DragonForce on DanSec Daily

Cybersecurity Brief – 2026-06-19

Fri, 19 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Nintendo of America confirmed that threat actors stole internal survey data via a breach of the TinyPulse service, a WebMD subsidiary. Nintendo’s own systems were not compromised in the attack ^[15].
Market intelligence platform Klue suffered an OAuth breach, which enabled the “Icarus” threat group to steal Salesforce CRM data from multiple organizations, including cybersecurity vendor Huntress, as part of an ongoing extortion campaign ^[17]^[29].
Kodak confirmed a data breach following threats from the ShinyHunters group, who claimed to have stolen 2.2 million records and threatened to leak them ^[47].
Novo Nordisk experienced a breach involving a leaked GitHub token, exposing risks in software development pipelines due to inadequate secrets management ^[26].
Nearly 74,000 Fortinet firewall and VPN credentials were exposed in a data leak dubbed “FortiBleed,” impacting organizations worldwide ^[13]^[21].
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, distributing infected releases to customers via the official update system ^[20].
International law enforcement and private partners cleaned nearly 15,000 SocGholish-infected WordPress sites and dismantled over 100 associated command and control servers, significantly disrupting the Evil Corp-linked botnet ^[19]^[36].
Splunk Enterprise vulnerability CVE-2026-20253 was exploited in attacks days after disclosure, prompting CISA to require federal agencies to patch within three days ^[37].
A sprawling Android-based botnet called Popa, active for four years, has used millions of consumer TV boxes for advertising fraud, account takeovers, and mass data scraping ^[33].

Newly Discovered Vulnerabilities

Apple patched a high-severity vulnerability (CVE-2025) in Beats Studio Buds wireless earbuds that allowed attackers within Bluetooth range to eavesdrop on conversations ^[4]^[22].
F5 released out-of-band patches for multiple critical vulnerabilities in NGINX Open Source, including flaws that could enable remote code execution on affected systems ^[5]^[24].
Splunk patched a critical OS command injection vulnerability in its AI Toolkit, and Atlassian addressed dozens of flaws in third-party dependencies ^[42].
Cisco patched a critical command execution vulnerability in Identity Services Engine (ISE) that allowed privilege escalation to root via insufficient input validation ^[44].
Microsoft acknowledged an unpatched Defender vulnerability (RoguePlanet) that could allow attackers full PC control and is working on a fix ^[45].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service operation is actively developing and maintaining multiple endpoint detection and response (EDR) killer tools to help affiliates evade detection, with research showing a sophisticated and evolving suite ^[3]^[14].
The DragonForce ransomware group has been observed using a custom Go-based remote access trojan (Backdoor.Turn) to hide command-and-control traffic within Microsoft Teams relays ^[11].
The “Icarus” threat group used an OAuth breach in the Klue app to steal Salesforce data from multiple organizations ^[17]^[29].
A Windows-based cryptocurrency clipper malware campaign has been spreading via USB shortcut files, using Tor-based command and control and self-propagation capabilities ^[8]^[16].
Law enforcement action dismantled the SocGholish botnet infrastructure, which was linked to Evil Corp ^[19]^[36].
The Popa Android botnet has been linked to a publicly traded Israeli firm and is associated with widespread malicious activity using consumer TV boxes ^[33].
The INC ransomware group has emerged as a significant ransomware-as-a-service threat, claiming over 830 victims since 2023 ^[9].

Trends, Tools, or Tactics of Interest

There is an increase in supply chain attacks on WordPress plugins, as seen with the ShapedPlugin compromise ^[20].
Threat actors are using AI chat links and browser add-ons as malware delivery paths, with macOS and npm package abuse also noted ^[7].
Autonomous AI agents present hidden access risks within enterprise environments, particularly when their authorization and access are not clearly tracked ^[6].
The use of endpoint detection and response (EDR) killer frameworks by ransomware groups is becoming more sophisticated, with the Gentlemen RaaS maintaining an extensive suite for defense evasion ^[3]^[14].
The Rokarolla Android banking trojan is targeting over 200 applications, enabling operators to take control of infected devices and harvest sensitive data ^[43].
Retro gaming enthusiasts are being targeted with fake GitHub projects distributing malware disguised as tools or plugins for consoles ^[46].

Regulatory or Policy Developments Affecting the Security Industry

CISA issued a warning to Fortinet customers to secure devices following the FortiBleed leak, emphasizing the urgency due to the scale of exposed credentials ^[13].
CISA mandated a three-day patch window for federal agencies to address the actively exploited Splunk Enterprise vulnerability CVE-2026-20253 ^[37].
New PCI DSS rules are impacting how organizations must manage scripts on checkout pages, with independent assessments highlighting increased compliance requirements ^[10].

Sources

Nintendo confirms data stolen in WebMD subsidiary cyberattack - bleepingcomputer.com
Klue OAuth breach linked to 'Icarus' Salesforce data theft attacks - bleepingcomputer.com
Salesforce Data Thefts Continue via Klue App Compromise - darkreading.com
Kodak confirms breach as ShinyHunters’ leak threat reaches deadline - malwarebytes.com
Novo Nordisk Breach Exposes Software Development Pipeline Risk - darkreading.com
CISA warns Fortinet users to secure devices after FortiBleed leak - bleepingcomputer.com
FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
ShapedPlugin update flow hacked to infect WordPress sites - bleepingcomputer.com
Police cleans nearly 15,000 SocGholish-infected sites tied to Evil Corp - bleepingcomputer.com
15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown - securityweek.com
Splunk Enterprise Vulnerability Exploited in Attacks Days After Disclosure - securityweek.com
‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm - krebsonsecurity.com
Apple Patches Beats Studio Buds Flaw Letting Nearby Attackers Spy via Microphone - thehackernews.com
Apple fixes Beats Studio Buds flaw that let hackers spy on conversations - bleepingcomputer.com
F5 Patches Two Critical NGINX Open Source Flaws Enabling Remote Code Execution - thehackernews.com
F5 issues out-of-band patches for critical NGINX vulnerabilities - bleepingcomputer.com
Atlassian, Splunk Patch Critical Vulnerabilities - securityweek.com
Critical Command Execution Vulnerability Patched in Cisco ISE - securityweek.com
Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control - malwarebytes.com
Killing me gently: Inside Gentlemen’s EDR killer framework - welivesecurity.com
Gentlemen ransomware uses multiple EDR killers to disable defenses - bleepingcomputer.com
DragonForce Hackers Abuse Microsoft Teams Relays to Hide Backdoor.Turn C2 Traffic - thehackernews.com
Microsoft Details Windows Clipper Malware Campaign Using USB LNK Worm and Tor-Based C2 - thehackernews.com
USB worm spreads crypto-stealing malware via Windows shortcut files - bleepingcomputer.com
INC Ransomware Emerges as Major RaaS Threat in 2026 with 830+ Victims Since 2023 - thehackernews.com
ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories - thehackernews.com
Orphaned AI Agents: How to Find Hidden Access Risks Inside Your Network - thehackernews.com
Rokarolla Banking Trojan Targets 200 Applications - securityweek.com
Retro gaming fans are the new target for fake GitHub malware - malwarebytes.com
The Scripts on Your Checkout Page Are Now a PCI DSS Problem - thehackernews.com

Cybersecurity Brief – 2026-06-18

Thu, 18 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

A data leak dubbed “FortiBleed” has exposed VPN credentials for 73,932 Fortinet and FortiGate firewall URLs at organizations worldwide. Attackers have compiled working credentials for tens of thousands of compromised devices across nearly 200 countries, actively targeting various sectors ^[11]^[18].
Kodak has confirmed a data breach following claims by the ShinyHunters hacking group. The company states there is no threat to its systems or operations as a result of the incident ^[24].
Researchers discovered an exposed collection of 24 billion stolen records online, including usernames, passwords, and other sensitive account data ^[34].
Roblox developers have been targeted by attackers using fake job offers and malware to steal accounts, Robux, and entire Roblox games ^[32].

