Gamaredon on DanSec Daily

Cybersecurity Brief – 2026-06-30

Tue, 30 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Nissan disclosed a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft vulnerability. This incident is linked to broader attacks involving the ShinyHunters group and the exploitation of a critical Oracle zero-day (CVE-2026-46817) ^[13]^[14]^[20]^[37].
The National Association of Insurance Commissioners (NAIC) confirmed a breach resulting from the same Oracle PeopleSoft vulnerability, with the ShinyHunters group claiming to have stolen 3.1 TB of data. NAIC stated that only publicly available data, outdated logs, and configuration files were taken ^[14]^[37].
Hackers are actively exploiting a critical authentication bypass vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a new cross-platform infostealer targeting Windows, macOS, and Linux systems. The malware focuses on stealing credentials, including those related to cloud and AI environments ^[19]^[23].
Over 236,000 websites built with the DCloud Uni-App framework are being abused for crypto scams, phishing, and wallet-draining attacks, leveraging legitimate development tools to host malicious content ^[10].
Microsoft has removed more than 100 malicious Edge browser extensions that were delivering malware via images, after being advertised as useful tools ^[43].

Newly Discovered Vulnerabilities

Apple released patches for over 30 vulnerabilities across iOS, macOS, and Safari, including four WebKit flaws discovered using artificial intelligence techniques ^[4].
A critical vulnerability (CVE-2026-46817, CVSS 9.8) in Oracle E-Business Suite is under active exploitation, enabling attackers to compromise affected systems ^[5]^[20].
Researchers disclosed a critical vulnerability in SimpleHelp (CVE-2026-48558) that allows authentication bypass and is being used to deploy malware in the wild ^[19]^[23].
The “DirtyClone” Linux kernel vulnerability, a variant of DirtyFrag, was revealed to allow unprivileged local users to manipulate the page cache and gain root privileges ^[38].
Multiple vulnerabilities were reported in Daktronics controllers, exposing highway signs and billboards to remote hacking. CISA has issued an advisory regarding these flaws ^[33].
A flaw in the Amazon Q VS Extension could allow attackers to execute arbitrary code and steal cloud credentials by planting malicious repositories ^[27].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service group has been observed deploying new ransomware variants and evolving its tactics, including the use of custom backdoors ^[1].
Mustang Panda, a China-aligned espionage group, is running two campaigns targeting Indian government and hydropower entities, using Zoho WorkDrive as a command-and-control channel and deploying new malware ^[8].
The Russian APT group Gamaredon continues to expand its attacks against Ukraine, updating its malware arsenal and abusing cloud services ^[12].
The ShinyHunters extortion group is linked to recent Oracle PeopleSoft breaches affecting organizations such as Nissan and NAIC ^[13]^[14]^[37].
Nation-state actors from Iran, Russia, and China have been targeting water systems for sabotage by exploiting weak passwords, exposed PLCs, and poor network segmentation ^[26].
The US Department of State has offered a $10 million reward for information on Russian-linked UNC5792 and UNC4221 hacker groups, which have targeted WhatsApp and Signal users, as well as US government and allied personnel ^[17]^[40].

Trends, Tools, or Tactics of Interest

Threat actors are increasingly abusing legitimate cloud services (such as Zoho WorkDrive) and open-source frameworks (such as DCloud Uni-App) for command and control or hosting malicious content ^[8]^[10].
Infostealer malware, such as Djinn Stealer, is being deployed via exploitation of newly disclosed vulnerabilities and is targeting credentials across cloud and AI services ^[19]^[23].
Malicious browser extensions remain a significant threat vector, with both Chrome and Edge extensions being used to log user activity or deliver malware ^[6]^[43].
Researchers demonstrated that indirect prompts embedded in code repositories can trigger AI coding assistants like Claude Code to execute malicious actions, such as spawning a reverse shell on a developer’s machine ^[35].
Business email compromise attacks are increasingly relying on convincing impersonation rather than malware, making detection by traditional security tools more difficult ^[21].
AI agents and agentic AI systems present new identity and access management challenges, as attackers seek to compromise their privileged identities to access enterprise resources ^[18]^[36].

