https://blog.dansec.red/actors/blind-eagle/Recent content in Blind Eagle on DanSec DailyHugoen-gbThu, 28 Aug 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-08-28-cybersecurity-news/Thu, 28 Aug 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-08-28-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>A cyberattack on Swedish IT systems supplier Miljödata has disrupted services across more than 200 municipalities, impacting approximately 80% of Sweden&rsquo;s municipal systems.</li> <li>Nevada state agencies experienced a disruptive cyberattack, leading to the shutdown of in-person services and state websites; emergency services reportedly remain unaffected.</li> <li>Healthcare Services Group (HSGI) disclosed a data breach affecting 624,000 individuals, exposing personal information.</li> <li>Hundreds of Salesforce customers were affected by a widespread data theft campaign, traced to compromised OAuth tokens associated with the Drift AI chat agent via the Salesloft platform. Attackers exported corporate data, including AWS and Snowflake keys.</li> <li>TheTruthSpy stalkerware suffered a new vulnerability, exposing all user records to compromise.</li> <li>77 malicious apps, including adware and advanced banking trojans, were removed from the Google Play Store following researcher discovery.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Over 28,000 Citrix NetScaler devices remain vulnerable to a critical remote code execution flaw (CVE-2025-7775), which is actively being exploited in the wild. Citrix and CISA have issued emergency patch deadlines.</li> <li>Sangoma FreePBX issued an emergency fix for a zero-day vulnerability in its Administrator Control Panel, which has been actively exploited on internet-exposed systems.</li> <li>A new vulnerability in TheTruthSpy Android stalkerware allows attackers to compromise any record in the system.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The financially motivated Storm-0501 group has shifted tactics, exploiting Microsoft Entra ID to conduct data exfiltration and extortion attacks targeting hybrid and cloud environments, moving away from traditional ransomware to cloud-based encryption and data theft.</li> <li>ShadowSilk, a threat cluster, targeted 35 government organizations in Central Asia and APAC using Telegram bots for command and control.</li> <li>Blind Eagle, linked to five distinct activity clusters, targeted Colombia with RATs, phishing lures, and dynamic DNS infrastructure between May 2024 and July 2025.</li> <li>China-linked actors, including Salt Typhoon and Mustang Panda, have been attributed to global espionage campaigns. Salt Typhoon operations were linked to Chinese tech firms and targeted networks worldwide. Mustang Panda hijacked captive portals to redirect Asian diplomats&rsquo; browsers to phishing sites.</li> <li>UNC6395 engaged in widespread data theft, exploiting OAuth tokens from the Salesloft Drift app to compromise Salesforce customers.</li> <li>UNC6384, another China-linked group, used social engineering, signed malware, and adversary-in-the-middle attacks to hijack web traffic and deliver backdoors.</li> <li>&ldquo;ZipLine&rdquo; phishing campaign employed a novel technique where victims initiate email contact, affecting organizations across multiple sectors.</li> <li>The Purgatory group has been identified as responsible for swatting attacks against US universities, offering such services for payment.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>AI-powered ransomware has emerged with the discovery of PromptLock, a cross-platform strain using OpenAI&rsquo;s gpt-oss:20b model and Lua scripts to encrypt and steal data on Windows, macOS, and Linux. PromptLock dynamically generates attack scripts in real time.</li> <li>Anthropic disrupted an operation in which its Claude AI chatbot was weaponized for large-scale theft and extortion, automating reconnaissance, credential harvesting, and intrusions across critical sectors.</li> <li>AI-generated phishing campaigns are increasingly sophisticated, with attackers crafting emails to deploy tools such as ConnectWise ScreenConnect for remote access.</li> <li>Malware-as-a-service competition has led to more refined and accessible infostealers, driving modern cybercrime.</li> <li>The Q2 2025 vulnerabilities and exploits report noted a significant number of published vulnerabilities and increased use of command-and-control frameworks.</li> <li>Zero trust is highlighted as an ongoing, adaptive process in response to evolving threats, including supply chain attacks and policy drift.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>The U.S. NSA, UK NCSC, and international partners issued a joint advisory attributing global hacking campaigns to Chinese state-sponsored actors, specifically Salt Typhoon, and provided guidance on countering such threats.</li> <li>CISA and partners are providing real-time incident response support for the Nevada state cyberattack.</li> <li>Google announced new developer verification requirements aimed at reducing harmful apps on Android, enhancing platform security.</li> </ul>https://blog.dansec.red/posts/2025-07-01-cybersecurity-news/Tue, 01 Jul 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-07-01-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Switzerland&rsquo;s government reported that sensitive data from multiple federal offices was compromised following a ransomware attack on the third-party provider Radix.</li> <li>Europol, in coordination with Spanish authorities, dismantled a cryptocurrency investment fraud ring responsible for laundering approximately $540 million (€460 million) from over 5,000 victims. Five suspects were arrested.</li> <li>Over 1,200 Citrix NetScaler ADC and NetScaler Gateway servers remain unpatched against a critical authentication bypass vulnerability, which is reportedly being actively exploited.</li> <li>The hacker collective Scattered Spider continues its campaign targeting the airline sector, with Microsoft designating the group as a significant cyber threat.</li> <li>The FBI disclosed that cybercriminals are impersonating health fraud investigators to steal sensitive health information from US citizens.</li> <li>The US Justice Department revealed that the identities of more than 80 Americans were stolen to facilitate North Korean IT worker scams, with action taken against associated “laptop farms.”</li> <li>A government report indicated that a hacker was hired by the Sinaloa drug cartel to identify and target individuals connected to the FBI’s investigation, leading to fatal outcomes.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Vulnerabilities in Airoha Bluetooth chips, used in Sony and Bose earbuds and headphones, could allow attackers to hijack both the audio devices and any connected host systems. Details of the vulnerabilities have not yet been published.</li> <li>Some Brother printers are affected by a critical security flaw that can be mitigated by changing the default admin password.</li> <li>Microsoft warned of delays in the delivery of June 2025 Windows security updates due to an incorrect metadata timestamp.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>US agencies (CISA, FBI, NSA, DC3) issued a joint advisory regarding increased Iranian state-sponsored cyber activity targeting US defense, operational technology (OT) networks, and critical infrastructure.</li> <li>Blind Eagle, a known threat actor, has been linked to the use of the Russian bulletproof hosting service Proton66 for phishing campaigns and remote access trojan (RAT) deployment targeting Colombian banks.</li> <li>Ongoing AI-themed SEO poisoning attacks are distributing Lumma and Vidar infostealers and other malware via malicious websites optimized for AI-related search terms.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Microsoft Defender for Office 365 now automatically detects and blocks email bombing attacks.</li> <li>Identity-based attacks, including impersonation and credential theft, continue to rise in frequency and sophistication.</li> <li>Attackers are increasingly leveraging legitimate system functionality and user credentials, often exploiting “by design” behaviors rather than technical flaws.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>The Canadian government ordered Hikvision Canada to cease all operations due to national security concerns, though individuals and private businesses may still purchase Hikvision products.</li> <li>The Berlin Data Protection Commissioner formally requested Google and Apple to remove the DeepSeek AI application from their app stores for GDPR violations.</li> <li>Microsoft announced it will remove password management functionality from its Authenticator app starting August 1, 2025, as part of a shift towards passkey-based authentication.</li> <li>Proposed US legislation aims to reduce federal AI funding for states that enact AI regulations, with exemptions for laws addressing unfair practices and child sexual abuse material.</li> </ul>