Newly Discovered Vulnerabilities

Microsoft has confirmed a zero-day vulnerability in Defender, codenamed RoguePlanet, which allows privilege escalation via a race condition. A patch is in development and public proof-of-concept code is available. The vulnerability is tracked as CVE-2026-50656 ^[4]^[30].
The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) plugin that is being actively exploited ^[15].
Rockwell Automation has released patches for vulnerabilities affecting Logix, CompactLogix, Flex, RSLinx, and FactoryTalk industrial control system products ^[28].
Oracle has issued its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple products, including Communications, EBS, and Enterprise Manager ^[31].

Notable Threat Actor Activity

A coordinated malware campaign has published at least 15 malicious plugins on the JetBrains Marketplace, exfiltrating AI API keys and other sensitive data. Additionally, malicious Chrome extensions are capturing chatbot conversations ^[7].
An unknown threat actor is leveraging paid or promoted posts on legitimate news websites, fake reviews, AI narrators, and comments on VirusTotal to promote a crypto clipper malware campaign ^[3].
A French-speaking attacker compromised a small French automotive business, planted a keylogger, and maintained persistence using Tailscale and OpenSSH after their command-and-control infrastructure went offline ^[5].
The DragonForce ransomware group deployed a Go-based backdoor that uses Microsoft Teams relay servers for command-and-control in a recent attack ^[29].
The INC ransomware group continues to target sectors where operational disruption puts immediate pressure on victims to pay, such as healthcare ^[17].

Trends, Tools, or Tactics of Interest

85.8 percent of phishing attacks in the past 12 months were AI-driven, with threat actors increasingly using AI agents to automate social engineering ^[1].
Enterprise adoption of AI agents is creating security blind spots, with 83 percent of organizations lacking visibility into their AI agents’ activities and 86 percent lacking visibility into AI data flows ^[2].
There is a rise in account takeovers as attackers bypass traditional defenses using phishing, session hijacking, and MFA fatigue attacks ^[12].
Attackers are increasingly exploiting exposed admin panels, credential reuse, and non-zero-day vulnerabilities to gain initial access, as seen in recent attack surface exposure reports ^[8].
Coordinated SSH brute-force attacks remain prevalent, with attackers adapting their tactics over recent months ^[21].
Security researchers highlight that browser-based attacks may evade detection by traditional security tools, creating a “browser blind spot” ^[22].
Adversarial exposure validation is emerging as a method to help security teams prioritize which vulnerabilities to address, moving beyond simple visibility to actual validation of risk ^[6].
New Android malware, Rokarolla, can take full control of infected devices and targets over 200 banking and cryptocurrency apps to steal credentials ^[33].
Attackers are using fake job offers as a vector to deliver malware and compromise developer accounts in gaming platforms ^[32].

Regulatory or Policy Developments Affecting the Security Industry

From August 3, 2026, Google will use IP addresses from UK, EEA, and Switzerland users for ad measurement and personalization, as the UK Information Commissioner’s Office (ICO) considers new consent rules ^[10].
The EU has initiated the “Shield-6G” project to develop security measures for 6G networks, incorporating AI threat detection, digital twins, and honeypots ^[16].
The UK Home Office will implement facial age estimation technology for asylum-seeker age checks despite internal tests showing high risks of errors ^[19].

Sources

FortiBleed leak exposes Fortinet VPN credentials for 73,000 devices. - bleepingcomputer.com
Sweeping Credential-Harvesting Heist Compromises 30K+ Fortinet Devices - darkreading.com
Kodak Admits Data Breach After ShinyHunters Hack Claims - securityweek.com
24 billion stolen records exposed online. Here’s what to do - malwarebytes.com
Roblox developers are losing entire games to malware attacks - malwarebytes.com
Microsoft Confirms RoguePlanet Defender Zero-Day, Says Patch is in Development - thehackernews.com
Microsoft Working on Patch for ‘RoguePlanet’ Zero-Day - securityweek.com
CISA orders feds to patch max severity Joomla plugin flaw by Friday - bleepingcomputer.com
Rockwell Automation Patches Vulnerabilities in ICS Controllers and Software - securityweek.com
Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
Malicious JetBrains Plugins Steal AI API Keys as Chrome Extensions Capture Chatbot Chats - thehackernews.com
Crypto Clipper Campaign Abuses Fake Reviews, AI Narrators, and VirusTotal Comments - thehackernews.com
Junior Hacker Used Tailscale and OpenSSH to Keep Access After His C2 Went Offline - thehackernews.com
Microsoft Teams Relay Servers Abused in DragonForce Ransomware Attack - securityweek.com
INC Ransomware Thrives by Mastering the Basics - darkreading.com
From 1% to 26%: How AIDA Orchestration Fixes the Remedial Training Gap - blog.knowbe4.com
Best AI Agent Security Tools for SMB and Enterprise in 2026 - blog.knowbe4.com
Why Account Takeovers Are Rising and How to Stop Them - bleepingcomputer.com
The Top 10 Attack Surface Exposures in 2026 - thehackernews.com
The Behavior of Coordinated SSH Brute Force Attacks over the last three months [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
The browser blind spot: Why your security tool may not be blocking what you think it is [Guest Diary], (Wed, Jun 17th) - isc.sans.edu
Adversarial Exposure Validation Turns Security Visibility into Confident Prioritization - thehackernews.com
Rokarolla Android malware can take over your phone and steal banking logins - malwarebytes.com
Google to use UK and EU user IP addresses for ad personalization - bleepingcomputer.com
EU Gets a Head Start in Developing 6G Network Security - darkreading.com
The UK Will Scan Asylum-Seekers’ Faces for Age Checks—Despite Knowing the Tech Is Flawed - wired.com

Cybersecurity Brief – 2026-06-17

Wed, 17 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Kodak has confirmed a data breach after hackers gained access to company data, with the ShinyHunters extortion gang claiming responsibility. External cybersecurity experts have been engaged to investigate the incident ^[12].
iRhythm, a digital health company, confirmed data theft and a ransom demand after a breach affecting cardiac patients’ medical data ^[35]^[42].
The cybercrime group FulcrumSec claims to have stolen 1.3TB of data from pharmaceutical company Novo Nordisk ^[40].
More than 200 members of Peter Thiel’s ‘Dialog’ Society were exposed through a leak associated with a retreat registration app ^[28].