Regulatory or Policy Developments Affecting the Security Industry

WhatsApp has begun rolling out a username feature globally, allowing users to hide their phone numbers and add an optional username key as a secondary credential for increased privacy ^[7]^[15]^[34].
Microsoft has extended Windows Server 2022 hotpatching support until October 2027, one year past its mainstream end date ^[16].
OpenAI and Anthropic are restricting access to new AI models to select customers during a cybersecurity review at the request of US authorities ^[39].
Google has warned that proposed EU pro-competition regulations could create privacy and security risks by requiring the opening of search and Android systems ^[29].
The US Justice Department seized nearly 400 domains used for illegal streaming of FIFA World Cup matches, disrupting illicit content distribution networks ^[22].
The US Department of State has issued a $10 million bounty for information on Russian state hackers targeting messaging app users and government personnel ^[17]^[40].

Sources

Nissan discloses employee data breach linked to Oracle zero-day attacks - bleepingcomputer.com
NAIC says public data stolen in ShinyHunters' PeopleSoft breach - bleepingcomputer.com
Hackers now exploit critical Oracle E-Business flaw in attacks - bleepingcomputer.com
Insurance Regulators Group NAIC Hit in Oracle PeopleSoft Hack - securityweek.com
Critical SimpleHelp flaw exploited to deploy new stealer malware - bleepingcomputer.com
'Djinn' Stealer Targets Cloud, AI Credentials - darkreading.com
236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers - thehackernews.com
119 Edge extensions promised useful tools, instead downloaded malware - malwarebytes.com
Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs - thehackernews.com
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild - thehackernews.com
‘DirtyClone’ Linux Kernel Vulnerability Leads to Root Access - securityweek.com
New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking - securityweek.com
Amazon Q VS Extension Flaw Leads to Cloud Credential Theft - darkreading.com
The Gentlemen are knocking: сustom backdoors and evolving tactics - securelist.com
Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks - thehackernews.com
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse - thehackernews.com
Iran, Russia, China Target Water Systems for Sabotage - darkreading.com
U.S. offers $10 million for hackers targeting WhatsApp, Signal users - bleepingcomputer.com
US Offers $10 Million Bounty for Russian State Hackers as Messaging App Attacks Evolve - securityweek.com
Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input - thehackernews.com
Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines - securityweek.com
Webinar: Why business email compromise attacks keep succeeding - bleepingcomputer.com
Agentic AI Has an Identity Problem and Attackers Know It - bleepingcomputer.com
Straiker Raises $64 Million for AI Security Platform - securityweek.com
WhatsApp is Finally Getting Usernames to Help Keep Phone Numbers Private - thehackernews.com
WhatsApp rolls out usernames to help users hide their phone number - bleepingcomputer.com
WhatsApp Rolling Out Username Feature to Bolster Phone Number Privacy - securityweek.com
Microsoft extends Windows Server 2022 hotpatching until October 2027 - bleepingcomputer.com
OpenAI and Anthropic Limit New AI Models to Trump-Approved Customers During Cybersecurity Review - securityweek.com
Top Google Security Staff Warn Search Data Could Be Hacked if EU Rules Change - wired.com
US seizes hundreds of FIFA World Cup illegal streaming domains - bleepingcomputer.com

Cybersecurity Brief – 2026-06-26

Fri, 26 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Personal data belonging to politicians, military leaders, and executives was left publicly accessible due to a security misconfiguration at an elite networking organization, leading to a data breach affecting high-profile individuals ^[40].
Authorities in Poland arrested four members of a cybercrime group accused of breaching telecommunications partners and hijacking email accounts to conduct SIM-swapping attacks, resulting in millions in cryptocurrency theft ^[13].

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2026-12569) in PTC Windchill enabling remote code execution has been exploited in the wild and added to CISA’s Known Exploited Vulnerabilities catalog ^[28].
A server-side request forgery (SSRF) flaw in Cisco Unified Communications Manager (CUCM) and Unified CM SME, which can escalate privileges to root, was weaponized by attackers less than 24 hours after disclosure ^[21].
A vulnerability in Lantronix Serial-to-IP converters (CVE-2025-67038), disclosed in April, has been exploited following OT threat warnings ^[33].
Chrome patched 18 vulnerabilities, including four critical flaws, two of which are WebGL bugs that could allow sandbox escape ^[38].
GitLab CE/EE released updates addressing 13 vulnerabilities, including three rated high severity that could lead to code execution or information disclosure ^[34].
The open-source curl tool patched 18 vulnerabilities, including a 25-year-old flaw, though all were rated medium or low severity ^[35].
A popular Chrome ad blocker extension for YouTube, with over 10 million installs, was found to have dormant script injection capability that could allow arbitrary JavaScript execution ^[7].

