AISURU on DanSec Daily

Cybersecurity Brief – 2026-03-21

Sat, 21 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Navia Data Breach: Hackers accessed personal and health plan information of 2.7 million individuals from Navia’s environment between late December 2025 and mid-January 2026.
Trivy Security Scanner GitHub Actions Breach: The Trivy open-source vulnerability scanner was compromised for the second time in a month, with attackers hijacking 75 tags to deliver malware aimed at stealing sensitive CI/CD secrets.
Magento Defacement Campaign: Thousands of Magento sites, including e-commerce platforms, global brands, and government services, have been targeted in an ongoing defacement campaign since 27 February.
Operation Alice: International law enforcement shut down over 373,000 dark web sites offering fake CSAM packages.
Beast Gang Ransomware Server Exposure: The ransomware group exposed files on a central cloud server, revealing systematic targeting of network backups.
Streaming Royalty Fraud: A North Carolina musician pleaded guilty to using AI bots to fraudulently collect over $10 million in streaming royalties from major music platforms.

Newly Discovered Vulnerabilities

Langflow (CVE-2026-33017): A critical unauthenticated remote code execution vulnerability in Langflow was publicly disclosed and exploited within 20 hours. The flaw allows attacker-supplied flow data to be executed as code.
Magento PolyShell Flaw: A critical vulnerability in Magento’s REST API allows unauthenticated attackers to upload arbitrary executables, enabling remote code execution and account takeover.
Oracle Identity Manager (CVE-2026-21992): Oracle released an emergency out-of-band patch for a critical unauthenticated remote code execution vulnerability affecting Identity Manager and Web Services Manager.
Cisco Secure Firewall Management Center (CVE-2026-20131): CISA has ordered federal agencies to patch a maximum-severity vulnerability in Cisco Secure Firewall Management Center by Sunday.
KVM Device and Claudy Day Claude Vulnerabilities: Additional vulnerabilities have been reported in KVM devices and Claudy Day Claude, though details remain limited.

Notable Threat Actor Activity

Russian Intelligence Signal Phishing: The FBI has linked recent phishing attacks targeting users of encrypted messaging apps (Signal, WhatsApp) to Russian intelligence services.
Interlock Ransomware: The Interlock ransomware gang, known for double-extortion tactics, exploited a critical Cisco firewall vulnerability weeks before its public disclosure.
GSocket Backdoor: A malicious Bash script installing the GSocket backdoor was discovered, though the delivery vector remains unidentified.
Fake Job Offers Distributing PureHVNC: Attackers are using fraudulent job offers via Google Forms to distribute PureHVNC malware, enabling remote device takeover.
US Confirms Handala-Iran Link: US authorities confirmed that the Handala group, whose domains were seized, is linked to the Iranian government and involved in cyber-enabled psychological operations.
Aisuru, KimWolf, JackSkid, Mossad Botnets: Joint international law enforcement action disrupted major IoT DDoS botnets by taking down their C2 infrastructure.

Trends, Tools, or Tactics of Interest

AI in Cybercrime: Increased use of AI by cybercriminals is enabling more sophisticated phishing attacks and rapid malware iteration.
Ransomware Backup Targeting: Analysis of Beast Gang’s exposed server files highlights aggressive targeting of network backups as a primary ransomware tactic.
Rapid Exploitation of Vulnerabilities: The Langflow case demonstrates minimal delay between vulnerability disclosure and active exploitation by threat actors.
Double Extortion: Interlock ransomware continues to employ double-extortion, combining data theft with ransomware demands.
Malware Delivery via Social Engineering: Ongoing campaigns use fake job postings and forms to deliver remote access malware.

Regulatory or Policy Developments

Google Android Sideloading Safeguard: Google implemented a mandatory 24-hour wait period for sideloading apps from unverified developers to reduce malware and scams.
CISA Directive on Cisco Vulnerability: US federal agencies are required to patch a critical Cisco Secure Firewall Management Center vulnerability by Sunday.
UK Toughens Cyber Reporting: The UK is strengthening requirements for cyber incident reporting, though specific measures were not detailed.
NYC Biometric Tracking Legislation: New York City lawmakers are seeking to limit biometric tracking to address concerns over surveillance pricing and customer profiling.
Meta Encryption Policy: Meta has removed end-to-end encryption for Instagram DMs, raising concerns among privacy experts about the future of encrypted communications.

Cybersecurity Brief – 2026-03-20

Fri, 20 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Navia Benefit Solutions disclosed a data breach impacting approximately 2.7 million individuals, with sensitive information exposed to attackers.
Security firm Aura reported a breach affecting 900,000 records after an employee was targeted via phone phishing, leading to data theft from a marketing tool.
Marquis confirmed a data breach affecting 672,000 individuals, with previous estimates suggesting over 1.6 million may be impacted.
Medical technology company Stryker suffered a destructive cyberattack that wiped around 80,000 devices. The FBI subsequently seized Handala hacktivist group’s data leak sites used to publicise the breach.
Bitrefill, a crypto-powered gift card store, attributed a recent cyberattack to North Korean Lazarus (Bluenoroff) group activity.
Ex-data analyst convicted of stealing company data and attempting to extort $2.5 million from Brightly Software while still employed as a contractor.

Newly Discovered Vulnerabilities

A critical “PolyShell” vulnerability affects all Magento Open Source and Adobe Commerce stable version 2 installations, enabling unauthenticated remote code execution and account takeover.
Ubiquiti patched two vulnerabilities in the UniFi Network Application, including a maximum-severity flaw that could allow account takeover.
A critical Microsoft SharePoint vulnerability, patched in January, is now being actively exploited in the wild.
ScreenConnect issued an update to address a critical vulnerability exposing machine keys, now adding encrypted storage and management for enhanced protection.

Notable Threat Actor Activity

Russian APT28 (GRU-linked) is exploiting a Zimbra Collaboration Suite vulnerability in attacks targeting Ukrainian government entities, leveraging insufficient sanitization of CSS content in HTML emails.
Multiple threat actors have been using the DarkSword iOS exploit kit, which chains six vulnerabilities (including three zero-days), for full device takeover since at least November 2025. Apple has issued warnings to users of older, unpatched iPhones.
North Korean Lazarus (Bluenoroff) group is linked to the cyberattack on Bitrefill.
Iranian threat actors prepared cyberattack infrastructure over a six-month period, including the use of US-based shell companies, to increase their operational resilience ahead of recent kinetic events.

Trends, Tools, or Tactics of Interest

EDR killer malware continues to evolve, with 54 EDR killers leveraging the Bring Your Own Vulnerable Driver (BYOVD) technique to exploit 35 signed vulnerable drivers and disable endpoint security solutions.
New Android malware family “Perseus” is actively targeting devices for takeover and financial fraud, monitoring user notes apps to extract sensitive data such as passwords and recovery phrases.
Speagle malware is hijacking the legitimate Cobra DocGuard program to exfiltrate data via compromised servers.
Recent DDoS botnet takedowns (Aisuru, Kimwolf, JackSkid, Mossad) highlight the continued threat from large-scale IoT botnets, with over 3 million infected devices used in record-breaking 31.4 Tbps attacks.
MCP (Model Code Provider) security issues in LLM (Large Language Model) environments are considered architectural and not easily patchable, posing ongoing risks.
Attackers are increasingly targeting password reset workflows for privilege escalation; security guidance has been issued to harden these processes.
Criminals are actively trading stolen tax records on dark web forums during tax season, with tax forms selling for as little as $20.

Regulatory or Policy Developments

The US Department of Justice, in cooperation with Canadian and German authorities, dismantled the infrastructure behind several major IoT botnets, including Aisuru, Kimwolf, JackSkid, and Mossad.
CISA issued advisories urging organisations to secure Microsoft Intune endpoint management systems, following their exploitation in the Stryker cyberattack.
Major providers are piloting quantum-safe HTTPS, reducing certificate size and improving both latency and transparency.