Newly Discovered Vulnerabilities

Three recently patched vulnerabilities in Fortinet FortiSandbox are being actively exploited in the wild, exposing up to 30,000 devices to compromise. At least one of the flaws was only patched last week ^[9]^[21]^[34].
CISA has warned of an actively exploited maximum-severity vulnerability in the Widget Factory Joomla Content Editor (JCE) that allows PHP code execution ^[4]^[33].
A critical vulnerability in a cPanel plugin (CVE-2026-54420) is being actively exploited, with CISA mandating US government agencies to secure affected servers within three days ^[19].
A flaw in the Google Cloud Vertex AI SDK for Python allowed attackers to hijack machine learning model uploads and execute code in Google’s infrastructure via bucket squatting ^[5].
Chrome and Firefox have received updates to patch multiple critical and high-severity memory safety vulnerabilities that could lead to remote code execution ^[32].
Oracle released its June 2026 Critical Security Patch Update, addressing 245 vulnerabilities across multiple product lines ^[31].
Microsoft is working on a patch for a Defender zero-day vulnerability named “RoguePlanet,” which was disclosed a week ago ^[11].

Notable Threat Actor Activity

The ShinyHunters extortion gang is implicated in the Kodak breach ^[12].
The ransomware and data extortion group Vice Society may be linked to the ClickFix campaign, which is delivering malware loaders such as BabaDeda Loader, Lorem Ipsum Loader, and Potemkin via compromised WordPress sites ^[6]^[27].
DragonForce ransomware operators have used a custom malware, ‘Backdoor.Turn,’ to conceal command-and-control traffic within Microsoft Teams relay infrastructure ^[20].
FishMonger, a China-nexus threat group, has deployed a Windows variant of the SprySOCKS backdoor, previously observed only on Linux, against government targets in Honduras, Taiwan, Thailand, and Pakistan ^[10]^[25].
At least 15 malicious plugins on the JetBrains Marketplace were designed to steal AI API keys from developers ^[13].

Trends, Tools, or Tactics of Interest

The new Rokarolla Android banking trojan targets 217 banking and cryptocurrency applications, utilizes 137 remote commands, and achieves full device control and persistence. It is distributed via fake TikTok and Chrome downloads ^[7]^[14]^[26].
GhostTree attack uses recursive NTFS junctions to create numerous valid Windows file paths, causing Microsoft Defender folder scans to never complete and enabling malware to evade detection ^[17].
The Phantom Stealer malware executes entirely in memory and incorporates anti-analysis techniques to target browser credentials ^[23].
Steam Workshop, via the Wallpaper Engine app, is being abused to distribute malware hidden in wallpaper packages ^[15].
Fileless and evasive malware techniques, as seen in both Phantom Stealer and GhostTree, are increasingly being leveraged to avoid detection by endpoint security tools ^[17]^[23].
144 npm packages associated with the Mastra namespace were compromised via a hijacked contributor account, impacting open-source AI development ecosystems ^[3].
ClickFix campaigns are expanding malware delivery with new loaders and fake update lures, exploiting compromised WordPress sites ^[6]^[27].
94 percent of security incidents involve anonymized infrastructure, and security teams remain largely reactive despite increased access to enrichment and threat intelligence data ^[8].

Regulatory or Policy Developments Affecting the Security Industry

The UK government will require individuals to verify their age with an ID upload or facial scan before creating new social media accounts, effectively banning under-16s from user-to-user social media platforms from spring 2027. Privacy and security experts have raised concerns about age-verification and privacy implications ^[16]^[22].
The US government has imposed export restrictions on Anthropic’s Claude Fable 5 and Mythos 5 AI models, drawing criticism from the security community ^[24]^[29].
US federal authorities have taken down sites hosting nonconsensual deepfake images of famous women ^[43].

Sources

Kodak confirms data breach claimed by ShinyHunters extortion gang - bleepingcomputer.com
iRhythm Confirms Data Stolen in Hack - securityweek.com
Cardiac patients’ medical data stolen and held to ransom - malwarebytes.com
Cybercrime Group Claims Novo Nordisk Hack - securityweek.com
Leak Exposes Members of Peter Thiel’s Secretive ‘Dialog’ Society - wired.com
Attackers Exploit Three Fortinet FortiSandbox Flaws, One Patched Last Week - thehackernews.com
Critical Fortinet FortiSandbox flaws now exploited in attacks - bleepingcomputer.com
3 Recently Patched Fortinet FortiSandbox Vulnerabilities in Hacker Crosshairs - securityweek.com
CISA Warns of Actively Exploited Joomla JCE Flaw Allowing PHP Code Execution - thehackernews.com
Joomla, LiteSpeed Vulnerabilities Exploited in Attacks - securityweek.com
CISA warns of another cPanel plugin flaw exploited in attacks - bleepingcomputer.com
Google Vertex AI SDK Flaw Let Attackers Hijack Model Uploads via Bucket Squatting - thehackernews.com
Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities - securityweek.com
Oracle’s Second Monthly Security Updates Deliver 245 Patches - securityweek.com
Microsoft working on Defender patch for RoguePlanet zero-day - bleepingcomputer.com
ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures - thehackernews.com
'Lorem Ipsum' Malware Pivots to ClickFix Delivery - darkreading.com
Ransomware gang abuses Microsoft Teams relays to hide malicious traffic - bleepingcomputer.com
China-Linked SprySOCKS Backdoor Expands to Windows with Driver-Based Stealth - thehackernews.com
SprySOCKS Windows Variant Abuses Kernel Drivers to Evade Detection - darkreading.com
Malicious JetBrains Marketplace plugins steal AI API keys from developers - bleepingcomputer.com
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds - thehackernews.com
New Rokarolla Android malware targets 217 banking, crypto apps - bleepingcomputer.com
Rokarolla Android Trojan Levels Up to Full Device Control, Persistence - darkreading.com
GhostTree Attack Abused Recursive Windows Junctions to Hide Malware - bleepingcomputer.com
Fileless Phantom Stealer Targets Browser Credentials - darkreading.com
Steam Workshop abused to spread malware via Wallpaper Engine app - bleepingcomputer.com
144 Mastra npm Packages Compromised via Hijacked Contributor Account - thehackernews.com
Survey: 94% of Incidents Involve Anonymized Infrastructure. Teams Are Still Reactive - thehackernews.com
UK to require ID or face scan before you can make social media accounts - bleepingcomputer.com
UK Social Media Ban for Minors Has Privacy Experts Worried - darkreading.com
Security Community Slams US Ban on Exporting Mythos, Fable - darkreading.com
‘Dangerous’ AI Models Are Coming No Matter What - wired.com
Deepfake posting sites depicting famous women taken down by feds - malwarebytes.com

Cybersecurity Brief – 2026-02-05

Thu, 05 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

A hacktivist group claims to have breached the Mexican government, allegedly leaking 2.3 terabytes of data affecting 36 million citizens. The government disputes the sensitivity of the leaked data.
Notepad++ update infrastructure was compromised by suspected Chinese state-backed hackers, resulting in the distribution of a backdoored version of the application.
Ongoing web traffic hijacking campaigns are targeting NGINX servers and management panels such as Baota (BT), redirecting user traffic through attacker-controlled infrastructure.
The DEAD#VAX malware campaign is deploying AsyncRAT via IPFS-hosted VHD phishing files, using advanced evasion techniques to bypass traditional security controls.
Iranian threat actors continue credential theft operations targeting expatriates, Syrians, and Israelis using spear-phishing and social engineering.
Attackers are leveraging Windows .scr screensaver files to deliver malware and remote management tools, exploiting the fact that these executables often evade standard controls.

