Kimsuky on DanSec Daily

Cybersecurity Brief – 2026-08-11

Tue, 11 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers breached a Polish combined heat and power plant by exploiting a private cellular network (APN), leading to the shutdown of a steam turbine and water treatment system. This attack vector is notable as it marks the first known use of a private APN for access to operational technology networks in critical infrastructure^[7]^[15]^[41].
LexisNexis took its Diligence, Metabase API, and Newsdesk services offline following detection of unusual activity on servers managed by a third-party vendor^[22].
Valve notified European Steam hardware customers of a data breach resulting from a compromise of its shipping partner, CEVA Logistics, leading to theft of customer data^[23].
Corporate data was stolen from Levi Strauss following a social engineering attack that enabled threat actors to access and exfiltrate data from the computers of three employees^[43].

Newly Discovered Vulnerabilities

A critical Progress Kemp LoadMaster command injection vulnerability is being actively exploited in the wild, allowing unauthenticated remote attackers to execute arbitrary commands. CISA has issued an urgent warning to patch affected systems^[24]^[42].
Two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery flaw, are now being exploited by ransomware groups^[19].
A maximum-severity, unauthenticated, remote administrator access vulnerability in Metabase has been exploited as a zero-day. Metabase has released a patch, but the vulnerability does not yet have a CVE^[27]^[40].
High-severity vulnerabilities in ClamAV, Cisco’s anti-malware engine, have been disclosed with a public proof-of-concept. These bugs could be exploited remotely by unauthenticated attackers to cause denial-of-service conditions^[37].
New passkey attacks have been demonstrated that can recover synced private keys or bypass phishing-resistant multi-factor authentication without breaking underlying cryptography^[13].

Notable Threat Actor Activity

Storm-1175, a financially motivated Chinese threat actor and former Medusa ransomware affiliate, has deployed a new ransomware strain named StormEncryptor, likely using an N-central flaw as an entry vector^[10]^[18].
The North Korean Kimsuky group has developed an offline AI stack to enhance phishing campaigns and automate malware development, allowing operations without dependence on public AI services^[12].
The threat actor Head Mare is exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with a backdoor named PhantomCore, targeting Russian companies in various sectors^[14].
A supply chain compromise at WordPress plugin vendor BdThemes allowed attackers to poison a remote JSON feed, creating rogue WordPress admin accounts on affected sites^[8]^[16].
Iranian-linked actors have widened attacks on water systems across at least a dozen US states, targeting internet-exposed industrial control systems at water facilities^[26]^[39].

Trends, Tools, or Tactics of Interest

Malware targeting Windows, macOS, and IoT devices continued to evolve in Q2 2026, with notable increases in sophistication and targeting breadth^[1].
Mobile threat trends in Q2 2026 include the rise of the Anatsa banking trojan and increased use of dropper techniques to bypass detection^[2].
AI-driven social engineering attacks are becoming more convincing and personalized, with attackers leveraging AI to increase the speed and effectiveness of phishing, credential theft, and social engineering operations^[3]^[20].
“Ghostjacking” is a newly described attack method where poisoned security logs or alerts are used to manipulate and hijack AI agents by embedding malicious instructions^[25]^[38].
Sophisticated iOS exploit chains, such as Coruna and DarkSword, are proliferating from nation-state use to wider adoption by organized cybercrime groups^[29].
A turnkey scam kit has been discovered that lowers the technical barrier for conducting online scams, making it easier for non-technical actors to launch fraudulent campaigns^[45].
A new phishing kit, dubbed “Bulletproof Redirector,” uses compromised legitimate websites and hidden directories to evade secure email gateways and facilitate credential theft^[4].
Attackers are increasingly exploiting supply chain weaknesses, as seen in the BdThemes and Metabase incidents, to compromise downstream targets^[8]^[16]^[27]^[40].
Security researchers have demonstrated that passkey-based authentication can be undermined through attacks on synchronization and device trust mechanisms^[13]^[20].
Increased scanning activity targeting Solana blockchain endpoints has been observed, indicating heightened interest in exploiting crypto-related infrastructure^[33].

Regulatory or Policy Developments Affecting the Security Industry

Outdated cybercrime laws are putting security researchers at risk, prompting calls for legal reforms to protect ethical hackers and good-faith security research^[30].
Microsoft Edge is dropping support for Manifest V2, which will impact popular privacy tools that rely on older extension technology, potentially reducing user privacy protections^[46].
Mozilla has issued a new Firefox GPG signing key after the previous subkey was inadvertently exposed on GitHub, requiring a key revocation^[34].