Cybersecurity Brief – 2026-02-06

Fri, 06 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Spain’s Ministry of Science has partially shut down IT systems following breach claims, disrupting several citizen- and company-facing services.
Rome’s La Sapienza University suffered a cyberattack causing widespread operational disruptions.
Romanian oil pipeline operator Conpet disclosed a cyberattack that disrupted business systems and took down its website; the Qilin ransomware group is reportedly involved.
Newsletter platform Substack notified users of a data breach after attackers stole email addresses and phone numbers (approx. 700,000 records) in October 2025.
Fintech firm Betterment reported a breach exposing email addresses and personal information of 1.4 million accounts in January.
Zendesk users experienced a renewed spam wave, with inboxes flooded by “Activate account” emails due to abuse of unsecured support systems.
SystemBC malware remains active post law enforcement takedown, infecting over 10,000 devices and continuing to deliver ransomware and proxy traffic.
VS Code configuration files in GitHub Codespaces were found to automatically execute when opening repositories or pull requests, exposing users to potential attacks.

Newly Discovered Vulnerabilities

Anthropic’s Claude Opus 4.6 LLM identified over 500 previously unknown high-severity security flaws across major open-source libraries.
A critical sandbox escape vulnerability in the n8n workflow automation tool could enable arbitrary command execution and credential theft.
Researchers highlighted that VS Code-integrated configuration files can be abused in GitHub Codespaces to achieve remote code execution.
The EnCase forensic tool driver, signed with an expired digital certificate, is being weaponised for EDR evasion due to Windows security gaps.

Notable Threat Actor Activity

The Stan Ghouls campaign is targeting organisations in Russia and Uzbekistan using Java-based loaders and NetSupport RAT, with indications of IoT interest.
Infy (aka Prince of Persia), an Iranian threat group, resumed operations with new C2 infrastructure after the end of the Iran internet blackout and has evolved its operational security tactics.
A previously identified cyberspy group, likely China-linked, has compromised governments and critical infrastructure in 37 countries.
Italy reportedly thwarted Russian-linked cyberattacks against Winter Olympics websites and foreign ministry offices.
The DEAD#VAX campaign is distributing AsyncRAT by disguising malicious virtual hard disks as PDF attachments.
Ransomware operators are abusing ISPsystem virtual machines to host and deliver payloads at scale.
The AISURU/Kimwolf botnet launched a record-setting 31.4 Tbps DDoS attack lasting 35 seconds.

Trends, Tools, or Tactics of Interest

Proof-of-concept attacks demonstrate that large language models (LLMs) can be used to generate phishing pages and malicious JavaScript in real time.
Phishing-as-a-service (PhaaS) platforms are increasingly central to the cybercriminal economy, enabling actors of all skill levels to conduct advanced phishing campaigns.
AI-powered scams are industrialising website cloning, with one network creating over 150 cloned law firm websites and using Cloudflare and IP rotation for evasion.
Attackers are leveraging malicious scripts, such as Chrome injectors, to steal browser data.
BYOVD (Bring Your Own Vulnerable Driver) techniques persist, with threat actors weaponising legitimate drivers for EDR bypass.
Cloud log limitations are creating monitoring blind spots; network-level telemetry is highlighted as a more reliable visibility source.
Abuse of unsecured customer support systems (e.g., Zendesk) continues to facilitate spam and phishing campaigns.
AI-generated web platforms (e.g., Moltbook) have been found exposing sensitive data via insecure APIs.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced the deprecation of Exchange Web Services (EWS) API for Exchange Online, effective April 2027.
Concerns have been raised regarding CISA’s silent updates to the Known Exploited Vulnerabilities (KEV) catalog, particularly relating to ransomware-exploited vulnerabilities.
Flock Safety’s ALPR cameras were found to have shared license plate data with hundreds of agencies without permission, prompting a California city to shut down its system.
Zscaler has acquired browser security firm SquareX, aiming to embed lightweight security extensions across browsers.

Cybersecurity Brief – 2026-01-30

Fri, 30 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Match Group, the parent company of Tinder, OkCupid, Hinge, and Match.com, confirmed a cybersecurity incident resulting in the compromise of user data across multiple platforms.
Marquis Software Solutions reported that a ransomware attack in August 2025 affecting dozens of U.S. banks and credit unions was due to a breach of SonicWall cloud backups.
An AI chat toy company, Bondu, exposed over 50,000 logs of conversations between children and its AI-enabled toys due to an unsecured web console.
The French national unemployment agency was fined €5 million for a breach that resulted in the theft of job seekers’ personal information.
eScan antivirus suffered a supply chain attack, with malicious updates detected and distributed through its update mechanism.
Google, in collaboration with industry partners, disrupted the IPIDEA residential proxy network, which had been leveraged by threat actors via malware-infected devices.

Newly Discovered Vulnerabilities

Ivanti released security updates for two zero-day remote code execution (RCE) vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), CVE-2026-1281 and CVE-2026-1340, both of which have been actively exploited.
SolarWinds patched four critical vulnerabilities in its Web Help Desk product, including unauthenticated RCE and authentication bypass flaws.
Multiple critical vulnerabilities were identified in the n8n automation platform, allowing unauthenticated remote code execution and server hijacking via sandbox and AST sanitization flaws.
Microsoft issued an emergency patch for a Microsoft Office zero-day that allowed malicious documents to bypass security checks.
Researchers found 175,000 publicly exposed Ollama AI servers across 130 countries, creating a significant attack surface for exploitation.
Android theft protection features were updated by Google to strengthen device authentication and recovery.

Notable Threat Actor Activity

A new Android malware campaign abused the Hugging Face platform to distribute thousands of APK payload variants targeting financial and payment credentials.
Chinese APT groups deployed advanced malware against organisations in Asia, indicating ongoing high-end cyber-espionage operations.
The Aisuru (Kimwolf) botnet executed a record-setting DDoS attack in December 2025, peaking at 31.4 Tbps and 200 million requests per second.
Flare researchers highlighted how infostealer malware is being distributed via malicious Roblox game mods, enabling lateral movement from home PCs to corporate environments.
An operation dubbed “Bizarre Bazaar” targeted exposed large language models (LLMs) and managed control panels (MCPs) for commercial monetization.
The Clawdbot malware rebranded as Moltbot, sparking impersonation and supply chain risk campaigns.

Trends, Tools, or Tactics of Interest

SentinelOne and Censys reported a widespread issue of unmanaged, publicly accessible AI deployments, specifically Ollama servers, posing risks to data privacy and security.
The use of “semantic chaining” in prompt engineering was shown to bypass content controls in LLMs such as Gemini Nano Banana and Grok 4 by splitting malicious prompts into discrete segments.
The IPIDEA proxy network relied on SDKs embedded in mobile and desktop applications to enroll compromised devices into its proxy service.
The Global Cybersecurity Outlook 2026 and industry commentary emphasize the need for improved vulnerability management, preparation for quantum threats, and responsible AI deployment.
A survey of over 100 energy sector OT systems revealed pervasive cybersecurity gaps in substations, power plants, and control centers.
Microsoft Teams will introduce a feature to report suspicious calls as potential scams or phishing attempts by mid-March 2026.

Regulatory or Policy Developments

The Trump administration rescinded Biden-era guidance requiring U.S. federal agencies to solicit software bills of materials (SBOMs) and compliance attestations with NIST’s Secure Software Development Framework (SSDF) from vendors.
The French data protection authority imposed a €5 million fine on the national unemployment agency for inadequate security measures leading to a data breach.

