Record Patch Tuesday, a phishing takedown, and laptop farms

Hi, it's It's probably nothing. Today's a bit calmer than the last couple of days: a record-sized Patch Tuesday with one exploited bug that matters to almost everyone, a takedown aimed at the kits behind those parcel and toll texts, and US raids on North Korean laptop farms.

Microsoft's count depends on who did the maths. BleepingComputer has 1,411 flaws, 70 of them critical, while SecurityWeek's headline says 1,413. Either way, it's a record. The one that matters is a Windows Shell bug that Microsoft describes as command injection letting an unauthorised attacker bypass a security feature over a network. Reporting says that feature is Mark of the Web, the thing that triggers SmartScreen and Protected View warnings on files from somewhere sketchy. Microsoft says it's being exploited, though someone still has to act on a crafted file, such as one sent by email or IM. It hasn't shared anything about the attacks. CISA added it to its known exploited list on the thirteenth and gave US federal agencies until the sixteenth. SecurityWeek says Fujitsu, Anthropic and an independent researcher each reported it separately, which suggests it wasn't exactly well hidden.

On its own, a Mark of the Web bypass isn't a crisis, but it removes one of the few speed bumps between a phishing attachment and execution. One caveat: we couldn't read Microsoft's advisory directly, so these details come from trade reporting and the CISA feed.

The two publicly disclosed bugs are less urgent: a dot NET Framework WDAC bypass found by James Forshaw, which Microsoft rates as unlikely to be exploited, and a denial-of-service bug in MessagePack for C sharp. Mallory's summary also flags a remote code execution bug, rated 8.8, involving indirect prompt injection in the Copilot component shared by Visual Studio and SQL Server Management Studio. We haven't checked that one against Microsoft's advisory. This is also the last update for Windows 11 24H2 Home and Pro, and for Windows 10 Enterprise LTSB 2016. If any of those are still hanging around, they've just become a different kind of problem.

That phishing point leads nicely into the takedown. Microsoft, working with Japan's National Police Agency and Health-ISAC, got a US court order to seize and redirect domains behind three Chinese-language phishing services: YAM Store, CoGUI and Iron Man. Health-ISAC, relaying Microsoft's figures, says that since January they've enabled more than a billion malicious messages aimed at over 75,000 organisations in more than 150 countries. The Record says Microsoft also disabled more than 20,000 YAM Store-linked accounts and is blocking more than 100,000 impersonation domains. Iron Man reportedly sells thousands of templates tailored to Australia, Japan, India and other countries, covering postal services, traffic fines, tax agencies, banks and telcos. In other words, the stuff in your family group chat. Proofpoint says the CoGUI-family campaigns mostly hit Japan. Proofpoint expects the takedown to dent the kits' effectiveness, but nobody has shown a lasting drop in volume yet, and these operators do tend to have spare domains lying about.

In the US, the Justice Department's Operation Lonestar Roundup searched suspected laptop farms in Texas and seized about 187 devices. SecurityWeek says investigators searched 40 locations. An Ohio indictment charges two US nationals, who were arrested, and ten China-based defendants. All of them are presumed innocent. The DOJ says the scheme hit more than 70 US employers and brought in about three million US dollars for entities controlled by North Korea. According to Mallory's summary, which we haven't checked against CrowdStrike's own material, CrowdStrike links the activity to Famous Chollima and expects only limited, local disruption. That sounds about right for a model that just needs another spare bedroom full of laptops.

A quick update on the French supermarket fridges. ComplexDiscovery, citing AP, reports that the finance minister told Parliament about 700 of France's roughly 10,000 supermarkets were affected, about double the earlier tallies, and that food supply wasn't at risk. AP doesn't say how that figure was compiled. Copeland has reportedly acknowledged a vulnerability in a discontinued generation of controllers but hasn't confirmed any compromises in France, and a Reuters scan reportedly found at least 4,500 Danfoss web interfaces still online. Nothing links the attack to a specific Copeland or Danfoss flaw yet.

That's the lot. Patch the Shell bug, ignore the toll text, and I'll catch you tomorrow.

Don't forget, all our threat intelligence comes from Mallory dot A I. If you want intelligence your team can act on, reach out for a chat.