The IT Nerd

Fortra Intelligence and Research Experts (FIRE) are tracking an active phishing campaign, first observed in June, that uses HTA malware to gather detailed intelligence about a victim’s device before determining which payload to deploy next.

Rather than immediately delivering malware, the campaign performs reconnaissance on infected systems, collecting information such as OS, BIOS, and user details that can be used to tailor subsequent attack stages. Researchers found the operation combines HTA malware delivered via mshta.exe with off-screen execution, HTML smuggling, and polymorphic payloads designed to complicate detection.

The campaign appears focused on Spanish-speaking users and organizations, using invoice and judicial-notice phishing lures, while the infrastructure remains active and continues distributing updated samples.

https://www.fortra.com/resources/guides/active-campaign-distributing-hta-malware-payloads

By Tyler Reguly, Associate Director, Security R&D, Fortra

I think it is safe to say that, as long as Microsoft is playing catch-up on patching vulnerabilities, numbers have lost all meaning. This is not a Microsoft specific problem… we see the same issue with Oracle and other large vendors that are being proactive. We need to remember that these large CVE counts are a good thing as we’re reducing attack surface before attackers get a chance to find and utilize the vulnerabilities. Eventually, all those long-standing, hard to find vulnerabilities will be fixed and Patch Tuesday will return to its typical cadence. Until that happens, prioritization is key and gift cards for extra coffee for your admins would likely be appreciated.

Even though I think it is temporary and we will return to manageable Patch Tuesday’s, I think it’s important that we acknowledge our current normal. Specifically, have you considered your people and processes during what could easily be called trying times? This is a great time to consider if your processes are designed to handle major changes and potential patching bottlenecks. While the number of patches may not have increased greatly (due to cumulative updates), they have increased as we see more and more one-off patches. How do you handle those one-off patches that may require a manual reinstall of the software or the extraction of a zip file to a specific location to overwrite a vulnerable version? These last few months may have disrupted your normal processes, so this is a great time to step back and really look at them. Are there places for improvement? What about your people. How are they handling the current levels of patches and the tickets that those produce. Are they managing? Are they struggling? Have you even stopped to ask them?

It’s time to put our CISOs and CSOs on notice. How are you helping your teams through these difficult times? Are you eliminating soak tests because some public guidance has suggested ridiculously short patch timeframes? Does that put added stress on your teams because they don’t know what outages they may see as a result? If you’re doing this… STOP! Patches still need to be tested because not all vendors can be trusted and many have broken the trust they had previously gained. Test your patches before you deploy them. Then, think about your deployment. Do you have your teams deploy after hours and on weekends to avoid disruption to the business environment? Do you reward them for that effort? Time to dig into your budget and buy dinner for your teams that are working on Saturday to get patches rolled out before users return to work on Monday.

Right now, if you are in charge of teams managing patches, you are probably struggling with what to do. Support your team, be aware of the difficulties they face, and ask them how things can be improved. If you still prioritize based on CVSS, you are hurting your organization and your employees. If you are constantly flip-flopping as guidance changes, you are putting your organization at risk and jeopardizing employee happiness. You are essentially steering a ship through rough waters, and you need a steady hand to accomplish that. If you keep the ship on course, your team will be able to do the rest.

A new report from Fortra Intelligence and Research Experts (FIRE) documents a 40% increase in online attacks leveraging an SEO poisoning technique dubbed “Chameleon.” In these campaigns, threat actors use cloaked search results to deliver phishing pages only to users arriving from Google or Bing search engines. By concealing malicious content from traditional security scanners, Chameleon campaigns can remain active longer and increase their odds of a successful attack. The article explains how the technique works, why legacy detection methods often miss it, and practical takeaways for CISOs and SOC teams.

The full article can be read here: https://www.fortra.com/blog/the-chameleon-threat

Fortra Intelligence and Research Experts (FIRE) just released research examining ExfilSquad, a new data extortion group believed to be exploiting misconfigured Microsoft Power Pages to access Dynamics 365 data. FIRE have obtained ExfilSquad data samples, and our analysis supports ExfilSquad’s claim that they have access to sensitive data from 15 different organizations.