Cybersecurity Brief – 2026-01-15

Thu, 15 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Kyowon Group, a major South Korean conglomerate, confirmed a ransomware attack resulting in operational disruption and potential exposure of customer data.
Cloud marketplace Pax8 inadvertently exposed internal business information, including MSP customer data, to fewer than 40 UK-based partners via email.
Robo-advisor Betterment disclosed a breach where a threat actor accessed customer information and sent scam crypto-related messages.
Free Mobile and its parent company, Free, were fined €42 million by the French CNIL for inadequate protection of customer data related to a 2024 breach.

Newly Discovered Vulnerabilities

Fortinet patched a critical unauthenticated remote code execution vulnerability in FortiSIEM. Public exploit code and technical details for this flaw have been released.
Additional critical vulnerabilities in Fortinet products, including FortiFone, were disclosed and patched, with risks of configuration leaks and code execution.
Chrome 144 and Firefox 147 released patches for high-severity vulnerabilities, addressing 26 security defects including code execution risks.
Microsoft’s January 2026 Patch Tuesday addressed 114 Windows vulnerabilities, including one actively exploited in the wild.
A DLL side-loading vulnerability in the open-source c-ares library is being actively exploited to bypass security controls and deploy malware.

Notable Threat Actor Activity

Microsoft and law enforcement disrupted the RedVDS cybercrime-as-a-service platform, which facilitated phishing, BEC, account takeover, and fraud, and was linked to over $40 million in losses.
Researchers null-routed over 550 command-and-control servers associated with the AISURU/Kimwolf botnet, which had infected over two million devices since October 2025.
A major phishing campaign abused Google’s infrastructure, targeting over 3,000 organizations (primarily in manufacturing) to bypass email security defenses.
Magecart skimming attacks are targeting online checkouts using major payment networks such as AmEx, Diners Club, and Mastercard.
The newly emerged Sicarii Ransomware-as-a-Service operation began advertising across underground forums in December 2025.
Predator spyware has been found to use failed attacks for intelligence gathering to improve future exploit attempts.
Fake “account restricted” comments are being posted on LinkedIn as part of phishing campaigns to steal user credentials.

Trends, Tools, or Tactics of Interest

Microsoft was the most impersonated brand in phishing attacks during Q4 2025, followed by Facebook, Roblox, McAfee, and Steam.
OAuth phishing attacks using the ConsentFix technique are evolving, with attackers hijacking Microsoft accounts via browser-based authorization flows.
The “Reprompt” attack technique allowed hijacking of Microsoft Copilot sessions for sensitive data exfiltration.
AI agents are increasingly being integrated into core workflows, raising concerns about privilege escalation pathways.
64% of third-party applications on leading websites now access sensitive data without business justification, up from 51% in 2024.
Attackers are leveraging legitimate open-source software downloads to conceal remote backdoors.
The “VoidLink” modular malware framework is targeting Linux systems, designed for stealthy, long-term access in cloud-first environments.
Infection campaigns are repeatedly adding scheduled tasks and increasing communication with persistent C2 domains.

Regulatory or Policy Developments

The French CNIL imposed a €42 million fine on Free Mobile and Free for failing to adequately protect customer data in a 2024 breach incident.
An investor lawsuit related to the CrowdStrike outage was dismissed due to lack of evidence of investor fraud.

Cybersecurity Brief – 2026-01-07

Wed, 07 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover (JLR) reported a 43% decline in third-quarter wholesale volumes following a cyberattack in September 2025.
Sedgwick confirmed a security breach at its federal contractor subsidiary, Sedgwick Government Solutions.
Two malicious Chrome extensions, installed by approximately 900,000 users, were found exfiltrating ChatGPT and DeepSeek conversations and browsing data.
NordVPN denied a breach after a threat actor leaked data allegedly sourced from the company; an internal investigation is ongoing.
Researchers linked dozens of major data breaches to a single initial access broker using credentials exfiltrated by information stealers.
A phishing campaign is actively abusing Google Cloud Integration Application infrastructure to steal Microsoft 365 credentials, bypassing standard email filters.

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2026-0625, CVSS 9.3) in legacy D-Link DSL gateway routers is under active exploitation. The affected devices are out of support.
An unpatched firmware flaw in the TOTOLINK EX200 wireless range extender allows remote authenticated attackers full device takeover.
A critical Dolby vulnerability (CVE-2025-54957) in Android, discovered by Google researchers, has been patched.
AI-powered VS Code forks (Cursor, Windsurf, Google Antigravity, Trae) recommend non-existent extensions, creating a supply chain risk in the Open VSX ecosystem.

Notable Threat Actor Activity

The Kimwolf Android botnet, an Aisuru malware variant, has infected over two million hosts by exploiting vulnerabilities in residential proxy networks to target internal devices.
Scattered Lapsus$ Hunters (ShinyHunters) were lured into a honeypot using synthetic data and fake accounts, allowing researchers to gather intelligence on their infrastructure and tactics.
A campaign named PHALT#BLYX targets the hospitality sector with fake booking emails that redirect hotel staff to counterfeit blue screen of death (BSoD) pages, leading to DCRat remote access trojan infections.
Chinese threat actors increased cyberattacks on Taiwan’s energy sector tenfold in 2025 compared to the previous year, according to Taiwan’s National Security Bureau.
An initial access broker has been linked to numerous major data breaches using credentials harvested by information-stealing malware.

Trends, Tools, or Tactics of Interest

Generative AI is accelerating credential attacks against Active Directory, enabling faster and more effective password cracking.
AI-generated images and videos are being used in misinformation campaigns during breaking news events, complicating verification and increasing the risk of disinformation.
Paid AI-powered tools capable of generating “undressed” images are becoming more accessible and mainstream via platforms such as X (formerly Twitter).
The ClickFix campaign uses legitimate Microsoft tools and social engineering (fake BSoD errors) to deploy DCRat RAT, particularly targeting the hospitality industry.
Tailsnitch, a new tool for auditing Tailscale configurations, has been released to improve overlay network security.
Debate continues around whether prompt injection and sandbox-related issues in Microsoft Copilot constitute true security vulnerabilities or are inherent limitations of AI systems.
Cyber risk management is shifting focus toward resilience and rapid recovery rather than solely prevention.

Regulatory or Policy Developments

Disney was fined $10 million by the FTC for violating children’s privacy laws by mislabeling kid-focused YouTube videos.
Microsoft canceled its planned daily limit of 2,000 external recipients for Exchange Online bulk email senders.
Thirty significant cybersecurity M&A deals were announced in December 2025, involving major industry players such as Akamai, Red Hat, Checkmarx, Silent Push, and ServiceNow.

Cybersecurity Brief – 2025-12-20

Sat, 20 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

University of Sydney Data Breach: A data breach at the University of Sydney has affected 27,000 individuals, including current and former staff, affiliates, alumni, and students. The breach was linked to information downloaded from a code library.
Microsoft Teams Outage: Microsoft Teams experienced significant service disruptions, with widespread issues and delays in message delivery.
Denmark Water Utility Attack: Danish intelligence has attributed destructive cyberattacks on the country’s water utility and other critical infrastructure to Russian state actors, in what is described as part of a broader campaign of hybrid warfare against Western nations.

Newly Discovered Vulnerabilities

WatchGuard Fireware OS VPN Vulnerability (CVE-2025-14733): A critical remote code execution vulnerability (CVSS 9.3) in WatchGuard Fireware OS VPN is being actively exploited in the wild. Patches have been released.
UEFI Firmware Flaw in Major Motherboards: Certain ASRock, ASUS, GIGABYTE, and MSI motherboards are affected by a UEFI vulnerability allowing early-boot DMA attacks that can bypass memory protections.
FortiCloud SSO Exposure: Over 25,000 Fortinet devices with FortiCloud SSO enabled are exposed online, putting them at risk of remote attacks amid ongoing exploitation of a critical authentication bypass vulnerability.
DCOM Lateral Movement via Control Panel: Researchers detailed a method for abusing DCOM interfaces and the Windows Registry to load malicious DLLs into memory via the Control Panel, facilitating lateral movement on Windows systems.
ASUS Live Update Backdoor: CISA has added the ASUS Live Update backdoor to its Known Exploited Vulnerabilities catalog, noting it remains exploitable seven years after the original discovery.

