EncryptHub on DanSec Daily

Cybersecurity Brief – 2025-08-16

Sat, 16 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Colt Technology Services, a UK-based telecommunications provider, experienced a cyberattack attributed to the WarLock ransomware group. The incident resulted in a multi-day outage affecting hosting and porting services, with stolen data now being offered for sale.
Italian hotels suffered a breach in which tens of thousands of scanned guest IDs were stolen and subsequently listed for sale on underground forums, according to CERT-AGID.
Web infrastructure entities in Taiwan were compromised by the Chinese-speaking APT group UAT-7237. The attackers used customized open-source tools to establish persistent access.
National Public Data, a service previously involved in a significant Social Security Number leak, has resumed operations under new ownership, raising concerns about the continued exposure and handling of leaked personal data.
The Canadian House of Commons was reportedly hacked, and the Pennsylvania Attorney General was targeted in a cyberattack. Russia was identified as being behind a separate attack on a court system.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical remote code execution vulnerability in the RADIUS subsystem of its Secure Firewall Management Center (FMC) software. The flaw is rated maximum severity.
Plex issued an urgent advisory for users to patch a recently discovered security vulnerability affecting its media servers.
Rockwell Automation released advisories for critical and high-severity vulnerabilities in its FactoryTalk, Micro800, and ControlLogix products.
A critical vulnerability was identified and patched in Zoom, details of which are referenced in industry news roundups.

Notable Threat Actor Activity

The Russian threat group EncryptHub continues to exploit a now-patched Microsoft Windows vulnerability (MSC EvilTwin) to deliver the Fickle Stealer malware.
WarLock ransomware claimed responsibility for the attack on Colt Technology Services and is selling exfiltrated data.
UAT-7237, a Chinese-speaking APT, targeted Taiwanese web servers with customized open-source hacking tools for long-term persistence.
Cybercriminals are leveraging sophisticated phishing kits to target brokerage account holders in a “ramp and dump” cashout scheme, converting stolen card data into mobile wallets.

Trends, Tools, or Tactics of Interest

Tech support scammers are targeting high-profile employees and influencers with fake podcast invitations as part of a new social engineering tactic, as reported by the Better Business Bureau.
There is an observed resurgence in traditional postal mail-based scams, with criminals exploiting physical mail systems to steal money.
Organizations are increasingly adopting AI-driven cybersecurity solutions to address staffing shortages and budget constraints.
Cybercriminals are shifting tactics to target brokerage accounts using mobile phishing and advanced cashout schemes.
The use of customized open-source tools by APT actors, such as UAT-7237, highlights a trend toward tailored toolsets for persistent access.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) renewed sanctions against the Russian cryptocurrency exchange Garantex and imposed new sanctions on Grinex, its successor, for facilitating ransomware-linked illicit crypto transactions exceeding $100 million.
Microsoft reiterated that Windows 10 support will end in October 2025, affecting all editions of version 22H2.
Google announced that Android pKVM has achieved SESIP Level 5 certification, denoting resistance to highly skilled and well-funded attackers.

Cybersecurity Brief – 2025-07-25

Fri, 25 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Law enforcement has seized the dark web extortion sites of the BlackSuit ransomware operation, which has breached hundreds of organizations globally.
Toptal’s GitHub organization account was compromised, with attackers publishing ten malicious npm packages to the npm registry.
Security flaws in Airportr, a luggage service used by 10 airlines, exposed user data and allowed attackers to potentially redirect or steal luggage.
A threat actor named EncryptHub compromised an early access Steam game to distribute info-stealing malware to users.
CastleLoader malware has infected 469 devices by leveraging fake GitHub repositories and phishing techniques (ClickFix) to deliver info-stealers and remote access trojans.
Multiple npm developer accounts were compromised in a phishing campaign, resulting in malware being injected into popular npm packages.

Newly Discovered Vulnerabilities

Microsoft SharePoint: Five vulnerabilities collectively known as ToolShell were detailed, including a POST request exploit that can bypass initial patches. Over 400 SharePoint servers, including US government systems, have been targeted.
Mitel MiVoice MX-ONE: A critical authentication bypass vulnerability has been disclosed and patched, allowing attackers to gain full access to affected systems.
Sophos Firewall and SonicWall SMA 100 Series: Critical remote code execution vulnerabilities have been patched. SonicWall specifically urges immediate updates due to recent malware attacks exploiting these flaws.
Airportr: Web security bugs exposed sensitive user data and allowed privilege escalation.
AI-generated image watermarks have been found to be easily removable, undermining some anti-misinformation controls.