Sources

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine - thehackernews.com
Hackers breached a small Polish energy plant via private APN last year - bleepingcomputer.com
Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility - securityweek.com
LexisNexis shuts down services after suspicious activity on servers - bleepingcomputer.com
Valve notifies Steam hardware customers of a data breach - bleepingcomputer.com
Corporate Data Stolen in Levi Strauss Cyberattack - securityweek.com
Critical Progress LoadMaster flaw now actively exploited in attacks - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability - securityweek.com
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs - bleepingcomputer.com
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius - darkreading.com
Metabase Patches Vulnerability Exploited as Zero-Day - securityweek.com
Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC - securityweek.com
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA - thehackernews.com
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw - thehackernews.com
New StormEncryptor ransomware used by former Medusa affiliate - bleepingcomputer.com
Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development - thehackernews.com
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore - thehackernews.com
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins - thehackernews.com
BdThemes plugins supply-chain hack creates rogue WordPress admins - bleepingcomputer.com
Multistate Water System Attacks Widen, Iran Suspected - darkreading.com
New Jersey, Alabama Join States Targeted in Water Cyberattacks - securityweek.com
IT threat evolution in Q2 2026. Non-mobile statistics - securelist.com
IT threat evolution in Q2 2026. Mobile statistics - securelist.com
Introducing Real-Time Coaching in KnowBe4’s AI-Native Security Awareness Training - blog.knowbe4.com
When Credentials Are No Longer Enough: Device Trust in the AI Era - bleepingcomputer.com
'GhostJacking' Exposes Identity Governance Gaps in AI Agents - darkreading.com
‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad - securityweek.com
Coruna, DarkSword iOS Exploits Proliferate Globally - darkreading.com
New turnkey kit makes it easy for anyone to become a scammer - malwarebytes.com
The Blind Spot: How “Bulletproof” Phishing Redirectors Slip Past SEGs - blog.knowbe4.com
Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th) - isc.sans.edu
Outdated Cybercrime Laws Put Security Researchers at Risk - darkreading.com
Edge is dropping older extensions, affecting popular privacy tools - malwarebytes.com
Mozilla Issues New Firefox GPG Key Following Exposure - securityweek.com

Cybersecurity Brief – 2026-05-29

Fri, 29 May 2026 00:00:00 +0000

Major Incidents or Breaches

Charter Communications suffered a data breach impacting 4.9 million accounts, with the ShinyHunters extortion group claiming responsibility for stealing personal information in early April ^[10].
Carnival Corporation confirmed a data breach affecting nearly 6 million people, also attributed to the ShinyHunters group, with exposed data including personal details of customers ^[20]^[34]^[42].
Customer data from more than 350 hotels worldwide was accessed as part of reservation-hijacking spear-phishing scams, enabling realistic phishing attacks against hotel guests ^[29].

Newly Discovered Vulnerabilities

A critical, unpatched zero-day vulnerability in Gogs, a self-hosted Git service, allows authenticated users to execute arbitrary code on affected instances. This vulnerability is accessible on Internet-facing deployments ^[5]^[16].
A critical authentication bypass vulnerability (CVE-2026-35616) in FortiClient Endpoint Management Server (EMS) has been actively exploited by threat actors to deploy credential-stealing malware. Fortinet released hotfixes in April after zero-day exploitation was detected ^[6]^[15]^[36].
A security flaw in Gitea exposed 30,000 deployments to attacks, allowing attackers to pull private container images and potentially access source code, credentials, and infrastructure ^[39].

Notable Threat Actor Activity

The North Korean state-sponsored group Kimsuky deployed new tools, including HTTPSpy, HelloDoor, and VS Code Tunnels, in attacks targeting South Korean military and corporate entities ^[4].
The Russian-linked threat cluster GreyVibe has been targeting Ukrainian organizations using AI-generated lures and custom malware, leveraging tools such as ChatGPT and Gemini to enhance their operations ^[12]^[32].
The ShinyHunters extortion gang claimed responsibility for large-scale breaches at Charter Communications and Carnival Corporation, stealing millions of customer records ^[10]^[20]^[34]^[42].

Trends, Tools, or Tactics of Interest

The BTMOB Android remote access trojan is being distributed via a malware-as-a-service model, offering a builder interface for custom phishing payloads and enabling full device takeover, financial theft, data exfiltration, and remote access. It is spreading across Brazil and Latin America ^[13]^[26]^[35].
AI is increasingly being used by both defenders and attackers. GreyVibe uses ChatGPT and Gemini for attack lures, while new security tools such as Google’s AI Threat Defense platform and Edamame’s AI agent monitoring platform are being launched to counter AI-powered threats and monitor AI coding agents for intent drift and secret theft ^[12]^[32]^[38]^[41].
Fake ChatGPT download sites are distributing malware to both Windows and Mac users, with payloads tailored to each platform ^[44].
The FBI issued a warning about fake FIFA websites ahead of the 2026 World Cup, which are being used for fraud schemes including stealing personal and financial information and selling fake tickets ^[14].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft publicly advocated for Coordinated Vulnerability Disclosure (CVD), urging security researchers to work with vendors before publicizing zero-day vulnerabilities ^[7].
IBM and Red Hat announced a $5 billion investment in Project Lightwell, aiming to secure open source software supply chains and address vulnerabilities without disrupting production systems ^[37].

