Cybersecurity Brief – 2025-06-20

Fri, 20 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Satellite communications provider Viasat was breached by China’s Salt Typhoon cyber-espionage group, which has previously targeted multiple telecom providers in the United States and abroad.
Krispy Kreme confirmed that personal information of over 160,000 individuals was stolen in a cyberattack that occurred in November 2024.
Paragon’s commercial spyware “Graphite” was used to target at least two prominent European journalists, attributed to an unnamed customer.

The Russian state-linked group APT29 has been observed exploiting Google account application-specific passwords to bypass two-factor authentication in targeted phishing campaigns.
BlueNoroff, a North Korea-aligned threat actor, targeted a Web3 sector employee using deepfaked Zoom calls impersonating company executives to deliver a macOS backdoor malware.
China’s Salt Typhoon group was responsible for the breach at Viasat, continuing their focus on telecom sector cyber-espionage.

Researchers have detailed a surge in Android malware, notably the AntiDot campaign, which compromised over 3,775 devices across 273 campaigns using overlays, virtualization fraud, and NFC theft.
A new version of the Godfather Android malware now uses virtualization to create isolated environments on mobile devices, enabling it to hijack legitimate banking apps and steal account data and transactions.

“Living Off Trusted Sites” (LOTS) attacks are increasingly common, with threat actors leveraging trusted tools and websites to evade detection and execute attacks.
Scammers are increasingly injecting false support information into legitimate websites via search parameter manipulation, tricking users into contacting fraudulent support channels.
DuckDuckGo has expanded its Scam Blocker to protect users from a wider array of online scams, including fake e-commerce stores, cryptocurrency exchanges, and scareware.
AI-generated code, referred to as “vibe coding,” is introducing new risks, including “silent knowledge gaps,” as natural language is used to create software.
There is a continued trend of credential theft being a primary vector for network breaches, as highlighted by recent webinars and the Verizon 2025 DBIR.
Reports confirm that the widely publicized “16 billion credentials leak” is not a new breach, but rather a compilation of previously leaked credentials.
Commercial spyware continues to be deployed against high-profile targets, such as journalists, raising concerns about surveillance and privacy.

Microsoft announced new security defaults for Windows 365 Cloud PCs, set to take effect in the second half of 2025 for newly provisioned and reprovisioned Cloud PCs.
The U.S. Department of Justice seized over $225 million in cryptocurrency linked to investment fraud and money laundering operations, marking the largest crypto seizure in the history of the U.S. Secret Service.
Facebook is preparing to introduce passkey support, enabling passwordless authentication for users, which could have implications for account security and user authentication practices.

Thu, 19 Jun 2025 00:00:00 +0000

Episource, a healthcare SaaS provider, disclosed a data breach affecting 5.4 million patients in the United States, with health information stolen during a January cyberattack.
Asana reported a flaw in its Model Context Protocol (MCP) AI feature, which exposed customer data from some instances to other organisations.
Over 1,500 Minecraft players were infected by a multi-stage Java-based malware campaign, distributed via malicious game mods and cheats on GitHub, aiming to steal credentials and authentication tokens.
Pro-Israel hacking group Predatory Sparrow claimed responsibility for stealing and destroying over $90 million in cryptocurrency from Iran’s Nobitex exchange in a politically motivated attack.
Water Curse, a newly identified threat actor, was found to have hijacked 76 GitHub accounts to deliver multi-stage malware with data exfiltration and remote control capabilities.

Two local privilege escalation (LPE) vulnerabilities were discovered in major Linux distributions, affecting the PAM and Udisks components, allowing attackers to gain root privileges. Exploitation in the wild has been reported, and CISA has issued an alert regarding the OverlayFS subsystem flaw.
BeyondTrust released patches for a high-severity pre-authentication remote code execution vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) solutions, which could allow unauthenticated attackers to execute code remotely.

North Korean APT BlueNoroff (Sapphire Sleet/TA444) used deepfake company executives in Zoom calls to trick employees into installing custom Mac malware.
Ryuk ransomware’s initial access specialist was extradited to the United States, highlighting ongoing law enforcement action against ransomware operators.
The Stargazers Ghost Network operated a distribution-as-a-service (DaaS) campaign targeting Minecraft users with infostealers via fake mods on GitHub.
An unidentified threat actor used Cloudflare Tunnel subdomains to host and deliver remote access trojans (RATs) through phishing emails in a campaign dubbed Serpentine#Cloud, leveraging .lnk shortcut files, in-memory code execution, and living-off-the-land tactics.
ChainLink phishing campaigns exploited trusted domains such as Google Drive and Dropbox to bypass security filters and conduct credential theft.

AI-generated voice deepfakes are improving in quality and present an increasing threat to organisations, with researchers noting their use in social engineering attacks.
Phishing campaigns are leveraging legitimate platforms (e.g., EUSurvey, Google Drive, Dropbox) to increase credibility and evade detection, as observed in recent sophisticated credential harvesting attacks.
The GodFather Android banking trojan has adopted virtualization tactics to take over banking and crypto apps by running them in isolated environments on compromised devices.
Varonis released the Jitter-Trap tool to detect beacons used by attackers for command-and-control communications, addressing evolving evasion techniques.
SMS-based two-factor authentication (2FA) remains vulnerable, as demonstrated by incidents where codes were intercepted by third-party companies, highlighting the ongoing risks with SMS 2FA.

Microsoft announced that Microsoft 365 will soon block access to SharePoint, OneDrive, and Office files via legacy authentication protocols by default, affecting all tenants.
Meta added passkey login support to Facebook for Android and iOS, moving towards passwordless authentication standards.
OpenAI was awarded a $200 million contract to support the US Department of Defense with artificial intelligence for administrative process improvement.
Iran implemented internet blackouts amid ongoing conflict, driving citizens to less secure domestic apps and restricting access to external information.
Guidance for CISOs on AI governance and compliance with evolving regulations was highlighted, reflecting increased scrutiny of AI adoption and data protection requirements.