EchoLeak
The EchoLeak attack is a critical zero-click vulnerability (CVE-2025-32711) discovered in Microsoft 365 Copilot, enabling attackers to silently exfiltrate sensitive organizational data without any user interaction. Here’s how EchoLeak Works
1. Malicious Email Injection: Attackers send a specially crafted email disguised as a business document. The email contains hidden prompt injections that bypass Microsoft’s cross-prompt injection attack (XPIA) classifiers.2. Retrieval-Augmented Generation (RAG) Exploit: When the victim later interacts with Copilot (e.g., asking a business-related question), the RAG engine retrieves the malicious email into the AI’s context due to its formatting and apparent relevance.3. LLM Scope Violation: The injected prompt tricks the AI into accessing privileged data (e.g., chat histories, OneDrive files, Teams conversations) and embedding it into a markdown image or link. The browser automatically requests the image, sending the stolen data to the attacker’s server.4. Exfiltration via Trusted Domains: Microsoft’s Content Security Policy (CSP) blocks most external domains, but attackers abuse trusted Microsoft URLs (e.g., SharePoint, Teams) to evade detection
ElasticsearchElasticsearch is an open-source, distributed search and analytics engine designed for speed, scalability, and versatility. Built on top of Apache Lucene, it enables users to store, search, and analyze large volumes of structured, unstructured, and even vector data in near real-time, delivering results in milliseconds.
Key Features
• Distributed Architecture: Elasticsearch automatically distributes data across multiple nodes and clusters, allowing it to scale horizontally and handle petabytes of information with high availability and fault tolerance.• Real-Time Search and Analytics: It provides millisecond-latency search and analytics, making it ideal for applications that require instant data retrieval and insights.• Flexible Data Handling: Supports various data types, including text, numbers, timestamps, and vectors, making it suitable for a wide range of use cases from full-text search to AI-driven applications.• RESTful API: Interacts with data using JSON over HTTP, making it easy to integrate with other systems and platforms.• Integration with Elastic Stack: Often used alongside Logstash (for data ingestion), Kibana (for visualization), and Beats (for lightweight data shipping), forming the Elastic Stack (formerly known as the ELK Stack).
Common Use Cases
• Application and Website Search: Powers search functionality for websites and applications, enabling users to find relevant content quickly.• Enterprise Search: Facilitates organization-wide search across documents, products, and other resources.• Log and Security Analytics: Ingests and analyzes log data in near real-time, providing operational and security insights.• Business Analytics: Supports advanced analytics and dashboarding, often integrated with visualization tools like Kibana.• Infrastructure and Performance Monitoring: Collects and analyzes metrics from servers, containers, and other infrastructure components.
How It Works
Elasticsearch stores data as JSON documents within indices. When data is ingested, Elasticsearch creates an inverted index, allowing for fast and efficient searches. Users can query and retrieve data using its RESTful API, and visualize results through tools like Kibana.
Ephemeral port
An ephemeral port, also called a transient port or temporary port, is a temporary, short-lived port number assigned by an operating system to a client application for the duration of a communication session with a server. These ports are used as communication endpoints in transport layer protocols such as TCP, UDP, or SCTP and are essential for enabling multiple simultaneous client-server connections without port conflicts.
When a client wants to communicate with a server (e.g., accessing a website), the server listens on a known port (like 80 for HTTP or 443 for HTTPS). The client’s operating system assigns an ephemeral port as the source port for this connection. This port acts as a temporary return address for the server’s responses. Once the communication session ends, the ephemeral port is released and returned to the pool for reuse in future connections.
Evil Corp
Evil Corp, also known as UNC2165, GOLD DRAKE, and Indrik Spider, is a Russia-based cybercriminal syndicate that has operated since at least 2009. The group is led by Maksim Viktorovich Yakubets and is notorious for its development and deployment of the Dridex banking trojan, as well as a series of advanced ransomware strains including BitPaymer, WastedLocker, Hades, PhoenixLocker, and MacawLocker.
Evil Corp has been responsible for infecting computers and harvesting banking credentials from hundreds of financial institutions across more than 40 countries, resulting in at least $100 million in theft and hundreds of millions of dollars in global damages. Their operations have targeted a wide range of sectors, including finance, healthcare, government, transportation, and education, with a particular focus on U.S. and U.K. institutions