Notable Threat Actor Activity

The Russian state-sponsored threat actor Turla has deployed a previously undocumented .NET backdoor named STOCKSTAY in espionage attacks targeting government and military organizations in Ukraine ^[6].
The Gamaredon APT group has upgraded its toolset, increasing its use of legitimate online services for command and control and data exfiltration, and is forming new alliances to enhance operational security ^[5]^[22].
A new backdoor named Mistic, linked to the KongTuke group, has been used in financially motivated attacks targeting sectors including insurance, education, IT, and professional services ^[11].
Iranian hacker group Handala claimed responsibility for a cyberattack on California Water Service, but investigation found no evidence of OT system compromise ^[32].

Trends, Tools, or Tactics of Interest

Sophisticated phishing kits are increasingly targeting device code authentication flows to breach accounts without requiring passwords ^[2].
The Bluekit phishing-as-a-service platform has adopted browser-in-the-middle techniques for login theft and expanded its infrastructure with nearly 70 new hostnames in the past week ^[18].
Threat actors are abusing the Shop order-tracking app by inserting fake purchase receipts into users’ histories to launch callback phishing attacks ^[14].
New macOS malware named Gaslight uses prompt injection payloads and embeds fake errors specifically designed to confuse AI-assisted malware analysis tools ^[10]^[16].
There is a rise in attacks against SMBs involving fake AI tools, phishing, and the sale of stolen data on the dark web ^[1].
Ransomware operators are increasingly targeting EU organizations and their suppliers, making Europe the primary region of interest after a global lull ^[25].
EdTech attackers are shifting focus from direct attacks on schools to targeting their software suppliers, increasing supply chain risk ^[23].
Parcel mule scams are spreading via fake job offers, tricking victims into handling stolen goods ^[37].
Fake domain renewal emails and websites are being used to deceive website owners into paying scammers ^[39].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has extended its free Windows 10 Extended Security Updates (ESU) program for consumers by one year, allowing continued receipt of security updates until October 2027 ^[15].
The new enterprise-ready Model Context Protocol (MCP) specification shifts security responsibilities from the protocol itself to developers and platform operators, introducing new security challenges ^[29].
A WIRED investigation highlighted reliability issues with a UK police predictive analytics system built as part of the adoption of AI in law enforcement ^[26].

Sources

Elite network says it was hacked after members’ personal data was left exposed - malwarebytes.com
Poland busts SIM-swapping gang tied to millions in crypto theft - bleepingcomputer.com
First-Ever Exploitation of PTC Windchill Vulnerability Discovered in the Wild - securityweek.com
In Less Than 24 Hours, Attackers Weaponize Cisco CUCM Flaw - darkreading.com
Lantronix Serial-to-IP Converter Flaw Exploited in Attacks After OT Threat Warning - securityweek.com
Update Chrome to patch critical browser security flaws - malwarebytes.com
GitLab Patches Code Execution, Information Disclosure Vulnerabilities - securityweek.com
25-Year-Old Vulnerability Patched in Curl - securityweek.com
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability - thehackernews.com
Google Details Turla's New STOCKSTAY Backdoor Used in Ukraine Espionage Attacks - thehackernews.com
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances - welivesecurity.com
Russian APT 'Gamaredon' Upgrades Its Arsenal, Requiring New Defenses - darkreading.com
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns - thehackernews.com
Cal Water Says No OT Systems Breached in Iranian Handala Cyberattack - securityweek.com
Report: Device Code Phishing is Surging - blog.knowbe4.com
Bluekit phishing kit adopts browser-in-the-middle for login theft - bleepingcomputer.com
Order-tracking app Shop abused to push callback phishing attacks - bleepingcomputer.com
New Gaslight macOS Malware Uses Prompt Injection to Disrupt AI-Assisted Analysis - thehackernews.com
New macOS malware embeds fake errors to confuse AI analysis tools - bleepingcomputer.com
Inside the 2026 SMB threat landscape: From phishing and scams to fake AI tools - securelist.com
Europe Evolves Into Ransomware's Favorite Region - darkreading.com
EdTech Attackers Shift From Schools to Their Software Suppliers - darkreading.com
Beware of “Parcel Expert” job offers: They’re parcel mule scams - malwarebytes.com
Fake domain renewal emails trick website owners into paying scammers - malwarebytes.com
Microsoft quietly extends free Windows 10 ESU support to October 2027 - bleepingcomputer.com
New Enterprise-Ready MCP Specification Brings New Security Challenges - securityweek.com
British Police Built a Sprawling Crime-Prediction Machine. Some Results Couldn’t Be Trusted - wired.com

