Webinar

August 2025 TRU Intelligence Briefing On-Demand

Join eSentire’s Threat Response Unit (TRU) as they share new research-driven observations of malware, notable vulnerabilities, threat actor groups, and cyber activity affecting the threat landscape.

During the August Threat Intelligence Briefing, TRU reviewed:

  • Machine Key Abuse: An overview of View State code injection attacks, a sophisticated technique exploiting publicly known or compromised keys to execute malicious code and establish persistent, stealthy footholds on servers. This method has gained significant attention due to the recent surge in "Toolshell" exploitation campaigns and will likely lead to wider adoption.
  • ToolShell Observations: Observations surrounding ToolShell exploitation including the different webshells eSentire has investigated along with mitigation and detection recommendations.
  • Threat Landscape: Malware observed by eSentire’s SOC (Interlock Backdoor, ShadowCoil, WEEVILPROXY), and recently disclosed critical vulnerabilities (CVE-2025-54309 [CrushFTP], CVE-2025-20281 & CVE-2025-20337 [Cisco], CVE-2025-47812 [WingFTP]).
  • A brief geopolitical update on Chinese state-sponsored APT activity.

This webinar also included a live Q&A.

Watch the Webinar

Join eSentire’s Threat Response Unit (TRU) as they share new research-driven observations of malware, notable vulnerabilities, threat actor groups, and cyber activity affecting the threat landscape.

During the August Threat Intelligence Briefing, TRU reviewed:

  • Machine Key Abuse: An overview of View State code injection attacks, a sophisticated technique exploiting publicly known or compromised keys to execute malicious code and establish persistent, stealthy footholds on servers. This method has gained significant attention due to the recent surge in "Toolshell" exploitation campaigns and will likely lead to wider adoption.
  • ToolShell Observations: Observations surrounding ToolShell exploitation including the different webshells eSentire has investigated along with mitigation and detection recommendations.
  • Threat Landscape: Malware observed by eSentire’s SOC (Interlock Backdoor, ShadowCoil, WEEVILPROXY), and recently disclosed critical vulnerabilities (CVE-2025-54309 [CrushFTP], CVE-2025-20281 & CVE-2025-20337 [Cisco], CVE-2025-47812 [WingFTP]).
  • A brief geopolitical update on Chinese state-sponsored APT activity.

This webinar also included a live Q&A.

Get The Webinar