Notable Threat Actor Activity

Cloud Atlas APT: Cloud Atlas has updated its toolkit, deploying new versions of its signature backdoors (VBShower, VBCloud, PowerShower, CloudAtlas) in recent campaigns.
Russia-Linked Microsoft 365 Phishing: A Russian-aligned threat group is conducting phishing campaigns targeting Microsoft 365 accounts using device code authentication workflows for account takeover.
RaccoonO365 Phishing Platform: Nigerian authorities arrested three individuals behind the RaccoonO365 phishing-as-a-service platform, which was used in targeted Microsoft 365 attacks against major corporations.
LongNosedGoblin (China-Aligned APT): The LongNosedGoblin group is targeting Southeast Asian and Japanese government networks, using Group Policy to deploy cyberespionage tools.
Kimwolf Android Botnet: The Kimwolf botnet, linked to the Aisuru IoT botnet, has compromised 1.8 million Android devices and issued over 1.7 billion DDoS attack commands.
Cracked Software/YouTube Malware Campaign: A new campaign is distributing CountLoader and GachiLoader malware via cracked software sites and YouTube videos.
North Korean Threat Activity: North Korean cybercriminals shifted strategy to target higher-value victims, employing more sophisticated and patient attack methods for larger financial gain.
Cisco VPNs and Email Services Attacks: Cisco reported two separate threat campaigns-one sophisticated and one broad-targeting its VPN and email services.

Trends, Tools, or Tactics of Interest

OAuth Device Code Phishing: Multiple threat actors are leveraging OAuth device code authorization mechanisms for phishing attacks on Microsoft 365 accounts.
Group Policy Abuse: Chinese APTs are deploying espionage tools via Group Policy across targeted government networks.
DCOM and DLL Abuse: Lateral movement techniques abusing DCOM interfaces and DLL loading via TLS Callbacks and Control Panel are being actively researched and reported.
Modular Loader Malware: New variants of modular and stealthy loaders, such as CountLoader and GachiLoader, are being distributed through popular cracked software channels and video platforms.
AI in Cybersecurity: Criminal IP’s integration with Palo Alto Networks Cortex XSOAR brings AI-driven exposure intelligence to automated incident response. Palo Alto Networks and Google Cloud have also announced a multibillion-dollar deal to integrate AI and cloud security capabilities.
Hardened Open Source Docker Images: Docker has released 1,000 hardened, production-ready container images as free and open source resources.

Regulatory or Policy Developments

FTC Settlement with Instacart: Instacart will refund $60 million to customers following an FTC settlement over deceptive subscription practices.
Thailand-Led International Anti-Scam Initiative: An international initiative to combat online scams was launched at a conference in Bangkok, with participation from ASEAN member states.
US Law Enforcement Action on Crypto Exchange: The US has shut down the E-Note crypto exchange and charged its Russian administrator for laundering funds for ransomware and other cybercriminal groups.
CISA KEV Catalog Update: CISA has updated its Known Exploited Vulnerabilities catalog to include the ASUS Live Update backdoor.
US Policy Shifts: The Trump administration has made significant policy changes perceived as weakening the nation’s cybersecurity posture and willingness to address technology challenges.

Cybersecurity Brief – 2025-12-06

Sat, 06 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite, resulting in the theft of database files.
American pharmaceutical company Inotiv reported a ransomware attack in August 2025 that led to the theft of personal information affecting thousands of individuals.
An AI image generator startup exposed a database containing over 1 million images and videos, including nude and “nudified” photos of real people, due to misconfigured internet access.
A human rights lawyer in Pakistan was targeted by Intellexa’s Predator spyware via a malicious WhatsApp link, marking the first known civil society targeting in the region.
Cloudflare experienced a major outage, causing widespread 500 Internal Server Errors, attributed to emergency mitigations for the React2Shell vulnerability.

Newly Discovered Vulnerabilities

React2Shell (CVE-2025-55182): A maximum-severity remote code execution vulnerability in React and Next.js was disclosed. The flaw is under active exploitation, particularly by China-linked threat actors, and has prompted emergency patching efforts including by Cloudflare.
Apache Tika (CVE-2025-66516): A critical XML external entity (XXE) injection vulnerability, rated CVSS 10.0, was disclosed in Apache Tika, requiring urgent patching.
Perplexity’s Comet Browser: A new agentic browser attack was disclosed, allowing a crafted email to trigger deletion of a user’s entire Google Drive contents via a zero-click exploit.
Akamai HTTP Smuggling: Akamai patched a vulnerability allowing HTTP smuggling attacks.

Notable Threat Actor Activity

Multiple China-nexus threat groups began exploiting the React2Shell vulnerability within hours of its public disclosure, targeting React and Next.js applications.
State-sponsored actors from the People’s Republic of China (PRC), including the group Warp Panda, have been observed deploying the BRICKSTORM, Junction, and GuestConduit malware families for long-term persistence in US systems.
Clop ransomware group exploited an Oracle E-Business Suite zero-day in the Barts Health NHS breach.
Intellexa, operators of Predator spyware, continue to leverage newly acquired zero-day exploits and alternative vectors such as ad-based delivery to bypass security controls and target individuals.

Trends, Tools, or Tactics of Interest

Malicious AI Tools: Researchers at Palo Alto Networks’ Unit 42 identified WormGPT 4 and KawaiiGPT, malicious AI tools enabling threat actors to automate the creation of phishing lures and ransomware code.
DDoS Attacks: The Aisuru botnet launched a record-breaking distributed denial-of-service (DDoS) attack, peaking at 29 Tbps and 14.1 billion packets per second, recently mitigated by Cloudflare.
Virtual Kidnapping Scams: The FBI warned of criminals using altered social media images as fake “proof of life” in virtual kidnapping ransom scams.
Attack Surface Management: Emphasis on continuous, automated attack surface visibility as cloud assets and exposures change rapidly.
Detection Tools: Burp Suite has added automated scanning capabilities for React2Shell vulnerabilities in Next.js applications.
Predator Spyware: Leaked Intellexa documents show ongoing use of high-priced zero-day exploits to maintain Predator spyware effectiveness.

Regulatory or Policy Developments

The European Commission fined X (formerly Twitter) €120 million ($140 million) for violating transparency obligations under the Digital Services Act (DSA), specifically related to deceptive blue checkmarks.
India has rolled back its proposed mandate requiring citizens to install a government cybersecurity app, following surveillance and privacy concerns.

Cybersecurity Brief – 2025-12-04

Thu, 04 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Cloudflare mitigated a record-breaking 29.7 Tbps distributed denial-of-service (DDoS) attack attributed to the Aisuru botnet, which leveraged up to 4 million infected hosts and launched over 1,300 attacks in three months.
Marquis Software Solutions reported a data breach impacting over 74 US banks and credit unions.
French retailer Leroy Merlin disclosed a data breach that compromised customer personal data in France.
Freedom Mobile, a major Canadian wireless carrier, suffered a breach exposing customer data after attackers accessed its customer account management platform.
The University of Phoenix and the University of Pennsylvania confirmed data breaches linked to the exploitation of vulnerable Oracle E-Business Suite instances in a campaign attributed to the Clop ransomware group.
WordPress sites using the King Addons for Elementor plugin are being actively compromised via exploitation of a critical vulnerability (CVE-2025-8489), allowing attackers to create admin accounts and take over sites.

