APT35 on DanSec Daily

Cybersecurity Brief – 2025-09-27

Sat, 27 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Volvo and two other international vehicle manufacturers suffered supply chain cyberattacks in the past month, resulting in the theft of Volvo employee Social Security Numbers in a ransomware attack.
Hackers stole data on 8,000 nursery children and contacted their parents directly, demanding ransom payments under threat of leaking the children’s information.
A South Korean credit card company was hacked, and the Maryland Transit Administration experienced a ransomware attack. The UK’s Co-op lost £206 million due to a cyberattack.
Flo Health and Google agreed to pay $56 million to settle lawsuits over the period-tracking app Flo sharing sensitive users’ health data for advertising purposes.
Neon Mobile, a popular US app, pays users to record their phone calls and then sells this data for AI training.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2025-10035, CVSS 10) in Fortra’s GoAnywhere Managed File Transfer (MFT) software was exploited as a zero-day at least eight days prior to public disclosure, allowing unauthenticated remote command injection and the creation of backdoor admin accounts.
Multiple vulnerabilities in Cognex industrial cameras allow for remote hacking; no patches are available, and customers are advised to migrate to newer models.
Google Project Zero highlighted the risk of pointer leaks through pointer-keyed data structures, which can undermine ASLR protections and facilitate remote exploitation.

Notable Threat Actor Activity

The Russian APT group COLDRIVER launched a new campaign using ClickFix-style attacks to deliver two new lightweight malware families.
Iranian APTs, including the Charming Kitten offshoot Subtle Snail, have been observed signing malware with valid code-signing certificates issued by SSL.com.
North Korean threat actors are posing as recruiters to steal developers’ identities and provide these to fraudulent IT workers.
A phishing campaign impersonating Ukrainian government agencies is distributing CountLoader, which subsequently deploys Amatera Stealer and PureMiner malware. PureRAT phishing threats are also targeting Vietnam.
LockBit 5.0 ransomware activity continues to be reported.

Trends, Tools, or Tactics of Interest

The XCSSET macOS malware has a new variant with a four-stage infection chain, an additional persistence mechanism, and new targeting of Firefox browser data, including cryptocurrency transaction hijacking.
Microsoft Edge will introduce a feature to block malicious sideloaded browser extensions.
Generative AI deployments are increasingly recognised as introducing new cyber risks, including phishing, fraud, and model manipulation.
North Korean threat actors are leveraging social engineering by masquerading as recruiters to facilitate identity theft for use by IT worker proxies.
Interpol arrested 260 suspects in Africa involved in online romance scams that used relationship-building to extort or blackmail victims.
A new tool, convert-ts-bash-history.py, has been released to facilitate quick timeline analysis from bash histories.
Breach and Attack Simulation (BAS) is highlighted as an effective method for validating security controls beyond theoretical design.
The Neon Mobile app’s business model of incentivising users to record and sell their phone call data for AI training is drawing privacy concerns.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has restricted access to cloud and AI products for a unit within the Israeli military, following an internal review linking these services to mass surveillance activities in Gaza.
U.S. President Donald Trump signed an executive order approving the restructuring of TikTok’s U.S. operations to address national security concerns, transferring control to U.S. investors.
Google and Flo Health face regulatory enforcement, agreeing to a $56 million settlement over improper sharing of sensitive health data.
Cognex is recommending customers transition to newer products due to unpatched vulnerabilities in its industrial cameras.

Cybersecurity Brief – 2025-09-21

Sun, 21 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-nexus cyber espionage group, compromised 34 devices across 11 European telecommunications firms using LinkedIn job lures and the MINIBIKE malware.
Over 600,000 individuals were impacted by healthcare data breaches in the past day, with additional major intrusions attributed to the ShinyHunters group.
The Royal Canadian Mounted Police dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million linked to criminal activity.
FBI issued an alert regarding cybercriminals impersonating the FBI’s Internet Crime Complaint Center (IC3) via fake reporting portals for malicious purposes.

Newly Discovered Vulnerabilities

Fortra released a critical patch for a command injection vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT) software, specifically in its License Servlet. Exploitation enables arbitrary command execution.
OpenAI’s ChatGPT Deep Research agent was found vulnerable to a zero-click flaw, allowing attackers to exfiltrate Gmail inbox data via a single crafted email. The vulnerability has since been patched.
Novakon HMIs were reported to have unpatched remote code execution and information exposure vulnerabilities, exposing industrial control systems to remote attacks.
A critical vulnerability was disclosed and fixed in Microsoft Azure Entra ID that could have enabled catastrophic identity and access management attacks if exploited.

