COLDRIVER on DanSec Daily

Cybersecurity Brief – 2025-10-21

Tue, 21 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

F5 disclosed a cyber attack, reportedly carried out by threat actors who maintained long-term, undetected access to internal systems.
Retailer Muji suspended online sales after a ransomware attack on its delivery partner, Askul, caused a logistics outage.
Envoy Air, an American Airlines subsidiary, confirmed a breach resulting in the theft of business information following an Oracle-related hack.
A European telecommunications organization was breached using Snappybee malware and a Citrix vulnerability, attributed to the China-linked Salt Typhoon group.
AWS suffered a significant outage, disrupting Amazon.com, Prime Video, Fortnite, Perplexity AI, Canva, and other major services for approximately two hours.
A phishing campaign impersonating Home Depot used fake giveaways and tracking pixels to lure victims and compromise data.
Over 75,000 WatchGuard Firebox security appliances remain exposed online and vulnerable to a critical remote code execution flaw (CVE-2025-9242).
131 malicious Chrome extensions, cloned from a WhatsApp Web automation tool, were used to hijack WhatsApp Web sessions and conduct large-scale spam campaigns, primarily targeting Brazilian users.
A self-propagating malware named GlassWorm targeted the OpenVSX and Visual Studio Code extension registries, infecting an estimated 36,000 developer systems and acting as a criminal proxy network.

Newly Discovered Vulnerabilities

U.S. CISA added five new exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, including flaws in Oracle and Microsoft products.
A high-severity Windows SMB privilege escalation vulnerability is now being actively exploited in the wild, allowing attackers to gain SYSTEM privileges on unpatched systems.
A critical flaw (CVE-2025-9242) in WatchGuard Firebox appliances remains unpatched in tens of thousands of devices, enabling remote code execution.
ConnectWise patched a critical vulnerability in its Automate RMM tool that could allow attackers to intercept and tamper with communications in certain configurations.
A vulnerability in Dolby Decoder on Android allows for zero-click attacks via out-of-bounds writes during media file processing.
Microsoft released fixes for Windows Server Active Directory sync issues and addressed smart card authentication problems caused by recent security updates.
October Windows security updates introduced issues with USB input devices (mice and keyboards) in the Windows Recovery Environment (WinRE).
Oracle E-Business Suite customers were exposed to risk due to conflicting vendor guidance on deploying a recent zero-day patch.

Notable Threat Actor Activity

The Russia-linked COLDRIVER (a.k.a. ColdRiver) group developed and deployed three new malware families, demonstrating increased operational tempo and rapid adaptation.
The China-linked Salt Typhoon group used Snappybee malware and a Citrix flaw to conduct cyber espionage against a European telecom operator.
The Lumma Stealer group saw a significant drop in activity after the core members’ identities were exposed in an underground doxxing campaign.
Chinese cybercriminal gangs utilized US SIM farms and money mules to run large-scale text message scams targeting Americans, generating over $1 billion in illicit proceeds.
Law enforcement dismantled a major SIM box criminal network in Europe, arresting seven individuals and disrupting a cybercrime-as-a-service platform responsible for €5 million in losses.

Trends, Tools, or Tactics of Interest

Long-term, stealthy breaches are increasingly common, as evidenced by the F5 incident and recent rootkit discoveries in Linux environments.
ClickFix and similar browser-based copy/paste attacks are a growing cause of security breaches, exploiting user interaction with malicious scripts.
Malicious OAuth applications are being used to infiltrate Microsoft 365 tenants; tools like Cazadora are being deployed to detect hidden rogue apps.
The GlassWorm malware campaign highlights the ongoing risk of supply-chain attacks against developer ecosystems, with self-spreading malware targeting code extension marketplaces.
SIM farms and SIM box infrastructure continue to enable cybercrime-as-a-service offerings, facilitating large-scale fraud and spam operations.
New microchip technology (“FD-SOI”) is being developed to protect vehicles from laser-based hardware attacks, with implications for regulatory compliance in the automotive sector.
BYOD risks are expanding to include vehicles, with researchers demonstrating that attacks on connected cars can potentially bridge to corporate networks via employee devices.