Cybersecurity Brief – 2026-06-03

Wed, 03 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

A large-scale malware campaign named WeedHack has infected over 116,000 Minecraft systems since January, targeting users via YouTube links to malware capable of system takeover. The campaign leverages malware-as-a-service infrastructure and has also facilitated the spread of cryptocurrency miners and other payloads through pirated content^[3]^[14].
Multiple Instagram accounts were hijacked after attackers exploited Meta’s AI-powered support tools, convincing them to reassign account ownership by linking accounts to attacker-controlled email addresses^[17]^[33].
23andMe is facing a lawsuit alleging that the genetic information of nearly seven million users was exposed following the compromise of user credentials^[36].
A supply chain attack targeted 32 Red Hat NPM packages, with 96 malicious package versions published. The packages were injected with a credential-stealing worm similar to Mini Shai-Hulud^[34].

Newly Discovered Vulnerabilities

Google’s June 2026 Android update patched 124 vulnerabilities, including a high-severity zero-day (CVE-2025-48595) in the Framework component that has been exploited in targeted attacks^[4]^[20]^[28].
A critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki WordPress plugin is being actively exploited to hijack admin accounts^[13].
Oracle WebLogic Server vulnerability CVE-2024-21182, which allows unauthenticated remote code execution, is being actively exploited in the wild and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog^[6]^[19]^[32].
A stack-based buffer overflow vulnerability in HP VoIP phones enables remote code execution and could facilitate enterprise network breaches^[31].
A zero-day vulnerability in Visual Studio Code allows attackers to steal GitHub authentication tokens via one-click social engineering attacks^[10].
A development misconfiguration in Microsoft Android apps exposed billions of installations to the risk of unauthorized access to Microsoft account tokens^[27].

Notable Threat Actor Activity

The Russian APT group Gamaredon continues to exploit a WinRAR vulnerability to deliver GammaWorm and GammaSteel malware families, focusing on data theft and propagation in Ukraine^[5].
Malware dubbed Argamal RAT is being distributed via trojanized hentai games, providing attackers with full control over infected machines^[1].

Trends, Tools, or Tactics of Interest

AI-driven exploitation is significantly accelerating the time from vulnerability disclosure to weaponization, with attackers leveraging AI to automate malware development and exploit creation^[7]^[26]^[30].
An AI-built ransomware toolkit has emerged, automating Active Directory discovery and evasion of endpoint detection and response (EDR) solutions^[15].
Attackers are abusing AI-powered support tools, such as Meta’s, to bypass traditional account recovery processes and hijack high-profile social media accounts^[17]^[33].
Scammers are using convincing fake copyright takedown notices with spoofed Google sign-in screens to steal credentials from Chrome developers^[35].
There is an increased emphasis on browser security as a critical frontline for defending against AI-powered attacks and shadow AI adoption^[18].

Regulatory or Policy Developments Affecting the Security Industry

The US President has signed an executive order establishing a framework for the federal government to vet the national security risks of advanced AI models before their public release^[25].
CISA has ordered federal agencies to patch the actively exploited Oracle WebLogic vulnerability (CVE-2024-21182)^[19].
CISA has urged stronger security controls for automatic tank gauge systems in critical infrastructure^[24].