Notable Threat Actor Activity

Russian APT groups Turla and Gamaredon, both linked to the FSB, were observed collaborating to compromise high-profile Ukrainian targets. Turla deployed malware on systems previously accessed by Gamaredon, including the Kazuar backdoor.
The Iranian APT group, including a Charming Kitten subgroup, conducted sophisticated cyberattacks targeting telecommunications and satellite companies, using bespoke targeting techniques.
The Scattered Spider group had two suspected members arrested in the UK, with one charged in the US for hacking critical infrastructure.
SystemBC malware is powering the REM Proxy botnet, leveraging approximately 1,500 daily VPS victims and 80 C2 servers to provide proxy services to threat actors.

Trends, Tools, or Tactics of Interest

A phishing-as-a-service (PhaaS) surge was observed, with Lighthouse and Lucid platforms linked to over 17,500 phishing domains targeting 316 brands across 74 countries.
Atomic Infostealer is being distributed to macOS users via fake GitHub repositories, with campaigns targeting LastPass users.
Researchers identified the earliest known malware, codenamed MalTerminal, embedding GPT-4 LLM capabilities for automated ransomware creation and reverse shell generation.
CISA published an analysis of malware kits deployed in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, detailing tactics such as system information collection, credential dumping, and arbitrary code execution.
Ransomware attacks continue to evade defenses, with prevention rates dropping to 62% and data exfiltration prevention at only 3%, per the Picus Blue Report 2025.
Synthetic identity fraud is resurging in the finance and lending sector, with estimated damages reaching $3.3 billion from new accounts.
ChatGPT was demonstrated to be capable of solving CAPTCHAs and mimicking human cursor behaviour, highlighting risks in automated abuse of AI agents.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and reaching a valuation of $8.6 billion.
Valve announced Steam will end support for 32-bit Windows in January 2026, affecting software compatibility and potentially security posture for legacy systems.

Cybersecurity Brief – 2025-06-27

Fri, 27 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

United Natural Foods Inc. (UNFI), a major supplier to Whole Foods, has restored its core systems and electronic ordering/invoicing platforms after a cyberattack. Details of the attack vector or threat actor have not been disclosed.
Hawaiian Airlines reported a cyberattack that disrupted access to some systems. Flight operations were not affected. The investigation is ongoing.
The U.S. Department of Justice charged a British national, alleged to be the threat actor “IntelBroker,” in connection with several high-profile breaches.
New South Wales Police arrested a former Western Sydney University student accused of repeatedly hacking university systems for personal gain, including manipulating parking and accessing data.
A Kansas City man pleaded guilty to hacking multiple organizations to promote his own cybersecurity services.
AT&T has agreed to a $177 million settlement following a data breach that resulted in customer information being leaked and sold on the dark web.
The “Cyber Fattah” hacktivist group leaked data from Saudi Games, amid increased hacktivist activity linked to regional tensions.

Newly Discovered Vulnerabilities

Researchers disclosed a critical vulnerability in the Open VSX Registry (“open-vsx[.]org”) that could allow attackers to take control of the registry and conduct supply chain attacks affecting millions of developers.
Cisco released updates to address two maximum-severity unauthenticated remote code execution vulnerabilities in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), which could allow attackers to gain root access.
CISA reported active exploitation of a maximum severity vulnerability in AMI MegaRAC Baseboard Management Controller (BMC) software, enabling server hijacking and potential bricking of affected systems.
A bug affecting 689 Brother printer models (and 53 models from other manufacturers) exposes default administrator passwords that can be generated remotely, putting devices at risk of unauthorized access.

Notable Threat Actor Activity

Iranian state-sponsored group APT35 (linked to the IRGC) is conducting spear-phishing campaigns targeting Israeli journalists, cybersecurity experts, and tech professionals using AI-powered phishing techniques.
Cybercriminals are exploiting open-source and publicly available tools to target financial institutions across Africa in attacks ongoing since at least July 2023.
Scattered Spider, a well-known threat actor, has shifted its targeting from global retailers to U.S.-based insurance firms, employing advanced TTPs.
Researchers observed a significant increase (517%) in ClickFix social engineering attacks using fake CAPTCHA verifications as an initial access vector. A new related method, FileFix, has emerged.
Ongoing phishing campaigns are abusing Microsoft 365’s “Direct Send” feature to send phishing emails as internal users, bypassing standard email security controls.
Bitdefender reported a surge in social engineering attacks targeting WhatsApp users, aiming to compromise accounts through various scam tactics.
New Trojan malware is targeting sensitive information stored in mobile device screenshots, including cryptocurrency wallet seed phrases.

Trends, Tools, or Tactics of Interest

Use of open-source and commodity tools by cybercriminals for targeting financial institutions is increasing, particularly in Africa.
Fake CAPTCHA (ClickFix) and document-based (FileFix) social engineering tactics are on the rise as initial access methods.
Abuse of Microsoft 365’s “Direct Send” feature is being used to bypass detection and facilitate internal phishing.
AI-powered phishing is being adopted by state-sponsored actors, as seen in APT35’s recent campaigns.
SaaS adoption continues to outpace the development of effective data resilience and security controls, increasing organizational risk.