This report is intended to help security teams understand the likely attack path, indicators of exposure, the types of data at risk, and immediate steps to identify and secure vulnerable Power Pages environments before sensitive CRM and ERP data is exposed.

Report can be accessed here: https://www.fortra.com/blog/exfilsquad-data-extortion-group-ransoming-microsoft-d365-data

By Tyler Reguly, Associate Director of Security R&D at Fortra

Is the National Vulnerability Database still meeting the needs of defenders, or has the volume and complexity of modern vulnerabilities outgrown the current model?

A more interesting question might be “has the National Vulnerability Database ever actually met the needs of defenders?” The only valuable information provided by NVD in the past has been CVSS information, and I’ll leave it up to the individual to decide if CVSS has ever been “valuable.” The other information provided by NVD was CPE data, and it has long been known that if you were using NVD CPE data for vulnerability detection, you were not getting accurate or reliable vulnerability detection.

What role should AI play in vulnerability discovery, prioritization, and remediation, and where is human oversight still necessary?

AI is playing a pretty strong role in vulnerability discovery with source code. That is the perfect application in my mind. We’re seeing the results with the size of the patch drops from companies like Microsoft and Oracle. When you let AI explore your source code, you fix all sorts of obscure vulnerabilities.

At the same time, we’re climbing a hill right now, discovering all the obscure issues that were either too buried, too complex, or too restrictive to be sought out by human researchers. Once these issues are all discovered and AI tools are run on new code bases, problems will be fixed before they are shipped, and those aren’t vulnerabilities and don’t require CVEs, so we’ll start to go back down the hill, and everything will normalize once again.

When it comes to prioritization, anything I’ve seen out of AI so far has been “good enough.” I’d call it on par with a junior analyst. I haven’t seen it perform prioritization as well as a VM expert.

Finally, remediation… I would not trust the remediation of vulnerabilities in critical systems to AI just yet. There’s no coming back from that. There’s a reason human-in-the-loop is still so critical, and as soon as AI starts remediating vulnerabilities, you lose the human oversight. In test environments, sure. In labs, definitely. In production systems… not yet.

What risks could organizations face if they rely too heavily on AI-generated vulnerability analysis and prioritization?

The risk is overlooking real risk. AI prioritization tends to rely on knowns and treats prioritization like a science. CVSS was used for years as a prioritization metric (they finally updated their documentation to advise against this, but people still use it that way). Prioritization is still, in my mind, an art. There’s a gut feeling that goes along with all the variables. You can get close (and some companies have interesting algorithms in the space), but you still have the art of it all that plays a major role in my mind.

How should security teams adapt their vulnerability management programs as attackers increasingly use AI to identify and exploit vulnerabilities faster?

Remember that vulnerability management is just one of the pillars of good cybersecurity hygiene. If you are layering it with FIM, EDR, and proper system hardening, then you’ve got a solid foundation. Yes, you have to make adjustments in some places, but remember that patches fix multiple vulnerabilities, that few vulnerabilities are ever actually exploited, and that known active exploitation increases risk. From there, a few simple choices will keep your VM program running smoothly.

If NIST successfully modernizes the NVD, what capabilities or improvements would have the biggest impact on organizations over the next five years?

First, we should talk about what modernization looks like. It’s better application of CPEs and CWEs. It’s inclusion of EPSS data alongside CVSS data. It’s providing better remediation guidance and a more structured list of external resources. My biggest fear is that OVAL will be seen as a useful standard and further adopted or that CPE data will continue to be less than complete. I’m not saying that everything needs better enrichment, but critical vulnerabilities need to be completely enriched and pulled out and better accessed. We need to deprioritize CVSS data. If we can start to make changes and improvements, then we may see a place where organizations can actually start to look for guidance. Right now, I would say that CISA Kev and CVE.org are a better combination of data than NVD, and I’m not sure anyone really needs to go to NVD. 10 years ago, NVD was at the top of the pecking order, and it would be interesting to see them return to that status.

Fortra today announced the expansion of its transformative Cloud Email Protection solution into Europe, enabling organizations to defend against advanced email threats while meeting European Union data residency requirements. 

