One Token to Rule Them All — Vulnerability in Azure Entra ID

In mid-September 2025, a vulnerability designated as CVE-2025–55241 was discovered in Microsoft Azure Entra ID (formerly Azure AD). This flaw represented one of the most serious IAM weaknesses ever identified in Microsoft cloud services — it allowed virtually anyone to gain administrator access across tenants worldwide through mere exploitation of a special so-called Actor token.

The essence of the vulnerability was an error in the validation of ‘actor’ tokens — undocumented tokens intended for internal communication within the Microsoft cloud and services environment. The combination of insufficient controls when using the old Azure AD Graph API with these tokens allowed an attacker to impersonate any user (including Global Admin) in any tenant, provided they knew the tenant ID and user ID.

The attacker could not only read and modify tenant identity or settings but also potentially escalate privileges in other connected tenants.

Microsoft responded to the vulnerability relatively quickly — patches were implemented within three days, and additional mitigations were prepared within several weeks. The fix primarily involved removing the ability to use such exploitable tokens with legacy APIs and tightening validations in Azure services.

MySonicWall Portal Attacked, Hackers Downloaded Firewall Backups

Hackers penetrated the MySonicWall cloud portal and obtained backup configuration files for thousands of customers’ firewalls. The attackers used a series of brute-force attacks and exploited weaknesses in authentication mechanisms. As a result, they downloaded backup configurations containing not only network settings and firewall rules but also encrypted login credentials, shared VPN keys, and other sensitive information needed for system administration.

Although the login credentials themselves were protected by encryption, detailed knowledge of the entire network configuration makes it easier for attackers to map infrastructure and search for potentially vulnerable points.

SonicWall responded to the incident by disabling cloud backup and notifying potentially affected customers. Additionally, they issued recommendations for immediate rotation of all passwords, authentication tokens, and thorough review of configuration logs for suspicious activity. They advised organizations to temporarily limit remote access, especially through SSLVPN interfaces, and conduct detailed audits.

Iranian Group UNC1549 Targets Telecommunications Companies in Europe

Swiss company PRODAFT has warned about an extensive campaign led by the Iranian cyber-espionage group UNC1549, also known as Subtle Snail. This group, closely linked to the IRGC, attacks highly relevant targets in Europe primarily from the telecommunications, aviation, and defense sectors. The campaign successfully compromised dozens of devices across eleven telecommunications companies.

The key element of the attack was the exploitation of the LinkedIn professional network. Attackers created fake HR specialist profiles and approached employees with highly privileged access with attractive job offers. After gaining their trust, they redirected them to convincingly-looking websites, often mimicking corporate portals or legitimate recruitment platforms, where they offered them an archive with malicious software for download.

At the center of the malicious activity was MINIBIKE malware, developed in C++ with an emphasis on modularity and low detectability. The malicious archive typically contained a legitimate-looking binary that loaded arbitrary code through DLL side-loading techniques. After execution, system information collection followed, along with installation of additional modules for stealing emails or login credentials, and often keylogging or screen capture.

UNC1549 did not limit its focus to the telecommunications sector alone — security reports indicate that attacks also targeted aviation and defense sectors.

HybridPetya Targets Secure Boot

HybridPetya is a newly discovered malware that raises the bar for ransomware attacks to an entirely new level. This malicious code combines the destructive properties of the well-known NotPetya and the encryption mechanisms of the original Petya, while bringing the ability to attack and bypass even UEFI Secure Boot protection for the first time in ransomware history.

What makes HybridPetya truly dangerous is its ability to install a malicious EFI module on the EFI System Partition. This allows it to activate immediately at computer startup, before the operating system itself. The critical exploitation appeared thanks to CVE-2024–7344 in the UEFI bootloader Howyar Reloader, which the malware uses to bypass Secure Boot.

HybridPetya leverages its hybrid nature not only to encrypt data (especially MFT on NTFS disks) but also to encode the key needed for recovery. Unlike NotPetya, however, it doesn’t ‘just’ destroy data but offers the possibility of payment for recovery — the classic ransomware model.

Analyzed samples of HybridPetya have not yet been recorded in real attacks but appeared on VirusTotal, where they were uploaded by someone from an IP address in Poland. Security experts therefore warn that although this may be a proof of concept, the risk of mass deployment is high. Attackers are increasingly exploiting the less protected UEFI/firmware area, which is extremely difficult for defenders and regular end users to monitor and secure.