Sources

Charter Communications data breach affects 4.9 million accounts - bleepingcomputer.com
Carnival Cruise confirms data breach affecting nearly 6 million people - bleepingcomputer.com
Carnival Data Breach Exposed 6 Million People - securityweek.com
Carnival confirms data breach impacting nearly 6 million - malwarebytes.com
Scammers Are Using Your Real Hotel Reservations to Trick You With Spear-Phishing Attacks - wired.com
Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code - thehackernews.com
New Gogs zero-day flaw lets hackers get remote code execution - bleepingcomputer.com
Threat Actors Exploit Critical FortiClient EMS Flaw to Deploy Credential Stealer - thehackernews.com
Hackers exploit FortiClient EMS flaw to push infostealer malware - bleepingcomputer.com
Critical FortiClient EMS Vulnerability Exploited in Fresh Attacks - securityweek.com
Gitea Vulnerability Exposed 30,000 Deployments to Attacks - securityweek.com
Kimsuky Deploys HTTPSpy, Expands Arsenal with HelloDoor and VS Code Tunnels - thehackernews.com
GreyVibe hackers use ChatGPT, Gemini to power cyberattacks - bleepingcomputer.com
Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge Cyberattacks - securityweek.com
BTMOB Android malware service generates custom phishing payloads - bleepingcomputer.com
BTMOB RAT Spreads Across Brazil, LatAm via MaaS Model - darkreading.com
New BTMOB Android Malware Enables Full Device Takeover - securityweek.com
New Edamame Platform Aims to Catch AI Coding Agents Going Off the Rails - securityweek.com
Google Unveils AI Threat Defense Platform to Fight AI-Powered Cyberattacks - securityweek.com
Fake ChatGPT download site infects Windows and Mac users with malware - malwarebytes.com
FBI warns of fake FIFA websites running World Cup fraud schemes - bleepingcomputer.com
Microsoft Slams Public Zero-Day Disclosures Amid GitHub Researcher Account Removal - thehackernews.com
IBM and Red Hat Commit $5 Billion to Secure Open Source Supply Chains Under “Project Lightwell” - securityweek.com

Cybersecurity Brief – 2026-05-15

Fri, 15 May 2026 00:00:00 +0000

Major Incidents or Breaches

Foxconn suffered a ransomware attack by the Nitrogen group on its North American manufacturing facilities. This is one of over 600 attacks targeting manufacturers this year.
OpenAI confirmed a security breach resulting from the TanStack supply chain attack, which compromised two employee devices and necessitated code-signing certificate rotation.
Taiwanese rail operations were disrupted for nearly an hour after a student used software-defined radio to shut down three bullet trains, exposing cybersecurity gaps in rail systems.
TeamPCP is threatening to leak source code from the Mistral AI project unless a buyer is found, following a breach.
Dell confirmed its SupportAssist software is causing Windows BSOD crashes, leading to system instability for users.

Newly Discovered Vulnerabilities

Cisco Catalyst SD-WAN Controller is affected by a critical authentication bypass vulnerability (CVE-2026-20182), which has been actively exploited in the wild to gain administrative access. This is the sixth SD-WAN zero-day exploited in 2026.
Microsoft disclosed a new actively exploited vulnerability (CVE-2026-42897) impacting on-premise Exchange Server, allowing arbitrary code execution via crafted email. A separate Exchange zero-day enabling XSS-based code execution is also under active exploitation.
PraisonAI (CVE-2026-44338) was targeted by threat actors within hours of disclosure, exploiting an authentication bypass flaw in this open-source orchestration framework.
Three versions of the node-ipc npm package were found to contain a stealer backdoor targeting developer secrets.
An 18-year-old NGINX vulnerability was discovered, allowing denial of service and, under certain conditions, remote code execution.
A new Linux kernel vulnerability, “Fragnesia” (CVE-2026-46300), allows root privilege escalation and is similar to previous Dirty Frag and Copy Fail exploits.
Burst Statistics WordPress plugin is being exploited via a critical authentication bypass flaw to obtain admin-level access on affected sites.
Chrome 148 update was released to patch critical use-after-free and other high-severity vulnerabilities.
F5 released patches for over 50 vulnerabilities in BIG-IP, BIG-IQ, and NGINX products, covering high and medium-severity issues.

Notable Threat Actor Activity

Kimsuky, a North Korean threat group, is using new PebbleDash-based tools linked to the AppleSeed malware cluster in recent campaigns.
Ghostwriter, a Belarus-aligned group, targeted Ukrainian government entities with geofenced PDF phishing and Cobalt Strike payloads.
FrostyNeighbor, another Belarusian APT, is spear-phishing government organizations in Poland and Ukraine using unique victim fingerprinting for espionage.
Chinese APTs Salt Typhoon and Twill Typhoon expanded their targeting: Salt Typhoon attacked an Azerbaijani energy entity, and Twill Typhoon deployed an updated RAT against Asian organizations.
KongTuke, an initial access broker, is now using Microsoft Teams for rapid social engineering attacks to breach corporate networks.
TeamPCP released the source code for the Shai-Hulud worm, encouraging its use in supply chain attacks and offering financial incentives for widespread deployment.

