Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack.

Detection and Response: The company detects and responds to cybersecurity incidents through an third party assistance with broadcom's symantec threat hunter team (investigation), and remediation measures with patching cve-2025-53770 (if not already applied)..

Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Exploited Microsoft SharePoint (CVE-2025-53770)SQL ServersAdobe ColdFusion Vulnerabilities.

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Credentials, Potentially Government/Telecom/Financial Data and .

Third-Party Assistance: The company involves third-party assistance in incident response through Broadcom's Symantec Threat Hunter Team (investigation), .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Patching CVE-2025-53770 (if not already applied), .

Key Lessons Learned: The key lessons learned from past incidents are 1. Patch management is critical, especially for publicly disclosed vulnerabilities like CVE-2025-53770, which was exploited even after patches were available. 2. China-nexus threat actors continue to target high-value sectors (telecom, government, finance) for espionage, leveraging both zero-days and known vulnerabilities. 3. Defense-in-depth strategies (e.g., monitoring for LotL tools, privilege escalation attempts) are essential to detect post-exploitation activity.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: 1. Immediate patching of Microsoft SharePoint servers for CVE-2025-53770 and related flaws (CVE-2025-49704, CVE-2025-49706). 2. Audit and harden SQL servers and Adobe ColdFusion instances to prevent exploitation via side-loading or other techniques. 3. Monitor for indicators of compromise (IoCs) tied to KrustyLoader, ShadowPad, Zingdoor, and other tools used in these attacks. 4. Implement multi-factor authentication (MFA) and least-privilege access controls to mitigate credential theft risks. 5. Enhance logging and detection for privilege escalation attempts (e.g. and PetitPotam exploitation). 6. Conduct threat hunting for signs of persistent access or backdoors established by China-linked groups..

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Broadcom's Symantec Threat Hunter Team, and Source: Synacktiv (KrustyLoader analysis)Date Accessed: 2024-01.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Broadcom'S Symantec Threat Hunter Team (Investigation), .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: 1. Accelerate vulnerability management processes for high-severity flaws. 2. Deploy behavioral detection for malware loaders (e.g., KrustyLoader) and espionage tools (e.g., ShadowPad). 3. Isolate and segment high-value systems (e.g., government/telecom networks) to limit lateral movement. 4. Conduct red team exercises to test defenses against similar attack chains..

Last Attacking Group: The attacking group in the last incident was an Linen Typhoon (Budworm)Violet Typhoon (Sheathminer)Storm-2603Salt Typhoon (Glowworm)UNC5221 (suspected overlap).

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-07.

Most Significant Data Compromised: The most significant data compromised in an incident were Credentials, Potentially Sensitive Government/Telecom/Financial Data and .

Most Significant System Affected: The most significant system affected in an incident was Microsoft SharePoint Servers (On-Premise)SQL ServersApache HTTP Servers with Adobe ColdFusionDomain Controllers (via CVE-2021-36942).

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was broadcom's symantec threat hunter team (investigation), .

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Potentially Sensitive Government/Telecom/Financial Data and Credentials.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was 1. Patch management is critical, especially for publicly disclosed vulnerabilities like CVE-2025-53770, which was exploited even after patches were available. 2. China-nexus threat actors continue to target high-value sectors (telecom, government, finance) for espionage, leveraging both zero-days and known vulnerabilities. 3. Defense-in-depth strategies (e.g., monitoring for LotL tools, privilege escalation attempts) are essential to detect post-exploitation activity.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was 1. Immediate patching of Microsoft SharePoint servers for CVE-2025-53770 and related flaws (CVE-2025-49704, CVE-2025-49706). 2. Audit and harden SQL servers and Adobe ColdFusion instances to prevent exploitation via side-loading or other techniques. 3. Monitor for indicators of compromise (IoCs) tied to KrustyLoader, ShadowPad, Zingdoor, and other tools used in these attacks. 4. Implement multi-factor authentication (MFA) and least-privilege access controls to mitigate credential theft risks. 5. Enhance logging and detection for privilege escalation attempts (e.g. and PetitPotam exploitation). 6. Conduct threat hunting for signs of persistent access or backdoors established by China-linked groups..

Most Recent Source: The most recent source of information about an incident are Synacktiv (KrustyLoader analysis) and Broadcom's Symantec Threat Hunter Team.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (attribution to specific groups remains inconclusive; evidence points to China-based actors).