Risky Business #799 -- Everyone's Sharepoint gets shelled

Risky Biz returns after two weeks off, and there sure is cybersecurity news to catch up on. Patrick Gray and Adam Boileau discuss:

• Microsoft tried to make outsourcing the Pentagon’s cloud maintenance to China okay (it was not)

• She shells Sharepoint by the sea-shore (by ‘she’ we mean ‘China’)

• Four (alleged) Scattered Spider members arrested (and bailed) in the UK

• Hackers spend $2700 to buy creds for a Brazilian payment system, steal $100M

• Fortinet has SQLI in the auth header, Citrix mem leak is weaponised, HP hardcodes creds and Sonicwalls get user-moderootkits. Just security vendor things!

This week’s episode is sponsored by Airlock Digital. CEO David Cottingham talks through what it takes to build a mature, resilient management platform for a security critical system.

This episode is also available on Youtube (youtu.be/Xs3q4LG5yvg).

Show notes

• Update on DOD’s cloud services (x.com/secdef/status/1946324468898426899)

• Microsoft to stop using engineers in China for tech support of US military, Hegseth orders review (reuters.com/world/us/microsoft-stop-using-engi…)

• A Little-Known Microsoft Program Could Expose the Defense Department to Chinese Hackers (propublica.org/article/microsoft-digital-escor…)

• While DOD policy bans unauthorized apps like TikTok from being on employees phones over national security risks (x.com/LauraLoomer/status/1947310343425794189)

• Microsoft Fix Targets Attacks on SharePoint Zero-Day – Krebs on Security (krebsonsecurity.com/2025/07/microsoft-fix-targ…)

• National Guard was hacked by China's 'Salt Typhoon' group, DHS says (nbcnews.com/tech/security/national-guard-was-h…)

• Suspected contractor for China’s Hafnium group arrested in in Italy | Cybersecurity Dive (cybersecuritydive.com/news/suspected-contracto…)

• Singapore accuses Chinese state-backed hackers of attacking critical infrastructure networks | The Record from Recorded Future News (therecord.media/singapore-accuses-chinese-back…)

• UK Arrests Four in ‘Scattered Spider’ Ransom Group – Krebs on Security (krebsonsecurity.com/2025/07/uk-charges-four-in…)

• Four people bailed after arrests over cyber attacks on M&S, Co-op and Harrods (nation.cymru/news/four-people-bailed-after-arr…)

• Brazilian police arrest IT worker over $100 million cyber theft | The Record from Recorded Future News (therecord.media/brazil-police-arrest-worker-th…)

• At Least 750 US Hospitals Faced Disruptions During Last Year’s CrowdStrike Outage, Study Finds | WIRED (wired.com/story/at-least-750-us-hospitals-face…)

• Hacker returns cryptocurrency stolen from GMX exchange after $5 million bounty payment | The Record (therecord.media/hacker-returns-stolen-gmx-bounty)

• Indian crypto exchange CoinDCX says $44 million stolen from reserves | The Record (therecord.media/indian-crypto-dcx-millions-sto…)

• Chainalysis: $2.17 billion in crypto stolen in first half of 2025, driven by North Korean hacks | The Record (therecord.media/chainalysis-crypto-stolen-bill…)

• PoisonSeed bypassing FIDO keys to ‘fetch’ user accounts (expel.com/blog/poisonseed-bypassing-fido-keys-…)

• Risky Bulletin: Browser extensions hijacked for web scraping botnet (risky.biz/risky-bulletin-browser-extensions-hi…)

• A Startup is Selling Data Hacked from Peoples’ Computers to Debt Collectors (404media.co/a-startup-is-selling-data-hacked-f…)

• A surveillance vendor was caught exploiting a new SS7 attack to track people's phone locations | TechCrunch (techcrunch.com/2025/07/18/a-surveillance-vendo…)

• Ukrainian hackers wipe databases at Russia's Gazprom in major cyberattack, intelligence source says (kyivindependent.com/ukrainian-intel-hackers-hi…)

• File transfer company CrushFTP warns of zero-day exploit seen in the wild | The Record (therecord.media/file-transfer-crushftp-zero-day)

• HPE warns of hardcoded passwords in Aruba access points (bleepingcomputer.com/news/security/hpe-warns-o…)

• Pre-Auth SQL Injection to RCE - Fortinet FortiWeb Fabric Connector (CVE-2025-25257) (labs.watchtowr.com/pre-auth-sql-injection-to-r…)

• Researchers, CISA confirm active exploitation of critical Citrix Netscaler flaw | Cybersecurity Dive (cybersecuritydive.com/news/researchers-cisa-ex…)

• Google finds custom backdoor being installed on SonicWall network devices - Ars Technica (arstechnica.com/security/2025/07/google-finds-…)

• Hackers Can Remotely Trigger the Brakes on American Trains and the Problem Has Been Ignored for Years (404media.co/hackers-can-remotely-trigger-the-b…)