https://blog.dansec.red/actors/castleloader/Recent content in CastleLoader on DanSec DailyHugoen-gbWed, 10 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-10-cybersecurity-news/Wed, 10 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-10-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Spanish authorities arrested a 19-year-old in Barcelona for allegedly stealing and attempting to sell 64 million personal data records obtained from breaches at nine companies.</li> <li>Canadian organizations have been the primary target in a campaign by threat cluster STAC6565, with almost 40 incidents investigated. The Gold Blade group has been observed deploying QWCrypt ransomware in these attacks.</li> <li>Japanese manufacturers, retailers, and government entities continue to experience prolonged recovery periods following ransomware attacks, highlighting the long-term operational impact of such incidents.</li> <li>Microsoft Copilot experienced an outage affecting users in Europe, with investigation and mitigation ongoing.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Microsoft’s December 2025 Patch Tuesday addressed 57 vulnerabilities, including three zero-days (one actively exploited, two publicly disclosed) affecting Windows and supported software.</li> <li>Adobe released patches for nearly 140 vulnerabilities, including 117 in Experience Manager (116 XSS bugs).</li> <li>SAP issued patches for 14 vulnerabilities across multiple products, including three critical-severity flaws.</li> <li>Fortinet released updates for two critical authentication bypass vulnerabilities affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, and warned of critical SSO login flaws in FortiCloud that could allow authentication bypass.</li> <li>Ivanti disclosed and patched a critical remote code execution vulnerability in Endpoint Manager.</li> <li>Google patched a critical “no-click” vulnerability in Gemini Enterprise that allowed attackers to exfiltrate sensitive data via malicious document instructions.</li> <li>Microsoft added PowerShell warnings for scripts using Invoke-WebRequest to help prevent risky code execution.</li> <li>Google introduced new layered defenses in Chrome to block indirect prompt injection threats following the addition of agentic AI capabilities.</li> <li>Researchers identified malicious extensions in Microsoft Visual Studio Code Marketplace and malicious packages in Go, npm, and Rust ecosystems, designed to steal developer data.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>North Korea-linked actors exploited the React2Shell (CVE-2025-55182) vulnerability in React Server Components to deploy new EtherRAT malware, which implements multiple Linux persistence mechanisms and uses Ethereum smart contracts for command and control.</li> <li>Four distinct threat clusters are leveraging the CastleLoader malware loader, indicating it is being offered as a service for broader cybercriminal use.</li> <li>Storm-0249, previously known as an initial access broker, has escalated to direct ransomware operations using advanced techniques such as domain spoofing, DLL side-loading, fileless PowerShell, and abusing endpoint detection and response (EDR) solutions for stealthy malware execution.</li> <li>A phishing campaign leveraging the Evilginx open-source phishing framework is targeting at least 18 U.S. universities, aiming to bypass MFA and steal credentials.</li> <li>Multi-stage phishing attacks have been observed evading Microsoft 365 security controls.</li> <li>Kaspersky researchers report that Telegram’s crackdown on illicit channels is pushing cybercriminal activity to other platforms.</li> <li>Shanya, a “packer-as-a-service,” is being used to obfuscate ransomware payloads and disable EDR, supporting ransomware operators in evading detection.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Increased abuse of EDR and trusted Windows utilities by threat actors for stealthy malware deployment and persistence.</li> <li>Growing adoption of malware loaders and packer-as-a-service offerings (e.g., CastleLoader, Shanya) to facilitate ransomware and malware campaigns.</li> <li>Surge in malicious packages and extensions targeting developer environments (VS Code, Go, npm, Rust) to steal sensitive data and credentials.</li> <li>Attackers are leveraging deepfakes, AI-generated resumes, and social engineering to impersonate job applicants and infiltrate organizations.</li> <li>Prompt injection vulnerabilities in AI-powered tools remain a persistent and difficult-to-mitigate risk, as highlighted by the UK’s NCSC.</li> <li>Zero Trust adoption is hindered by lack of interoperability among security tools, with 88% of organizations experiencing challenges in sharing security signals.