Everest on DanSec Daily

Cybersecurity Brief – 2026-07-23

Thu, 23 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Upbound Group reported a cyberattack in which threat actors leveraged stolen data to create $13 million in fraudulent Acima leases, indicating significant financial impact and data misuse^[13].
South Korea disclosed a breach of the National Diplomatic Academy’s online education system, resulting in the theft of personal information of current and former Ministry of Foreign Affairs employees and diplomats worldwide over a ten-month period^[14].
Swiss rail manufacturer Stadler Rail confirmed a ransomware attack. The Everest ransomware gang demanded a $12.3 million ransom after breaching a data exchange platform shared with a supplier^[15].
Tens of millions of accounts were affected in breaches at Suno and Paidwork, with hackers leaking names, email addresses, phone numbers, passwords, and financial information^[32]^[42].
Chick-fil-A loyalty accounts were hijacked through the use of stolen passwords, exposing users to account compromise and potential fraud^[41].
A ransomware attack on a Japanese frozen-food supply chain company disrupted the supply of frozen food to thousands of clients, including major franchises^[23].

Newly Discovered Vulnerabilities

Check Point patched a critical vulnerability in its SmartConsole admin panel that allowed attackers full administrative access. The flaw was actively exploited as a zero-day in the wild^[4]^[12].
Researchers disclosed a local privilege escalation vulnerability in Ubuntu’s snap-confine, which could allow unprivileged users to gain root access on default desktop installs^[6].
A high-severity vulnerability (CVE-2026-29059) in the open-source Windmill developer platform is under active exploitation, allowing unauthenticated attackers to read arbitrary server files^[8].
The Adobe Acrobat Chrome extension, installed on over 314 million devices, contained a now-patched vulnerability chain that allowed malicious sites to access and exfiltrate WhatsApp Web data, including messages and contacts^[7]^[18]^[34].
A fourth SharePoint vulnerability (CVE-2026-50522) was reported as exploited in recent attacks, enabling threat actors to steal machine keys and maintain long-term access^[38].
Oracle released a quarterly security update addressing over 1,400 vulnerabilities across its product suite^[40].

Notable Threat Actor Activity

The Everest ransomware gang was responsible for the cyberattack and ransom demand against Stadler Rail^[15].
Iranian hackers are actively targeting Siemens, Schneider Electric, and Rockwell ICS devices, with updated US federal advisories detailing their techniques for compromising programmable logic controllers^[31].
A Brazilian banking trojan is actively spreading in Portugal, leveraging the shared Portuguese language to target local businesses^[22].
Advanced threat actors are exploiting AI toolchains, as demonstrated by the Sandworm_Mode malware that leverages trusted AI tools and workflows to blend malicious activity with legitimate operations^[24].
Threat actors are using “phantom squatting” to manipulate AI-generated outputs, causing AI tools to direct users to phishing sites^[1].
A malicious Android app disguised as a Bahrain alert application is delivering multi-stage spyware during periods of heightened civilian fear, exploiting fake Google Play sites^[25].

Trends, Tools, or Tactics of Interest

The ARToken phishing kit, built on the EvilTokens platform, has been identified as a sophisticated phishing-as-a-service tool automating business email compromise (BEC) attacks through targeted social engineering and credential theft^[2].
Attackers are increasingly leveraging AI hallucinations and trusted AI workflows to facilitate phishing and evade detection, with examples such as phantom squatting and Sandworm_Mode malware^[1]^[24].
AI-generated applications (notably those coded with Vibe) are being found to contain numerous exploitable vulnerabilities, including denial-of-service, authorization, and secrets exposure risks^[37].
Enterprise adoption of generative AI is amplifying ransomware risk by inheriting excessive permissions or compromised identities, highlighting the importance of identity controls and governance^[16].
There is a trend of data leakage from EU and US financial institutions via tracking pixels and cookie trackers, inadvertently transmitting customer data to ad platforms and raising compliance and privacy concerns^[27].
A new infrastructure cybersecurity knowledge base, InfraTrust, and its Pulse report have been launched to help organizations prioritize patching of infrastructure vulnerabilities^[17].

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated urgent patching of an actively exploited remote code execution vulnerability in the Langflow visual framework for US government agencies^[19].
Microsoft has announced it will cease providing security updates for Exchange 2016 and 2019 through the Extended Security Update program in October 2026^[21].
GitHub will reduce public bug bounty payouts by at least half at every severity level, moving top rewards to a VIP tier starting July 27, 2026^[5].