Newly Discovered Vulnerabilities

Critical vulnerabilities in React Server Components (RSC), tracked as CVE-2025-5518 and another CVE, allow unauthenticated remote code execution; these flaws may impact more than a third of cloud service providers.
The King Addons for Elementor WordPress plugin (CVE-2025-8489, CVSS 9.8) is under active attack, enabling privilege escalation to administrative permissions.
Microsoft silently patched a high-severity Windows LNK vulnerability that has been exploited by multiple state-backed and cybercrime groups as a zero-day since 2017. The November 2025 Patch Tuesday update addressed the issue, and Windows now displays additional LNK file properties to help identify malicious code.
Three critical vulnerabilities were disclosed in Picklescan, an open-source utility for scanning PyTorch models. These flaws allow malicious PyTorch models to evade scans and execute arbitrary code.
Chrome 143 stable release addressed 13 vulnerabilities, including a high-severity flaw in the V8 JavaScript engine.

Notable Threat Actor Activity

Kaspersky identified Shai Hulud 2.0, a new version of the npm worm now equipped with wiper functionality, targeting organizations in Russia, India, Brazil, China, and other countries.
The Water Saci threat actor has evolved its banking trojan campaign in Brazil, now using a multi-layered infection chain involving HTA files, PDFs, and propagation via WhatsApp and RelayNFC for NFC relay fraud. AI-enhanced Python variants are targeting enterprise users of banks and cryptocurrency exchanges.
The MuddyWater APT (linked to Iran) targeted Israeli organizations using new evasion tactics, including techniques mimicking the retro Snake mobile game.
The ShadyPanda group, believed to be China-based, has been using malicious Chrome and Edge browser extensions to spy on millions of users globally.
A malicious Rust crate was discovered targeting Web3 developer systems across Windows, macOS, and Linux, capable of OS-specific malware delivery and stealthy execution.
DragonForce ransomware, in collaboration with the Scattered Spider group, has expanded operations in 2025, leveraging advanced social engineering and initial access techniques.
Attackers are increasingly using Evilginx to steal session cookies, enabling bypass of multi-factor authentication (MFA) protections.
There is a rise in attackers abusing legitimate Remote Monitoring and Management (RMM) tools to gain remote control of victim systems.

Trends, Tools, or Tactics of Interest

The Aisuru botnet’s scale and DDoS throughput set new records, highlighting the growing potency of botnet-driven attacks.
Matrix Push C2, a new criminal toolkit, is abusing browser push notifications to launch social engineering attacks.
Use of AI tools is fueling more sophisticated cybercrime, lowering barriers for less-skilled actors and enhancing the quality of phishing and malware campaigns.
Attackers are increasingly targeting enterprises during off-hours, weekends, and holidays, exploiting reduced staffing and slower response times.
Content Delivery Networks (CDNs) remain a primary mitigation for DDoS and aggressive bot traffic, but attackers are attempting to bypass these protections.
Fileless attack techniques and abuse of legitimate IT tools are increasingly observed, complicating detection and response for defenders.

Regulatory or Policy Developments

The Arizona Attorney General has filed a lawsuit against Chinese online retailer Temu, alleging unauthorized and undisclosed access to and harvesting of user data through its mobile application.
CISA and partners released a new joint guide focused on the secure integration of artificial intelligence in operational technology environments.
Google is expanding Android’s in-call scam protection for financial applications in the US, aiming to address rising phone-based fraud.
Russia has blocked access to the Roblox gaming platform, citing the distribution of LGBT-related content and extremist material as justification.

Cybersecurity Brief – 2025-11-19

Wed, 19 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The Pennsylvania Attorney General’s office confirmed a data breach following a ransomware attack by the Inc Ransom group, which claims to have stolen several terabytes of data.
Princeton University disclosed a data breach affecting alumni, donors, faculty, students, and parents, with hackers accessing a database containing personal information.
Eurofiber France suffered a breach where a threat actor exploited a vulnerability, exfiltrated data, and attempted extortion.
French social security agency Pajemploi reported a data breach potentially exposing the personal information of 1.2 million individuals.
DoorDash disclosed a data breach involving theft of customer names and addresses.
A simple flaw in WhatsApp’s contact discovery tool exposed up to 3.5 billion phone numbers, along with profile photos and other data, by allowing mass enumeration.
Cloudflare experienced a global outage affecting multiple major online services, though it was confirmed not to be caused by a cyberattack.

Newly Discovered Vulnerabilities

Fortinet released patches for a new FortiWeb zero-day vulnerability (CVE-2025-58034, CVSS 6.7) that is being actively exploited in the wild.
Google released an emergency update to address a new Chrome zero-day vulnerability under active exploitation, marking the seventh Chrome zero-day exploited this year.
Researchers identified that exposed Ray clusters are being hijacked via an old code execution flaw in a campaign dubbed ShadowRay 2.0, converting them into a cryptomining botnet.
IoT devices remain susceptible to takeover via gaps in cloud management interfaces for firewalls and routers, even if protected by security software or not directly online.

Notable Threat Actor Activity

Iranian-linked threat actors, including UNC1549, have been observed targeting aerospace and defense sectors in the US, Israel, UAE, Qatar, Spain, and Saudi Arabia, deploying backdoors such as TWOSTROKE and DEEPROOT.
The Inc Ransom group claimed responsibility for the ransomware attack and data breach at the Pennsylvania Attorney General’s office.
A new phishing kit is impersonating the Italian IT provider Aruba, targeting Italian entities to steal credentials.
MI5 warned UK lawmakers that Chinese intelligence operatives are using LinkedIn for large-scale outreach and espionage efforts.
Seven malicious npm packages were discovered using Adspect cloaking to differentiate between security researchers and real victims, redirecting the latter to cryptocurrency scam pages.

Trends, Tools, or Tactics of Interest

Phishing-as-a-Service (PhaaS) kit Sneaky 2FA has added Browser-in-the-Browser (BitB) pop-up functionality to better mimic legitimate login processes and bypass 2FA.
The Tycoon 2FA phishing platform has enabled real-time MFA relays, supporting over 64,000 attacks this year, highlighting the ongoing collapse of legacy MFA when targeted by advanced phishing kits.
Tuoni C2, a nascent command-and-control and red teaming framework, was used in a recent attempted cyber intrusion targeting a major US real-estate company.
Microsoft mitigated a record-breaking 15.72 Tbps DDoS attack against an endpoint in Australia, attributed to the AISURU botnet.
Enterprises are increasingly leveraging dark web search engines for credential leak monitoring, impersonation detection, and supply chain exposure analysis using APIs and IOC hunting.
Bug bounty programs continue to rise as a key strategic security solution, with Meta alone paying out $4 million in 2025 and launching new tools to support security research on WhatsApp.
Microsoft announced native integration of Sysmon into Windows 11 and Server 2025, eliminating the need for standalone deployment.
New Windows 11 features, Cloud Rebuild and Point-in-Time Restore, aim to streamline system recovery and reduce downtime.
Microsoft Teams will soon allow users to report messages incorrectly flagged as threats, refining threat detection accuracy.
Thunderbird 145 now supports native connectivity to Microsoft Exchange via EWS protocol.

Regulatory or Policy Developments Affecting the Security Industry

MI5 issued a formal warning to UK lawmakers regarding ongoing Chinese espionage campaigns leveraging professional networking platforms.