Newly Discovered Vulnerabilities

Multiple critical vulnerabilities (including CVE-2026-25049) have been disclosed in the n8n workflow automation platform, allowing arbitrary system command execution and full host compromise. Public exploits are available.
A critical vulnerability in DockerDash, the AI assistant for Docker, allows remote code execution and data theft due to insufficient instruction validation in the MCP Gateway architecture.
VMware ESXi is affected by a high-severity sandbox escape vulnerability now exploited in ransomware attacks, as confirmed by CISA.
A five-year-old GitLab vulnerability is being actively exploited, prompting CISA to order urgent patching by US government agencies.
Google Looker contained vulnerabilities (dubbed LookOut) that allowed cross-tenant remote code execution and data exfiltration, putting multiple GCP environments at risk.
A fresh critical vulnerability in SolarWinds Web Help Desk is being exploited in the wild, allowing unauthenticated remote code execution.
Malicious NGINX configurations are being used to facilitate large-scale web traffic hijacking and exploitation via React2Shell, with attackers deploying cryptominers and reverse shells.
The EnCase forensic software kernel driver, though long-revoked, is being abused by attackers in an EDR killer tool to disable 59 security products.

Notable Threat Actor Activity

The Amaranth-Dragon group, linked to Chinese state-sponsored APT41, is exploiting the WinRAR CVE-2025-8088 vulnerability in espionage campaigns targeting government and law enforcement agencies across Southeast Asia.
Chinese threat actors hijacked Notepad++’s update infrastructure to distribute backdoored software.
Iranian state actors are conducting ongoing credential theft campaigns across the Middle East.
Ransomware group DragonForce is promoting a cartel model, increasing coordination among ransomware gangs.
Hackers are abusing legitimate but revoked drivers to disable endpoint detection and response (EDR) solutions.

Trends, Tools, or Tactics of Interest

AI-driven phishing attacks are increasing in sophistication, with attackers combining technical exploits and identity-based attacks to bypass email security solutions.
Leaked non-human identities, such as API keys and tokens, are becoming significant breach drivers in cloud environments, providing attackers with persistent access.
Attackers are increasingly abusing less-monitored file types (e.g., .scr screensaver files) and legitimate system features to evade detection.
Microsoft has developed a lightweight scanner for detecting backdoors in open-weight large language models (LLMs).
Microsoft is rolling out built-in Sysmon security monitoring in Windows 11 Insider builds, enhancing native endpoint visibility.
Orchid Security has introduced continuous identity observability for enterprise applications, addressing identity management beyond traditional IAM controls.
Prompt injection and data leakage risks have been identified in AI agent networks such as Moltbook.
Early incident response failures are often due to decision-making in the first moments after detection, not technical shortcomings.

Regulatory or Policy Developments Affecting the Security Industry

CISA has made unpublicized updates to its Known Exploited Vulnerabilities (KEV) catalog, highlighting ransomware operators’ focus on network edge device vulnerabilities.
CISA has mandated the patching of actively exploited legacy vulnerabilities in products such as GitLab.
Mozilla Firefox is introducing an AI feature opt-out, reflecting a trend toward increased user control over AI-driven browser functions.

Industry and Market Developments

Blockchain intelligence firm TRM Labs raised $70 million in Series C funding to expand AI-driven disruption of criminal networks.
Varonis acquired AllTrue.ai for $150 million to enhance AI trust, risk, and security management capabilities.
Orion raised $32 million for data security product development and market expansion.

Cybersecurity Brief – 2025-12-04

Thu, 04 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Cloudflare mitigated a record-breaking 29.7 Tbps distributed denial-of-service (DDoS) attack attributed to the Aisuru botnet, which leveraged up to 4 million infected hosts and launched over 1,300 attacks in three months.
Marquis Software Solutions reported a data breach impacting over 74 US banks and credit unions.
French retailer Leroy Merlin disclosed a data breach that compromised customer personal data in France.
Freedom Mobile, a major Canadian wireless carrier, suffered a breach exposing customer data after attackers accessed its customer account management platform.
The University of Phoenix and the University of Pennsylvania confirmed data breaches linked to the exploitation of vulnerable Oracle E-Business Suite instances in a campaign attributed to the Clop ransomware group.
WordPress sites using the King Addons for Elementor plugin are being actively compromised via exploitation of a critical vulnerability (CVE-2025-8489), allowing attackers to create admin accounts and take over sites.

Newly Discovered Vulnerabilities

Critical vulnerabilities in React Server Components (RSC), tracked as CVE-2025-5518 and another CVE, allow unauthenticated remote code execution; these flaws may impact more than a third of cloud service providers.
The King Addons for Elementor WordPress plugin (CVE-2025-8489, CVSS 9.8) is under active attack, enabling privilege escalation to administrative permissions.
Microsoft silently patched a high-severity Windows LNK vulnerability that has been exploited by multiple state-backed and cybercrime groups as a zero-day since 2017. The November 2025 Patch Tuesday update addressed the issue, and Windows now displays additional LNK file properties to help identify malicious code.
Three critical vulnerabilities were disclosed in Picklescan, an open-source utility for scanning PyTorch models. These flaws allow malicious PyTorch models to evade scans and execute arbitrary code.
Chrome 143 stable release addressed 13 vulnerabilities, including a high-severity flaw in the V8 JavaScript engine.

Notable Threat Actor Activity

Kaspersky identified Shai Hulud 2.0, a new version of the npm worm now equipped with wiper functionality, targeting organizations in Russia, India, Brazil, China, and other countries.
The Water Saci threat actor has evolved its banking trojan campaign in Brazil, now using a multi-layered infection chain involving HTA files, PDFs, and propagation via WhatsApp and RelayNFC for NFC relay fraud. AI-enhanced Python variants are targeting enterprise users of banks and cryptocurrency exchanges.
The MuddyWater APT (linked to Iran) targeted Israeli organizations using new evasion tactics, including techniques mimicking the retro Snake mobile game.
The ShadyPanda group, believed to be China-based, has been using malicious Chrome and Edge browser extensions to spy on millions of users globally.
A malicious Rust crate was discovered targeting Web3 developer systems across Windows, macOS, and Linux, capable of OS-specific malware delivery and stealthy execution.
DragonForce ransomware, in collaboration with the Scattered Spider group, has expanded operations in 2025, leveraging advanced social engineering and initial access techniques.
Attackers are increasingly using Evilginx to steal session cookies, enabling bypass of multi-factor authentication (MFA) protections.
There is a rise in attackers abusing legitimate Remote Monitoring and Management (RMM) tools to gain remote control of victim systems.

Trends, Tools, or Tactics of Interest

The Aisuru botnet’s scale and DDoS throughput set new records, highlighting the growing potency of botnet-driven attacks.
Matrix Push C2, a new criminal toolkit, is abusing browser push notifications to launch social engineering attacks.
Use of AI tools is fueling more sophisticated cybercrime, lowering barriers for less-skilled actors and enhancing the quality of phishing and malware campaigns.
Attackers are increasingly targeting enterprises during off-hours, weekends, and holidays, exploiting reduced staffing and slower response times.
Content Delivery Networks (CDNs) remain a primary mitigation for DDoS and aggressive bot traffic, but attackers are attempting to bypass these protections.
Fileless attack techniques and abuse of legitimate IT tools are increasingly observed, complicating detection and response for defenders.

Regulatory or Policy Developments

The Arizona Attorney General has filed a lawsuit against Chinese online retailer Temu, alleging unauthorized and undisclosed access to and harvesting of user data through its mobile application.
CISA and partners released a new joint guide focused on the secure integration of artificial intelligence in operational technology environments.
Google is expanding Android’s in-call scam protection for financial applications in the US, aiming to address rising phone-based fraud.
Russia has blocked access to the Roblox gaming platform, citing the distribution of LGBT-related content and extremist material as justification.