Sources

Upbound says hack caused $13 million in fraudulent Acima leases - bleepingcomputer.com
South Korea discloses data breach impacting diplomats worldwide - bleepingcomputer.com
Swiss rail giant Stadler rejects $12.3M ransom demand after cyberattack - bleepingcomputer.com
Suno, Paidwork Data Breaches Affect Tens of Millions of Accounts - securityweek.com
Paidwork breach exposes data of 23 million users: Check if you’re affected - malwarebytes.com
Chick-fil-A loyalty accounts hijacked using stolen passwords - malwarebytes.com
Ransomware Attack Puts a Chill On Japanese Frozen-Food Chain - darkreading.com
Check Point Patches Exploited SmartConsole Flaw Allowing Full Admin Access - thehackernews.com
Check Point warns of SmartConsole zero-day exploited in attacks - bleepingcomputer.com
Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs - thehackernews.com
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication - thehackernews.com
Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data - thehackernews.com
Adobe Chrome extension flaw let sites access private WhatsApp chats - bleepingcomputer.com
Flaw in Adobe Extension With 300M Installs Enabled WhatsApp Data Theft - securityweek.com
Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks - securityweek.com
Oracle Patches Over 1,400 Vulnerabilities With Quarterly Security Updates - securityweek.com
US Warns of Iranian Hackers Targeting Siemens, Schneider, and Rockwell ICS Devices - securityweek.com
Brazilian Banking Trojan Actively Spreading in Portugal - darkreading.com
Attackers Are Learning to Live Off the AI Toolchain - darkreading.com
Attackers Exploit AI Hallucinations to Send Users to Phishing Sites - blog.knowbe4.com
Fake Bahrain Alert App Deploys Android Surveillance Malware - darkreading.com
Warning: ARToken Phishing Kit Automates BEC Attacks - blog.knowbe4.com
Vibe-Coded Apps Riddled With Exploitable Security Flaws - securityweek.com
How enterprise GenAI can amplify ransomware risk — and how to contain it - bleepingcomputer.com
EU Financial Institutions Leak Data Through Cookie Trackers - darkreading.com
New InfraTrust report reveals infrastructure flaws admins should patch first - bleepingcomputer.com
CISA orders urgent action on actively exploited Langflow RCE flaw - bleepingcomputer.com
Microsoft to stop Exchange 2016 / 2019 security updates in October - bleepingcomputer.com
GitHub Cuts Public Bug Bounty Payouts, Moves Top Rewards to VIP Tier - thehackernews.com

Cybersecurity Brief – 2026-02-24

Tue, 24 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Optimizely, a New York-based ad tech company, confirmed a data breach following a voice phishing (vishing) attack that led to unauthorised access to customer data.
Vanta Diagnostics (formerly Vikor Scientific), a US healthcare diagnostics firm, reported a data breach affecting 140,000 individuals, attributed to the Everest ransomware group.
The University of Mississippi Medical Center was forced to close all clinics and cancel elective procedures following a ransomware attack.
PayPal disclosed that an application error led to a data breach, exposing customer personal information for nearly six months and resulting in fraudulent transactions.
France’s Ministry of Economy disclosed a data breach, as noted in Check Point Research’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

Two recently patched vulnerabilities in RoundCube Webmail are being actively exploited in the wild, including an XSS flaw via animate tags in SVG documents.
Researchers identified multiple security vulnerabilities in Android mental health apps with a combined 14.7 million installs, potentially exposing sensitive medical information.
Microsoft is investigating a bug in the classic Outlook desktop client that causes the mouse pointer to disappear for some users.
Supply chain attacks continue to be observed in the npm ecosystem, with at least 19 malicious npm packages actively harvesting cryptocurrency keys, CI secrets, and API tokens.
Researchers reported ongoing malware campaigns using malicious JPEG files with embedded payloads to deliver MSI installers.

Notable Threat Actor Activity

APT28 (Russia-linked) has been attributed to a new campaign targeting Western and Central European entities using webhook-based macro malware.
The Iranian state-sponsored group MuddyWater deployed new malware strains in attacks against organizations in the Middle East and Africa.
The Everest ransomware group claimed responsibility for the Vanta Diagnostics breach.
A Russian-speaking hacker used generative AI to compromise over 600 FortiGate firewalls, targeting credentials and backups for potential ransomware operations.
Autonomous AI agents have been leveraged in a new class of supply chain attack targeting crypto wallets.
The Shai-Hulud-like npm supply chain campaign is actively spreading through malicious packages.
Spanish authorities arrested four alleged members of the Anonymous Fenix hacktivist group for DDoS attacks against government and political websites.
A Romanian hacker pleaded guilty to selling access to a US state government network.
Oleksandr Didenko, a Ukrainian national, was sentenced in the US for selling stolen identities to North Korean IT workers for use on freelance platforms.

