HTG Threat Report

Threat Report 8/27/25

Written by Evan Kennedy | Aug 26, 2025 8:14:47 PM

Multiple Vulnerabilities in Microsoft Products
Could Allow for Remote Code Execution
 

 

Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user or exploited process. Depending on the privileges associated with the user or process, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. 

 

Affected Systems: 

  • Microsoft Edge 
  • Microsoft PC Manager 
  • Microsoft Purview Data Governance 
  • Windows 10 
  • Windows 11 
  • Windows Server 2008/2008 R2 
  • Windows Server 2012/2012 R2 
  • Windows Server 2016 
  • Windows Server 2019 
  • Windows Server 2022 
  • Windows Server 2025 

 

Risk 

  • Large and medium business entities: High 
  • Small business entities: High 

 

Remediation Recommendations 

  • Ensure all versions of all Microsoft products are updated to their latest versions 
  • Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 

 

References 

 

Vulnerability in Apple Products Could Allow
for
Arbitrary Code Execution 

 

Multiple vulnerabilities have been discovered in Apple products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. 

 

Affected Systems: 

  • Versions prior to iOS 18.6.2 and iPadOS 18.6.2 
  • Versions prior to iPadOS 17.7.10 
  • Versions prior to macOS Sonoma 14.7.8 
  • Versions prior to macOS Sequoia 15.6.1 
  • Versions prior to macOS Ventura 13.7.8 

 

Risk: 

  • Large and medium business entities: High 
  • Small business entities: Medium 

 

Remediation Recommendations 

  • Ensure Apple software has the latest version(s) installed 
  • Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 

References 


Multiple Vulnerabilities in Mozilla Products Could Allow for Arbitrary Code Execution  

 

Multiple vulnerabilities have been discovered in Mozilla Products, the most severe of which could allow for arbitrary code execution. Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.  

 

Affected Systems: 

  • Thunderbird versions prior to 140.2 
  • Thunderbird versions prior to 128.14 
  • Thunderbird versions prior to 142 
  • Focus for iOS versions prior to 142 
  • Firefox versions prior to for iOS 142 
  • Firefox ESR versions prior to 140.2 
  • Firefox ESR versions prior to 128.14 
  • Firefox ESR versions prior to 115.27 
  • Firefox versions prior to 142 

 

Risk 

  • Large and medium business entities: High 
  • Small business entities: Medium 

 

Remediation Recommendations 

  • Ensure all versions of all Mozilla products are updated to their latest versions 
  • Enact the Principle of Least Privilege (limit higher-level privileges to only the users that need it) 

References 

 

 

MacOS Malware Spreads via ClickFix Technique 

 

The cybercriminal group COOKIE SPIDER is distributing the SHAMOS macOS malware via the ClickFix social engineering technique, according to researchers at CrowdStrike. The attackers spread malicious ads related to macOS issues, targeting users searching for technical solutions. The phishing sites trick the user into copying and pasting a malicious command into their computer's terminal. CrowdStrike notes, "The one-line installation command enables eCrime actors to directly install the Mach-O executable onto the victim’s machine while bypassing Gatekeeper checks." 


 

Murky Panda Targets Cloud Environments 

 

CrowdStrike has published a report on a cyberespionage campaign by a China-nexus threat actor dubbed "MURKY PANDA" which overlaps with activity tracked in the security industry as "Silk Typhoon." MURKY PANDA is notable for its "extensive knowledge of cloud environments and custom application logics," and the group has "shown considerable ability to quickly weaponize n-day and zero-day vulnerabilities." Since late 2024, the threat actor has been targeting North American entities in the government, technology, academic, legal, and professional services sectors. The group exploits internet-facing appliances to gain initial access and deploy its custom malware family "CloudedHope."