Cybersecurity Brief – 2025-04-12

Sat, 12 Apr 2025 00:00:00 +0000

Phishing Campaign Targeting QuickBooks Users:
- Cybercriminals are targeting QuickBooks users with phishing campaigns during tax season.
Threat Actors Retain Access to FortiGate Devices Post-Patching:
- Fortinet warns that threat actors can maintain read-only access to FortiGate devices even after initial access vectors are patched.
PowerModul Implant Targeting Russian Sectors:
- The threat actor Paper Werewolf has deployed a new implant called PowerModul to target Russian entities.
Brute-Force Attempts Against PAN-OS GlobalProtect Gateways:
- Palo Alto Networks has observed brute-force login attempts targeting PAN-OS GlobalProtect gateways.
SpyNote, BadBazaar, MOONSHINE Malware Target Android and iOS Users:
- Cybersecurity researchers have discovered malware targeting Android and iOS users through fake apps.
Microsoft Defender to Isolate Undiscovered Endpoints:
- Microsoft is testing a new Defender for Endpoint capability to block attacks by isolating undiscovered endpoints.
Western Sydney University Discloses Security Breaches:
- WSU has reported security incidents exposing personal information of community members.
Ransomware Attack Cost IKEA Operator $23 Million:
- Fourlis Group, the operator of IKEA stores in Eastern Europe, suffered a ransomware attack causing significant losses.
Code of Practice for States Signed to Curb Commercial Spyware:
- Nations are signing the Code of Practice for States to address commercial spyware threats.
Goffee Targeting Russian Organizations with New Malware:
- The threat actor Goffee, also known as Paper Werewolf, is targeting Russian organizations with new malware targeting flash drives.

Cybersecurity Brief – 2025-04-11

Fri, 11 Apr 2025 00:00:00 +0000

Major Incidents and Attacks

GOFFEE continues to attack organizations in Russia: Kaspersky researchers analyze GOFFEE’s campaign in H2 2024, with updated infection scheme, new PowerModul implant, and switch to a binary Mythic agent.
Russian Threat Actor Launches Spear-Phishing Campaign Against Ukrainians: The Russian threat actor Gamaredon targets Ukrainians with spear-phishing documents related to troop movements.

Vulnerabilities and Exploits

OttoKit WordPress Plugin Admin Creation Vulnerability Under Active Exploitation: A high-severity security flaw impacting OttoKit has been under active exploitation within hours of public disclosure.
Incomplete Patch in NVIDIA Toolkit Leaves CVE-2024-0132 Open to Container Escapes: Cybersecurity researchers detail an incomplete patch for a security flaw impacting the NVIDIA Container Toolkit.
Malicious npm Package Targets Atomic Wallet, Exodus Users by Swapping Crypto Addresses: Threat actors upload malicious packages to the npm registry to tamper with legitimate libraries and execute malicious code.

Industry Developments

Zero-Day in CentreStack File Sharing Platform Under Attack: A critical deserialization flaw in Gladinet’s platform is under attack, impacting managed service providers and their customers.
AuthZEN Aims to Harmonize Fractured Authorization Controls: An open specification aims to manage permissions and authorizations across multiple cloud services.
Ping Identity Doubles Down on Partner Strategy with New Partner Program and Advisory Board: Ping Identity reveals a new partner program and advisory board to enhance its partner strategy.

Regulatory and Policy News

US to sign Pall Mall pact aimed at countering spyware abuses: The U.S. plans to sign an international agreement to govern the use of commercial spyware.
Oregon’s environmental agency shuts down network after cyberattack: Oregon’s Department of Environmental Quality experiences a cyberattack, disrupting services like vehicle inspections.

These incidents and developments highlight ongoing threats from threat actors targeting organizations with sophisticated attacks and the importance of addressing vulnerabilities to enhance cybersecurity measures. The regulatory and policy news also underlines the need for international cooperation to combat cyber threats effectively.

Goffee on DanSec Daily

Cybersecurity Brief – 2025-04-12

Cybersecurity Brief – 2025-04-11

Major Incidents and Attacks

Vulnerabilities and Exploits

Industry Developments

Regulatory and Policy News