Cybersecurity Brief – 2025-04-29

Tue, 29 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Ransomware Attack
- Marks & Spencer experienced significant operational disruption, including outages and warehouse worker furloughs, due to a ransomware attack attributed to the “Scattered Spider” group.
Hitachi Vantara Ransomware Incident
- Hitachi Vantara took servers offline to contain an Akira ransomware attack, impacting business operations.
VeriSource Data Breach
- Employee benefits firm VeriSource confirmed that a February breach exposed personal information of 4 million individuals.
Urban One Data Breach
- Urban One, a major media company, disclosed a data breach following claims by a ransomware group.
World Uyghur Congress Targeted by Malware
- Senior members of the World Uyghur Congress were targeted in a sophisticated malware campaign via a trojanized UyghurEdit++ tool, indicating ongoing cyber-espionage efforts against exiled Uyghur groups.

Newly Discovered and Actively Exploited Vulnerabilities

SAP NetWeaver Visual Composer (CVE-2025-31324)
- Over 1,200 internet-facing SAP NetWeaver servers remain vulnerable to an actively exploited unauthenticated file upload flaw, allowing server hijacking. Attacks began before SAP released a patch.
Craft CMS Zero-Day Flaws
- Two newly disclosed critical vulnerabilities in Craft CMS are being exploited in the wild, with hundreds of servers likely compromised.
Broadcom Brocade Fabric OS and Commvault Web Server
- CISA added high-severity vulnerabilities in Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) database, indicating active exploitation.
Pymatgen 2024.1 Remote Code Execution
- A high-risk remote code execution vulnerability has been disclosed in Pymatgen 2024.1.
WooCommerce Phishing Campaign
- Attackers are distributing fake security patches to WooCommerce users, installing backdoors under the guise of critical updates.

Notable Threat Actor Activity

Earth Kurma APT
- Newly identified APT group “Earth Kurma” has targeted government and telecom sectors in Southeast Asia since June 2023, using rootkits and cloud-based data theft tools.
Scattered Spider
- Linked to the ransomware attack on Marks & Spencer, demonstrating continued targeting of UK-based large enterprises.
AI-Powered Phishing and Commodity Tools
- Increased use of AI-powered phishing kits and automated attack tools is lowering the barrier to entry for less skilled threat actors.

Trends, Tools, and Tactics

AI and Automation in Threat Landscape
- Attackers are leveraging AI, automation, and dark web resources to accelerate attack sophistication and frequency.
Record DDoS Attack Volumes
- Cloudflare reported a 358% year-over-year increase in DDoS attacks, highlighting a surge in volumetric and application-layer attacks.
Supply Chain and Update Risks
- Kali Linux users were warned of update failures due to a lost repository signing key, underscoring the importance of secure software supply chains.
Surveillance Risks in Connected Vehicles
- Law enforcement agencies are increasingly exploiting data from internet-connected vehicle features for surveillance purposes.

Regulatory and Policy Developments

CISA KEV Updates
- The U.S. CISA’s addition of new vulnerabilities to its KEV database may prompt UK organisations to review their own exposure and patch management processes.
US DoJ Data Security Program
- New compliance rules from the US Department of Justice will require organisations to reassess data sharing practices, with potential implications for multinational firms operating in or with the US.
Windscribe Legal Precedent
- Windscribe VPN was acquitted on charges regarding user data collection, reinforcing the legal standing of privacy-first service providers.

Other Notable Developments

Operational Disruptions
- Ukrainian state and banking services were temporarily disrupted due to a data centre power outage, affecting government and corporate customers.
Security Tooling
- Malwarebytes highlighted as a tool for combating online scams, reflecting ongoing emphasis on endpoint protection and anti-fraud solutions.

Summary of Key Risks

Ransomware remains a significant threat to large enterprises, with notable UK impact.
Actively exploited vulnerabilities in widely used enterprise software (SAP, Craft CMS, Broadcom, Commvault) require urgent attention.
AI-driven attack automation and phishing are reshaping the threat landscape, enabling more actors to launch sophisticated campaigns.
Regulatory changes and legal rulings are influencing data security and privacy practices globally.

