This month’s cybersecurity highlights show how tools and techniques continuously evolve. Scattered Spider has expanded their attacks from retail companies to airlines, demonstrating how persistent threat actors adapt to exploit new sectors. Meanwhile, the emergence of EchoLeak reveals the hidden risks of integrating AI into everyday workflows, reminding us that innovation must be matched with vigilance.
Techniques
EchoLeak
EchoLeak is a newly discovered vulnerability designed to specifically target Microsoft 365 Copilot. Unlike typical email based cyberattacks, EchoLeak does not require users to click on or open malicious emails, instead, an attacker sends a specially crafted email containing hidden instructions for Copilot. When Copilot scans the user’s inbox to answer questions or generate summaries, it inadvertently reads these secret instructions and retrieves sensitive information, such as confidential documents or private conversations. The instructions then ask Copilot to embed the data in a URL for an image link, then when the browser attempts to fetch the image, the URL is passed to a server controlled by the malicious party, who collect the information.
Microsoft has since released an update addressing EchoLeak, but the vulnerability showcases the security risks posed by integrating AI into everyday business tools and allowing it to take actions in the user context. Organisations should consider proactively restricting AI systems from processing untrusted external emails and closely monitor their AI assistants for unusual behaviour to prevent similar information leaks in the future. We recommend not integrating AI tools that can take direct actions within email accounts and educating staff on the cybersecurity risks introduced by AI tooling.
AI Bug Hunter – XBOW
Previously we have reported on AI agents being used to automatically find vulnerabilities – Microsoft have been utilising AI to discover vulnerabilities in their operating system with fixes applied during one of their monthly patching cycles. A powerful new AI security testing tool called XBOW has reached a significant milestone – it has topped the HackerOne (a global bug bounty platform) US leaderboard by autonomously discovering and submitting over 1,000 real-world security vulnerabilities within a 90-day period. XBOW was initially trained on challenge-based environments, such as capture the flag scenarios, as well as open-source code. Once trained, XBOW was released for use in in full black-box scenarios, where it had no inside information.
This groundbreaking achievement demonstrates that AI can now perform the full lifecycle of security testing without human intervention. Unlike traditional penetration testing or human-led bug bounties, XBOW runs continuously, and can quickly scan large-scale digital environments for vulnerabilities such as SQL injection, cross-site scripting (XSS), and server-side request forgery (SSRF) – the result is faster, broader, and more consistent security coverage.
Microsoft UEFI Secure Boot Flaw
An arbitrary overwrite vulnerability was discovered in UEFI Secure Boot, which allows attackers to manipulate a variable in applications trusted by Microsoft’s widely distributed UEFI CA 2011 certificate, allowing for the complete disabling of Secure Boot, or persistence beyond the OS (Operating System) layer of the device.
Secure Boot is a platform-level security feature built into the firmware of modern devices that runs during power-on. It checks the digital signatures of the bootloader and other core components against a trusted database of approved signatures (stored on device), to ensure that these have not been maliciously altered. It is one of the core controls used in avoiding malicious bootloaders running, directly protecting the kernel and integrity of the OS – which are mostly isolated from activities performed in the user context.
Due to previous concerns around this certificate, Microsoft issued a new certificate in 2023, and a revocation for the 2011 certificate that has been scheduled for early 2026. Revoking the certificate immediately is not possible as many devices and firmware components still rely on this certificate, and manufacturers of hardware and firmware require time to migrate to the new certificate. Microsoft provides firmware updates, including the distribution and revocation of these certificates via their regular update channels, proving the importance of keeping your device up to date.
Diode recommends using automatic OS updates where possible to enable devices to receive timely security updates.
Happenings
[Global] Scattered Spider Targets Airlines
Scattered Spider, the APT (Advanced Persistent Threat) group discussed in the previous month, has moved on from casinos, retailers, and insurers to the aviation sector. Google-owned Mandiant and Palo Alto Networks’ Unit 42 disclosed that they had responded to multiple airline and transportation breaches showing signs of the group’s techniques, and the FBI has since echoed the warning. Although the investigators have not publicly named victims, recent cyber incidents at Hawaiian Airlines and Canada’s WestJet match the timeline of Scattered Spider’s new campaign.