Trends, Tools, or Tactics of Interest

There is a surge in ATM jackpotting attacks, with losses exceeding $20 million in 2025; attackers continue to use longstanding tools and tactics.
Cryptojacking campaigns are deploying bespoke XMRig miners using pirated software bundles, leveraging BYOVD (Bring Your Own Vulnerable Driver) exploits and time-based logic bombs for lateral movement.
Threat actors are increasingly using AI, including generative AI, to automate and scale attacks against exposed infrastructure, such as FortiGate firewalls.
Supply chain attacks remain prevalent, with npm and Docker ecosystems being active targets for malware distribution and credential harvesting.
Exposed endpoints and internal APIs in LLM (Large Language Model) infrastructure present new attack surfaces for organizations adopting AI technologies.
Ongoing campaigns use vishing (voice phishing) and deepfake audio to compromise organisations, as highlighted by the Optimizely breach and industry analysis of AI-generated voice threats.
Attackers are exploiting the persistent reuse of trust via stolen tokens and compromised devices, bypassing traditional identity-based security controls.
Malicious actors are using typosquatting (e.g., fake Huorong security site) to distribute remote access trojans such as ValleyRAT.

Regulatory or Policy Developments Affecting the Security Industry

CISA has ordered US federal agencies to patch actively exploited RoundCube Webmail vulnerabilities within three weeks.
The arrest of hacktivists and cybercriminals in Spain, the US, and Romania demonstrates ongoing law enforcement efforts targeting cybercrime and hacktivism.

Cybersecurity Brief – 2025-11-04

Tue, 04 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers stole over $120 million from the Balancer DeFi crypto protocol by targeting its v2 pools.
A major breach at the Kansas City, Kansas, Police Department exposed a list of alleged officer misconduct, including dishonesty, sexual harassment, excessive force, and false arrests.
Everest ransomware group claimed responsibility for recent attacks, according to Check Point’s latest threat intelligence report.

Newly Discovered Vulnerabilities

XWiki (CVE-2025-24893): Exploit attempts have been observed against XWiki’s SolrSearch component, which allows arbitrary remote code execution. A patch was released in February.
Google Chrome: Two high-severity vulnerabilities in the V8 JavaScript engine (type confusion and inappropriate implementation) were disclosed, with Google awarding $100,000 in bug bounties.
Microsoft WSUS: An out-of-band update to patch an actively exploited Windows Server Update Service vulnerability has disabled hotpatching on some Windows Server 2025 systems.

Notable Threat Actor Activity

Lazarus Group targeted Web3 entities, using advanced tools and rapid exploitation of new vulnerabilities.
North Korea-linked Kimsuky group deployed a new backdoor, HttpTroy, disguised as a VPN invoice in a likely spear-phishing attack in South Korea.
Chinese APTs used new ‘Airstalk’ malware (PowerShell and .NET variants) in supply chain attacks, abusing AirWatch’s MDM API for C2 communication.
Cybercriminals are increasingly targeting logistics and freight networks by deploying remote monitoring and management (RMM) tools to hijack cargo and steal physical shipments.
Three former US cybersecurity professionals were indicted for conducting BlackCat (ALPHV) ransomware attacks against five US companies.
Ukrainian national Yuriy Igorevich Rybtsov (aka MrICQ) was extradited to the US to face charges related to the Jabber Zeus cybercrime operation.

Trends, Tools, or Tactics of Interest

AI Poisoning: New research indicates attackers can more easily poison AI models by introducing malicious data, increasing the risk of models producing harmful outputs.
Abuse of AI APIs: Microsoft identified the ‘SesameOp’ backdoor, which uses the OpenAI Assistants API as a covert C2 channel. Additionally, Claude AI APIs can be abused for data exfiltration via prompt injection.
Malicious VSCode Extensions: The ‘SleepyDuck’ remote access trojan was found in a fake Solidity extension on the Open VSX registry, using an Ethereum smart contract for C2.
Android Malware: BankBot-YNRK and DeliveryRAT trojans are actively stealing financial data from Android users, with BankBot-YNRK reportedly muting device alerts and draining cryptocurrency wallets, primarily targeting Indonesia.
TruffleNet Attack: Attackers use frameworks based on TruffleHog to leverage stolen credentials for AWS account compromise, leading to reconnaissance and business email compromise (BEC).
Device Code Phishing: Attackers are exploiting OAuth device flows, with significant differences in attack surfaces between Azure and Google.
Fake AI Apps: There is an increase in fake ChatGPT and AI-related apps in app stores, some containing adware or spyware.
SOC Operations: Security Operations Centers are increasingly overwhelmed by alert volumes, leading to a shift toward continuous exposure management and automation.
Generative AI in Malware Analysis: Generative AI is being used to accelerate reverse engineering of malware such as XLoader.