Regulatory or Policy Developments

The U.S. Federal Trade Commission (FTC) approved $126 million in refunds to Fortnite users as part of a settlement over the use of “dark patterns” by Epic Games to induce unwanted purchases.
Microsoft has rolled out changes to Windows security architecture aimed at preventing outages similar to the 2024 CrowdStrike incident, improving system resilience and recovery.
AT&T’s $177 million settlement over a major data breach establishes compensation for affected users whose personal data was leaked.

Cybersecurity Brief – 2025-06-26

Thu, 26 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Citrix NetScaler ADC Vulnerability (CVE-2025-6543): Citrix released emergency patches for a critical vulnerability in NetScaler ADC appliances, which has been actively exploited in the wild for denial of service and session hijacking attacks. The flaw, dubbed “CitrixBleed 2,” allows unauthenticated attackers to steal authentication tokens and disrupt services.
SonicWall NetExtender Trojan: Unknown threat actors have distributed a trojanized version of SonicWall’s NetExtender SSL VPN client, enabling credential theft from users who install the compromised application.
Pro-Iranian Hacktivist Data Leak: The Cyber Fattah group, aligned with Iranian interests, leaked thousands of personal records related to athletes and visitors of the 2024 Saudi Games.
BreachForums Operator Arrests: French authorities reportedly arrested five operators of the BreachForums cybercrime forum, which facilitated the trade and exposure of stolen data.
‘IntelBroker’ Charged: A British national known as “IntelBroker” has been charged in the US for stealing and selling sensitive data from global victims, causing $25 million in damages.

Newly Discovered Vulnerabilities

Citrix NetScaler ADC (CVE-2025-6543, “CitrixBleed 2”): Critical vulnerability allowing token theft, session hijacking, and denial of service. Actively exploited prior to patch release.
SAP GUI for Windows and Java: Two vulnerabilities, now patched, could have allowed attackers to access sensitive user data via exploitation of the input history feature.
WinRAR (CVE-2025-6218): Directory traversal vulnerability allowing malware execution from specially crafted archives upon extraction.
Brother Printers: Multiple vulnerabilities, including a critical unpatchable flaw (CVSS 9.8) that enables attackers to generate default admin passwords on hundreds of models.
Microsoft Entra ID (nOAuth): A known vulnerability in Entra ID still affects 9% of SaaS apps two years after discovery, risking account takeovers. Additional research highlights risks related to guest user invitation and access control gaps.

Notable Threat Actor Activity

North Korean Supply Chain Attacks: The “Contagious Interview” campaign linked to North Korea continues, with 35 new malicious npm packages targeting developers and job seekers. Packages deliver infostealers and backdoors.
Charming Kitten (Iran): This Iran-sponsored APT has targeted Israeli cybersecurity experts with spear-phishing campaigns.
Dire Wolf Ransomware: An emerging ransomware group has compromised 16 organizations in technology and manufacturing sectors across 11 countries since May, employing double extortion tactics.
Abuse of ConnectWise ScreenConnect: Threat actors are modifying the Authenticode signature of ScreenConnect installers to create signed remote access malware.
OneClik Campaign: Attackers are leveraging Microsoft’s ClickOnce deployment tool and AWS infrastructure to deliver custom Golang backdoors, targeting the energy sector.

Trends, Tools, or Tactics of Interest

Social Engineering: Europol reports that social engineering remains a leading initial access vector for cybercriminals.
AI and Collaboration Tool Abuse: Kaspersky’s SMB threat report highlights increasing targeting of small and medium businesses through AI-powered scams, phishing, and malware, particularly via collaboration platforms.
Generative AI in Supply Chain Attacks: Malicious actors are leveraging AI-generated software components to compromise software supply chains.
Remote Access Tool Abuse: Both SonicWall NetExtender and ConnectWise ScreenConnect have been abused for distributing malware and credential theft.
AI Evasion Tactics: Researchers identified a rudimentary malware (“Skynet”) that attempts to instruct AI-based security tools to ignore it, suggesting early stages of adversarial AI evasion.
Open MCP Servers: Hundreds of MCP servers exposing AI models are vulnerable to abuse and remote code execution.
Security Features in Consumer Products: Avast has integrated AI-powered scam detection into its antivirus products; WhatsApp and Ring have added AI features for message and video summarization; Android 16 introduces new security features requiring user activation.

Regulatory or Policy Developments

CISA Downsizing: Reports note reductions in staffing and resources at the US Cybersecurity and Infrastructure Security Agency (CISA), with potential implications for the broader cybersecurity landscape.