Cybersecurity Brief – 2025-04-23

Wed, 23 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack: The UK retailer confirmed a cyberattack affecting operations, including delayed Click and Collect orders. The company implemented temporary operational changes and is responding to the incident.
DeepSeek Breach: An AI-focused organisation suffered a significant breach, with sensitive data appearing on dark web forums, highlighting ongoing risks to AI platforms.
SK Telecom Data Exposure: South Korea’s largest mobile operator disclosed a malware attack that exposed sensitive USIM-related customer data.
Healthcare Ransomware Attacks: Three additional healthcare organisations-DaVita, Bell Ambulance, and Alabama Ophthalmology Associates-were impacted by ransomware, continuing the trend of targeting healthcare.
Baltimore Public Schools Data Breach: A February ransomware attack resulted in the theft of personal information belonging to thousands of students, teachers, and administrators.
City of Abilene Cyberattack: The Texas municipality went offline following a cyberattack, with incident response and investigation ongoing.

Newly Discovered Vulnerabilities

GCP Cloud Composer Privilege Escalation: A now-patched vulnerability in Google Cloud Platform’s Cloud Composer could have allowed attackers to escalate privileges via malicious PyPI packages.
Active! Mail RCE Zero-Day: A remote code execution vulnerability in Active! Mail is being actively exploited in attacks against large Japanese organisations.
Ripple’s xrpl.js Library Compromised: The widely used Ripple cryptocurrency JavaScript library “xrpl.js” was compromised, enabling theft of XRP wallet seeds and private keys.
Cookie-Bite Attack PoC: A proof-of-concept demonstrates how a malicious Chrome extension can steal Azure Entra ID session tokens, bypassing MFA and maintaining access to Microsoft 365 services.
Docker Malware Targeting Teneo Web3 Node: A new malware campaign exploits Docker environments using a previously undocumented technique to mine cryptocurrency by faking heartbeat signals.

Notable Threat Actor Activity

Russian Organisations Targeted by Sophisticated Backdoor: A new backdoor, disguised as secure networking software updates, is being used to target Russian entities.
China-Linked Billbug Group: The Billbug APT (aka Lotus Panda/Blossom, Bronze Elgin) breached multiple organisations in a Southeast Asian country, continuing its targeting of government and telecom sectors.
Russia-Linked Phishing on NGOs: Russian threat actors are conducting phishing campaigns against NGOs connected to Ukraine, using video call lures to compromise Microsoft 365 accounts.
Russian Sabotage Against Dutch Critical Infrastructure: Dutch intelligence reported Kremlin-backed attempts to sabotage critical infrastructure, underlining ongoing state-sponsored cyber risk.
Elusive Comet Hacking Group: This group is exploiting Zoom’s remote control feature in social engineering attacks to steal cryptocurrency from users.

Trends, Tools, and Tactics

Increasing Abuse of AI in Cybercrime: Threat actors are leveraging AI tools to assist in social engineering, phishing, and scam campaigns, as highlighted in Microsoft’s latest Cyber Signals report.
Phishing via Google Sites and DKIM Replay: Sophisticated phishing attacks are abusing Google Sites and DKIM replay to send signed emails that redirect to credential harvesting pages.
Browser Security Concerns: The browser is increasingly the primary endpoint in cloud-native workplaces, yet remains largely unmonitored, presenting a growing attack surface.
Microsoft Secure Future Initiative: In response to the Storm-0558 breach, Microsoft has migrated MSA signing services to Azure confidential VMs and is purging millions of legacy cloud tenants, as part of broader security enhancements.
Android and Chrome Security Updates: Android will introduce auto-reboot after three days of inactivity, and Chrome is dropping third-party cookie prompts while adding IP protection in Incognito mode.
Sensitive Content Protection: Google Messages is rolling out a feature to warn users about potentially explicit images and allow easy blocking, improving user safety.

Regulatory and Policy Developments

Zambia’s New Cyber Laws: Recently signed cyber security and cyber crime acts in Zambia have raised concerns among international observers regarding increased surveillance and potential suppression of dissent.

Other Notable Observations

Edge Vulnerabilities and SMB Threats: Verizon’s report notes a surge in edge-related vulnerabilities, persistent ransomware threats, and ongoing challenges for small and medium businesses (SMBs).
Legal Debates on Device Search Protections: Ongoing discussions about the comparative legal protections of biometrics vs. passcodes for device searches, relevant for privacy and compliance considerations.

