Cybersecurity Brief – 2025-07-08

Tue, 08 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro, a major IT distributor, experienced a ransomware attack causing widespread outages and disruption to customer ordering and services. The company is working to restore systems; details on data theft remain undisclosed.
Qantas confirmed it is being extorted by threat actors following a cyberattack that potentially exposed the data of 6 million customers.
Hackers stole nearly $140 million from six Brazilian banks by using credentials purchased from a C&M employee for $920.
The International Criminal Court (ICC) disclosed a sophisticated cyberattack in its latest threat intelligence report.
The PC version of Call of Duty: WWII was taken offline after reports of gamers being hacked.
Several Russian industrial enterprises were targeted in a phishing campaign delivering the newly discovered Batavia spyware, which exfiltrates sensitive data from corporate devices.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Researchers released proof-of-concept exploits for CVE-2025-5777 (“CitrixBleed2”), a critical Citrix NetScaler vulnerability that is easily exploitable and now publicly available.
Grafana patched multiple Chromium bugs, including CVE-2025-6554, a zero-day vulnerability exploited in the wild that could allow remote code execution and memory corruption.

A Chinese national allegedly linked to the Silk Typhoon (APT41) group was arrested in Milan for cyberespionage activities targeting American organizations.
North Korean threat actors were observed targeting cryptocurrency and Web3 platforms on Telegram using malicious Zoom meeting requests to deliver the NimDoor macOS malware.
TAG-140 targeted Indian government entities using “ClickFix-style” lures, leading to BroaderAspect .NET loader execution.
Iranian hackers breached a U.S. water facility, gaining control over a pressure station serving 7,000 people.
Batavia spyware campaigns used contract-themed phishing emails to compromise Russian industrial organizations.
Over 8,500 SMB users were targeted in an SEO poisoning campaign delivering the Oyster malware loader disguised as AI tools.
Hackers exploited a leaked copy of the Shellter Elite red team tool to deploy infostealers in live attacks.

The Atomic macOS infostealer (AMOS) has added a backdoor for persistent access to compromised systems.
The new “Bert” ransomware strain targets both Linux and Windows systems, featuring aggressive multithreading and cross-platform capabilities.
A Chrome browser extension with over 100,000 downloads was found to contain sophisticated spyware, hijacking sessions and redirecting users to malicious sites.
Modern malware increasingly incorporates anti-debugging and anti-analysis features to evade detection.
Hunters International, a Ransomware-as-a-Service (RaaS) group and successor to Hive, announced its shutdown and transition to “World Leaks,” focusing on data theft and extortion. Free decryptors were offered to previous victims.
PayPal has implemented an AI-powered scam alert system that may intercept suspicious transactions to combat increasingly sophisticated fraud attempts.
Let’s Encrypt began issuing free certificates for IP addresses, which, while enhancing security, also presents new opportunities for cybercriminal abuse.

CISA’s addition of four new actively exploited vulnerabilities to its KEV catalog may prompt accelerated patching and mitigation efforts across affected organizations.
Let’s Encrypt’s rollout of certificates for IP addresses introduces new considerations for certificate management and threat actor abuse.

Fri, 04 Jul 2025 00:00:00 +0000

Spanish police dismantled an investment fraud ring responsible for over €10 million in losses, targeting victims through fraudulent investment schemes.
IdeaLab confirmed data was stolen during a ransomware attack in October 2024, with notifications being sent to affected individuals.
Microsoft is investigating ongoing intermittent access issues affecting SharePoint Online users.
Over 40 malicious Firefox browser extensions targeting cryptocurrency wallets have been discovered, designed to steal wallet secrets and user assets.

Grafana Labs released critical security updates for the Image Renderer plugin and Synthetic Monitoring Agent, addressing four Chromium vulnerabilities.
Brother printers have a critical security flaw related to default admin credentials; users are advised to change default passwords immediately.

A major Android ad fraud operation, IconAds, involving 352 malicious apps, was disrupted. The apps loaded out-of-context ads and performed fraud at scale.
Chinese threat actors exploited Ivanti Connect Secure Appliance (CSA) zero-days in attacks against French government, telecommunications, media, finance, and transport sectors.
Hunters International Ransomware-as-a-Service operation has shut down and released free decryptors for its victims.
Dark web vendors are increasingly shifting to selling access to third-party and software supply chain services, with more data on critical infrastructure being advertised.
Attackers are using QR codes in phishing and malware campaigns, as observed by the Anti-Phishing Working Group.
Callback phishing campaigns are impersonating brands such as Microsoft, PayPal, and DocuSign, luring victims to call attacker-controlled numbers.

Malicious IDE extensions can bypass verification checks in popular integrated development environments, posing a hidden risk to the software supply chain.
There is a notable increase in attacks targeting software supply chains and third-party providers, as evidenced by trends on the dark web.
Weaknesses in AI-powered SOC tools have been highlighted, with concerns around reliance on limited training data and insufficient transparency in automated decision-making.
Southeast Asia remains a hotspot for cybercrime, with organizations in the region experiencing some of the highest cybersecurity risks globally, particularly from phishing.
Criminals are increasingly using QR codes as a vector for phishing and malware distribution.
Leaks suggest OpenAI is developing an Operator-like tool for ChatGPT ahead of the GPT-5 launch, potentially impacting conversational AI security.
xAI is preparing to launch Grok 4, a new state-of-the-art AI model intended to compete with Claude and Gemini.

Microsoft announced the general availability of Exchange Server Subscription Edition (SE) for enterprise customers.
Deloitte released a new cyber blueprint aimed at guiding organizations on AI adoption and preparedness.
The U.S. Treasury’s sanctions against a Chinese national operating a cloud provider linked to virtual currency scams have seen mixed compliance from major technology firms.