Trends, Tools, or Tactics of Interest

Ransomware gangs are increasingly targeting manufacturers due to their low tolerance for downtime, as evidenced by the Foxconn incident.
Phishing attacks are ramping up ahead of the 2026 FIFA World Cup, with at least 79 phishing sites targeting fans.
Netflix-themed phishing campaigns are proliferating, with attackers leveraging poor user security practices for credential theft.
Cyber-enabled cargo crime is shifting from physical hijackings to phishing and credential theft to reroute and steal freight.
AI-assisted ransomware and AI-driven social engineering are emerging, with threat actors leveraging generative AI for more convincing phishing and attack automation.
AI hallucinations are creating new security risks by generating plausible but incorrect outputs, which can mislead decision-makers in critical infrastructure.
Supply chain attacks remain a significant threat, highlighted by the node-ipc, TanStack, and Shai-Hulud worm incidents.
New malware libraries are prompting the need for updated detection signatures.
Mythos, an autonomous vulnerability discovery tool, proves effective in code audits and reverse engineering but has inconsistent exploit validation.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Cisco SD-WAN CVE-2026-20182 to its Known Exploited Vulnerabilities (KEV) catalog, mandating urgent remediation.
G7 countries released guidance on AI Software Bill of Materials (SBOM), outlining minimum elements to enhance transparency in AI systems and supply chains.
SecurityScorecard acquired Driftnet to improve threat intelligence and third-party risk visibility, responding to growing concerns over supply chain attack vectors.
Akamai announced the acquisition of LayerX for $205 million, expanding its Zero Trust portfolio to include browser-level protection.

Cybersecurity Brief – 2026-01-13

Tue, 13 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Target Corporation: Hackers claim to have stolen and are selling internal source code from Target, with samples published online. Target’s development server has been taken offline.
University of Hawaii Cancer Center: Ransomware attack in August 2025 resulted in theft of participant data, including documents with Social Security numbers dating back to the 1990s.
Endesa (Spanish Energy Provider): Data breach disclosed, with hackers accessing customer contract-related information, including personal details.
BreachForums: The notorious cybercriminal forum was breached, exposing data on 324,000 administrators and members.
Manage My Health (New Zealand): Identified as a top breach in recent threat intelligence reporting, affecting patient portals and healthcare data.
Instagram: Data leak incident where user data appeared on the dark web, coinciding with a password reset vulnerability (see below).
Apex Legends: Live matches disrupted as threat actors hijacked player characters, disconnected users, and changed nicknames.

Newly Discovered Vulnerabilities

n8n Workflow Automation Platform:
- “Ni8mare” vulnerability impacts nearly 60,000 online instances; maximum-severity flaw remains largely unpatched.
- Supply chain attack observed, with malicious npm packages masquerading as integrations to steal OAuth credentials from developers.
Gogs (Git Service): High-severity remote code execution (RCE) flaw exploited in zero-day attacks. CISA has ordered US federal agencies to patch.
Instagram: Password reset vulnerability allowed third parties to send reset emails to users, contributing to a recent data leak.
Telegram: Hidden proxy links can expose user IP addresses with a single click due to how proxy links are handled. Telegram has announced plans for a fix.

Notable Threat Actor Activity

GoBruteforcer Botnet: New campaigns target over 50,000 Linux servers, especially those supporting cryptocurrency and blockchain projects, exploiting weak credentials and AI-generated configurations.
APT28 (Russia): Targeting energy research and defense collaboration entities by impersonating webmail and VPN portals (Microsoft OWA, Google, Sophos VPN).
Kimsuky (North Korea): FBI flagged QR-code phishing (“quishing”) campaigns targeting US and foreign government agencies, NGOs, and academia.
LLM/AI Service Exploitation: Multiple campaigns targeting exposed large language model (LLM) endpoints and misconfigured proxy servers to access sensitive APIs and data.
VoidLink Malware: Discovery of a stealthy, cloud-native Linux malware framework, attributed to a Chinese threat cluster, designed for persistence and evasion in cloud environments.
Facebook Credential Theft: Increased use of “browser-in-the-browser” (BitB) phishing techniques to steal Facebook login credentials over the past six months.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks: Growing use of malicious npm packages for credential theft, specifically targeting workflow automation platforms.
Botnet Evolution: GoBruteforcer botnet demonstrates ongoing adaptation, now preying on servers with weak or AI-generated credentials.
AI and LLM Security: Surge in attacks against exposed LLM endpoints and APIs, highlighting expanding attack surfaces in organizations’ AI deployments.
Phishing Techniques: Rise in “quishing” (QR-code phishing) and “browser-in-the-browser” attacks, increasing the sophistication of credential theft campaigns.
Healthcare AI Adoption: Anthropic launched Claude AI for healthcare, introducing HIPAA-ready tools for providers and payers, reflecting broader AI integration in sensitive sectors.
Endpoint Security Expansion: Hexnode announced entry into endpoint security with its new XDR (Extended Detection and Response) platform.

Regulatory or Policy Developments Affecting the Security Industry

CISA Directive: US federal agencies ordered to patch Gogs RCE vulnerability exploited in active attacks.
EU Regulatory Review: The European Union set a February deadline for its verdict on Google’s $32B acquisition of Wiz, following US approval.
Deepfake Regulation: Global regulators are scrutinizing Grok, an AI tool, over its role in generating illegal sexual deepfake content, including child sexual abuse material.
Privacy and Cybersecurity Law Complexity: Ongoing analysis indicates compliance challenges will persist into 2026, with limited progress on comprehensive federal cybersecurity legislation.

Cybersecurity Brief – 2026-01-10

Sat, 10 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

The Illinois Department of Human Services (IDHS) exposed personal and health data of nearly 700,000 residents due to incorrect privacy settings.
Gulshan Management Services, a Texas gas station operator, reported a data breach affecting 377,000 individuals following a ransomware attack.
An Illinois man has been charged with hacking nearly 600 Snapchat accounts via phishing to steal and sell private photos online.