Cybersecurity Brief – 2025-11-18

Tue, 18 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Eurofiber France disclosed a data breach after hackers exploited a vulnerability in its ticket management system, resulting in exfiltration of customer information. The breach was discovered after the attacker attempted to sell the data.
Princeton University reported a data breach on 10 November 2025, exposing personal information of alumni, donors, faculty, and students.
DoorDash confirmed a data breach involving compromise of names, addresses, email addresses, and phone numbers after an employee was targeted in a social engineering attack.
The Pennsylvania Attorney General’s office confirmed a data breach following an August 2025 ransomware attack by the INC Ransom group, with personal and medical information stolen.
Logitech confirmed a data breach after being listed by the Cl0p ransomware group. The incident is linked to the Oracle E-Business Suite exploitation.
Dutch police seized approximately 250 servers used by a bulletproof hosting service that provided infrastructure for cybercriminals.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two vulnerabilities, including CVE-2025-xxxx, a V8 zero-day flaw under active exploitation, reportedly by a commercial spyware vendor.
A critical remote code execution vulnerability in Fortinet FortiWeb WAF is being actively exploited in the wild, allowing unauthenticated attackers to execute administrative commands.
The RondoDox botnet is exploiting CVE-2025-24893, a critical RCE vulnerability in XWiki Platform. Widespread exploitation has been observed, including by botnets, crypto miners, and custom tools.
Seven malicious npm packages are abusing the Adspect cloud-based service to redirect researchers while leading victims to malicious payloads.
A vulnerability in DoorDash’s email systems allowed attackers to send spoofed, official-looking emails from DoorDash servers, creating a significant phishing risk. DoorDash has since patched the issue.
Researchers identified a security weakness in the AI-powered coding tool Cursor, enabling credential-stealing attacks via a malicious MCP server hijacking the internal browser.

Notable Threat Actor Activity

The Dragon Breath threat actor is using a multi-stage loader (RONINGLOADER) to disable security tools and deploy a modified Gh0st RAT in recent campaigns.
Iranian state-sponsored APTs are targeting defense and government officials, including their family members, in ongoing campaigns to increase pressure on primary targets.
The Aisuru botnet launched a 15.72 Tbps DDoS attack against Microsoft Azure, leveraging over 500,000 IP addresses.
The EVALUSION ClickFix campaign is deploying Amatera Stealer and NetSupport RAT via social engineering techniques.
Cl0p ransomware group continues to exploit Oracle E-Business Suite (CVE-2025-61882), with associated data breaches including Logitech.
Scammers are sending fake copyright violation messages to steal X (formerly Twitter) logins.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly shifting to non-email channels, with LinkedIn and other platforms now accounting for 1 in 3 phishing incidents.
ClickFix social engineering tactics are being widely adopted in malware distribution campaigns.
Malicious packages in open-source repositories such as npm are using cloud-based redirectors to evade detection and target victims.
Bulletproof hosting services remain a critical enabler for cybercriminal infrastructure, as evidenced by recent law enforcement action in the Netherlands.
Attackers are leveraging vulnerabilities in widely used platforms (e.g., XWiki, FortiWeb, Oracle E-Business Suite) for large-scale exploitation.
DDoS attacks are increasing in scale and sophistication, as demonstrated by the recent record-setting attack on Microsoft Azure.

Regulatory or Policy Developments Affecting the Security Industry

In the US, five individuals pleaded guilty to assisting North Korean IT workers in obtaining employment at US companies by providing false identities and remote access to company laptops, highlighting ongoing law enforcement efforts against supply chain and insider threats.
Microsoft released an out-of-band Windows 10 update (KB5072653) to address issues with installing Extended Security Updates, ensuring continued compliance for organizations relying on legacy systems.

Cybersecurity Brief – 2025-11-06

Thu, 06 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall confirmed that state-sponsored threat actors were responsible for the September 2025 breach, which resulted in the exposure of customers’ firewall configuration backup files.
Hyundai AutoEver America reported a data breach in which attackers accessed sensitive personal information, including Social Security numbers and driver’s license details.
The University of Pennsylvania disclosed that a cyberattack led to the compromise and theft of data from internal systems related to development and alumni activities.
Nikkei, a major Japanese media company, suffered a breach via compromised Slack credentials, impacting approximately 17,000 employees and business partners.
International law enforcement dismantled three large credit card fraud and money laundering networks, linked to losses exceeding €300 million and affecting over 4.3 million cardholders.
Check Point Research detailed an incident where an attacker exploited a rounding error in Balancer V2’s ComposableStablePool, resulting in the theft of $128 million in cryptocurrency.

Newly Discovered Vulnerabilities

A critical remote command execution vulnerability in CentOS Web Panel (CWP) is being actively exploited, according to CISA.
A critical vulnerability in the Post SMTP WordPress plugin is under active attack, allowing full compromise of affected sites and unauthorized reading of emails, including password reset messages. Approximately 400,000 WordPress sites are affected.
Researchers disclosed new vulnerabilities in OpenAI’s ChatGPT that could enable attackers to steal personal information and confidential data.
Apple released patches addressing nearly 50 security flaws across iPhones, Macs, Safari, and other products, some of which could be used to compromise user data.
A zero-day vulnerability (CVE-2025-61932) in a popular endpoint manager was exploited by the APT group Bronze Butler to backdoor Japanese organizations.

Notable Threat Actor Activity

Google identified a previously unknown threat actor deploying VB Script malware dubbed PROMPTFLUX, which uses Gemini AI to rewrite its code every hour to evade detection.
Google’s Threat Intelligence Group reported a major shift toward adversaries leveraging artificial intelligence to create and deploy new malware families with large language model (LLM) integration, including malware that mutates during execution.
The Gootloader malware loader operation has resumed after a 7-month hiatus, again using SEO poisoning to distribute malicious payloads.
A new threat cluster, codenamed UNK_SmudgedSerpent, has targeted US academics and foreign policy experts amid Iran–Israel tensions, with attribution to Iranian threat actors suspected but unconfirmed.
The Aisuru botnet was observed dominating Cloudflare’s top requested domains list, indicating significant botnet activity.
The US Treasury Department imposed sanctions on two North Korean financial institutions and eight individuals, targeting entities involved in laundering stolen cryptocurrency and conducting fraudulent IT worker schemes.

Trends, Tools, or Tactics of Interest

Multiple sources, including Malwarebytes and Google, highlight a rapid increase in AI-driven extortion, phishing, and malware campaigns, with AI being used for code mutation, data collection, and evasion.
Verizon’s Mobile Security Index and other studies reaffirm that human error remains a leading factor in successful cyberattacks, particularly in mobile security incidents.
Gootloader’s return signals ongoing use of SEO poisoning as an effective method for malware distribution.
Attackers are increasingly targeting supply chain vulnerabilities, with concerns raised about a popular software update tool presenting risks comparable to the SolarWinds incident.
There is continued exploitation of operational technology (OT) environments in manufacturing, with inherent security risks persisting despite increased awareness.

Regulatory or Policy Developments Affecting the Security Industry

UK mobile carriers, in partnership with the government, have committed to network upgrades designed to block spoofed phone numbers, aiming to reduce scam and fraud incidents.
The US Treasury Department’s new sanctions against North Korean entities underscore ongoing international efforts to disrupt cyber-enabled financial crime and fraud.

Cybersecurity Brief – 2025-10-29

Wed, 29 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Dentsu Data Breach: Japanese advertising giant Dentsu disclosed a cybersecurity incident at its U.S. subsidiary Merkle, resulting in the exposure of staff and client data.
Oracle EBS Attacks: Numerous organizations, including Schneider Electric and Emerson, have been identified as victims of attacks exploiting Oracle E-Business Suite zero-day CVE-2025-61882. Data stolen from these companies has been made available on the Cl0p ransomware leak site.
Swedish Power Grid Incident: Hackers targeted a Swedish power grid operator, stealing information from a file transfer solution. The country’s power supply was not affected.
183 Million Credentials Traded: Cybercriminals are trading 183 million stolen credentials on Telegram and dark web forums, with 16.4 million email addresses not previously seen in data breaches.