Cybersecurity Brief – 2025-04-28

Mon, 28 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

M&S Cyberattack: Marks & Spencer (M&S), a major UK retailer, experienced a cyberattack that disrupted warehouse operations, resulting in approximately 20% of logistics workers being told not to report to work. The incident highlights ongoing threats to supply chain and logistics infrastructure.
Ukrainian Service Outage: A Ukrainian cloud provider restored state and banking services following a data centre power outage that impacted government agencies and major companies.
WooCommerce Phishing Campaign: A large-scale phishing campaign is targeting WooCommerce users with fake security alerts, tricking them into installing backdoors under the guise of a “critical patch.”
Craft CMS Zero-Day Exploits: Attackers are actively exploiting two newly disclosed critical vulnerabilities in Craft CMS, compromising hundreds of servers to gain unauthorized access.
SAP NetWeaver Exploitation: Over 1,200 internet-facing SAP NetWeaver servers remain vulnerable to a maximum severity, unauthenticated file upload flaw that is being actively exploited to hijack servers.

Notable Threat Actor Activity

Earth Kurma APT Campaign: A newly identified APT group, Earth Kurma, has been conducting sophisticated attacks against government and telecommunications sectors in Southeast Asia since June 2023. Tactics include rootkit deployment and cloud-based data theft tools.
Uyghur Cyber-Espionage: Researchers identified a highly targeted spearphishing campaign deploying custom malware against senior members of the exiled World Uyghur Congress, indicative of ongoing cyber-espionage activities against dissident groups.
Iran Infrastructure Attack Claims: Iranian officials reported repelling “widespread and complex” cyberattacks targeting national infrastructure, though details remain unspecified.

Newly Discovered Vulnerabilities

Craft CMS: Two critical, newly disclosed vulnerabilities are being exploited in the wild in Craft CMS installations, enabling attackers to breach servers.
SAP NetWeaver: An unauthenticated file upload vulnerability (maximum severity) is under active exploitation, affecting over 1,200 exposed SAP NetWeaver instances.
Vulnerability Chaining: Analysis of five real-world vulnerabilities demonstrates that even lower-risk flaws can be chained or escalated by advanced threat actors to achieve significant breaches.

Trends, Tools, and Tactics

AI-Powered Phishing & Automation: Attackers are increasingly leveraging AI-driven phishing kits and automation, lowering the technical barrier to launching sophisticated attacks and exploiting commodity tools and credentials available on the dark web.
DDoS Attack Surge: Cloudflare reported a record number of DDoS attacks in 2024, with a 358% year-over-year increase, reflecting a significant escalation in volumetric and application-layer attack activity.
Forensic Tooling: Release of DataSurgeon, an open-source Linux tool for fast data extraction and transformation, enhances forensic investigation capabilities.
SRUM-DUMP v3: Updated forensic tools like SRUM-DUMP v3 are being used to uncover malware activity through advanced system resource usage monitoring.
Security Tooling: Ongoing development of anti-scam and anti-phishing features in security products such as Malwarebytes to counter evolving online fraud methods.

Regulatory and Policy Developments

US DoJ Data Security Program: The US Department of Justice announced new compliance rules for its Data Security Program, requiring organisations to reassess data sharing practices and business relationships.
Connected Vehicle Surveillance Risks: Reports indicate increased law enforcement interest in exploiting data generated by internet-connected vehicle features, raising privacy and surveillance concerns.

Operational and Platform Updates

Kali Linux Repository Signing Key: Offensive Security warned Kali Linux users to manually update their repository signing key to prevent update failures, following the loss of the previous key.
Microsoft Outlook & SharePoint Online: Microsoft is addressing ongoing issues with Outlook on the web and SharePoint Online, where users have experienced search delays and failures.
Coinbase 2FA Log Bug: Coinbase resolved an error in its 2FA activity logs that caused users to mistakenly believe their accounts had been compromised.

Earth Kurma on DanSec Daily

Cybersecurity Brief – 2025-04-29

Major Incidents and Breaches

Newly Discovered and Actively Exploited Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, and Tactics

Regulatory and Policy Developments

Other Notable Developments

Summary of Key Risks

Cybersecurity Brief – 2025-04-28

Major Incidents and Breaches

Notable Threat Actor Activity

Newly Discovered Vulnerabilities

Trends, Tools, and Tactics

Regulatory and Policy Developments

Operational and Platform Updates