BianLian on DanSec Daily

Cybersecurity Brief – 2025-09-19

Fri, 19 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall suffered a breach of its MySonicWall cloud backup service, exposing firewall configuration backup files for fewer than 5% of customers. Impacted customers have been instructed to reset their passwords and import new configuration files.
Tiffany & Co. disclosed a data breach affecting thousands of customers in the US and Canada, with attackers accessing information related to gift cards.
Medical Associates of Brevard reported a data breach impacting nearly 250,000 individuals, attributed to the BianLian ransomware group.
ChatGPT was targeted in a server-side data theft attack using a zero-click method called ShadowLeak, which has since been fixed by OpenAI.
The Python Package Index (PyPI) invalidated all tokens stolen in the GhostAction supply chain attack and confirmed that threat actors did not use the stolen tokens to publish malicious packages.

Newly Discovered Vulnerabilities

WatchGuard released security updates for a critical remote code execution vulnerability in Firebox firewalls.
Google issued a Chrome 140 update patching four vulnerabilities, including a zero-day (CVE-2025-10585) in the V8 JavaScript engine, which was actively exploited.
Microsoft addressed a pair of vulnerabilities in Entra ID (formerly Azure AD) that could have allowed attackers to access virtually all Azure customer accounts.
CISA published details of two malware strains exploiting Ivanti EPMM vulnerabilities (CVE-2025-4427 and CVE-2025-4428) in a recent incident.

Notable Threat Actor Activity

Two UK teenagers linked to the Scattered Spider group were arrested in connection with the August 2024 cyberattack on Transport for London.
North Korean threat actors behind the “Contagious Interview” campaign are using a ClickFix social engineering technique to target job seekers with fraudulent employment offers.
Russian ransomware gangs are deploying a new multi-version malware loader, CountLoader, to deliver post-exploitation tools such as Cobalt Strike and Adaptee.
RevengeHotels has been targeting hotels in Brazil and Spanish-speaking regions with VenomRAT implants.
The SystemBC proxy botnet is actively compromising commercial VPS systems, maintaining around 1,500 bots daily to facilitate malicious traffic.
Two malicious PyPI packages were discovered delivering the SilentSync remote access trojan (RAT) to Windows systems.
Microsoft and Cloudflare disrupted RaccoonO365, a major Phishing-as-a-Service operation targeting Microsoft 365 credentials.
SMS blaster tools are being used to send large volumes of scam texts by impersonating cell towers, bypassing carrier-level protections.

Trends, Tools, or Tactics of Interest

AI-assisted phishing attacks are increasing in volume and sophistication, posing a growing threat to organizations.
Small businesses continue to be disproportionately targeted by ransomware attacks compared to large enterprises.
Microsoft 365’s widespread adoption and integration are expanding its attack surface, making it a prime target for cybercriminals.
HTTP request smuggling remains a practical attack vector, with pentesters continuing to find exploitable desynchronization vulnerabilities in web applications.
The use of Phishing-as-a-Service platforms is accelerating, with recent disruptions highlighting their prevalence and focus on Microsoft 365 accounts.
Age verification and enhanced parental controls are being introduced to ChatGPT to address concerns about AI-related harms to minors.

Regulatory or Policy Developments Affecting the Security Industry

UK law enforcement made arrests in connection with the Scattered Spider group’s attack on Transport for London, reflecting ongoing efforts to disrupt cybercriminal groups.
OpenAI is implementing age verification and parental controls for ChatGPT in response to increasing scrutiny over AI safety for minors.

Cybersecurity Brief – 2025-08-26

Tue, 26 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Farmers Insurance disclosed a data breach affecting 1.1 million individuals, with the compromise traced to broader attacks on Salesforce environments.
French retailer Auchan reported a cyberattack that exposed sensitive loyalty account data of several hundred thousand customers.
Aspire Rural Health System confirmed a data breach impacting nearly 140,000 individuals, attributed to the BianLian ransomware group.
Data I/O, a chip programming firm, experienced a ransomware attack disrupting communications, shipping, and production operations.
Arch Linux Project has been subject to a week-long DDoS attack, affecting its website, repository, and forums.
US pharmaceutical company Inotiv suffered a cyberattack, as reported in threat intelligence bulletins.
Lab-Dookhtegen claimed responsibility for attacks disabling communications on more than 60 Iranian cargo ships and oil tankers.