Newly Discovered Vulnerabilities

TEE.Fail Side-Channel Attack: Academic researchers disclosed TEE.Fail, a side-channel attack enabling extraction of secrets from trusted execution environments in Intel, AMD, and NVIDIA CPUs, undermining confidential computing.
QNAP NetBak PC Agent Vulnerability: The software is affected by a recent critical ASP.NET Core flaw that allows HTTP request smuggling, data access, server file modification, or denial-of-service.
Dassault Systèmes DELMIA Apriso: CISA warned of two actively exploited vulnerabilities in this manufacturing operations management platform.
Chrome Zero-Day: A now-patched Chrome zero-day was exploited to deliver Memento Labs’ LeetAgent spyware.
BiDi Swap Phishing Technique: Attackers are abusing bidirectional text to craft fake URLs that appear legitimate, reviving a browser flaw for phishing.
Atroposia Malware: A new malware-as-a-service platform, Atroposia, includes a built-in local vulnerability scanner for post-compromise exploitation.

Notable Threat Actor Activity

BlueNoroff (North Korea): The BlueNoroff APT group is running twin campaigns (GhostCall and GhostHire) targeting Web3 and blockchain sectors with cross-platform malware, using fake business collaboration and job recruitment lures.
Qilin Ransomware: The Qilin operation is abusing Windows Subsystem for Linux (WSL) to run Linux encryptors on Windows systems, evading traditional security tools.
Herodotus Android Trojan: A new banking trojan, Herodotus, is targeting Italy and Brazil, using random delay injection to mimic human typing and bypass anti-fraud and security detection mechanisms.
Aisuru Botnet: The Aisuru botnet, previously responsible for massive Mirai-class DDoS attacks exceeding 20 Tbps, has shifted to operating as a residential proxy network for more sustainable monetization.
YouTube Ghost Network: This malware operation leverages compromised YouTube accounts and botnets to distribute infostealers, with activity tripling in 2025.

Trends, Tools, or Tactics of Interest

AI-Powered Attacks in Africa: Cybersecurity firms report a surge in AI-driven phishing, deepfakes, and impersonation attacks across Africa, with adversaries testing new techniques on government and enterprise targets.
Deepfake-as-a-Service: The emergence of voice cloning and synthetic media fraud services is impacting enterprise security, with documented cases of business compromise and evolving detection tactics.
Invisible Characters in Phishing: Attackers are using invisible characters in email subject lines to bypass detection and trick recipients.
Grok Abuse for Phishing: Attackers are exploiting the Grok platform to distribute phishing links.
Surge in Credential Theft: Large-scale credential theft and trading continues unabated, with significant numbers of newly compromised emails.
Chrome HTTP Warnings: Google Chrome will begin warning users before connecting to insecure HTTP sites starting with version 154 in October 2026.

Regulatory or Policy Developments

UN Cybercrime Convention: Around 70 countries have signed a new UN cybercrime convention, though concerns have been raised about expanded surveillance and potential criminalization of security research.
Python Software Foundation Grant Rejection: The PSF withdrew a $1.5 million U.S. National Science Foundation grant proposal due to terms that conflicted with its diversity and inclusion commitments.
Microsoft Copilot Lawsuit: The Australian Competition and Consumer Commission (ACCC) has filed suit against Microsoft, alleging the company misled 2.7 million Australians into subscribing to Copilot M365.
Windows 11 Security Update: Microsoft released the KB5067036 preview update, introducing the Administrator Protection cybersecurity feature for Windows 11 24H2 and 25H2.

Cybersecurity Brief – 2025-10-12

Sun, 12 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall SSL VPN devices: Huntress reported a widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into over 100 customer environments to access internal systems.
Gladinet CentreStack and TrioFox: Active exploitation of a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox products has been observed, allowing unauthenticated local file access and potential escalation to remote code execution. The flaw remains unpatched.
BreachForums Takedown: The FBI seized all domains of the BreachForums hacking forum operated by the ShinyHunters group, which was used for leaking data from ransomware and extortion attacks, including recent Salesforce-related incidents.
AI Companion Apps Data Leak: Two AI “girlfriend” apps exposed millions of private chat logs belonging to over 400,000 users.
Oracle EBS Zero-Day Attacks: Sophisticated malware was deployed in attacks exploiting a zero-day in Oracle E-Business Suite (EBS), affecting dozens of organizations since at least 10 July.
Discord Age-Verification Data Exposure: A hack exposed sensitive age-verification data of Discord users.
Manufacturing Sector Ransomware: Reports highlight continued ransomware attacks targeting the manufacturing industry, with attackers exploiting unpatched vulnerabilities.
US Universities Payroll Attacks: US universities were targeted by attackers hijacking HR SaaS accounts to divert payroll payments, attributed to the Storm-2657 threat actor.

Newly Discovered Vulnerabilities

Juniper Networks Junos Space: More than 200 vulnerabilities, including nine critical-severity flaws, were patched in Junos Space and Junos Space Security Director.
Ivanti Endpoint Manager: The Zero Day Initiative (ZDI) disclosed 13 unpatched vulnerabilities in Ivanti Endpoint Manager, enabling remote code execution and privilege escalation.
GoAnywhere MFT (CVE-2025-10035): Fortra detailed active exploitation of this critical flaw in GoAnywhere Managed File Transfer, which has since been patched.
Node.js SEA Feature Abuse: The Stealit malware campaign uses Node.js’ Single Executable Application feature to distribute payloads via trojanized game and VPN installers.
Malicious npm Packages: 175 malicious npm packages with over 26,000 downloads were found harvesting credentials as part of a phishing campaign.

Notable Threat Actor Activity

North Korean IT Worker Schemes: North Korean threat actors have expanded fraudulent remote employment operations to target a broad range of industries, including architectural design, using fake identities and documentation.
LockBit/Storm-2603: The LockBit ransomware group (Storm-2603) has been observed abusing the Velociraptor DFIR tool to maintain persistence and facilitate attacks.
Storm-2657: This actor is actively hijacking HR SaaS accounts to redirect payroll payments, targeting a variety of organizations, including universities.
Coordinated Attacks on Network Devices: Infrastructure linked to coordinated attacks is being used to exploit vulnerabilities in Cisco, Fortinet, and Palo Alto Networks devices.
RondoDox Botnet: The RondoDox botnet employs over 50 exploits in a “shotgun” approach to compromise routers, DVRs, NVRs, CCTV systems, and other edge devices globally.
Aisuru DDoS Botnet: The Aisuru botnet is responsible for record-setting DDoS attacks against US ISPs, leveraging large numbers of compromised IoT devices.

Trends, Tools, or Tactics of Interest

Abuse of Legitimate Tools: Increased weaponization of legitimate digital forensics and incident response tools (e.g., Velociraptor) by ransomware groups for persistence and post-exploitation.
AI and Deepfake Threats: OpenAI’s new video and audio generation system raises concerns about the proliferation of deepfakes. Organizations report high awareness but insufficient investment in deepfake detection capabilities.
AI in Security Operations: Advancements in AI-powered Security Operations Center (SOC) platforms, with Microsoft introducing agentic AI capabilities in Sentinel, and the emergence of AI browser agents presenting new authentication challenges.
Supply Chain Risks: Discovery of malicious packages in npm and abuse of Node.js SEA highlight ongoing supply chain threats to software development environments.
Password Guidance: NIST updates suggest a shift away from overly complex password requirements, focusing on usability and security balance.

Regulatory or Policy Developments Affecting the Security Industry

Apple Bug Bounty Expansion: Apple has doubled its maximum bug bounty payout to $2 million for zero-click RCE vulnerabilities, introduced new research categories, and increased transparency in its rewards structure. Total payouts have reached $35 million, with bonuses for iPhone exploits potentially raising rewards to $5 million.
Windows 11 23H2 End of Support: Microsoft reminded users that Home and Pro editions of Windows 11 23H2 will stop receiving security updates next month.
Chrome Notification Permissions: Google Chrome will automatically revoke notification permissions for inactive websites to reduce notification spam.
Age-Verification Law Privacy Concerns: Apple raised privacy concerns regarding proposed age-verification laws, citing risks associated with increased sensitive data collection.