Regulatory or Policy Developments

OpenAI Safety Panel: A panel led by Zico Kolter at OpenAI now has the authority to halt the release of new AI systems if deemed unsafe.
Electrical Grid Security: Regulators and industry experts are advocating for the convergence of cyber and physical security strategies for the power grid, reflecting increased attack activity on critical infrastructure.

Cybersecurity Brief – 2025-10-25

Sat, 25 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Toys ‘R’ Us Canada experienced a data breach resulting in customer information, including names, addresses, phone numbers, and email addresses, being leaked and published on the dark web.
A major AWS outage occurred this week due to a significant DNS failure, impacting multiple websites and online services.
A large-scale malicious network on YouTube has been identified, with over 3,000 videos used as malware delivery traps, leveraging trusted platforms for distribution.
Multiple fraudulent domains and fake applications have targeted users of the newly launched Perplexity Comet browser.
LastPass customers are being targeted by a phishing campaign involving fake death claims to illicitly access password vaults via legacy inheritance processes.

Newly Discovered Vulnerabilities

Microsoft released out-of-band patches for a critical Windows Server Update Services (WSUS) vulnerability (CVE-2025-59287). This flaw allows remote, unauthenticated code execution and is under active exploitation, with public proof-of-concept exploit code available.
WordPress websites using outdated GutenKit and Hunk Companion plugins are being targeted in a mass exploitation campaign, with attackers leveraging old, critical vulnerabilities to achieve remote code execution.

Notable Threat Actor Activity

The Smishing Triad group has been linked to over 194,000 malicious domains used in a global smishing campaign since January 2024, targeting a wide range of services.
APT36, a Pakistan-linked threat actor, has been observed targeting Indian government entities using spear-phishing emails to deliver Golang-based DeskRAT malware.
North Korean Lazarus Group has targeted European drone technology companies using fake job offers in order to steal sensitive information.
The Everest group has claimed responsibility for a cyberattack on Collins Aerospace.
Gamers are being targeted with red teaming tools and remote access trojans (RATs) in ongoing campaigns.

Trends, Tools, or Tactics of Interest

Phishing campaigns are increasingly impersonating trusted brands and services, including Google Careers recruiters and LastPass, to target job seekers and password management users.
Large-scale abuse of trusted platforms such as YouTube is being used for widespread malware distribution.
Attackers are rapidly exploiting newly disclosed vulnerabilities, particularly in widely used software such as Microsoft WSUS and WordPress plugins.
There is a reported increase in cyberattacks against financially constrained US government agencies during periods of shutdown and resource reduction.
Microsoft has disabled downloaded file previews in Windows to prevent NTLM hash leaks via HTML tags referencing external paths.
Shadow Escape and other red teaming tools are being used in active campaigns targeting specific user groups, including gamers.

Regulatory or Policy Developments Affecting the Security Industry

Mozilla will require, starting next month, that Firefox extension developers disclose whether their add-ons collect or share user data with third parties.
CISA layoffs in the US are reducing federal cybersecurity resources, prompting calls for enterprises to strengthen their own cyber defences.
The US Department of Homeland Security is soliciting proposals for AI-powered surveillance trucks to enhance border monitoring capabilities.

Cybersecurity Brief – 2025-05-30

Fri, 30 May 2025 00:00:00 +0000

Major Incidents or Breaches

ConnectWise, the developer of ScreenConnect remote access software, disclosed a cyberattack attributed to a suspected nation-state threat actor. The breach impacted a limited number of ScreenConnect customers.
Victoria’s Secret took its website and some store services offline following a security incident. The company has engaged third-party experts to investigate.
LexisNexis Risk Solutions reported a data breach affecting over 364,000 individuals, resulting from a December 2024 incident. The breach involved third-party access to customer data, but LexisNexis systems were not directly compromised.
A Managed Service Provider’s SimpleHelp RMM tool was compromised by the DragonForce ransomware group, who exfiltrated data and deployed ransomware across customer endpoints.
SentinelOne experienced a global outage affecting 10 commercial customer consoles, including Singularity Endpoint, XDR, Cloud Security, and related services. Services have since been restored.