Newly Discovered Vulnerabilities

Docker released patches for CVE-2025-9074, a critical container escape vulnerability (CVSS 9.3) in Docker Desktop for Windows and macOS, which allowed attackers to compromise host systems even with Enhanced Container Isolation enabled.
CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, impacting Citrix Session Recording and Git.
Researchers described the “OneFlip” attack, a Rowhammer-based technique that flips a single bit in neural network weights, enabling stealthy backdoors in AI systems.
Multiple password manager flaws and an Apple 0-day were highlighted as being exploited in the wild.
Researchers detailed a new AI attack method that hides data-theft prompts in downscaled images processed by large language models.
The “ClickFix” attack was described, where AI-generated content summaries are abused to push malware.
Prompt injection vulnerabilities in AI browsers were reported, with potential for significant financial risk to users.

Notable Threat Actor Activity

The China-nexus threat actor UNC6384 was attributed to attacks against diplomats in Southeast Asia and globally, deploying PlugX malware via captive portal hijacks and valid certificates.
Transparent Tribe (APT36), a Pakistani state-sponsored group, targeted Indian government entities and Linux systems with malicious desktop shortcut files as part of a phishing campaign.
The Anatsa Android banking trojan expanded operations, now targeting 830 financial and cryptocurrency applications across additional countries.
A new phishing campaign was identified using fake voicemail and purchase order emails to deliver the UpCrypter malware loader, which installs remote access trojans (RATs) for persistent access.
Surge in coordinated scanning activity detected against Microsoft Remote Desktop Web Access and RDP authentication servers, involving nearly 2,000 IP addresses.
BianLian ransomware group was confirmed as responsible for the Aspire Rural Health System breach.

Trends, Tools, or Tactics of Interest

Seventy-seven malicious Android apps, totalling over 19 million installs, were removed from Google Play after being found to contain various types of malware.
Fast-spreading, complex phishing campaigns are increasingly delivering RATs, enabling both credential theft and long-term network persistence.
Attackers are leveraging malware persistence techniques such as scheduled tasks and startup scripts, with detection and blocking methods highlighted for platforms like Wazuh.
SIEM rule effectiveness was analysed using 160 million attack simulations, revealing common detection failures and the need for improved tuning.
Ongoing DDoS attacks continue to target open-source and infrastructure projects, as seen with the Arch Linux Project.

Regulatory or Policy Developments Affecting the Security Industry

Google announced forthcoming requirements to verify the identity of all Android app developers in four countries, extending to those distributing apps outside the Play Store.
CISA published updated guidance on the Minimum Elements for a Software Bill of Materials (SBOM) and requested public feedback.
The US Federal Trade Commission (FTC) chair issued letters to major tech companies, urging them not to weaken encryption in response to foreign government demands.

Cybersecurity Brief – 2025-08-25

Mon, 25 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Aspire Rural Health System suffered a data breach impacting nearly 140,000 individuals, attributed to the BianLian ransomware group, which exfiltrated sensitive data.
Chip programming firm Data I/O disclosed a ransomware attack that disrupted communications, shipping, and production operations.
Farmers Insurance reported a data breach affecting over 1 million individuals, with separate notifications filed by Farmers New World Life Insurance and Farmers Group.
The Arch Linux Project has been subjected to a week-long DDoS attack, disrupting its website, repository, and forums.

Newly Discovered Vulnerabilities

A malicious Go module has been identified masquerading as an SSH brute-force tool; instead of legitimate functionality, it exfiltrates stolen credentials to the attacker via a Telegram bot.

Notable Threat Actor Activity

Transparent Tribe (APT36) has been observed targeting Indian government entities using weaponised desktop shortcut files delivered via phishing campaigns. The attacks target both Windows and BOSS Linux systems.
The BianLian ransomware group has been confirmed as the actor behind the Aspire Rural Health System breach.

Trends, Tools, or Tactics of Interest

The Anatsa Android banking trojan has expanded its targeting to 830 financial applications, including new countries and additional cryptocurrency apps.
New Android malware is circulating that impersonates antivirus software purportedly from Russia’s FSB, with Russian business executives as the primary targets.
AzureStrike, a new offensive toolkit, has been released for red team operations against Azure Active Directory environments, enabling reconnaissance, credential abuse, and persistence.
Analysis of SIEM deployments across 160 million attack simulations highlights frequent failure of SIEM rules due to poor tuning and excessive false positives, with recommendations for rule optimisation.
Increased use of phishing techniques leveraging malicious desktop shortcut files and open-source tool masquerading (as seen with the Go module) has been observed in recent threat campaigns.

Regulatory or Policy Developments

The US Cybersecurity and Infrastructure Security Agency (CISA) has released updated minimum elements guidance for Software Bill of Materials (SBOM) and is soliciting public feedback on the changes.