Cybersecurity Brief – 2025-10-11

Sat, 11 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has seized all domains associated with BreachForums, operated by the ShinyHunters group, which was used as a portal for leaking corporate data obtained through ransomware and extortion attacks, including recent Salesforce-related incidents. Despite the takedown, ShinyHunters continues to issue extortion threats against Salesforce victims.
Two AI companion applications exposed millions of private chat records from over 400,000 users due to inadequate security controls.
A critical zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox file sharing products is being actively exploited in the wild, allowing unauthenticated local attackers to access system files.
Sophisticated malware has been deployed in Oracle E-Business Suite (EBS) zero-day attacks, with exploitation believed to have started as early as July 10 and affecting dozens of organizations.
A large-scale DDoS attack was launched by the Aisuru botnet, leveraging compromised IoT devices hosted on major US ISPs.
Microsoft has observed a threat actor, Storm-2657, hijacking HR SaaS accounts to divert employee salary payments to attacker-controlled accounts; US universities have been specifically targeted in these payroll diversion attacks.

Newly Discovered Vulnerabilities

Fortra disclosed details of active exploitation of CVE-2025-10035, a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
13 unpatched vulnerabilities in Ivanti Endpoint Manager have been publicly released by the Zero Day Initiative (ZDI), permitting remote code execution and privilege escalation.
Juniper Networks released patches for over 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
175 malicious npm packages, collectively downloaded over 26,000 times, have been used in a credential phishing campaign.
Security researchers have detailed an active Stealit malware campaign abusing the Node.js Single Executable Application (SEA) feature, distributed via game and VPN installers.

Notable Threat Actor Activity

North Korean threat actors have expanded their fraudulent remote employment schemes to target nearly every industry hiring remote workers, including architectural design roles, using fake identities and documentation.
Chinese APT group Storm-2603 is abusing the Velociraptor digital forensics and incident response (DFIR) tool to gain persistent access to victim networks and facilitate ransomware deployment.
A coordinated campaign has been identified targeting Cisco, Fortinet, and Palo Alto Networks devices, with attacks originating from shared infrastructure.
The RondoDox botnet employs a “shotgun” approach, using more than 50 exploits against unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices globally.

Trends, Tools, or Tactics of Interest

AI-generated deepfakes are proliferating, with OpenAI releasing an updated AI video and audio generation system, raising concerns about the acceleration and accessibility of deepfake creation.
The security industry is experiencing inadequate investment in deepfake detection, despite high organizational awareness and frequent encounters with AI-augmented threats.
Security Operations Centres (SOCs) are increasingly integrating AI-powered agents, with projections indicating significant transformation in SOC workflows by 2026.
Microsoft has added agentic AI capabilities to its Sentinel platform, previewing new security graph and MCP server features.
Attackers are leveraging malicious npm packages and abusing legitimate software features (e.g., Node.js SEA) to distribute malware and harvest credentials.
1Password addressed a critical security gap in its AI browser agent, which posed risks of credential leakage.
Timely patch management is highlighted as a key defense against escalating ransomware attacks on manufacturing and industrial control system (ICS) environments.

Regulatory or Policy Developments Affecting the Security Industry

Apple has expanded its bug bounty program, doubling the maximum payout to $2 million for zero-click remote code execution vulnerabilities, with potential bonuses raising the maximum to $5 million. The program now includes new research categories and a more transparent reward structure.
Microsoft reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 30 days, after which security updates will cease.
Google Chrome will automatically revoke notification permissions for inactive websites to reduce user alert fatigue.
Apple voiced concerns over proposed age-verification laws, warning that increased data collection for compliance could heighten user privacy risks.
NIST is revising password guidance, indicating that excessively complex password requirements may no longer be necessary.

Cybersecurity Brief – 2025-09-25

Thu, 25 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Boyd Gaming reported a data breach affecting employees and other individuals, as disclosed to the SEC.
A US Federal Civilian Executive Branch (FCEB) agency was breached via exploitation of a critical GeoServer vulnerability (CVE-2024-36401); attackers deployed China Chopper and remote access scripts and remained undetected for three weeks.
European airports experienced widespread disruptions due to a ransomware attack linked to the RTX group; the UK National Crime Agency arrested a suspect in connection with the incident. The attack on Collins Aerospace is believed to have involved HardBit ransomware.
Interpol-led law enforcement seized over $439 million in cash and cryptocurrency from cybercrime rings worldwide during a five-month joint operation.
A record-breaking DDoS attack peaked at 22 Tbps and 10 billion packets per second (Bpps), targeting a European network infrastructure company and linked to the Aisuru botnet.
The Python Package Index (PyPI) urged users to reset credentials following a new wave of phishing attacks using a fake PyPI website.
GitHub users were targeted in a large-scale phishing campaign impersonating Y Combinator via GitHub notifications, delivering cryptocurrency drainers.
KNP Logistics Group, a 158-year-old business, collapsed following a cyber incident attributed to poor password security.

Newly Discovered Vulnerabilities

Cisco disclosed a high-severity, actively exploited SNMP vulnerability in IOS and IOS XE Software allowing remote code execution or denial-of-service; patches have been released.
Two critical vulnerabilities were identified in Wondershare RepairIt, exposing private user data and enabling potential tampering with AI models.
Supermicro hardware was found to have two firmware vulnerabilities in its Baseboard Management Controller (BMC), which could allow attackers to create persistent backdoors by updating systems with malicious images.
A flaw in multiple OnePlus OxygenOS versions allows installed apps to access SMS data and metadata without permissions or user interaction; the issue remains unpatched.
Ongoing exploit attempts have been observed against an older Hikvision camera vulnerability.
SonicWall SMA devices were targeted with the ‘OVERSTEP’ backdoor; SonicWall released updates for SMA 100 appliances to remove the malware and improve file checks.

Notable Threat Actor Activity

Suspected Chinese threat actors (RedNovember) have been targeting global government and private sector organizations using Pantegana and Cobalt Strike.
UNC5221, believed to be China-nexus, used the BRICKSTORM backdoor to infiltrate US legal, SaaS, BPO, and technology sectors; Google reports the malware has been used for over a year for data theft and persistent espionage.
UNC6148 deployed the OVERSTEP backdoor in ongoing attacks against SonicWall SMA devices, enabling system control, credential theft, and evasion.
A new malware family, YiBackdoor, was discovered with significant code overlap with IcedID and Latrodectus, suggesting shared development or tool reuse.
A new ransomware variant, Obscura, was observed spreading from a victim’s domain controller.
Scattered Spider: A core member surrendered to authorities amid claims of the group’s shutdown; US prosecutors charged a UK national, linking the group to $115 million in ransomware payments.
Russian threat actors conducted a disinformation campaign targeting the upcoming Moldovan elections, linked to previous 2022 operations.
An npm package was found to use steganography (QR codes) to hide a credential-stealing malware, posing a supply chain risk.

Trends, Tools, or Tactics of Interest

Attackers are exploiting payment iframe security weaknesses to deploy malicious overlays on checkout pages, facilitating credit card data theft.
Burp Suite introduced Burp AI, providing on-demand AI assistance for penetration testing workflows.
AI pentesting is emerging, with new agentic capabilities being integrated into security tools.
Kali Linux 2025.3 was released, featuring ten new tools, Nexmon support, and NetHunter improvements.
OpenAI is internally testing a new GPT-5-based AI agent, “GPT-Alpha”.
Police forces are increasingly using drones equipped with license plate recognition technology.
GitHub is implementing enhanced security measures for npm supply chain protection, including mandatory 2FA, short-lived granular tokens, and trusted publishing workflows.

Regulatory or Policy Developments Affecting the Security Industry

GitHub announced new security requirements for npm package publishing, including mandatory two-factor authentication, expiring granular tokens, and trusted publishing, in response to recent supply chain attacks.