Cybersecurity Brief – 2025-04-22

Tue, 22 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

NLRB Data Exfiltration by DOGE: A whistleblower alleges that employees from Elon Musk’s Department of Government Efficiency (DOGE) siphoned gigabytes of sensitive case data from the US National Labor Relations Board (NLRB).
City of Abilene Cyberattack: The city of Abilene, Texas, took systems offline following a detected cyber incident.
Japan Brokerage Account Breaches: Japanese regulators issued an urgent warning after hundreds of millions of dollars in unauthorized trades were made from hacked brokerage accounts.
Microsoft Entra Account Lockouts: Microsoft confirmed that recent Entra account lockouts were caused by a mishap involving the logging of short-lived user refresh tokens.
‘Fog’ Ransomware Campaign: The ‘Fog’ ransomware group, known for trolling victims with DOGE-themed ransom notes, has compromised over 100 victims since January.
WordPress Ad Fraud Operation ‘Scallywag’: A large-scale ad fraud operation using malicious WordPress plugins generated approximately 1.4 billion fraudulent ad requests daily, primarily monetizing pirating and URL shortening sites.

Newly Discovered Vulnerabilities

ASUS AiCloud Router Vulnerability: ASUS urged immediate patching of a critical 9.2 CVSS-rated vulnerability in its AiCloud router series, exploitable via crafted requests.
BlueKeep RDP Exploitation by Kimsuky: North Korean threat actor Kimsuky is actively exploiting the BlueKeep (CVE-2019-0708) RDP vulnerability, despite it being patched, to breach systems in South Korea and Japan.

Notable Threat Actor Activity

Lumma Stealer Distribution: Security researchers detailed the distribution channels of Lumma Stealer, observed in recent incident response cases, including its use of fake CAPTCHA attacks.
Lotus Panda Espionage: The China-linked Lotus Panda group conducted a campaign targeting Southeast Asian government entities, deploying browser stealers and sideloaded malware.
Kimsuky Campaigns: Kimsuky continues to leverage legacy vulnerabilities (BlueKeep) for initial access, targeting East Asian organisations.
SuperCard X Android Malware: A new malware-as-a-service (MaaS) platform, SuperCard X, enables cybercriminals to conduct NFC relay attacks for contactless ATM and PoS fraud.
‘Elusive Comet’ Social Engineering: This threat actor uses sophisticated social engineering via Zoom to deliver infostealers or RATs to victims.
SVG-based Phishing: Attackers are increasingly embedding HTML or JavaScript code within SVG email attachments to bypass detection and deliver phishing payloads.

Trends, Tools, and Tactics

Professionalisation of Southeast Asian Cyber Fraud: Organised cybercrime groups in Southeast Asia are expanding globally and deepening ties with other regional networks, despite ongoing crackdowns.
Nation-State Focus on SMBs: Nation-state actors are increasingly targeting small and medium-sized businesses, especially those in the supply chain for larger enterprises.
Ad Fraud via WordPress Plugins: Malicious plugins are being used at scale to automate ad fraud, highlighting ongoing abuse of open-source platforms.
Device Management Limitations: Industry commentary stresses that device management alone does not equate to device trust, as initial access often exploits credentials and unmanaged devices.
Ongoing Malicious Advertising: Despite advances in detection, malicious ad URLs remain prevalent, underscoring persistent gaps in web security and user awareness.
YARA Rule Automation: Tools like xorsearch.py are being used to generate ad hoc YARA rules from regex patterns for more efficient malware hunting.

Regulatory and Policy Developments

Japanese Regulatory Response: Japanese authorities are responding to major financial account breaches with urgent warnings and likely increased scrutiny of brokerage cybersecurity.
CISA Leadership Changes: Two senior officials, Bob Lord and Lauren Zabierek, have resigned from the US Cybersecurity and Infrastructure Security Agency (CISA), potentially impacting ongoing federal cybersecurity initiatives.

Emerging Security Concerns

AI and Privacy Risks: Demonstrations show that AI tools like ChatGPT can extract location data from photos without embedded metadata, raising privacy and OSINT concerns.
AI in Public Safety: Motorola Solutions is deploying AI-enabled body cameras for first responders, highlighting the growing integration of AI in law enforcement technology and associated security considerations.

Elusive Comet on DanSec Daily

Cybersecurity Brief – 2025-04-23

Major Incidents and Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, and Tactics

Regulatory and Policy Developments

Other Notable Observations

Cybersecurity Brief – 2025-04-22

Major Incidents and Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, and Tactics

Regulatory and Policy Developments

Emerging Security Concerns