Cybersecurity Brief – 2025-07-06

Sun, 06 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro, a major IT distributor, is experiencing an ongoing outage attributed to a SafePay ransomware attack. Internal systems have been shut down as a result of the incident.

Exposed Java Debug Wire Protocol (JDWP) interfaces are being actively exploited by threat actors to gain remote code execution and deploy cryptocurrency miners on compromised systems.

Attackers are leveraging exposed JDWP interfaces for illicit crypto mining operations.
Hpingbot malware is targeting SSH services to facilitate Distributed Denial of Service (DDoS) attacks.
Iran-linked hackers have threatened to release emails related to the Trump campaign.
Chinese state-linked threat actors reportedly maintain persistent access within US telecommunications networks.

SSH and Telnet honeypot data has revealed the use of new and notable usernames by attackers, indicating ongoing credential stuffing and brute-force attempts.
The Flipper Zero multi-tool continues to gain attention for its versatile capabilities, which include radio protocol manipulation and device access, underscoring its popularity among security researchers and potential misuse by threat actors.
AI research tools such as ChatGPT Deep Research are expanding integration options, with new connectors including Slack, potentially broadening the attack surface if misconfigured or abused.

Taiwan’s National Security Bureau (NSB) has issued a public warning regarding the security risks posed by Chinese-developed applications, specifically RedNote (Xiaohongshu), Weibo, TikTok, WeChat, and Baidu Cloud, citing concerns over excessive data collection and potential foreign influence.
Android is reportedly developing a feature to warn users about fake cell towers (IMSI catchers), aimed at improving user privacy and security against mobile interception threats.

Sat, 05 Jul 2025 00:00:00 +0000

Ingram Micro has suffered a global outage affecting its websites and internal systems. Customers have expressed concern that this may be the result of a cyberattack, although the company has not issued an official statement regarding the cause.
A hacker has claimed to have stolen and leaked 106GB of data from Spanish telecommunications provider Telefónica. The company has not confirmed the breach.

Two critical vulnerabilities have been disclosed in the Sudo command-line utility for Linux and Unix-like operating systems. These flaws allow local attackers to escalate privileges to root. The vulnerabilities impact major Linux distributions.

Threat actors are exploiting exposed Java Debug Wire Protocol (JDWP) interfaces to execute code remotely and deploy cryptocurrency miners on compromised systems. Additionally, Hpingbot malware is targeting SSH services to launch DDoS attacks.
A previously undocumented threat actor, NightEagle (also known as APT-Q-95), has been observed exploiting a Microsoft Exchange zero-day vulnerability to target China’s military and technology sectors.

There is increased threat activity leveraging exposed development and debugging interfaces (such as JDWP) for initial access and subsequent crypto mining payload deployment.
AI agents and custom generative AI workflows are emerging as potential sources of sensitive data leakage, introducing new risks for enterprises.

A U.S. court has ordered Google to pay $314 million for misusing Android users’ cellular data by passively transmitting information while devices were idle, without user permission.
Taiwan’s National Security Bureau (NSB) has issued a public warning about the security risks associated with Chinese-developed applications including TikTok, Weibo, RedNote (Xiaohongshu), WeChat, and Baidu Cloud, citing concerns over excessive data collection and ties to China.