Sources

Weedhack Attacks Minecraft Users, CountLoader Hits 86K, Miners Spread via Pirated Content - thehackernews.com
Over 116,000 Minecraft systems infected in WeedHack malware campaign - bleepingcomputer.com
Instagram users locked out after Meta AI abused to steal accounts - bleepingcomputer.com
Meta AI Hands Over High-Profile Instagram Accounts to Hackers - securityweek.com
23andMe exposed genetic information of millions, lawsuit says - malwarebytes.com
Supply Chain Attack Hits 32 Red Hat NPM Packages - securityweek.com
Google June 2026 Android Update Patches 124 Flaws, One Actively Exploited - thehackernews.com
Google fixes one actively exploited Android zero-day, 124 flaws - bleepingcomputer.com
Android Update Patches Exploited Zero-Day, 123 Other Vulnerabilities - securityweek.com
Critical Kirki flaw exploited to hijack WordPress admin accounts - bleepingcomputer.com
Oracle WebLogic CVE-2024-21182 Added to KEV Catalog After Active Exploitation - thehackernews.com
CISA flags two-year-old Oracle flaw as actively exploited in attacks - bleepingcomputer.com
Oracle WebLogic Vulnerability Exploited in the Wild - securityweek.com
Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches - securityweek.com
VS Code zero-day lets hackers steal GitHub tokens in one click - bleepingcomputer.com
Exclusive: How One Line of Code Put Billions of Microsoft Android App Downloads at Risk - securityweek.com
Gamaredon Exploits WinRAR to Deliver GammaWorm and GammaSteel Against Ukraine - thehackernews.com
Argamal: Malware hidden in hentai games - securelist.com
AI-Driven Exploitation is Destroying Vulnerability Management. Here’s How to Handle It. - thehackernews.com
Two New Reports Offer Competing Explanations for Cybersecurity’s Growing Crisis - securityweek.com
The Zero-Knowledge Threat Actor and the End of Responsible Disclosure - securityweek.com
AI-built ransomware toolkit automates EDR evasion, AD discovery - bleepingcomputer.com
These convincing copyright notices are designed to steal Google logins - malwarebytes.com
Why the browser is now the front line for AI security - bleepingcomputer.com
Trump Signs Executive Order That Invites Vetting of Top AI Models for National Security Risks - securityweek.com
CISA Urges Stronger Security for Automatic Tank Gauge Systems - cisa.gov

Cybersecurity Brief – 2025-09-21

Sun, 21 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-nexus cyber espionage group, compromised 34 devices across 11 European telecommunications firms using LinkedIn job lures and the MINIBIKE malware.
Over 600,000 individuals were impacted by healthcare data breaches in the past day, with additional major intrusions attributed to the ShinyHunters group.
The Royal Canadian Mounted Police dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million linked to criminal activity.
FBI issued an alert regarding cybercriminals impersonating the FBI’s Internet Crime Complaint Center (IC3) via fake reporting portals for malicious purposes.

Newly Discovered Vulnerabilities

Fortra released a critical patch for a command injection vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT) software, specifically in its License Servlet. Exploitation enables arbitrary command execution.
OpenAI’s ChatGPT Deep Research agent was found vulnerable to a zero-click flaw, allowing attackers to exfiltrate Gmail inbox data via a single crafted email. The vulnerability has since been patched.
Novakon HMIs were reported to have unpatched remote code execution and information exposure vulnerabilities, exposing industrial control systems to remote attacks.
A critical vulnerability was disclosed and fixed in Microsoft Azure Entra ID that could have enabled catastrophic identity and access management attacks if exploited.

Notable Threat Actor Activity

Russian APT groups Turla and Gamaredon, both linked to the FSB, were observed collaborating to compromise high-profile Ukrainian targets. Turla deployed malware on systems previously accessed by Gamaredon, including the Kazuar backdoor.
The Iranian APT group, including a Charming Kitten subgroup, conducted sophisticated cyberattacks targeting telecommunications and satellite companies, using bespoke targeting techniques.
The Scattered Spider group had two suspected members arrested in the UK, with one charged in the US for hacking critical infrastructure.
SystemBC malware is powering the REM Proxy botnet, leveraging approximately 1,500 daily VPS victims and 80 C2 servers to provide proxy services to threat actors.

Trends, Tools, or Tactics of Interest

A phishing-as-a-service (PhaaS) surge was observed, with Lighthouse and Lucid platforms linked to over 17,500 phishing domains targeting 316 brands across 74 countries.
Atomic Infostealer is being distributed to macOS users via fake GitHub repositories, with campaigns targeting LastPass users.
Researchers identified the earliest known malware, codenamed MalTerminal, embedding GPT-4 LLM capabilities for automated ransomware creation and reverse shell generation.
CISA published an analysis of malware kits deployed in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, detailing tactics such as system information collection, credential dumping, and arbitrary code execution.
Ransomware attacks continue to evade defenses, with prevention rates dropping to 62% and data exfiltration prevention at only 3%, per the Picus Blue Report 2025.
Synthetic identity fraud is resurging in the finance and lending sector, with estimated damages reaching $3.3 billion from new accounts.
ChatGPT was demonstrated to be capable of solving CAPTCHAs and mimicking human cursor behaviour, highlighting risks in automated abuse of AI agents.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and reaching a valuation of $8.6 billion.
Valve announced Steam will end support for 32-bit Windows in January 2026, affecting software compatibility and potentially security posture for legacy systems.