Cybersecurity Brief – 2025-07-03

Thu, 03 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas Airlines suffered a data breach impacting 6 million customers. Personal information was accessed via a third-party call center platform; passport and credit card data were not included.
Spanish authorities arrested two individuals in Las Palmas for cybercriminal activity, including data theft from government entities, politicians, and journalists.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical vulnerability in Unified Communications Manager (Unified CM) and Session Management Edition, involving hardcoded root SSH credentials that allowed remote root access. The backdoor account has now been removed.
The Forminator WordPress plugin is vulnerable to an unauthenticated arbitrary file deletion flaw, enabling potential full site takeover attacks.
Google Chrome was updated to address a serious security flaw that has been exploited in the wild.
Citrix issued a warning that patching recent authentication bypass vulnerabilities in NetScaler ADC and Gateway may cause login page failures.
Multiple fake cryptocurrency wallet extensions were discovered in the Firefox add-ons store, designed to steal wallet credentials and sensitive data.

Notable Threat Actor Activity

The Russian APT group Gamaredon continues aggressive spearphishing campaigns targeting Ukrainian government entities in 2024, utilizing an evolved cyberespionage toolset and new stealth-focused techniques, including weaponization of network drives.
North Korean state-backed actors are targeting Web3 and cryptocurrency organizations with new malware written in Nim, including a macOS variant named NimDoor, which can revive itself if terminated. They are also leveraging the ClickFix technique in the BabyShark campaign to bypass browser safeguards.
A China-nexus initial access broker has been observed exploiting unpatched Ivanti vulnerabilities for initial access, then self-patching the vulnerabilities to block other threat actors.
Scattered Spider, a group of young cybercriminals, is identified as a significant and imminent threat, having targeted retailers, insurers, and airlines with a flexible and difficult-to-defend structure.
Threat actors are increasingly using callback phishing campaigns, impersonating brands such as Microsoft and DocuSign via PDFs to trick users into calling attacker-controlled phone numbers.
Attackers are using AI to rapidly generate convincing phishing sites impersonating Okta and Microsoft 365 login pages.
Attack chains such as ClickFix and FileFix exploit browser and user behavior to bypass security controls and enable malicious script execution.

Trends, Tools, or Tactics of Interest

Nearly 80% of cyber threats now mimic legitimate user behavior, complicating network threat detection.
Modern phishing campaigns are leveraging AI and social engineering to increase the speed and realism of attacks.
Social engineering tactics are being used in attack chains to manipulate victims into saving and renaming files that execute malicious scripts.
Fake browser extensions and add-ons targeting cryptocurrency wallets are proliferating in official app stores.
New malware written in the Nim programming language is being used in targeted attacks, reflecting an ongoing trend of threat actors adopting less common languages to evade detection.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Russia-based bulletproof hosting provider Aeza Group for supporting ransomware and malware operations, including affiliations with BianLian and Lumma Stealer.
The U.S. Department of Justice is investigating a former ransomware negotiator for alleged criminal collaboration with ransomware gangs to profit from extortion payment deals.
A U.S. judge approved the sale of 23andMe’s DNA data to TTAM Research Institute, prompting privacy concerns and increased user requests for data deletion.

Cybersecurity Brief – 2025-06-30

Mon, 30 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Hawaiian Airlines has confirmed a cyber incident linked to the cybercrime group Scattered Spider, which has expanded operations to target airlines following high-profile breaches at WestJet and insurers.
Over 27% of UK businesses experienced cyber incidents in the past year, a significant increase from 16%. Vulnerable smart buildings and IoT systems pose significant risk factors, with 73% of leaders anticipating further disruptions.
Nearly 16 billion login credentials have been leaked online, highlighting ongoing issues with password hygiene and the reuse of credentials.

Cybersecurity Brief – 2025-05-15

Thu, 15 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach and Extortion Attempt
- Coinbase disclosed a data breach affecting approximately 1% of its users after cybercriminals bribed customer support agents. Attackers accessed sensitive customer information, including government IDs, and attempted to extort $20 million. The extortion attempt failed, but the incident highlights ongoing risks to cryptocurrency platforms from both insider and external threats.
Nova Scotia Power Data Breach
- Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data. The breach was discovered last month and underscores the persistent targeting of critical infrastructure and utility providers.