Cybersecurity Brief – 2025-10-09

Thu, 09 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Discord has confirmed a breach of its Zendesk support system, with threat actors claiming to have exfiltrated data on 5.5 million users, including government IDs and email addresses.
The Qilin ransomware group has claimed responsibility for an attack on Asahi brewery, leaking 27GB of data comprising contracts, employee information, and financial documents.
The Crimson Collective threat group has targeted AWS cloud environments for data theft and extortion, and is also reported to have breached the GitLab instance of Red Hat Consulting in collaboration with the Scattered Lapsus$ group.
The UK Metropolitan Police arrested two individuals in connection with a ransomware attack on a chain of London nurseries, which resulted in the doxing of children online.
Microsoft 365 services, including Teams and Exchange Online, experienced an outage, preventing user access.
DraftKings has alerted users to a credential stuffing attack leading to unauthorised access to user accounts and exposure of personal information.

Newly Discovered Vulnerabilities

A critical authentication bypass vulnerability in the Service Finder WordPress theme is under active exploitation, enabling attackers to gain administrator-level access to affected sites.
A severe vulnerability (CVE-2025-53967) in the Figma-developer-MCP Model Context Protocol server, now patched, allowed remote code execution, exposing organisations to potential agentic AI compromise.
A new variant of the FileFix social engineering attack leverages cache smuggling to covertly deliver malicious ZIP files and evade security controls.
Researchers have demonstrated a technique (“Mic-E-Mouse”) to turn computer mice into covert audio surveillance devices.
Hundreds of Oracle E-Business Suite instances remain vulnerable to a zero-day exploit that was actively targeted two months prior to the official patch release.

Notable Threat Actor Activity

LockBit, Qilin, and DragonForce ransomware groups have announced a strategic alliance to share attack resources and intelligence, forming a ransomware “cartel” and inviting other e-crime actors to join.
Suspected China-nexus threat actors are weaponising the open-source Nezha monitoring tool to deploy Gh0st RAT malware in new attack campaigns.
The BatShadow group, operating from Vietnam, is running a campaign using Vampire Bot malware to target job seekers.
Cybercriminals are exploiting compromised WordPress sites to inject malicious JavaScript for next-generation ClickFix phishing attacks.
North Korean threat actors are reported to have stolen $2 billion in cryptocurrency in 2025, contributing to over $6 billion in total thefts for the regime.

Trends, Tools, or Tactics of Interest

Increased use of artificial intelligence by both attackers and defenders is reshaping the threat landscape, with AI-powered tools being leveraged for both attack automation and defensive noise reduction.
Attackers are increasingly targeting third-party integrations (e.g., OAuth in Google Workspace) rather than core platforms.
Social engineering campaigns are evolving, including job-themed phishing targeting influencers and job seekers, and modeling scams targeting older adults on social media.
Polymorphic Python remote access trojans (RATs) and self-modifying malware are being observed in the wild.
Fake gaming pages (e.g., on itch.io) are being used to distribute malware via stealthy stagers.
Cache smuggling and other advanced evasion techniques are being adopted to bypass traditional security controls.

Regulatory or Policy Developments

Google has expanded its bug bounty programme to cover AI-specific abuse and security issues, offering up to $20,000 per submission.
Microsoft is enabling threshold-based auto-archiving by default in Exchange Online to address mailbox overflow and ensure email continuity.

Cybersecurity Brief – 2025-09-10

Wed, 10 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Plex has disclosed a data breach affecting emails, usernames, password hashes, and authentication data stored in a database. Users have been urged to reset their passwords.
Wayne Memorial Hospital suffered a breach in May 2024, with hackers stealing names, Social Security numbers, financial information, and protected health information of approximately 160,000 individuals.
Qantas reduced executive pay following a data breach earlier this year in which threat actors compromised a third-party platform and accessed customer personal information.

Newly Discovered Vulnerabilities

Adobe patched a critical vulnerability (CVE-2025-54236, also called SessionReaper) in its Commerce and Magento Open Source platforms, which allows attackers to take over customer accounts. This is described as one of the most severe flaws in the platform’s history. Adobe also released fixes for critical vulnerabilities in ColdFusion.
SAP released updates for 21 vulnerabilities, including three critical issues in NetWeaver (CVSS up to 10.0) that could enable remote code execution and privilege escalation, as well as high-severity flaws in S/4HANA.
Microsoft’s September 2025 Patch Tuesday addressed 81–86 vulnerabilities (depending on source), including two publicly disclosed zero-day flaws and numerous escalation of privilege bugs. No vulnerabilities were reported as actively exploited prior to release.
Researchers disclosed “catastrophic” vulnerabilities in the platforms operated by Restaurant Brands International (RBI) for Burger King, Tim Hortons, and Popeyes.
Microsoft released Windows 10 (KB5065429) and Windows 11 (KB5065426, KB5065431) cumulative updates, addressing security vulnerabilities and system issues.
Microsoft is investigating an anti-spam bug causing Exchange Online and Teams to mistakenly block URLs and quarantine emails.

Notable Threat Actor Activity

A TOR-based cryptojacking campaign is expanding, targeting exposed Docker APIs. Attackers mount host filesystems in new containers, fetch malicious scripts via TOR, and block Docker API access. Tooling updates suggest efforts to build a complex botnet.
A Kosovo national pleaded guilty to running BlackDB.cc, a cybercrime marketplace active since 2018.
The U.S. charged a Ukrainian national for administering the LockerGoga, MegaCortex, and Nefilim ransomware operations.
A threat actor has been identified as connected to Play, RansomHub, and DragonForce ransomware, deploying multiple malware families, backdoors, a proxy tunneller, and reconnaissance tools.
A large NPM supply chain attack involved phishing the Qix NPM account and publishing malicious versions of 18 popular open source packages, collectively receiving over 2 billion weekly downloads.

Trends, Tools, or Tactics of Interest

Axios HTTP client abuse and Salty 2FA phishing kits are being combined with Microsoft’s Direct Send feature in advanced Microsoft 365 phishing campaigns, creating highly efficient attack pipelines.
The Salty2FA phishing kit is being used at an enterprise level, with adversaries employing advanced strategy and planning.
RatOn Android malware has evolved from conducting NFC relay attacks to a sophisticated remote access trojan with Automated Transfer System (ATS) banking fraud capabilities.
Recent phishing campaigns are delivering MostereRAT, a banking malware now functioning as a remote access trojan, using a variety of evasion and delivery techniques.
Ransomware losses are increasing, with trends including triple extortion and more sophisticated social engineering, as reported in midyear insurance claims analysis.
The browser is increasingly viewed as a critical endpoint, with rising usage prompting calls for improved browser-focused security controls.
Shadow AI agents are proliferating within enterprise environments, raising risks related to detection and control.
External Attack Surface Management (EASM) is highlighted as a key approach for identifying and prioritizing remediation of unknown internet-facing assets.
Microsoft is testing new AI-powered features in Windows 11 File Explorer to improve file handling capabilities.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury imposed sanctions on networks of cyber scam operations in Southeast Asia, responsible for stealing over $10 billion from Americans in the past year. Firms in Burma and Cambodia cooperating with these cybercrime syndicates are also facing enforcement actions.
A court ordered Google to pay $425 million in a class action lawsuit for misleading users about their online privacy.
Mitsubishi Electric announced the acquisition of industrial cybersecurity firm Nozomi Networks for nearly $1 billion.
The Public Service Alliance launched a new platform offering privacy and threat monitoring tools to public servants.
Attaullah Baig, former WhatsApp security chief, filed a lawsuit against Meta, alleging retaliation over critical cybersecurity failures.

