlled Gmail accounts. This 'Living off the Trusted Service' method allowed for stealthy data theft, bypassing traditional network security controls and targeting research on molecular discovery and clinical drug trials.

The FBI has issued a warning about 'Kali365', a new AI-powered Phishing-as-a-Service platform that automates sophisticated MFA-bypassing attacks against Microsoft 365 environments. Kali365 facilitates OAuth token theft through device code phishing, making these advanced techniques accessible to a broader range of threat actors. The new report provides critical detection guidance, including specific cyber observables for monitoring Microsoft Entra ID logs. These include looking for unusual requests to the `oauth2/v2.0/devicecode` API endpoint and auditing for suspicious application consents. This development signifies an escalation in the accessibility and sophistication of these persistent threats, requiring organizations to enhance their monitoring and mitigation strategies.

New reports confirm the University of Nottingham breach by ShinyHunters impacted approximately 455,000 current and former students. Attackers exfiltrated 40 GB of sensitive data, including names, addresses, and critically, passport numbers. The university has notified affected individuals and reported the incident to the UK's ICO and Action Fraud. This update provides specific impact metrics for a previously identified victim, highlighting the severe consequences of the Oracle PeopleSoft zero-day exploitation. Additionally, new hunting hints for the /PSEMHUB/ URL pattern have been identified.