Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with microsoft threat intelligence, and containment measures with patch released (v2.0.63), removal of malicious payloads (om.vbs, omserverservice.vbs, omserverservice.exe), and remediation measures with fix for cve-2025-27920, enhanced authentication mechanisms, and enhanced monitoring with monitoring for connections to c2 domain (api.wordinfos[.]com)..

Common Attack Types: The most common types of attacks the company has faced is Vulnerability.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through DNS hijacking or typosquatted domains to intercept credentials.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are User credentials, communication data and personally identifiable information (PII).

Third-Party Assistance: The company involves third-party assistance in incident response through Microsoft Threat Intelligence.

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Fix for CVE-2025-27920, enhanced authentication mechanisms.

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by patch released (v2.0.63), removal of malicious payloads (om.vbs, omserverservice.vbs and omserverservice.exe).

Key Lessons Learned: The key lessons learned from past incidents are Zero-day exploits can be leveraged for targeted cyber espionage; reconnaissance plays a critical role in threat actor operations; timely patching is essential to mitigate risks.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Implement multi-factor authentication (MFA) for sensitive systems, Conduct regular security audits and vulnerability assessments, Educate users on phishing and credential interception risks, Monitor for connections to known malicious domains (e.g., api.wordinfos[.]com) and Apply the latest patch (v2.0.63) for Output Messenger.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Microsoft Threat Intelligence, and Source: Cisco Talos.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Microsoft Threat Intelligence, Monitoring for connections to C2 domain (api.wordinfos[.]com).

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Patch Management For Zero-Day Vulnerabilities, Implementation Of Mfa, Enhanced Network Monitoring For C2 Traffic, User Training On Credential Security, .

Last Attacking Group: The attacking group in the last incident were an Marbled Dust (aka Cosmic Wolf, Sea Turtle, Teal Kurma, UNC1326 and Silicon).

Most Recent Incident Detected: The most recent incident detected was on 2024-04-01.

Most Recent Incident Resolved: The most recent incident resolved was on 2024-12-01.

Most Significant Data Compromised: The most significant data compromised in an incident were User data, credentials and and sensitive information.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was Microsoft Threat Intelligence.

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Patch released (v2.0.63), removal of malicious payloads (OM.vbs, OMServerService.vbs and OMServerService.exe).

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were User data, credentials and and sensitive information.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Zero-day exploits can be leveraged for targeted cyber espionage; reconnaissance plays a critical role in threat actor operations; timely patching is essential to mitigate risks.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement multi-factor authentication (MFA) for sensitive systems, Conduct regular security audits and vulnerability assessments, Educate users on phishing and credential interception risks, Monitor for connections to known malicious domains (e.g., api.wordinfos[.]com) and Apply the latest patch (v2.0.63) for Output Messenger.

Most Recent Source: The most recent source of information about an incident are Cisco Talos and Microsoft Threat Intelligence.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.

Most Recent Entry Point: The most recent entry point used by an initial access broker was an DNS hijacking or typosquatted domains to intercept credentials.

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Pre-attack reconnaissance to identify Output Messenger users.