Purpose-built for modern cloud environments, Fortra’s Cloud Email Protection stops threats that bypass traditional defenses using a combination of AI-powered detection, global threat intelligence from the Fortra platform, and automated remediation. As one of the industry’s early cloud-native email security platforms, Cloud Email Protection was created with machine learning and AI models as its core, helping organizations simplify and scale email protection while stopping threats like business email compromise, spear phishing, and targeted social engineering.   

Organizations across Europe increasingly require security solutions that allow sensitive email data to remain within European jurisdictions. Fortra’s European deployment in ISO27001/SOC2 datacenters enables customers to keep their data in-region, supporting local compliance requirements while maintaining enterprise-grade protection. 

Built with privacy-by-design principles, the platform minimizes the collection of personal information while protecting email communications through layered security controls including encryption, access management, and comprehensive auditing.   

Customers retain control of their data while benefiting from enterprise email security. Administrative access, data handling practices, and regional hosting support organizations’ strict sovereignty requirements.  

Learn more about the market’s most comprehensive cybersecurity platform at fortra.com. 

Fortra’s new 2025 Phishing Simulation Benchmark Report analyzed 14 million recipients across 7,500+ simulations and found a concerning reality: While click rates average just 5.4%, nearly 90% of phishing emails go unreported.

The findings suggest organizations are measuring the wrong thing. While click rates remain a common benchmark, the greater risk is that 9 out of 10 malicious emails go unreported, denying security teams the visibility needed to stop active campaigns. As the report notes, “a single report may be the difference in determining whether a phishing campaign is successful or not.”

The data also reveals significant differences in phishing susceptibility across regions, languages, company sizes, and industries. Notably, defense employees clicked on phishing emails 13% of the time – more than double the global average, while insurance employees opened attachments 12.6% of the time, highlighting how phishing risks vary widely and where targeted awareness efforts may be most needed.

The full report can be accessed here: https://www.fortra.com/resources/guides/2025-phishing-simulation-benchmark-report

Fortra Intelligence and Research Experts (FIRE) have uncovered a highly sophisticated fileless malware campaign that uses five layers of obfuscation to evade email, endpoint, and memory-based defenses. The campaign is targeting large enterprises, with techniques that significantly increase attacker dwell time, complicates investigations.

Victims are at risk of credential theft, data exfiltration, and ransomware deployment, which could lead to operational disruption, regulatory exposure, reputational damage and more. Unlike typical fileless threats, this attack also leaves virtually no disk artifacts, with the loader fragmenting its payload across hundreds of environment variables, useing uncommon CJK character encoding, and reconstructing a .NET payload entirely in memory.

The full analysis can be found here: https://www.fortra.com/blog/5-layers-obfuscation-sophisticated-fileless-malware-campaign

Fortra has been named a 2026 U.S. News Best Company to Work For in four categories: Overall, Information Technology, Midwest, and Supporting Family Caregiving. The annual U.S. News Best Companies to Work For ratings recognize companies that best support employees’ day-to-day experience. For this year’s rankings, U.S. News evaluated nearly 1,100 privately held companies and nonprofits using publicly available data, including employee reviews, court records, financial strength, and governance information. Companies did not apply for consideration, submit data, or pay a fee to be evaluated. 

In the U.S. News evaluation, Fortra received perfect scores of 5 out of 5 for both work-life balance and flexibility, and physical and psychological safety. Additionally, the company was awarded strong scores for job and company stability, belongingness and esteem, and career opportunities and professional development. Together, they point to an environment in which employees are supported in their work, encouraged to grow, and given the flexibility to balance their professional and personal lives. 

Fortra Intelligence and Research Experts (FIRE) this morning published their analysis of Mirage2FA, a newly discovered Microsoft 365 phishing kit that tricks users into sharing login details and MFA codes. Targeted businesses could experience account takeover, fraudulent payment redirection, data theft, unauthorized access to sensitive documents, and more as a result of an attack.

Mirage2FA uses short-lived HTML smuggling and obfuscated Javascript-loaders in a single phishing workflow, helping it evade detection. It is yet another example of a growing number of phishing campaigns using multiple tactics to successfully bypass 2FA/MFA workflows.

Details here: https://www.fortra.com/blog/mirage2fa-obfuscated-html-loader-delivers-microsoft-365-mfa-phishing-kit