Threat Bulletin //
Cyber threats continue to evolve at pace, with attackers finding new ways to exploit trusted software, abuse legitimate system functionality, and compromise critical business services. Throughout the past month, the NormCyber Threat Intelligence team has been monitoring and analysing several significant developments that organisations should be aware of.
Below is a summary of our latest Threat Bulletins, covering software supply chain attacks, emerging Windows vulnerabilities, privilege escalation techniques, and a new ransomware threat targeting SMB environments.
Backdoored PyTorch Lightning Package Drops Credential-Stealing Malware
A major software supply chain incident emerged after malicious versions of the popular PyTorch Lightning machine learning framework were uploaded to the Python Package Index (PyPI). The compromised packages automatically executed malware when imported, enabling attackers to harvest credentials, API keys, browser data, and cloud secrets from affected environments. The incident highlights the growing risk posed by trusted open-source dependencies and the increasing focus on AI and development ecosystems as attack targets.
Why it matters:
Organisations relying on open-source software must ensure robust dependency management, package validation, and continuous monitoring of development environments.
Windows CreateFileW API Flaw Could Let Attackers Lock SMB Files at Scale
Researchers recently demonstrated how the legitimate Windows CreateFileW API can be abused to deny access to large numbers of files stored on SMB network shares. The technique, known as GhostLock, allows attackers with low-level privileges to create widespread operational disruption without encrypting files or deploying traditional ransomware. Because it leverages expected Windows behaviour, detection can be significantly more challenging than conventional attacks.
Why it matters:
This attack demonstrates that business disruption no longer requires encryption. Organisations should review file-share permissions, SMB exposure, and monitoring capabilities for unusual file-locking activity.
New Windows “MiniPlasma” Zero-Day Enables SYSTEM Privilege Escalation
A newly disclosed Windows zero-day vulnerability dubbed “MiniPlasma” has raised concerns after researchers demonstrated the ability to achieve SYSTEM-level privileges on fully patched systems. Privilege escalation vulnerabilities remain a favourite tool for threat actors because they can turn an initial foothold into complete control of a compromised endpoint.
Why it matters:
Even organisations with strong patch management processes remain vulnerable to zero-day exploitation. Defence-in-depth controls, endpoint monitoring, and rapid detection remain critical safeguards.
WannaToCry Ransomware Abuses SMB Services to Remotely Encrypt Files
Drawing inevitable comparisons to the infamous WannaCry outbreaks, the newly observed WannaToCry ransomware leverages SMB services to move laterally and remotely encrypt files across networked systems. The campaign demonstrates how attackers continue to target common network services to maximise impact and accelerate ransomware deployment across enterprise environments.
Why it matters:
SMB remains a high-value target for attackers. Organisations should ensure SMB exposure is minimised, patching is maintained, and network segmentation limits the potential spread of ransomware incidents.
Stay Ahead of Emerging Threats
Threat actors continue to adapt their tactics, exploiting everything from trusted software packages and legitimate operating system functionality to newly discovered vulnerabilities and ransomware techniques.
Get Norm’s threat bulletin direct to your inbox
Norm tracks and monitors the latest security trends and cyber threats and collates these into a fortnightly threat bulletin.
You can receive this bulletin for free, every fortnight, by entering your business email address below:
Insights //