Cybersecurity Brief – 2025-09-20

Sat, 20 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-linked cyber espionage group, successfully infiltrated 34 devices across 11 European telecommunications organisations using LinkedIn job lures and the MINIBIKE malware.
Russian threat groups Gamaredon and Turla collaborated in a campaign targeting Ukrainian entities, with Turla malware deployed on systems previously compromised by Gamaredon.
Over 600,000 individuals were impacted by recent healthcare sector breaches; ShinyHunters was identified as responsible for major attacks.
The FBI issued a warning about cybercriminals creating fake FBI Internet Crime Complaint Center (IC3) portals for malicious activity.
The REM Proxy botnet, powered by SystemBC malware, currently controls approximately 1,500 VPS victims daily via 80 C2 servers.
A surge in phishing-as-a-service (PhaaS) operations, notably Lighthouse and Lucid, has resulted in over 17,500 phishing domains targeting 316 brands in 74 countries.

Newly Discovered Vulnerabilities

Fortra disclosed and patched a critical vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT), allowing remote command injection via the License Servlet.
A zero-click vulnerability in OpenAI ChatGPT’s Deep Research agent enabled attackers to exfiltrate Gmail inbox data through a crafted email. OpenAI has since patched the issue.
Novakon Human-Machine Interfaces (HMIs) were found to have unpatched remote code execution and information exposure vulnerabilities.
A critical flaw in Microsoft Azure Entra ID was disclosed and fixed; it could have enabled catastrophic identity and access management attacks.
CISA released an analysis of malware kits used in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, where attackers chained two flaws to collect system information, dump credentials, and execute malware.

Notable Threat Actor Activity

Iranian APT group UNC1549 targeted European telecom and satellite companies with highly bespoke attacks, leveraging LinkedIn lures and custom malware.
Russian APTs Gamaredon and Turla collaborated to compromise Ukrainian organisations, with evidence of sequential deployment of their respective malware.
Scattered Spider group members were arrested in the UK and charged in the US for attacks on critical infrastructure organisations.

Trends, Tools, or Tactics of Interest

Researchers identified the earliest known malware (MalTerminal) embedding GPT-4-powered LLM capabilities, enabling autonomous creation of ransomware and reverse shells.
ChatGPT was demonstrated as capable of solving CAPTCHAs and mimicking human cursor movement, highlighting ongoing risks of AI-driven automation in bypassing security controls.
Ransomware continues to evade defences, with latest data showing only 62% prevention rates and data exfiltration prevention dropping to 3%.
Synthetic identity fraud in the finance and lending sector is rising post-pandemic, with estimated damages reaching $3.3 billion from new accounts.
The Tines platform released over 1,000 pre-built AI-driven security automation workflows, facilitating automated alert triage and response using AI agents and Confluence SOPs.
Industrial automation systems remain a high-value target, with Kaspersky reporting a broad range of malicious objects detected on ICS computers in Q2 2025.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and achieving a valuation of $8.6 billion.
Valve announced that Steam will end support for 32-bit Windows systems in January 2026, impacting legacy software environments.

Cybersecurity Brief – 2025-07-03

Thu, 03 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas Airlines suffered a data breach impacting 6 million customers. Personal information was accessed via a third-party call center platform; passport and credit card data were not included.
Spanish authorities arrested two individuals in Las Palmas for cybercriminal activity, including data theft from government entities, politicians, and journalists.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical vulnerability in Unified Communications Manager (Unified CM) and Session Management Edition, involving hardcoded root SSH credentials that allowed remote root access. The backdoor account has now been removed.
The Forminator WordPress plugin is vulnerable to an unauthenticated arbitrary file deletion flaw, enabling potential full site takeover attacks.
Google Chrome was updated to address a serious security flaw that has been exploited in the wild.
Citrix issued a warning that patching recent authentication bypass vulnerabilities in NetScaler ADC and Gateway may cause login page failures.
Multiple fake cryptocurrency wallet extensions were discovered in the Firefox add-ons store, designed to steal wallet credentials and sensitive data.