Newly Discovered Vulnerabilities

Trend Micro patched a critical remote code execution vulnerability (CVSS 9.8) in on-premise versions of Apex Central for Windows, which could allow attackers to execute arbitrary code with SYSTEM privileges. Three vulnerabilities were addressed, and proof-of-concept code has been released.
VMware ESXi zero-day vulnerabilities have been exploited by threat actors, with evidence that exploits were developed up to a year prior to public disclosure. The flaws allow virtual machine escapes and were initially accessed via a compromised SonicWall VPN appliance.

Notable Threat Actor Activity

Russian APT28 (state-sponsored) is conducting credential-stealing campaigns targeting individuals linked to Turkish energy and nuclear research agencies, as well as other policy organizations.
Chinese-speaking threat actors exploited VMware ESXi zero-days and used a compromised SonicWall VPN for initial access. Chinese cyberattacks against Taiwan have intensified.
North Korean Kimsuky group has been using spear-phishing campaigns featuring malicious QR codes to target government organizations, think tanks, and academic institutions.
Threat actors are systematically seeking out misconfigured proxy servers to gain unauthorized access to paid large language model (LLM) services.

Trends, Tools, or Tactics of Interest

“ClickFix”/ConsentFix attacks, a form of social engineering using fake prompts (e.g., Cloudflare), are being observed, relying on tricking users into clicking under false pretenses.
Researchers demonstrated the “ZombieAgent” attack, which can bypass ChatGPT protections to exfiltrate user data and implant persistent logic in the agent’s memory.
Deepfake-enabled fraud tools are increasing in realism and popularity, but defensive measures are currently keeping pace.
Email security analysis highlights that post-compromise impact and containment are more critical than traditional “click rate” metrics.
Process Environment Block (PEB) manipulation is being used by malware to evade detection and analysis.
There is a surge in illicit cryptocurrency transactions, particularly involving nation-state actors from sanctioned countries such as Russia and Iran.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has retired 10 emergency cybersecurity directives issued between 2019 and 2024, as their objectives have been met or are now covered by the Known Exploited Vulnerabilities (KEV) catalog.
Microsoft is testing a policy to allow IT administrators to uninstall Copilot on managed devices.
The founder of stalkerware provider pcTattletale pleaded guilty in a rare U.S. federal case as authorities increase enforcement actions against stalkerware vendors.
Tim Kosiba has been appointed as the new Deputy Director of the U.S. National Security Agency (NSA).

Cybersecurity Brief – 2026-01-09

Fri, 09 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

WhatsApp accounts are being targeted by a phishing campaign attempting to trick users into linking malicious devices, potentially resulting in account compromise.
A WhatsApp worm is distributing the Astaroth banking trojan in Brazil via auto-messaging to contacts, facilitating rapid malware propagation and credential theft.
Fake AI-powered Chrome extensions, mimicking legitimate tools, have stolen data from approximately 900,000 users, harvesting ChatGPT and DeepSeek credentials.
The Kimwolf botnet has rapidly infected over two million devices, primarily by compromising unofficial Android TV streaming boxes.
Microsoft Exchange Online experienced an outage affecting mailbox access via IMAP4.
Researchers demonstrated remote hacking risks in WHILL wheelchairs due to unauthenticated Bluetooth access, enabling unauthorized device movement.

Newly Discovered Vulnerabilities

HPE OneView: A maximum-severity, unauthenticated remote code execution vulnerability (CVE-2025-37164) is being actively exploited in the wild.
n8n: A critical vulnerability (CVE-2026-21858, CVSS 10) allows unauthenticated remote code execution, exposing self-hosted automation instances to takeover.
jsPDF: A critical vulnerability has been patched that allowed attackers to read arbitrary files from the system, risking credential and configuration exposure.
Coolify: Eleven critical security flaws have been disclosed in this open-source self-hosting platform, including authentication bypass and remote code execution.
Cisco Identity Services Engine (ISE): A medium-severity flaw with public proof-of-concept exploit code has been patched; exploitation requires administrative access.
VMware ESXi: Zero-day vulnerabilities were reportedly exploited by Chinese-speaking threat actors up to a year before public disclosure, with initial access via a compromised SonicWall VPN.
Cisco Switches: Multiple models are experiencing reboot loops due to a DNS client bug, causing operational disruptions.

Notable Threat Actor Activity

North Korean state-sponsored group Kimsuky is leveraging malicious QR codes in spear-phishing campaigns targeting US organizations.
China-linked UAT-7290 has been attributed to espionage intrusions targeting telecommunications providers in South Asia and Southeastern Europe, using Linux malware and edge device exploits.
Threat actors distributed the NodeCordRAT malware via three malicious npm Bitcoin-themed packages, targeting developers and users in the cryptocurrency space.
Fake WinRAR installers are distributing Winzipper malware, using a legitimate installer to mask malicious activity.