</li> <li>Ongoing migration of cybercriminal communities away from Telegram due to increased enforcement and platform blocks.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>The UK government imposed sanctions on Russian and Chinese firms suspected of conducting malign information warfare and hybrid threats targeting critical infrastructure and democratic processes.</li> <li>The EU fined X (formerly Twitter) $140 million for verification rules that facilitate impostor scams by allowing anyone to purchase a verified checkmark.</li> <li>CISA, FBI, and international partners issued a joint advisory urging immediate action to defend critical infrastructure from pro-Russia hacktivist threats.</li> <li>The US announced a $10 million bounty for information on Iranian hackers associated with Emennet Pasargad.</li> <li>Microsoft announced new operating CISOs as part of a strategic shift toward AI-driven cyber defense and enhanced operational oversight.</li> </ul>https://blog.dansec.red/posts/2025-09-06-cybersecurity-news/Sat, 06 Sep 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-09-06-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Wealthsimple, a Canadian online investment management service, disclosed a data breach involving the theft of personal data from an undisclosed number of customers.</li> <li>Multiple cybersecurity firms, including Proofpoint, SpyCloud, Tanium, and Tenable, were affected by a breach involving their Salesforce instances, with attackers accessing stored information.</li> <li>Nexar’s dashcam video database was compromised, exposing video recordings from vehicle-mounted cameras.</li> <li>The City of Baltimore was reported to have sent $1.5 million to a scammer in a cyber fraud incident.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A critical command injection vulnerability in SAP S/4HANA (CVE-2025-42957) is under active exploitation. This flaw allows attackers to achieve full system compromise with minimal effort.</li> <li>A critical Sitecore vulnerability has been identified and is being actively exploited. CISA has ordered immediate patching of affected Sitecore instances by federal agencies.</li> <li>A max-severity Argo CD API flaw allows users with low-level project permissions to access API endpoints and retrieve all repository credentials for a project.</li> <li>Academics have developed an AI-powered framework (A2) for discovering and validating vulnerabilities in Android applications.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>TAG-150, a threat actor group operating a malware-as-a-service (MaaS) framework known as CastleLoader, has developed a new remote access trojan called CastleRAT, available in both Python and C variants.</li> <li>North Korean hackers have targeted hundreds of individuals using fake job interview lures. The group actively monitors cyber threat intelligence to rebuild exposed infrastructure.</li> <li>Scammers are abusing the Grok AI platform to distribute malicious links on X (formerly Twitter), bypassing restrictions on links in promoted posts.</li> <li>A smishing campaign is targeting California taxpayers with fraudulent refund offers, as warned by the California Franchise Tax Board.</li> <li>A wave of spear phishing attacks is targeting C-suite executives and senior leadership across multiple industries.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Q2 2025 threat reports indicate continued high volumes of mobile malware, adware, and unwanted software targeting Android, as well as persistent threats to Windows, macOS, and IoT platforms, including ransomware and cryptominers.</li> <li>Automation is increasingly being adopted in penetration testing, with AI-powered offensive security platforms such as FireCompass receiving significant investment.</li> <li>The use of agentic AI introduces new vulnerabilities at integration points with enterprise systems.</li> <li>There is a trend towards using AI-driven tools for vulnerability discovery and validation in software development.</li> <li>Smishing, spear phishing, and the abuse of AI platforms for phishing and malware distribution are prominent tactics.</li> <li>Improvements in IoT security have been noted over the past five years, though significant gaps remain.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>CISA has mandated immediate patching of the critical Sitecore vulnerability for federal agencies.</li> <li>Microsoft has enforced multifactor authentication (MFA) for Azure Portal sign-ins across all tenants since March 2025.</li> <li>The European Commission fined Google €2.95 billion ($3.5 billion) for anti-competitive practices in the digital advertising market.</li> <li>Federal budget cuts in the US are impacting cybersecurity funding for local and state agencies, increasing their exposure to cyber risk.</li> </ul>