Cybersecurity Brief – 2025-07-16

Wed, 16 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Century Support Services, a Pennsylvania-based debt settlement firm, disclosed a data breach impacting 160,000 individuals after its systems were compromised in November 2024.
US department store chain Belk was targeted by the DragonForce ransomware group, which claims to have stolen over 150GB of data during a May 2025 attack.
Abacus Market, a major Western darknet drug marketplace, has gone offline in a suspected exit scam, shutting down its public infrastructure.
McDonald’s hiring platform inadvertently exposed data of approximately 64 million job applicants due to the use of default credentials.
Several companies in Italy’s Lombardy region suffered business disruption after a Romanian ransomware group known as ‘Diskstation’ attacked NAS devices. The group was dismantled by international law enforcement.

Newly Discovered Vulnerabilities

Google released a security update for Chrome version 138, patching its fifth zero-day vulnerability of 2025.
Microsoft issued emergency update KB5064489 to address an issue preventing Azure virtual machines from launching when Trusted Launch is disabled and Virtualization-Based Security is enabled.

Notable Threat Actor Activity

North Korean threat actors associated with the “Contagious Interview” campaign published 67 malicious packages to the npm registry, delivering the XORIndex malware loader to developer systems.
A state-backed group is targeting Southeast Asian government organizations with the novel HazyBeacon Windows backdoor, utilizing AWS Lambda for command-and-control and data exfiltration.
Attackers leveraged over 600 domains to distribute a trojanized Telegram Android app, stealing data from Chinese-speaking users, particularly those on older Android versions.
A new variant of the Android malware Konfety uses malformed APKs and obfuscation techniques to evade detection and analysis.
Threat actors are embedding obfuscated JavaScript in SVG files to enable browser-native redirection to malicious sites.

Trends, Tools, or Tactics of Interest

AsyncRAT, an open-source remote access trojan first released in 2019, has proliferated into a complex ecosystem of forks and variants, fueling global cybercrime and democratizing access to malware capabilities.
GLOBAL GROUP, a newly emerged ransomware-as-a-service (RaaS) operation, is expanding its activities across Australia, Brazil, Europe, and the United States, employing AI-driven negotiation tools to enhance extortion processes.
Cloudflare reported mitigation of 7.3 million DDoS attacks in Q2 2025, with hyper-volumetric attacks reaching a record 7.3 Tbps. The company noted that the total number of DDoS attacks blocked in 2025 has already exceeded the total for 2024.
Criminal networks continue to exploit insider vulnerabilities within organizations, adapting rapidly to bypass traditional security measures.
Alternate Data Streams (ADS) in NTFS are being used by keylogger malware to hide captured data, providing stealth persistence.
AI prompt attacks and the security of agentic AI systems are highlighted as emerging concerns, with risks associated with high-privilege authentication and invisible identity access in automated workflows.

Regulatory or Policy Developments Affecting the Security Industry

MITRE launched the AADAPT framework, designed to complement the ATT&CK framework, focusing on detection and response to cyberattacks targeting cryptocurrency assets and financial systems. The framework provides documentation for identifying, investigating, and mitigating weaknesses in digital asset payments.

Cybersecurity Brief – 2025-07-09

Wed, 09 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

M&S confirmed a significant ransomware attack by DragonForce, initiated via a sophisticated social engineering/impersonation attack.
Qantas experienced a data breach resulting in an extortion demand after customer data was stolen from a contact centre.
South Korean telecommunications provider SK Telecom suffered a breach exposing 27 million records; the government imposed a monetary penalty and new regulatory requirements.
Over 17,000 fake news websites were uncovered globally as part of a large-scale investment fraud campaign (“BaitTrap”).
More than 1.7 million installations of malicious Chrome extensions were identified, capable of tracking users, stealing browser activity, and redirecting to unsafe sites.
The Anatsa Android banking trojan was distributed via a fake PDF viewer app on Google Play, impacting over 90,000 users, primarily targeting US banks.
Russian organisations were targeted by a new Windows spyware dubbed Batavia, used in ongoing espionage campaigns.
A supply chain attack compromised the Ethcode Visual Studio Code extension, exposing over 6,000 developers to malicious pull requests.
The RondoDox botnet exploited vulnerabilities in TBK DVRs and Four-Faith routers to conscript devices for DDoS attacks.

Newly Discovered Vulnerabilities

Microsoft’s July 2025 Patch Tuesday addressed 130–137 vulnerabilities, including a publicly disclosed zero-day in SQL Server. Seventeen bugs are considered high risk, including multiple remote code execution vulnerabilities in Office and SharePoint.
Adobe released patches for critical code execution vulnerabilities affecting several products, including After Effects, Audition, Illustrator, and others.
SAP patched critical insecure deserialization vulnerabilities in NetWeaver, which could allow remote code execution and full system takeover.
Technical details and exploit code for CitrixBleed2 (CVE-2025-5777) in Citrix NetScaler have been released, increasing the risk of exploitation.
A new Android “TapTrap” attack was disclosed, using invisible UI tricks to bypass permission systems and trick users into granting sensitive access.

Notable Threat Actor Activity

Threat actors repurposed the legitimate Shellter red teaming tool to distribute Lumma Stealer, SectopRAT, Arechclient2, and Rhadamanthys malware, leveraging its AV/EDR evasion features.
A suspected Chinese state-sponsored hacker linked to Silk Typhoon (Hafnium) was arrested in Milan, facing charges including wire fraud and unauthorized computer access.
Russian organisations faced an ongoing campaign involving the newly identified Batavia Windows spyware.
A large-scale operation using Baiting News Sites (BNS) was uncovered, leveraging fake news for investment fraud.
RondoDox botnet activity increased, exploiting IoT device vulnerabilities for DDoS.

Trends, Tools, or Tactics of Interest

Malicious open source packages increased by 188% year-over-year, with data exfiltration as the most common malware function.
Threat actors continue to exploit legitimate security and pen-testing tools (e.g., Shellter) for malware delivery and AV/EDR evasion.
Supply chain attacks targeting development environments (e.g., VS Code extensions) remain a significant threat vector.
Identity-based attacks in the retail sector are exploiting overprivileged admin roles and neglected vendor tokens.
Agentic AI is emerging as a growing attack surface, with increased risk from invisible threats and novel vectors.
Human risk management and measurement in security awareness programs remain a focus area for evaluating organisational resilience.

Regulatory or Policy Developments Affecting the Security Industry

South Korea imposed regulatory requirements on SK Telecom following a major data breach, in addition to a monetary penalty.
SSL/TLS certificate lifespan reduction to 47 days by 2029 is prompting organisations to prepare for operational changes in certificate management.
Samsung announced major security and privacy enhancements for its upcoming One UI 8 release on Galaxy smartphones.
Microsoft clarified options for extended Windows 10 security updates through October 2026, including free alternatives with certain conditions.

