https://blog.dansec.red/actors/crocodilus/Recent content in Crocodilus on DanSec DailyHugoen-gbWed, 04 Jun 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-06-04-cybersecurity-news/Wed, 04 Jun 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-06-04-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Victoria&rsquo;s Secret has delayed its Q1 2025 earnings release due to ongoing corporate system restoration efforts following a security incident on 24 May.</li> <li>A data breach at Coinbase has been attributed to bribed customer support representatives at TaskUs in India, leading to data theft from the crypto exchange.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Hewlett Packard Enterprise (HPE) released security patches for eight vulnerabilities in StoreOnce, including a critical remote authentication bypass flaw.</li> <li>A critical 10-year-old vulnerability in Roundcube webmail software allows authenticated users to execute malicious code.</li> <li>Google patched a new Chrome zero-day vulnerability currently being exploited in the wild; this is the third Chrome zero-day exploited this year.</li> <li>Two newly disclosed vBulletin vulnerabilities (CVE-2025-48827, CVE-2025-48828) are easily exploitable and present risks to bulletin board deployments.</li> <li>CISA has issued a warning regarding active exploitation of a recently patched ConnectWise ScreenConnect vulnerability that allows remote code execution.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Scattered Spider has been linked to high-profile attacks on UK retailers Marks &amp; Spencer and Co-op, using tactics such as vishing, adversary-in-the-middle (AiTM) phishing, and exploiting multi-factor authentication gaps to hijack cloud accounts. The group operates as an identity-first threat model rather than a single entity.</li> <li>Threat actors are using fake DocuSign and Gitcode websites to distribute the NetSupport RAT via multi-stage PowerShell attacks.</li> <li>The Acreed infostealer has overtaken LummaC2 as the dominant credential theft malware on the Russian Market, reflecting a shift in the threat landscape.</li> <li>Malicious RubyGems packages impersonating Fastlane CI/CD plugins have been found redirecting Telegram API requests to attacker-controlled servers to steal data.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>The Crocodilus Android banking trojan has expanded its targeting from Turkey to eight countries across Europe and South America, now incorporating tactics such as adding fake contacts to victims&rsquo; devices to spoof trusted callers.</li> <li>A new unrestricted AI chatbot, Venice[.]ai, has emerged, capable of generating phishing messages and malware code to assist cybercriminal activity.</li> <li>Kaspersky research highlights the challenge of determining attack origins in environments lacking container visibility, emphasizing the importance of distinguishing between host-based and container-based threats.</li> <li>Mozilla has introduced a new system to detect and block Firefox add-ons that function as cryptocurrency drainers.</li> <li>LayerX has launched ExtensionPedia, and TXOne Networks introduced intelligent vulnerability mitigation capabilities, both reflecting ongoing innovation in endpoint and OT security.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>Google Chrome will distrust digital certificates issued by Chunghwa Telecom and Netlock due to compliance and conduct issues, effective from August.</li> <li>Microsoft and CrowdStrike have launched a shared threat actor glossary to align their threat actor taxonomies and reduce attribution confusion.</li> </ul>