Trends, Tools, or Tactics of Interest

Increased use of QR codes in phishing, as seen in North Korean campaigns, indicating evolving social engineering tactics.
Credential stuffing remains a prevalent threat, driven by widespread password reuse.
Attackers are leveraging open-source supply chains, as evidenced by malicious npm packages and vulnerabilities in platforms like Coolify and n8n.
Rapid propagation of malware via messaging platforms (e.g., WhatsApp worm spreading Astaroth).
AI and automation are driving new attack trends, including prompt injection exploits targeting ChatGPT’s memory feature (“ZombieAgent” exploit).
Cloud and SaaS security remain under pressure, with attackers exploiting misconfigurations and vulnerabilities in widely used platforms.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has unveiled a new cyber action plan focused solely on governmental operations, with no guidance for the private sector or critical national infrastructure.
The US Cybersecurity and Infrastructure Security Agency (CISA) retired 10 emergency directives, citing completion or incorporation of required actions into standard practice.
Microsoft will enforce multi-factor authentication (MFA) for all users accessing the Microsoft 365 admin center starting next month.

Cybersecurity Brief – 2026-01-08

Thu, 08 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

The Crimson Collective extortion group claims to have stolen data on over one million Brightspeed broadband customers. Brightspeed is investigating the alleged breach.
Chrome extensions impersonating AITOPIA, with a combined 900,000 downloads, were found exfiltrating users’ AI chat data and browser activity.
Logitech Options+ and G Hub apps for macOS became non-functional after their code-signing certificate expired, preventing users from launching the applications.
Multiple enterprises’ file-sharing instances were breached by the “Zestix” threat actor using infostealers to obtain credentials; lack of multi-factor authentication (MFA) was identified as a common vulnerability.
ownCloud issued a warning to users to enable MFA following reports of credential theft and unauthorised data access.

Newly Discovered Vulnerabilities

A critical unauthenticated remote code execution (RCE) vulnerability (CVSS 10.0, dubbed “Ni8mare”) was disclosed in n8n, a popular workflow automation platform, affecting both self-hosted and cloud deployments.
Veeam released patches for several vulnerabilities in its Backup & Replication software, including a critical RCE flaw (CVSS 9.0) that could allow attackers to compromise backup servers.
jsPDF, a widely used JavaScript PDF generation library, is affected by a critical vulnerability allowing attackers to steal sensitive local files via maliciously crafted PDFs.
A vulnerability in Totolink range extenders enables unauthenticated attackers to start a root-level Telnet service and take over affected devices.
A zero-day vulnerability in discontinued D-Link DSL routers is being actively exploited to execute arbitrary commands remotely on unpatched devices.
CISA added actively exploited vulnerabilities in Microsoft Office and HPE OneView to its Known Exploited Vulnerabilities Catalog, urging immediate remediation.

Notable Threat Actor Activity

North Korean threat actor Kimsuky is distributing mobile malware via phishing sites that use QR codes, targeting users to install malicious apps.
The Black Cat cybercrime group is running an SEO poisoning campaign, creating fraudulent sites advertising popular software to deliver malware to users searching for legitimate downloads.
The pro-Russian hacktivist group NoName057(16) continues to leverage its DDoSia tool to coordinate volunteer-driven DDoS attacks against government, media, and institutional targets associated with Ukraine and Western countries.
The “Zestix” actor used infostealers to compromise cloud credentials and breach approximately 50 enterprise file-sharing environments.
GoBruteforcer botnet activity is increasing, targeting crypto and blockchain projects by brute-forcing exposed databases on servers often configured with weak, AI-generated default credentials.
Threat actors are exploiting complex email routing scenarios and misconfigured spoof protections to impersonate internal domains in phishing campaigns, particularly targeting Microsoft Office 365 tenants with weak configurations.

Trends, Tools, or Tactics of Interest

QR code-based phishing is being actively observed, with attackers embedding QR codes in emails and web pages to lure victims into installing malware or visiting phishing sites.
There is a rise in phishing attacks exploiting email routing misconfigurations and insufficient anti-spoofing controls, enabling domain impersonation and internal phishing.
Cybercriminals are increasingly adopting AI to automate and scale attacks, including “vibe hacking” and the use of tools like “HackGPT” in underground forums, reducing the technical barrier to entry for threat actors.
AI-generated server configuration examples are contributing to insecure deployments, as seen in GoBruteforcer campaigns targeting databases with weak or default passwords.
Affiliate-driven hacktivist campaigns, such as those orchestrated by NoName057(16) with DDoSia, are enabling coordinated volunteer attacks at scale.
Non-human (AI/automation) entities are becoming integral to cybersecurity operations, increasing the attack surface and requiring new approaches to identity and access management.

Regulatory or Policy Developments

The UK government announced a new cybersecurity strategy backed by over £210 million to strengthen cyber defences across public sector organisations and government departments.
OpenAI confirmed that health information shared with ChatGPT Health will not be used to train its models, addressing privacy concerns related to health data.

Cybersecurity Brief – 2025-12-19

Fri, 19 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The University of Sydney suffered a data breach after attackers accessed an online coding repository, resulting in the theft of files containing personal information of staff and students.
The Richmond Behavioral Health Authority (Virginia, US) experienced a ransomware attack, with threat actors stealing names, Social Security numbers, and financial and health information of 113,000 individuals.
French authorities arrested two crew members from an Italian passenger ferry for allegedly installing malware enabling remote control of the vessel. France’s counterespionage agency is investigating the incident as suspected foreign interference.
The US Department of Justice seized the E-Note cryptocurrency exchange, which was allegedly used to launder over $70 million in ransomware payments.