Newly Discovered Vulnerabilities

A new Windows Remote Access Trojan (RAT) was identified using corrupted DOS and PE headers to evade detection for weeks.
A vulnerability in Apple Safari enables fullscreen browser-in-the-middle attacks, allowing threat actors to steal account credentials.
Thousands of ASUS routers have been infected and backdoored as part of a large-scale botnet campaign, with the ORB network also affecting Linksys, D-Link, QNAP, and Araknis Network devices.
Microsoft confirmed that some Windows 11 systems may fail to start after installing the KB5058405 security update.
Mozilla released an emergency update (Firefox 139.0.1) to address graphical artifacts on NVIDIA GPUs caused by the previous release.

Notable Threat Actor Activity

Meta disrupted three coordinated influence operations originating from Iran, China, and Romania, which used fake personas to target Romania, Azerbaijan, and Taiwan.
The DragonForce ransomware group exploited flaws in SimpleHelp RMM to deploy ransomware and exfiltrate data from an MSP’s customers.
APT41 (Double Dragon), a Chinese state-sponsored group, used Google Calendar events as command-and-control infrastructure in a recent campaign.
The ‘Everest Group’ is conducting extortion attacks against global organisations by stealing data from SAP SuccessFactors HR tools, targeting entities in multiple countries.
Cybercriminals are distributing malware and ransomware, including CyberLock and Lucky_Gh0$t, via fake installers for popular AI tools such as ChatGPT and InVideo AI.
Threat actors are abusing Google Apps Script to host phishing pages, leveraging the platform’s legitimacy to evade detection.
The ‘Haozi’ gang is selling turnkey phishing-as-a-service kits via Telegram, providing infrastructure and support for low-skilled actors.
PumaBot is targeting Linux devices in a new botnet campaign, employing semi-automated tactics.

Trends, Tools, or Tactics of Interest

Scammers are exploiting uncertainty around US tariff policy to launch phishing and social engineering attacks.
Active credential harvesting phishing campaigns are targeting Capital One customers.
Attackers are increasingly mapping organisational attack surfaces using automated reconnaissance tools, mirroring defender efforts.
Cybercriminals are capitalising on AI tool popularity, using fake installers as lures to spread malware and ransomware.
Usage of the “passwd” command is being tracked in honeypots, indicating ongoing brute-force and credential access attempts.
The deprecation of Microsoft Authenticator’s password autofill feature is prompting migration to Microsoft Edge.
Zscaler’s acquisition of Red Canary highlights the growing importance of telemetry and managed detection and response (MDR) in security operations.

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury Department sanctioned Funnull Technology, a Philippines-based cloud provider, for supporting hundreds of thousands of scam websites involved in “pig butchering” and other cyber fraud schemes linked to over $200 million in losses.
US Customs and Border Protection is storing the DNA of migrant children in a criminal database managed by the FBI, raising privacy and data protection concerns.

Cybersecurity Brief – 2025-04-08

Tue, 08 Apr 2025 00:00:00 +0000

Major Incidents and Attacks

Attackers are distributing a miner and the ClipBanker Trojan via SourceForge, using unconventional persistence techniques.
Researchers discovered a surge in SMS phishing (smishing) attacks driven by a phishing-as-a-service (PhaaS) platform named ‘Lucid.’

Newly Discovered Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical security flaw impacting CrushFTP to its Known Exploited Vulnerabilities (KEV) catalog.
Google released patches for 62 vulnerabilities, including two actively exploited zero-days in Android devices.

Impacts on the Cybersecurity Industry

The dark web leak site of the Everest ransomware gang was hacked and is now offline, affecting the ransomware group’s operations.
Nine malicious VSCode extensions on Microsoft’s Visual Studio Code Marketplace were found infecting users with cryptominers.
WK Kellogg Co disclosed a data breach linked to Clop ransomware attacks, warning employees and vendors about stolen company data.

Regulatory and Policy Developments

NIST is implementing a ‘Deferred’ status for dated vulnerabilities to prioritize CVEs in the National Vulnerability Database (NVD).
EU officials are preparing to ’ease the burden’ of the GDPR data privacy law for small and medium businesses while ensuring data privacy rules still function effectively.

Notable Incidents in Aviation Sector

The Computer Emergency Response Team of Ukraine (CERT-UA) revealed cyber attacks targeting Ukrainian institutions with information-stealing malware, impacting military entities.

Overall, the cybersecurity landscape is witnessing a rise in sophisticated attacks, exploitation of vulnerabilities, and regulatory efforts to enhance security standards, with specific incidents targeting various sectors like gaming, ransomware, and phishing-as-a-service platforms.