Today’s digest spans four different layers of the stack — endpoint, cloud control plane, OT, and package supply chain — with the same lesson underneath each: the interfaces built for trusted operators (a scheduled task, a database gateway, a PLC’s admin panel, a package maintainer handoff) are exactly where attackers go first. Here’s what changed since yesterday’s digest.
Threat intel watch: Kaspersky uncovers OctLurk and SilkLurk, memory-resident backdoors hitting Central Asian governments
Kaspersky’s Securelist detailed a cyberespionage campaign, active since at least January 2025, using two previously undocumented backdoors — OctLurk and SilkLurk — against government ministries, law-enforcement agencies, healthcare, research, logistics, and urban-planning organizations across Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and Syria. OctLurk persists via scheduled tasks and malicious services disguised as components like “GoogleUpDate,” then pulls plugins directly into memory — no files touch disk — to open command shells, browse and copy files, capture screenshots, read the clipboard, scan networks, and simulate keyboard and mouse input; a proxy plugin lets operators pivot into internal systems not directly reachable from outside. SilkLurk instead hides behind a legitimate-looking Windows program, decrypts its payload using the victim’s own computer name, injects it into memory, and installs a service to survive reboot. Attackers used stolen administrator credentials to invoke cmd.exe and PowerShell, connect to network shares, stage documents, and archive stolen data with WinRAR and 7-Zip before exfiltrating it. Kaspersky has not linked the activity to a known group, describing the actor only as suspected Chinese-speaking. The Hacker News · Securelist
A memory-resident plugin architecture means standard file-hash detection won’t catch this — hunt for the behaviors instead: scheduled tasks or services named like update agents that don’t match your known software inventory, and PowerShell sessions that enumerate AV exclusions, event logs, and scheduled tasks in sequence, a fingerprinting pattern that shows up early in this kind of intrusion.
Cloud watch: CosmosEscape — a now-patched Azure Cosmos DB flaw exposed a platform-wide key to every tenant’s data
Wiz Research disclosed CosmosEscape, a vulnerability chain in Azure Cosmos DB that began with a crafted Gremlin query against a database the researchers controlled and ended with full read/write access to any customer’s data on the platform. Cosmos DB’s sandbox restrictions on Gremlin queries didn’t sufficiently account for .NET reflection, letting the researchers escape the query sandbox and build file read, write, and ultimately arbitrary code-execution primitives — entirely through queries against their own database. Code execution on the shared multi-tenant gateway exposed a platform-wide signing secret and a regional account directory, letting them locate a target tenant and retrieve its primary account key; the signing key wasn’t scoped to a single customer, region, or API surface, and worked across SQL, MongoDB, Cassandra, and Gremlin API formats alike. Wiz reported the issue to Microsoft on November 20, 2025; Microsoft blocked the vulnerable Gremlin entry point within 48 hours and completed a full architectural fix — removing the platform-wide Cosmos Master Key from the design entirely — across all regions by the time of public disclosure on July 30. Microsoft says it found no evidence of customer impact beyond the researchers’ own testing. The Hacker News · Wiz · SecurityWeek
No customer action is required here — Microsoft’s fix is already live platform-wide — but the shape of the bug is the real takeaway for anyone building multi-tenant SaaS: a single shared signing secret behind a query engine’s sandbox is a cross-tenant breach waiting for one sandbox-escape bug, no matter how well the per-tenant database access controls are designed on top of it.
Critical infrastructure watch: CISA warns of a nationwide surge in attacks on internet-exposed water utility PLCs
CISA, alongside the FBI, issued an advisory on July 30 warning of a “significant escalation” in attacks against internet-facing programmable logic controllers at U.S. water and wastewater utilities, urging every utility — regardless of size or existing security maturity — to identify and remove PLCs and other OT assets directly reachable from the public internet. Since July 27, utilities in at least seven states have reported incidents to the FBI, with attackers changing administrator passwords to lock out legitimate operators and altering IP address settings to sever PLCs from the operational network entirely; some incidents have degraded water treatment operations and triggered boil-water notices. The advisory follows the coordinated attack on more than 30 Minnesota community water systems on July 26–27 covered in Thursday’s digest, but describes a broader, ongoing national pattern rather than a single incident. BleepingComputer · CISA
If you operate or support OT environments, this is a direct instruction from CISA, not background noise: inventory every PLC and OT asset with a public IP, pull them behind a VPN or firewall today, and confirm operators can still run the process manually if remote access to the controller disappears without warning.
Supply chain watch: Arch Linux halts AUR package adoptions to stop an ongoing malicious-takeover campaign
Arch Linux’s DevOps team disabled package adoption on the Arch User Repository on July 30 after a renewed wave of malicious commits tied to a campaign researchers call “Atomic Arch.” The technique: attackers adopt orphaned, unmaintained AUR packages — starting with openconnect-sso in late May — then push malicious commits into the package’s PKGBUILD build script, embedding compiled ELF binaries directly rather than relying on higher-level scripting that existing detection tooling watches for. The payload uses a Tor-based, two-stage delivery to steal credentials, spread over SSH, and maintain persistence on machines that build the compromised package. Arch purged more than 1,900 compromised packages and declared the repository clean in mid-June, but the campaign has since escalated with obfuscated downloaders that execute during the makepkg build phase, expanding to a reported 200+ affected packages. Adoption functionality and new account registration are both suspended while the team investigates. BleepingComputer · gbhackers
The AUR has never been vetted the way official Arch repos are, but this campaign specifically targets the maintainer-handoff mechanism — if your build or CI infrastructure pulls from the AUR, pin package versions and commit hashes rather than tracking “latest,” and audit any recently-adopted packages already in your dependency tree.
Final thought
CosmosEscape and the Arch Linux campaign are really the same story told at two different layers of trust: a shared secret behind a sandboxed query engine, and a shared build script behind a maintainer-adoption workflow. Both let an attacker turn a mechanism designed for legitimate hand-offs into a way to reach everyone downstream of it. If you want help auditing which of your own shared control planes — cloud, CI/CD, or OT — carry that kind of blast radius, see our how-to guides or book a discovery call.