Cybersecurity Brief – 2025-05-14

Wed, 14 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer confirmed customer data was stolen in a recent cyberattack. While no account passwords were compromised, customers are being required to reset passwords as a precaution.
Dior disclosed a cybersecurity incident resulting in the exposure of customer information.
Nucor Corporation, a major steel producer, experienced network disruptions due to a cyberattack, forcing parts of its systems offline for containment.
The Australian Human Rights Commission suffered a data breach in which private documents were leaked online and indexed by search engines.
Xinbi Guarantee, a Chinese-language Telegram marketplace, has been linked to $8.4 billion in illicit transactions, including crypto crime, romance scams, and North Korean money laundering.
North Korean IT worker scams are being exposed at scale, with researchers publishing 1,000 email addresses and photos linked to infiltration of Western companies.
Kosovo extradited the admin of BlackDB, an online cybercrime marketplace, to the US to face charges.

Microsoft Patch Tuesday (May 2025): Microsoft released fixes for 78 vulnerabilities, including five zero-days under active exploitation. Notably, a CVSS 10 vulnerability impacts Azure DevOps Server.
Samsung patched CVE-2025-4632 in MagicINFO 9 Server, a critical flaw (CVSS 9.8) exploited to deploy Mirai botnet malware.
Fortinet addressed CVE-2025-32756, a zero-day RCE flaw in FortiVoice enterprise phone systems, confirmed as exploited in the wild.
Ivanti released updates for two vulnerabilities in Endpoint Manager Mobile (EPMM) that have been chained for remote code execution in limited attacks.
SAP NetWeaver vulnerability is being actively exploited by multiple ransomware groups, including BianLian and RansomExx, to deploy malware such as PipeMagic Trojan.
Google Chrome is rolling out a security change to prevent browser launches with admin privileges on Windows, reducing attack surface.
Open redirect vulnerabilities in trusted domains (e.g., google.com) continue to be abused in phishing campaigns.
Focused phishing attacks are leveraging trusted domains, real CAPTCHAs, and server-side validation for more targeted credential theft.

Earth Ammit, a cyber espionage group, was linked to supply chain breaches in the drone sector via ERP systems in the VENOM and TIDRONE campaigns targeting Taiwan and South Korea.
Scattered Spider (aka UNC3944) tactics, previously used against UK retail chains, are now being deployed against US retailers.
Ransomware gangs are increasingly exploiting SAP NetWeaver vulnerabilities for initial access and malware deployment.
Meta Mirage, a global phishing campaign, is targeting Meta Business Suite users to hijack high-value business accounts.
Horabot malware is being distributed through invoice-themed phishing emails, targeting Windows users across six Latin American countries.

Phishing campaigns are becoming more sophisticated, with increased use of trusted domains, CAPTCHAs, and real-time validation to evade detection and improve targeting.
Telegram-based black markets remain a significant vector for cybercrime, with recent enforcement actions leading to shutdowns and exposure of major illicit marketplaces.
Shadow SaaS and AI usage is an emerging risk, with new tools (e.g., LastPass SaaS monitoring) being developed to detect unauthorised employee use of unsanctioned cloud and AI services.
Supply chain attacks via ERP systems and targeting of high-value sectors (e.g., drones, retail) remain prevalent.
AI agent security: Research indicates that AI agents can be manipulated by implanting fake “memories,” raising concerns about the integrity of autonomous systems.
Device hygiene: Daily phone reboots are recommended as a practical defense against persistent zero-click mobile exploits.

Consumer Financial Protection Bureau (CFPB) in the US has canceled plans for tighter regulation of data brokers, potentially impacting privacy and data protection standards.
Telegram enforcement: Following media inquiries, Telegram banned thousands of accounts tied to crypto scam money laundering, disrupting several major illicit marketplaces.