Newly Discovered Vulnerabilities

Hewlett Packard Enterprise (HPE) patched a critical vulnerability (CVE-2025-37164, CVSS 10.0) in OneView software allowing unauthenticated remote code execution.
SonicWall SMA1000 devices were found to be vulnerable to a zero-day flaw that has been exploited in the wild. Attackers chained this with a previously disclosed critical vulnerability to achieve remote code execution. SonicWall has released a patch.
A UEFI vulnerability affecting ASRock, Asus, Gigabyte, and MSI motherboards allows early-boot DMA attacks, exposing systems to compromise before the operating system loads.
CISA issued a warning regarding CVE-2025-59374, a supply chain backdoor in Asus Live Update, which has been exploited in the wild.
Microsoft confirmed that recent Windows updates have caused issues with Azure Virtual Desktop RemoteApp sessions and broke Message Queuing (MSMQ) functionality in Windows 11 and 10.
Automated password spraying attacks are targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect VPN gateways.
A Chrome extension marketed for privacy was found to collect and exfiltrate users’ AI chat data after installation.

Notable Threat Actor Activity

The China-aligned APT group LongNosedGoblin was identified targeting governmental entities in Southeast Asia and Japan, using Windows Group Policy to deploy espionage malware across networks.
North Korea-linked threat actors, including Kimsuky, were responsible for at least $2.02 billion in global cryptocurrency theft in 2025. Kimsuky has also been observed distributing a new Android malware variant, DocSwap, via QR phishing campaigns impersonating Seoul-based delivery apps.
The Clop ransomware group is targeting Gladinet CentreStack file servers exposed to the internet, conducting data theft and extortion operations.
The Iranian APT group “Prince of Persia,” previously considered dormant, has been confirmed active, employing advanced operational security and cryptographic C2 communications to spy on dissidents.
WhatsApp account hijacking attacks using “GhostPairing” are ongoing, where attackers trick users into linking their accounts to attacker-controlled browsers via fake login prompts.
WeChat phishing attacks are increasing outside China, leveraging the platform’s wide functionality for social engineering.

Trends, Tools, or Tactics of Interest

AI-powered deepfake technologies are increasingly accessible, enabling realistic impersonation in video and audio, which is being leveraged for fraud and social engineering.
Ultra-realistic AI face-swapping platforms, such as “Haotian”, are being used to facilitate romance scams, with live video face swaps making detection difficult.
Attackers are refining credential-based attacks, evidenced by new password spraying campaigns against major VPN gateways.
There is a trend of exploiting supply chain vulnerabilities, as seen with the Asus Live Update backdoor.
The adoption of AI copilots and agents in SaaS applications is rising, increasing the attack surface and driving demand for dynamic AI-SaaS security measures.

Regulatory or Policy Developments Affecting the Security Industry

NIS2 compliance is placing increased emphasis on strong identity and access controls, with weak passwords and inadequate multi-factor authentication now considered compliance risks.
The US Immigration and Customs Enforcement (ICE) agency is seeking to expand its cybersecurity capabilities for enhanced internal monitoring and investigation of employees, reflecting a broader trend of increased internal surveillance in government agencies.

Cybersecurity Brief – 2025-11-12

Wed, 12 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

GlobalLogic, a Hitachi group company, is notifying over 10,000 current and former employees of data theft following a breach of Oracle E-Business Suite (EBS).
The Rhadamanthys infostealer malware operation has been disrupted, with operators and customers losing access to their servers.
A Chinese national known as the “Bitcoin Queen” was sentenced in London to over 11 years in prison for laundering Bitcoin from a $7.3 billion cryptocurrency investment scam.

Newly Discovered Vulnerabilities

Microsoft’s November 2025 Patch Tuesday addressed 63 vulnerabilities, including one actively exploited Windows kernel zero-day and several critical flaws. Emergency and cumulative updates were also released for Windows 10 and Windows 11 to address security vulnerabilities and ESU enrollment issues.
Synology patched a critical remote code execution vulnerability in BeeStation products, demonstrated at Pwn2Own Ireland.
Gladinet’s Triofox file-sharing and remote-access platform was found to have a critical vulnerability that allowed attackers to exploit the built-in antivirus feature to gain SYSTEM privileges and deploy remote access tools.
SAP released patches for multiple vulnerabilities, including a maximum severity flaw in SQL Anywhere Monitor due to hardcoded credentials and a critical code execution issue in Solution Manager.
Adobe released security updates addressing 29 vulnerabilities across multiple products, including InDesign, InCopy, Photoshop, Illustrator, Pass, Substance 3D Stager, and Format Plugins.
A critical zero-day vulnerability affecting Samsung mobile devices was exploited in the wild to deliver LANDFALL spyware.
Mozilla introduced new fingerprinting protections in Firefox, reducing the number of trackable users.
A new side-channel attack, dubbed “Whisper Leak,” allows attackers intercepting network traffic to infer user prompt topics in large language model (LLM) conversations, despite end-to-end encryption.