Cybersecurity Brief – 2025-05-30

Fri, 30 May 2025 00:00:00 +0000

Major Incidents or Breaches

ConnectWise, the developer of ScreenConnect remote access software, disclosed a cyberattack attributed to a suspected nation-state threat actor. The breach impacted a limited number of ScreenConnect customers.
Victoria’s Secret took its website and some store services offline following a security incident. The company has engaged third-party experts to investigate.
LexisNexis Risk Solutions reported a data breach affecting over 364,000 individuals, resulting from a December 2024 incident. The breach involved third-party access to customer data, but LexisNexis systems were not directly compromised.
A Managed Service Provider’s SimpleHelp RMM tool was compromised by the DragonForce ransomware group, who exfiltrated data and deployed ransomware across customer endpoints.
SentinelOne experienced a global outage affecting 10 commercial customer consoles, including Singularity Endpoint, XDR, Cloud Security, and related services. Services have since been restored.

Newly Discovered Vulnerabilities

A new Windows Remote Access Trojan (RAT) was identified using corrupted DOS and PE headers to evade detection for weeks.
A vulnerability in Apple Safari enables fullscreen browser-in-the-middle attacks, allowing threat actors to steal account credentials.
Thousands of ASUS routers have been infected and backdoored as part of a large-scale botnet campaign, with the ORB network also affecting Linksys, D-Link, QNAP, and Araknis Network devices.
Microsoft confirmed that some Windows 11 systems may fail to start after installing the KB5058405 security update.
Mozilla released an emergency update (Firefox 139.0.1) to address graphical artifacts on NVIDIA GPUs caused by the previous release.

Notable Threat Actor Activity

Meta disrupted three coordinated influence operations originating from Iran, China, and Romania, which used fake personas to target Romania, Azerbaijan, and Taiwan.
The DragonForce ransomware group exploited flaws in SimpleHelp RMM to deploy ransomware and exfiltrate data from an MSP’s customers.
APT41 (Double Dragon), a Chinese state-sponsored group, used Google Calendar events as command-and-control infrastructure in a recent campaign.
The ‘Everest Group’ is conducting extortion attacks against global organisations by stealing data from SAP SuccessFactors HR tools, targeting entities in multiple countries.
Cybercriminals are distributing malware and ransomware, including CyberLock and Lucky_Gh0$t, via fake installers for popular AI tools such as ChatGPT and InVideo AI.
Threat actors are abusing Google Apps Script to host phishing pages, leveraging the platform’s legitimacy to evade detection.
The ‘Haozi’ gang is selling turnkey phishing-as-a-service kits via Telegram, providing infrastructure and support for low-skilled actors.
PumaBot is targeting Linux devices in a new botnet campaign, employing semi-automated tactics.

Trends, Tools, or Tactics of Interest

Scammers are exploiting uncertainty around US tariff policy to launch phishing and social engineering attacks.
Active credential harvesting phishing campaigns are targeting Capital One customers.
Attackers are increasingly mapping organisational attack surfaces using automated reconnaissance tools, mirroring defender efforts.
Cybercriminals are capitalising on AI tool popularity, using fake installers as lures to spread malware and ransomware.
Usage of the “passwd” command is being tracked in honeypots, indicating ongoing brute-force and credential access attempts.
The deprecation of Microsoft Authenticator’s password autofill feature is prompting migration to Microsoft Edge.
Zscaler’s acquisition of Red Canary highlights the growing importance of telemetry and managed detection and response (MDR) in security operations.

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury Department sanctioned Funnull Technology, a Philippines-based cloud provider, for supporting hundreds of thousands of scam websites involved in “pig butchering” and other cyber fraud schemes linked to over $200 million in losses.
US Customs and Border Protection is storing the DNA of migrant children in a criminal database managed by the FBI, raising privacy and data protection concerns.

Cybersecurity Brief – 2025-05-28

Wed, 28 May 2025 00:00:00 +0000

Major Incidents or Breaches

Adidas has disclosed a data breach following a compromise at a customer service provider, resulting in the theft of data from individuals who contacted the company’s customer service help desk. Payment or financial information was not affected.
MathWorks, the developer of MATLAB, has confirmed a ransomware attack that caused ongoing service outages. The specific ransomware group involved and whether data was exfiltrated remain unclear.
Commvault’s Metallic SaaS service has been targeted by threat actors who gained access to Microsoft 365 environments of a small number of customers, according to a CISA alert.
DragonForce ransomware successfully breached a managed service provider (MSP) and used the SimpleHelp remote monitoring and management (RMM) platform to steal data and deploy ransomware encryptors on downstream customer networks.
Apple reported it prevented over $9 billion in fraudulent transactions via the App Store over the past five years, including $2 billion in 2024, amid rising threats targeting the platform.

Newly Discovered Vulnerabilities

Microsoft has released an emergency update for Windows Server 2022 to address a known issue causing Hyper-V virtual machines to freeze or restart unexpectedly.
Misconfigured Docker API instances are being exploited by new self-spreading malware that transforms them into Dero cryptocurrency mining botnets.

Notable Threat Actor Activity

Russian threat group Void Blizzard (also known as Laundry Bear) has been linked to breaches of over 20 NGOs using Evilginx phishing via fake Microsoft Entra pages. The group has also been connected to the September 2024 Dutch police security breach.
Cybercriminals are cloning legitimate antivirus websites (specifically Bitdefender) to distribute the Venom remote access trojan (RAT) and steal cryptocurrency wallets.
The Luna Moth (Silent Ransom Group) is conducting stealth phishing campaigns, including vishing (voice phishing) attacks, to extort law firms, as highlighted in a recent FBI alert.
A novel campaign is using search engine optimization (SEO) poisoning to trick employees searching for payroll portals into payroll fraud, targeting mobile devices.
The Danabot botnet infrastructure has been seized in the US and key operators indicted, disrupting a major Russian cybercrime operation.
An Iranian national has pleaded guilty to involvement in RobbinHood ransomware attacks that targeted US cities and organisations.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly using AI-generated audio to impersonate senior US officials in phishing attacks, according to an FBI warning.
Attackers are leveraging the SimpleHelp RMM platform in supply chain ransomware attacks, specifically in the DragonForce incident.
SEO poisoning is being used to redirect employees searching for payroll portals to malicious sites, facilitating payroll diversion fraud.
Self-spreading malware targeting Docker containers is automating the creation of cryptocurrency mining botnets.
There is a trend of cybercriminals cloning legitimate software vendor websites to distribute malware such as Venom RAT.
Law enforcement and industry partnerships are achieving significant disruption of cybercrime infrastructure, as demonstrated by the Danabot takedown.

Regulatory or Policy Developments Affecting the Security Industry

The FBI has issued multiple alerts regarding evolving social engineering and extortion tactics, including the use of AI-generated media and vishing campaigns.
CISA has published an advisory on attacks targeting Commvault’s SaaS environment, urging increased vigilance for SaaS providers and their customers.

Cybersecurity Brief – 2025-05-03

Sat, 03 May 2025 00:00:00 +0000

Major Incidents and Breaches

Co-op Data Theft Confirmed: Co-op has verified that significant data was stolen in a recent cyberattack, following claims by the DragonForce ransomware group. The breach impacts a substantial number of current and former customers.
Magento Supply Chain Attack: Between 500 and 1,000 e-commerce stores, including a $40 billion multinational, were compromised through 21 backdoored Magento extensions in a widespread supply chain attack.
UK Retail Sector Under Attack: Multiple major British retailers, including Harrods, have been targeted by likely ransomware attacks in recent weeks. The UK NCSC has characterised these incidents as a “wake-up call” for the sector, urging improved cyber resilience.
Ransomware Surge in Food and Agriculture: Ransomware attacks targeting the food and agriculture sector have doubled in 2025, with the increase attributed largely to Clop’s exploitation of a popular file-sharing service.

