Week of February 10, 2025: 8Base leak site seized, and Microsoft patches two exploited zero-days

What mattered to security leaders in the week of February 10, 2025? An international operation coordinated by Europol took down the 8Base ransomware group's leak site and 27 servers while Thai police made four arrests, and Microsoft's February Patch Tuesday fixed two Windows zero-days under active exploitation. Apple also patched an exploited flaw that could switch off USB Restricted Mode on locked iPhones, and Microsoft and Volexity described Russian campaigns built on a Sandworm access team and on device code phishing.

8Base leak site seized as Phobos operation spans 14 countries

On February 10 Thai police raided four locations in Phuket and arrested four people suspected of leading the 8Base ransomware group, who are also suspected of stealing about $16 million from more than 1,000 victims using Phobos ransomware. The same day, Bavarian police seized the 8Base leak site and 27 linked servers were taken down. Europol said agencies from 14 countries took part and that more than 400 companies were warned of ongoing or imminent attacks. For defenders, the warnings to hundreds of firms showed the value of law enforcement visibility into active ransomware operations. (Help Net Security)

February Patch Tuesday closes two exploited Windows privilege flaws

Microsoft's February 11 update fixed 56 vulnerabilities, including two zero-days under active exploitation. CVE-2025-21418 is an elevation of privilege bug in the Windows Ancillary Function Driver for WinSock that can yield SYSTEM privileges, and CVE-2025-21391 affects Windows Storage and lets attackers delete targeted files, which could make services unavailable. Researchers noted that privilege escalation bugs like these are usually chained with a code execution flaw, so the fixes matter even where initial access is thought to be blocked. (Help Net Security)

Apple fixes an exploited bypass of USB Restricted Mode

Apple urged users of iOS and iPadOS 18 and iPadOS 17 to update after fixing CVE-2025-24200, which allowed a physical attack to disable USB Restricted Mode on a locked device. The feature is meant to block forensic unlocking tools that connect over USB. Apple said the bug may have been exploited in an extremely sophisticated attack against specific targeted individuals, and it was reported by Bill Marczak of the Citizen Lab. For executives who travel, device seizure scenarios belong in the threat model. (Help Net Security)

Microsoft profiles a Sandworm subgroup that builds persistent access

Microsoft said on Wednesday, February 12, that a subgroup of Russia's Sandworm, linked by researchers to GRU Unit 74455, works to gain and keep initial access to networks in sectors of interest to Russia. After focusing on Ukraine in 2022, it went global in 2023 and in 2024 concentrated on the US, Canada, Australia and the UK. It exploits internet-facing systems, with flaws in Exchange, Zimbra, JetBrains TeamCity, ConnectWise ScreenConnect and Fortinet FortiClient EMS among those listed, and has used legitimate remote management tools for persistence. (Help Net Security)

Russian actors abuse device code authentication to take over M365 accounts

Volexity and Microsoft reported that suspected Russian actors were tricking targets into approving Microsoft Device Code Authentication requests, handing over access to their Microsoft 365 accounts. Posing as US, Ukrainian and EU officials or prominent researchers, the attackers targeted government bodies, NGOs and a range of industries. Microsoft said the activity had run since August 2024, and Volexity judged the method more effective than years of other spear-phishing by the same actors. The technique abuses a legitimate sign-in flow, so identity teams have reason to check whether they need it enabled at all. (Help Net Security)

PAN-OS authentication bypass fixed as a proof of concept goes public

Palo Alto Networks fixed CVE-2025-0108, a high-severity authentication bypass in the PAN-OS management web interface found by Assetnote researchers while analyzing the patches for the two November 2024 zero-days. A public proof of concept followed. Palo Alto said it was not aware of malicious exploitation and that invoking the reachable PHP scripts does not give remote code execution but can affect integrity and confidentiality. Keeping firewall management interfaces off the internet remained the most effective mitigation. (Help Net Security)

CISA and FBI issue a Secure by Design alert on buffer overflows

On February 12 CISA and the FBI released a Secure by Design Alert, Eliminating Buffer Overflow Vulnerabilities, describing techniques to prevent this class of defect, which threat actors often exploit for initial access before moving laterally. The agencies urged manufacturers to build new software in memory-safe languages where feasible and urged customers to demand products that include these protections. The second request gives buyers a concrete question for vendor security reviews. (CISA)