Newly Discovered Vulnerabilities

SAP NetWeaver (CVE-2025-31324)
- A critical vulnerability in SAP NetWeaver is being actively exploited by multiple threat actors, including ransomware groups BianLian and RansomExx. The flaw allows remote code execution and has led to a surge in attacks against unpatched systems. Immediate patching is strongly advised.
Samsung MagicINFO 9 Server (CVE-2025-4632)
- Samsung patched a critical vulnerability (CVSS 9.8) in MagicINFO 9 Server that was actively exploited to deploy Mirai botnet variants. Organizations using this software should update immediately.
Google Chrome High-Severity Flaw
- Google released emergency updates addressing a high-severity Chrome vulnerability that has a public exploit and is being used in the wild for cross-origin data leaks via the Loader Referrer Policy. All users are advised to update promptly.
Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Flaws
- Ivanti confirmed exploitation in the wild of zero-day vulnerabilities in EPMM, affecting a limited number of customers. The flaws stem from open source library issues and are being used in chained attacks.

Cybersecurity Brief – 2025-05-14

Wed, 14 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer confirmed customer data was stolen in a recent cyberattack. While no account passwords were compromised, customers are being required to reset passwords as a precaution.
Dior disclosed a cybersecurity incident resulting in the exposure of customer information.
Nucor Corporation, a major steel producer, experienced network disruptions due to a cyberattack, forcing parts of its systems offline for containment.
The Australian Human Rights Commission suffered a data breach in which private documents were leaked online and indexed by search engines.
Xinbi Guarantee, a Chinese-language Telegram marketplace, has been linked to $8.4 billion in illicit transactions, including crypto crime, romance scams, and North Korean money laundering.
North Korean IT worker scams are being exposed at scale, with researchers publishing 1,000 email addresses and photos linked to infiltration of Western companies.
Kosovo extradited the admin of BlackDB, an online cybercrime marketplace, to the US to face charges.

Newly Discovered Vulnerabilities and Exploits

Microsoft Patch Tuesday (May 2025): Microsoft released fixes for 78 vulnerabilities, including five zero-days under active exploitation. Notably, a CVSS 10 vulnerability impacts Azure DevOps Server.
Samsung patched CVE-2025-4632 in MagicINFO 9 Server, a critical flaw (CVSS 9.8) exploited to deploy Mirai botnet malware.
Fortinet addressed CVE-2025-32756, a zero-day RCE flaw in FortiVoice enterprise phone systems, confirmed as exploited in the wild.
Ivanti released updates for two vulnerabilities in Endpoint Manager Mobile (EPMM) that have been chained for remote code execution in limited attacks.
SAP NetWeaver vulnerability is being actively exploited by multiple ransomware groups, including BianLian and RansomExx, to deploy malware such as PipeMagic Trojan.
Google Chrome is rolling out a security change to prevent browser launches with admin privileges on Windows, reducing attack surface.
Open redirect vulnerabilities in trusted domains (e.g., google.com) continue to be abused in phishing campaigns.
Focused phishing attacks are leveraging trusted domains, real CAPTCHAs, and server-side validation for more targeted credential theft.

Notable Threat Actor Activity

Earth Ammit, a cyber espionage group, was linked to supply chain breaches in the drone sector via ERP systems in the VENOM and TIDRONE campaigns targeting Taiwan and South Korea.
Scattered Spider (aka UNC3944) tactics, previously used against UK retail chains, are now being deployed against US retailers.
Ransomware gangs are increasingly exploiting SAP NetWeaver vulnerabilities for initial access and malware deployment.
Meta Mirage, a global phishing campaign, is targeting Meta Business Suite users to hijack high-value business accounts.
Horabot malware is being distributed through invoice-themed phishing emails, targeting Windows users across six Latin American countries.

Trends, Tools, and Tactics of Interest

Phishing campaigns are becoming more sophisticated, with increased use of trusted domains, CAPTCHAs, and real-time validation to evade detection and improve targeting.
Telegram-based black markets remain a significant vector for cybercrime, with recent enforcement actions leading to shutdowns and exposure of major illicit marketplaces.
Shadow SaaS and AI usage is an emerging risk, with new tools (e.g., LastPass SaaS monitoring) being developed to detect unauthorised employee use of unsanctioned cloud and AI services.
Supply chain attacks via ERP systems and targeting of high-value sectors (e.g., drones, retail) remain prevalent.
AI agent security: Research indicates that AI agents can be manipulated by implanting fake “memories,” raising concerns about the integrity of autonomous systems.
Device hygiene: Daily phone reboots are recommended as a practical defense against persistent zero-click mobile exploits.

Regulatory and Policy Developments

Consumer Financial Protection Bureau (CFPB) in the US has canceled plans for tighter regulation of data brokers, potentially impacting privacy and data protection standards.
Telegram enforcement: Following media inquiries, Telegram banned thousands of accounts tied to crypto scam money laundering, disrupting several major illicit marketplaces.