Notable Threat Actor Activity

DragonForce Ransomware: Claimed responsibility for the Co-op breach, confirming ongoing ransomware activity against UK retailers.
Black Kingdom Ransomware: US authorities indicted a Yemeni national believed to be the developer and main operator behind Black Kingdom, which conducted approximately 1,500 attacks on Microsoft Exchange servers.
Scattered Spider: Despite recent law enforcement arrests, the group continues to conduct high-profile cyberattacks, underscoring its resilience and operational capability.
MintsLoader and GhostWeaver: The MintsLoader malware loader is being used to deliver the PowerShell-based remote access trojan GhostWeaver via phishing campaigns. The attacks leverage domain generation algorithms (DGA) and TLS encryption for stealth.

Newly Discovered Vulnerabilities and Exploits

Magento Extensions Backdoors: The compromised Magento extensions represent a significant supply chain vulnerability, affecting hundreds of e-commerce sites.
Developer Secrets Targeting: Threat actors are increasingly scanning for exposed secrets in configuration and repository files, highlighting the ongoing risk of credential leakage in software development pipelines.

Trends, Tools, and Tactics

Passwordless Authentication: Microsoft has made all new accounts passwordless by default, aiming to reduce risks from phishing, brute-force, and credential-stuffing attacks.
Automated Vulnerability Response: The Tines platform is promoting community-driven, pre-built workflows to automate CVE and vulnerability advisory responses, supporting more rapid and consistent remediation.
Stealth Malware Delivery: Recent campaigns (e.g., MintsLoader/GhostWeaver) demonstrate advanced use of multi-stage infection chains, obfuscation, DGA, and TLS for evasion.
Retail Sector Targeting: The ongoing wave of ransomware and cyberattacks against UK retailers signals a trend of increased targeting of the retail sector, likely due to its data-rich environment and operational impact.

Regulatory and Policy Developments

TikTok Fined for GDPR Breach: The Irish Data Protection Commission fined TikTok €530 million ($601 million) for illegally transferring personal data of EEA users to China, in violation of GDPR. This is among the largest fines issued under GDPR, reinforcing regulatory scrutiny of cross-border data transfers.
NCSC Advanced Cryptography Guidance: The UK NCSC has published a white paper on “Advanced Cryptography,” defining and providing guidance on cryptographic techniques for processing encrypted data and enhancing privacy and security.
US Regulatory Actions: The US Treasury is moving to cut off Huione Group, which is accused of laundering funds from North Korean cybercrime and investment scams. Separately, new security rules from the New York Department of Financial Services require finance firms to implement stronger protections against unauthorised access to information systems.

Other Industry Notes

Microsoft Exchange Online Issue Resolved: Microsoft fixed a bug in Exchange Online that was incorrectly flagging Gmail emails as spam due to a machine learning model error.
Privacy Concerns with Consumer Devices: Ongoing media coverage highlights persistent privacy risks associated with smart TVs and streaming devices collecting user data.

Cybersecurity Brief – 2025-04-24

Thu, 24 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Blue Shield of California Data Breach: The health data of 4.7 million members was exposed to Google’s analytics and ad platforms due to a misconfiguration, affecting sensitive personal and medical information. Additional healthcare sector breaches have been reported to regulators, indicating a concerning trend.
National Labor Relations Board (NLRB) Data Exfiltration: A whistleblower alleges that significant volumes of sensitive agency data were siphoned by individuals associated with the Department of Government Efficiency (DOGE).
Marks & Spencer Cyber Incident: Marks & Spencer is investigating a cyber incident that has impacted some customer operations.
FBI Cybercrime Losses: The FBI reported $16.6 billion in cybercrime-related losses in 2024, a 33% increase year-over-year, marking the highest annual losses recorded.

Newly Discovered Vulnerabilities

ASUS Server Vulnerability (CVE-2024-54085): ASUS released patches for a critical AMI bug that could allow attackers to hijack and potentially brick servers.
Kubernetes Permissions Risk: Research highlights that Kubernetes pods are often provisioned with excessive permissions, increasing risk of lateral movement and privilege escalation.

Notable Threat Actor Activity

Lazarus Group (North Korea): Operation SyncHole is a new campaign using watering hole attacks to exploit vulnerabilities in South Korean software, targeting specific user groups.
DPRK Crypto Theft: North Korean threat actors stole $137 million from TRON blockchain users in a single-day phishing attack, reflecting ongoing targeting of Web3 and cryptocurrency sectors.
North Korean Deepfakes in Recruitment: North Korean operatives are using deepfake technology to impersonate IT job candidates and infiltrate Western organisations.
Iran-Linked UNC2428: Deployed MURKYTOUR backdoor via fake job-themed social engineering campaigns targeting Israeli entities.
Russian State-Linked Activity:
- Microsoft OAuth Abuse: Russian actors are exploiting Microsoft OAuth to target Ukraine allies and human rights organisations, aiming for unauthorised Microsoft 365 access via messaging apps like Signal and WhatsApp.
- Android Malware Targeting Russian Military: New spyware-laden versions of the Alpine Quest mapping app are being distributed to Russian military personnel, likely for intelligence gathering.
Asian Organised Crime: ‘Industrial-scale’ scam centres in Asia are expanding globally, blending cybercrime with financial fraud and traditional organised crime tactics.
Japan Credential Theft: Attackers are using phishing sites mimicking securities firms to steal credentials and conduct unauthorised stock trades.

Trends, Tools, and Tactics

Ransomware Evolution:
- Ransomware remains the dominant threat for SMBs, responsible for over 90% of incident response cases for medium businesses and 70% for small businesses in 2024.
- Groups such as DragonForce and Anubis are innovating with new affiliate business models and ransomware-as-a-service offerings to scale operations and profits.
Phishing Tactics:
- Phishing detection is increasingly ineffective, with attacks often evading traditional filters, proxies, and even MFA, making each incident akin to a zero-day.
- Attackers are shifting towards identity-based phishing rather than exploiting software vulnerabilities.
- Browser-based, real-time detection is emerging as a more effective countermeasure.
- Employee awareness training, particularly phishing simulations, is widely recognised (90% approval in surveys) as improving security posture.
Privacy and Security Enhancements:
- WhatsApp introduced Advanced Chat Privacy, preventing chat exports and auto-downloads to better protect sensitive conversations.
AI Security: Research proposes using hypervisors to isolate and regulate the behaviour of potentially malicious AI systems in critical sectors.

Regulatory and Policy Developments

FTC on AI Regulation: The US Federal Trade Commission signals a cautious approach, aiming to avoid excessive regulation that could hinder AI innovation.
CISA Energy Sector Collaboration: CISA, DHS S&T, INL, and LSU are working with the energy industry to bolster incident response and operational technology (OT) cybersecurity.
Cloudflare Internet Shutdown Trends: Government-imposed internet shutdowns dropped to zero in Q1 2025, indicating a shift in government tactics for information control.

Industry Developments

Microsoft Security Culture: Microsoft reports ongoing efforts to prioritise and embed security within its corporate culture, including linking security to employee performance reviews.