Notable Threat Actor Activity

The Russian APT group Gamaredon continues aggressive spearphishing campaigns targeting Ukrainian government entities in 2024, utilizing an evolved cyberespionage toolset and new stealth-focused techniques, including weaponization of network drives.
North Korean state-backed actors are targeting Web3 and cryptocurrency organizations with new malware written in Nim, including a macOS variant named NimDoor, which can revive itself if terminated. They are also leveraging the ClickFix technique in the BabyShark campaign to bypass browser safeguards.
A China-nexus initial access broker has been observed exploiting unpatched Ivanti vulnerabilities for initial access, then self-patching the vulnerabilities to block other threat actors.
Scattered Spider, a group of young cybercriminals, is identified as a significant and imminent threat, having targeted retailers, insurers, and airlines with a flexible and difficult-to-defend structure.
Threat actors are increasingly using callback phishing campaigns, impersonating brands such as Microsoft and DocuSign via PDFs to trick users into calling attacker-controlled phone numbers.
Attackers are using AI to rapidly generate convincing phishing sites impersonating Okta and Microsoft 365 login pages.
Attack chains such as ClickFix and FileFix exploit browser and user behavior to bypass security controls and enable malicious script execution.

Trends, Tools, or Tactics of Interest

Nearly 80% of cyber threats now mimic legitimate user behavior, complicating network threat detection.
Modern phishing campaigns are leveraging AI and social engineering to increase the speed and realism of attacks.
Social engineering tactics are being used in attack chains to manipulate victims into saving and renaming files that execute malicious scripts.
Fake browser extensions and add-ons targeting cryptocurrency wallets are proliferating in official app stores.
New malware written in the Nim programming language is being used in targeted attacks, reflecting an ongoing trend of threat actors adopting less common languages to evade detection.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Russia-based bulletproof hosting provider Aeza Group for supporting ransomware and malware operations, including affiliations with BianLian and Lumma Stealer.
The U.S. Department of Justice is investigating a former ransomware negotiator for alleged criminal collaboration with ransomware gangs to profit from extortion payment deals.
A U.S. judge approved the sale of 23andMe’s DNA data to TTAM Research Institute, prompting privacy concerns and increased user requests for data deletion.

Cybersecurity Brief – 2025-04-11

Fri, 11 Apr 2025 00:00:00 +0000

Major Incidents and Attacks

GOFFEE continues to attack organizations in Russia: Kaspersky researchers analyze GOFFEE’s campaign in H2 2024, with updated infection scheme, new PowerModul implant, and switch to a binary Mythic agent.
Russian Threat Actor Launches Spear-Phishing Campaign Against Ukrainians: The Russian threat actor Gamaredon targets Ukrainians with spear-phishing documents related to troop movements.

Vulnerabilities and Exploits

OttoKit WordPress Plugin Admin Creation Vulnerability Under Active Exploitation: A high-severity security flaw impacting OttoKit has been under active exploitation within hours of public disclosure.
Incomplete Patch in NVIDIA Toolkit Leaves CVE-2024-0132 Open to Container Escapes: Cybersecurity researchers detail an incomplete patch for a security flaw impacting the NVIDIA Container Toolkit.
Malicious npm Package Targets Atomic Wallet, Exodus Users by Swapping Crypto Addresses: Threat actors upload malicious packages to the npm registry to tamper with legitimate libraries and execute malicious code.

Industry Developments

Zero-Day in CentreStack File Sharing Platform Under Attack: A critical deserialization flaw in Gladinet’s platform is under attack, impacting managed service providers and their customers.
AuthZEN Aims to Harmonize Fractured Authorization Controls: An open specification aims to manage permissions and authorizations across multiple cloud services.
Ping Identity Doubles Down on Partner Strategy with New Partner Program and Advisory Board: Ping Identity reveals a new partner program and advisory board to enhance its partner strategy.

Regulatory and Policy News

US to sign Pall Mall pact aimed at countering spyware abuses: The U.S. plans to sign an international agreement to govern the use of commercial spyware.
Oregon’s environmental agency shuts down network after cyberattack: Oregon’s Department of Environmental Quality experiences a cyberattack, disrupting services like vehicle inspections.

These incidents and developments highlight ongoing threats from threat actors targeting organizations with sophisticated attacks and the importance of addressing vulnerabilities to enhance cybersecurity measures. The regulatory and policy news also underlines the need for international cooperation to combat cyber threats effectively.