Notable Threat Actor Activity

Storm-2603, a China-based threat actor, is actively exploiting SharePoint ToolShell vulnerabilities to deploy Warlock ransomware in ongoing campaigns.
Fire Ant, a threat actor, is targeting VMware ESXi hosts and vCenter environments in a prolonged cyber espionage campaign.
China-nexus APTs have deployed fake Dalai Lama apps to spy on the Tibetan community in multi-stage attacks.
BlackSuit ransomware infrastructure was disrupted by law enforcement following a global campaign of breaches.
High-value npm developer accounts have been targeted in phishing campaigns to distribute malicious packages.
Koske, a new Linux malware, is using steganography-hiding malicious payloads in panda JPEG images-and may have been developed with AI.

Trends, Tools, or Tactics of Interest

Ransomware groups are increasingly exploiting SharePoint ToolShell vulnerabilities, with a focus on unpatched systems.
CastleLoader demonstrates the use of fake GitHub repositories and phishing as initial infection vectors for malware distribution.
New malware delivery methods include steganography (Koske) and compromised software supply chains (npm, Steam games).
The evilreplay tool enables real-time browser session hijacking via XSS without the need for cookie theft, providing interactive post-exploitation control.
Offensive security is shifting towards continuous, proactive testing rather than annual penetration tests.
Law enforcement actions are increasing against cybercrime forums (e.g., XSS) and ransomware operations.

Regulatory or Policy Developments Affecting the Security Industry

The UK has implemented mandatory age verification for adult content access, raising privacy and security concerns about the collection and management of personal data.
New York is seeking public input on proposed cyber regulations for water systems, including incident reporting, response plans, and compliance certification.
Clorox has filed a $380 million lawsuit against Cognizant over a 2023 hack, alleging that IT provider actions enabled the breach.

Cybersecurity Brief – 2025-07-21

Mon, 21 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Over 75 company servers have been breached via active, large-scale exploitation of a critical Microsoft SharePoint zero-day vulnerability (CVE-2025-53770, CVSS 9.8). At least 85 organisations are confirmed affected, with exploitation ongoing since at least July 18th.
Over 3,500 websites have been compromised to host stealth JavaScript-based cryptocurrency miners using advanced obfuscation and WebSocket communication to evade detection.
Five npm packages were injected with malware following a phishing campaign that resulted in the theft of maintainer tokens, constituting a significant software supply chain attack.

Newly Discovered Vulnerabilities

Microsoft SharePoint is affected by two zero-day remote code execution vulnerabilities (CVE-2025-53770 and CVE-2025-53771), both actively exploited in the wild. Emergency patches have been released for some flaws, but at least one remains unpatched. Microsoft recommends applying mitigations and commencing threat hunting.
CrushFTP has a critical vulnerability (CVE-2025-54309, CVSS 9.0) under active exploitation, allowing attackers to gain administrative access on unpatched servers.
Hewlett-Packard Enterprise (HPE) Aruba Instant On Access Points contain hardcoded credentials, enabling attackers to bypass authentication and access the web interface. Security updates have been released to address the issue.

Notable Threat Actor Activity

The PoisonSeed threat group is bypassing FIDO key protections by exploiting QR code phishing and abusing cross-device sign-in features to deceive users into approving malicious authentication requests.
EncryptHub (aka LARVA-208/Water Gamayun) is targeting Web3 developers with phishing campaigns using fake AI platforms to distribute the Fickle Stealer information-stealing malware.

Trends, Tools, or Tactics of Interest

Attackers are reviving browser-based cryptojacking, compromising thousands of sites with stealthy JavaScript miners that leverage WebSockets for covert communication.
A new toolkit, CredMaster, facilitates anonymous password spraying attacks by routing traffic through AWS proxies with rotating IPs to evade detection and throttling.
Supply chain attacks on open-source repositories continue, with phishing campaigns targeting package maintainers to steal credentials and inject malicious code.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has issued emergency security guidance and patches for SharePoint zero-days, urging organisations to apply mitigations and conduct compromise assessments due to ongoing exploitation.