According to the FBI and incident responders, Scattered Spider’s pivot relies on the same playbook that previously crippled Marks & Spencer’s; persuasive social engineering calls to airline IT helpdesks, convincing staff to reset MFA (Multifactor Authentication) or add rogue devices, followed by rapid cloud and on-prem exploitation to harvest credentials, disable backups, and employ ransomware or steal data. Organisations should support helpdesks to implement strong identity verification and remind staff to remain sceptical of any requests for MFA or credential resets that come through out of the ordinary channels – as long as humans are involved in the chain, they will remain a weakness that malicious actors will seek to exploit.
[UK] Disgruntled Former Employee Cyber Spree
31-year-old IT worker in West Yorkshire has been sentenced to 7 months imprisonment for causing £200,000 worth of intentional business and reputational damages to their former employer. The man went on a “digital rampage” in 2022 after being informed of his suspension from work, including changing every key password and breaking the company’s MFA. This locked staff out of critical systems disrupting operations for customers in the UK, Germany, and Bahrain. Investigators later discovered phone records of the man boasting about the sabotage.
This is a textbook case of an insider risk, where a disgruntled worker sabotages the company; Diode recommends that companies employ processes to revoke privileged access at the time of suspension, dismissal, or serious investigation to avoid such threats.
[NZ] Contractors Sentenced in Aotearoa’s Largest Private Sector Corruption Case
The two Australian men responsible for what has been described by the SFO (Serious Fraud Office) as New Zealand’s largest ever private sector corruption case were sentenced to three years in the Auckland High Court. In April 2023 the SFO levelled charges against two men, Mark Lester and Sean Byran, for ‘giving and receiving gifts to and from an agent’ – in effect, monetary kickbacks.
Mr Lester was initially contracted by Spark in 2013 to provide advice and oversee testing for a major upgrade to Spark’s customer service platform. In this capacity, he recommended using Mr Bryan’s company, Victory IT, to provide testing against the upgrades to the platform, resulting in over $20m in contracts being awarded to the company between 2014 and 2017. Although the two men knew each other, the relationship was never disclosed. In the same period around $4m was paid from Victory IT’s accounts to Mr Lester over a number of payments, which the SFO believed had no commercial basis. The Auckland high court found that there was indeed no commercial basis, and that in return for the payments Mr Lester had promoted Mr Bryans business interests. Spark is pursuing a civil case against the pair to recover the money.
Although the SFO refrained from commenting on process failures by Spark, this incident highlights the importance of a robust and transparent procurement process, and the importance of competitive tendering.
[TO] Tonga’s National Health Database Seized
The government of Tonga has refused to pay a $1.6 million NZD ransom after attackers took control of the country’s Nation Health Information System (NHIS). The attackers exfiltrated data, and deployed ransomware on the system bringing it offline, causing hospitals to revert to paper-based systems. The attack was claimed by Inc. Ransom Group, who have historically used spear phishing (highly targeted phishing, often utilising personal information) as an initial ingress point, although details of this attack’s initial vector have yet to be disclosed. The group released several files to provide proof they exfiltrated the database, and the Tongan Minister for Health has asked that any members of the public that the information reaches not share it further, as the information includes confidential records, with a real chance of harming individuals. The Minister is confident that a full system recovery with no data impact is possible, and the Australian Government has deployed their Cyber RAPID (Rapid Assistance and Proactive Incident Response) Team to assist with restoring systems. Full recovery has so far been challenging, as the system lacks secure off-site backups, with the Tongan Police Minister making comments critical of past governments for ignoring warnings that Tonga’s infrastructure is not prepared to deal with current cyber threats.
Smaller pacific nations face serious and increasing risks of cyber-attacks from advanced groups and nation states. Many of these nations currently lack the infrastructure and resources to adequately combat these threats without assistance from New Zealand and Australia.