Regulatory or Policy Developments

The DNS0.EU non-profit public DNS service for European users announced an immediate shutdown due to sustainability issues, impacting privacy-focused DNS options in the region.
A U.S. judge ordered NSO Group to cease hacking WhatsApp but reduced damages from $167 million to $4 million.
South Korea is intensifying efforts to prosecute online scam suspects repatriated from Cambodia, responding to public pressure over overseas cybercrime.
Anthropic, in partnership with the U.S. government, introduced a filter to prevent its Claude AI from providing information relevant to nuclear weapon construction, reflecting ongoing policy attention to AI misuse.

Cybersecurity Brief – 2025-09-27

Sat, 27 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Volvo and two other international vehicle manufacturers suffered supply chain cyberattacks in the past month, resulting in the theft of Volvo employee Social Security Numbers in a ransomware attack.
Hackers stole data on 8,000 nursery children and contacted their parents directly, demanding ransom payments under threat of leaking the children’s information.
A South Korean credit card company was hacked, and the Maryland Transit Administration experienced a ransomware attack. The UK’s Co-op lost £206 million due to a cyberattack.
Flo Health and Google agreed to pay $56 million to settle lawsuits over the period-tracking app Flo sharing sensitive users’ health data for advertising purposes.
Neon Mobile, a popular US app, pays users to record their phone calls and then sells this data for AI training.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2025-10035, CVSS 10) in Fortra’s GoAnywhere Managed File Transfer (MFT) software was exploited as a zero-day at least eight days prior to public disclosure, allowing unauthenticated remote command injection and the creation of backdoor admin accounts.
Multiple vulnerabilities in Cognex industrial cameras allow for remote hacking; no patches are available, and customers are advised to migrate to newer models.
Google Project Zero highlighted the risk of pointer leaks through pointer-keyed data structures, which can undermine ASLR protections and facilitate remote exploitation.

Notable Threat Actor Activity

The Russian APT group COLDRIVER launched a new campaign using ClickFix-style attacks to deliver two new lightweight malware families.
Iranian APTs, including the Charming Kitten offshoot Subtle Snail, have been observed signing malware with valid code-signing certificates issued by SSL.com.
North Korean threat actors are posing as recruiters to steal developers’ identities and provide these to fraudulent IT workers.
A phishing campaign impersonating Ukrainian government agencies is distributing CountLoader, which subsequently deploys Amatera Stealer and PureMiner malware. PureRAT phishing threats are also targeting Vietnam.
LockBit 5.0 ransomware activity continues to be reported.

Trends, Tools, or Tactics of Interest

The XCSSET macOS malware has a new variant with a four-stage infection chain, an additional persistence mechanism, and new targeting of Firefox browser data, including cryptocurrency transaction hijacking.
Microsoft Edge will introduce a feature to block malicious sideloaded browser extensions.
Generative AI deployments are increasingly recognised as introducing new cyber risks, including phishing, fraud, and model manipulation.
North Korean threat actors are leveraging social engineering by masquerading as recruiters to facilitate identity theft for use by IT worker proxies.
Interpol arrested 260 suspects in Africa involved in online romance scams that used relationship-building to extort or blackmail victims.
A new tool, convert-ts-bash-history.py, has been released to facilitate quick timeline analysis from bash histories.
Breach and Attack Simulation (BAS) is highlighted as an effective method for validating security controls beyond theoretical design.
The Neon Mobile app’s business model of incentivising users to record and sell their phone call data for AI training is drawing privacy concerns.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has restricted access to cloud and AI products for a unit within the Israeli military, following an internal review linking these services to mass surveillance activities in Gaza.
U.S. President Donald Trump signed an executive order approving the restructuring of TikTok’s U.S. operations to address national security concerns, transferring control to U.S. investors.
Google and Flo Health face regulatory enforcement, agreeing to a $56 million settlement over improper sharing of sensitive health data.
Cognex is recommending customers transition to newer products due to unpatched vulnerabilities in its industrial cameras.

Cybersecurity Brief – 2025-05-09

Fri, 09 May 2025 00:00:00 +0000

Major Incidents or Breaches

Pearson Data Breach: Education giant Pearson suffered a cyberattack resulting in the theft of corporate and customer data.
Insight Partners Breach: Venture capital firm Insight Partners confirmed sensitive employee and investor data was stolen in a January 2025 cyberattack.
Toronto School District Ransomware: Toronto’s school district paid a ransom believing stolen data would be deleted; however, the data was not removed as promised.
Supply Chain Attacks on Open Source Packages:
- The npm package ‘rand-user-agent’ (45,000 weekly downloads) was compromised to deliver a remote access trojan (RAT).
- A malicious PyPI package targeting Discord developers was found to be distributing RAT malware since 2022.
Kickidler Software Abused: Ransomware operators are leveraging legitimate Kickidler employee monitoring software for post-compromise reconnaissance and credential harvesting.

