Breach Roundup: Chinese Hackers Exploited ArcGis

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week: Chinese hackers exploited ArcGIS, Internet-exposed call center software under attack, October patch Tuesday, Massachusetts student sentenced for $3 million extortion hack, New York fined eight insurers $14.2M over data breaches, more than 100 VS Code extensions leak secrets.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Suspected Chinese state-linked hackers infiltrated an ArcGIS mapping software server and remained undetected for over a year, weaponizing a Java server object extension into a web shell.

ReliaQuest researchers attribute with moderate confidence the incident to the Chinese nation-state threat actor tracked as Flax Typhoon (see: US Sanctions Beijing Company for Flax Typhoon Hacking).

Hackers gained access using valid administrator credentials to a public-facing ArcGIS server connected to an internal one. They uploaded a malicious Java SOE that functioned as a web shell. Protected by a hardcoded secret key, the backdoor blended in with routine server activity.

To ensure further persistence, the hackers installed SoftEther VPN Bridge and registered it as an automatic Windows service. The VPN established an outbound tunnel to the attacker infrastructure, enabling covert lateral movement, credential dumping and network reconnaissance using legitimate-looking traffic over port 443.

Researchers observed hands-on keyboard activity targeting IT staff workstations as attackers attempted to dump the Active Directory Security Account Manager database and steal sensitive credentials. This aligns with Flax Typhoon’s known method of relying on stealth and living-off-the-land techniques.

Attackers are exploiting an ICTBroadcast call center software vulnerability, tracked as CVE-2025-2611, to remotely compromise the software, said threat intelligence firm VulnCheck.

The vulnerability in versions 7.4 and earlier of the software exists because “the ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server,” said cybersecurity firm Rapid7. “This results in unauthenticated remote code execution in the session handling.”

VulnCheck said in-the-wild attacks its observed begin with “a time-based exploit check, then attempts to establish reverse shells” to give attackers persistent access to the victim’s environment. “The software, which should not be internet-facing, currently has a couple hundred instances online,” it said.

Security researcher Valentin Lobstein, aka Chocapikk, discovered and disclosed the vulnerability to the vendor in March, as well as to VulnCheck, which publicly releases details of a flaw 120 days later, even if the vendor fails to issue a patch, as happened in this case.

On Aug. 5, Metasploit published exploit code for the flaw, authored by Lobstein. He reported Tuesday in a post to social platform X that the vendor, Pakistan-based ICT Innovations, has “remained silent” since receiving details of the vulnerability,” and that “the status of the patch is unknown.”

ICT Innovations didn’t immediately respond to a request for comment.

VulnCheck said the campaign uses similar tactics, techniques and procedures to a campaign detailed by Fortinet in May, in which attackers exploited the legitimate email-sending service serviciodecorreo.es in phishing attacks designed to distribute a remote access trojan.

Microsoft released security updates addressing 172 vulnerabilities, including six zero-day flaws, as part of its October patch dump. This marks the final free security update for Windows 10 as the operating system reaches its end of support.

Of the total flaws, eight are critical, with five involving remote code execution and three elevation of privilege vulnerabilities. The update covers 80 elevation of privilege, 31 remote code execution and 28 information disclosure flaws, among others.

Three of the six zero-days were actively exploited. They include elevation of privilege vulnerabilities in the Agere Modem driver – CVE-2025-24990, a Remote Access Connection Manager – CVE-2025-59230 and a Secure Boot bypass in IGEL OS – CVE-2025-47827.

The three publicly disclosed flaws are tied to AMD SEV-SNP RMP corruption – CVE-2025-0033, another Agere Modem driver bug CVE-2025-24052 and a TPM 2.0 vulnerability CVE-2025-2884.

Microsoft said that support for Windows 10 can continue through Extended Security Updates for up to three years for enterprises.

A U.S. federal judge sentenced a Massachusetts college student to four years in prison for hacking and extorting two companies, including education software provider PowerSchool.

Matthew D. Lane pleaded guilty in May to breaching networks of a telecommunications firm and an education technology company, demanding roughly $3 million in bitcoin to prevent data leaks.

Court documents show Lane and accomplices extorted $200,000 from the telecom company between April and May 2024 using data stolen in 2022. He later accessed the second company’s network in September and December 2024, stealing names, addresses, Social Security numbers, medical records and other sensitive information. Hackers threatened to leak the data unless they received $2.85 million.

The incident matches details of the PowerSchool breach, which impacted an estimated 70 million people. Although PowerSchool confirmed paying a ransom in May to prevent a leak, attackers continued extorting school districts in the United States and Canada.

Eight major car insurance companies will pay $14.2 million in fines to New York after data breaches exposed personal information of more than 825,000 people. Hackers exploited “pre-fill” quoting tools that auto-populated sensitive data such as driver’s license numbers, VINs and dates of birth, using the stolen details to file fraudulent unemployment claims during the pandemic.

The companies fined include American Family Mutual Insurance, Farmers Insurance, Hagerty Insurance Agency, Hartford Insurance Group, Infinity Insurance, Liberty Mutual, Metromile and State Auto Mutual Insurance.

New York Attorney General Letitia James said the companies’ poor cybersecurity enabled easy access for hackers to personal data. Investigators found they lacked multifactor authentication and monitoring tools to detect suspicious activity.

American Family will pay the largest fine of $2.8 million. Liberty Mutual, State Auto, Metromile and Infinity will each pay $2 million, while Farmers and Hagerty will pay $1.3 million.

Cloud security firm Wiz uncovered the exposed personal access tokens of more than 100 Visual Studio Code extensions, creating a software supply chain risk. The leaked tokens could have allowed attackers to push malicious updates to an install base numbering 150,000.

Wiz identified 550 secrets across more than 500 extensions from hundreds of publishers, including OpenAI, Gemini, Anthropic, AWS, Google Cloud, GitHub and database access keys for MongoDB, PostgreSQL and Supabase.

Other Stories From Last Week

With reporting from Information Security Media Group’s Gregory Sirico in New Jersey and Mathew Schwartz in Scotland.