The Good, the Bad and the Ugly in Cybersecurity – Week 25

A coordinated law-enforcement and private-sector operation dismantled the Outsider Enterprise PhaaS and removed SocGholish infections from ~15,000 WordPress sites while seizing infrastructure and cryptocurrency; separately, DragonForce actors deployed a Go-based Backdoor.Turn that abuses Microsoft Teams TURN relays for covert C2 and long dwell time, and UNC6508 (China-linked) exfiltrated medical research from exposed REDCap servers using a custom "InfiniteRed" backdoor and novel data-exfiltration via compliance rules. The bulletin describes scale (financial loss, stolen credit cards, sites compromised), key TTPs (DLL sideloading, BYOVD, TURN/QUIC abuse, credential harvesting), and recommended mitigations (patching, MFA, DBSC, IoCs/YARA).