Newly Discovered Vulnerabilities

SonicWall SMA 100 Flaws: Three vulnerabilities (including one actively exploited) in SonicWall SMA 100 appliances allow remote code execution as root. Patches have been released, and urgent remediation is advised.
Cisco IOS XE Critical Flaw: Cisco patched a maximum severity vulnerability in IOS XE Software for Wireless LAN Controllers, which allowed unauthenticated remote takeover via a hard-coded JWT.
SAP NetWeaver RCE (CVE-2025-31324): Chinese threat actors (Chaya_004) are actively exploiting this recent SAP NetWeaver remote code execution flaw.
End-of-Life Routers Compromised: The FBI warned that threat actors are compromising end-of-life routers to build proxy networks for cybercrime.

Notable Threat Actor Activity

Qilin Ransomware Surge: Qilin ransomware was the most prolific in April 2025, responsible for 72 data leak disclosures. Operators are using SmokeLoader and a new .NET loader (NETXLOADER).
Chinese APT (Chaya_004): Actively exploiting SAP NetWeaver RCE to deploy Golang-based SuperShell malware.
Russian State-Linked ColdRiver Group: Deploying new LostKeys data theft malware in espionage campaigns targeting Western governments, journalists, and think tanks.
MirrorFace Espionage: The MirrorFace group is targeting Japanese and Taiwanese government/public sector organisations with upgraded ANEL and new ROAMINGMOUSE malware.
Phishing Operations:
- Industrial-scale crypto phishing operation using over 38,000 FreeDrain subdomains to steal wallet seed phrases.
- CoGUI phishing kit targeting Japanese organisations with sophisticated detection-evasion capabilities.

Trends, Tools, or Tactics of Interest

Phishing Kits Bypassing MFA: Ongoing evolution of phishing kits with features designed to bypass multi-factor authentication, increasing risk to organisations relying on MFA alone.
Abuse of Legitimate Tools: Ransomware actors are increasingly using legitimate employee monitoring software (e.g., Kickidler) for internal reconnaissance and credential theft post-breach.
Open Source Supply Chain Risk: Continued targeting of popular npm and PyPI packages to deliver malware, highlighting persistent risks in software supply chains.
Email-Based Attacks Dominate Claims: Business email compromise and funds transfer fraud accounted for 60% of 2024 cyber-insurance claims, underscoring the prevalence and impact of email-based attacks.
Proxy Networks via EoL Routers: Threat actors are exploiting outdated routers to create large-scale proxy networks used in cybercrime infrastructure.
DDoS-for-Hire Disruption: International law enforcement (Operation PowerOFF) took down nine DDoS-for-hire domains, reflecting ongoing efforts to disrupt cybercrime services.

Regulatory or Policy Developments

CVE Database Concerns: Industry discussion is intensifying around the future and timeliness of the CVE vulnerability database, with calls for reform to address delays and improve vulnerability coordination.
Leadership Change at FBI Cyber Division: The head of the FBI’s Cyber Division, Bryan Vorndran, is expected to retire, potentially impacting US cyber policy and enforcement priorities.

Cybersecurity Brief – 2025-05-08

Thu, 08 May 2025 00:00:00 +0000

Major Incidents and Breaches

LockBit Ransomware Gang Breach: The LockBit ransomware group suffered a significant breach, with its dark web affiliate panels defaced and victim negotiation data exposed via a leaked MySQL database. This incident may disrupt ongoing operations and expose sensitive data related to victims and affiliates.
PowerSchool Extortion Escalates: Following a December cyberattack, the PowerSchool hacker is now directly extorting individual school districts, threatening to release stolen student and teacher data if ransoms are not paid.
Masimo Cyberattack: Medical device manufacturer Masimo reported a cyberattack that has disrupted production and caused delays in fulfilling customer orders.
South African Airways Disruption: A cyberattack temporarily disrupted operational systems at South African Airways. The company is investigating potential data theft.