Ankura CTIX FLASH Update - August 15, 2025

Malware Activity

Vulnerabilities in Authentication Protocols and Advanced Espionage Campaigns

Recent security analyses reveal critical vulnerabilities and threat actors posing significant risks to digital and governmental infrastructure. A newly identified downgrade attack exploits weaknesses in Microsoft Entra ID's FIDO-based authentication. This vulnerability allows attackers to force a fallback to less secure password methods and bypass multi-factor protections. Concurrently, a sophisticated cyber espionage operation, attributed to the threat group "Curly Comrades," leverages custom malware like "GnatSpy" to infiltrate government and diplomatic networks worldwide. Utilizing techniques such as spear-phishing and supply chain compromises. The group demonstrates high operational security and resourcefulness in collecting sensitive intelligence. These developments underscore the importance for organizations and governments to implement strict security controls,