Notable Threat Actor Activity

Threat actors are distributing a new banking malware called “Maverick” via WhatsApp, targeting major Brazilian banks. Maverick shares similarities with the Coyote banking malware.
GootLoader malware has resurfaced, now using a novel font-based obfuscation technique to hide malicious payloads on compromised WordPress sites.
A malicious npm package, “@acitons/artifact”, was discovered typosquatting the legitimate “@actions/artifact” package, targeting GitHub-owned repositories.
The Fantasy Hub Android remote access trojan (RAT) is being sold on Russian-speaking Telegram channels as a Malware-as-a-Service (MaaS), turning Telegram into a distribution hub for threat actors.
Kimsuky (DPRK-linked) APT group is exploiting Google Find Hub to compromise South Korean Android devices, remotely wiping devices and abusing the KakaoTalk messaging app.
RansomHub ransomware was detected during an in-progress attack, initiated via fake browser updates and leading to domain-admin privilege escalation.
Scammers are using AI-generated fake faces combined with real body images in extortion scams, and leveraging AI voice cloning and open-source data for social engineering attacks, particularly targeting the elderly.
Thieves are increasingly phishing Apple ID credentials through fake “Find My” messages to unlock stolen iPhones.

Trends, Tools, or Tactics of Interest

AI-enabled supply chain attacks increased by 156% over the past year, with CISOs advised to reassess traditional defenses.
Script-kiddie-level phishing campaigns remain effective at rapidly stealing credentials, even with poorly crafted lures.
The use of Telegram as a central hub for malware distribution and MaaS offerings is increasing.
Threat actors are exploiting built-in software features (e.g., antivirus in Triofox) to escalate privileges and deploy malware.
Fake browser update lures are being used as initial access vectors for ransomware attacks.
Social engineering attacks are leveraging AI-generated content and public data to bypass human defences.

Regulatory or Policy Developments

The US Department of Defense began enforcement of Cybersecurity Maturity Model Certification (CMMC) requirements for contractors on 10 November 2025.
Microsoft announced end of security update support for Windows 11 23H2 Home and Pro editions; extended security updates for Windows 10 are now available.
Firefox introduced new privacy protections to reduce user tracking.
Tenzai, an Israeli startup, raised $75 million in seed funding to develop an AI-powered penetration testing platform.

Cybersecurity Brief – 2025-11-05

Wed, 05 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The Swedish IT systems supplier Miljödata suffered a data breach impacting 1.5 million individuals. The Swedish Authority for Privacy Protection (IMY) is investigating.
Japanese media conglomerate Nikkei reported a data breach after its Slack platform was compromised, exposing personal data of over 17,000 employees and business partners.
Hundreds of malicious Android apps on Google Play were downloaded over 42 million times between June 2024 and May 2025, according to Zscaler, distributing various malware strains.
Threat actors are actively exploiting a critical vulnerability in the Post SMTP WordPress plugin (installed on 400,000+ sites) to hijack admin accounts.
Attackers are exploiting a critical authentication bypass flaw in the JobMonster WordPress theme, allowing admin account hijacking under certain conditions.
European authorities dismantled a cryptocurrency fraud and money laundering network responsible for defrauding victims of over €600 million, arresting nine individuals.
U.S. prosecutors indicted three individuals for deploying BlackCat (ALPHV) ransomware against five U.S. companies between May and November 2023, resulting in network compromise and extortion.
Transportation and logistics companies have been targeted by threat actors using sophisticated attack chains to deploy remote access tools and steal cargo.

Newly Discovered Vulnerabilities

CISA added critical vulnerabilities in Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog. The CWP flaw (CVE-2025-48703) allows remote, unauthenticated command execution and is being actively exploited.
A critical vulnerability (CVE-2025-11953) in the “@react-native-community/cli” npm package for React Native allowed arbitrary command/code execution on Windows, macOS, and Linux. The issue has now been patched.
Four security flaws were disclosed in Microsoft Teams enabling attackers to impersonate colleagues and edit messages without detection, facilitating social engineering and phishing attacks.
Google’s AI-powered agent “Big Sleep” discovered five new vulnerabilities in Apple’s Safari WebKit. Apple has issued patches addressing these and over 100 other vulnerabilities across its operating systems.
The November 2025 Android update patched two critical remote code execution vulnerabilities in the platform’s System component.
Apple released updates for iOS and macOS addressing 110 vulnerabilities, including 19 in WebKit, some of which were critical.

Notable Threat Actor Activity

A new cybercrime collective has formed, merging Scattered Spider, LAPSUS$, and ShinyHunters. The group has created at least 16 Telegram channels since August 2025, indicating increased coordination.
The Russian threat group “Curly COMrades” is abusing Microsoft Hyper-V to deploy hidden Alpine Linux-based virtual machines on Windows hosts, bypassing endpoint detection and response (EDR) solutions to run malware undetected.
Operation SkyCloak: Threat actors are deploying a Tor-enabled OpenSSH backdoor via weaponized phishing attachments, targeting defense sectors in Russia and Belarus.
The North Korean group Kimsuky has debuted the HTTPTroy backdoor against South Korean targets, with enhanced obfuscation and anti-analysis features.
The SesameOp backdoor has been observed using the OpenAI API as a covert command-and-control (C2) channel, demonstrating the misuse of generative AI services for stealthy communications.
Criminals are impersonating U.S. Immigration and Customs Enforcement (ICE) agents in social engineering campaigns, prompting an FBI warning to law enforcement.

Trends, Tools, or Tactics of Interest

Browser sandbox evasion: Attackers are exploiting browser behaviors to steal credentials, abuse extensions, and move laterally, bypassing traditional security tools.
Increased ransomware and extortion attacks in Europe, with attackers leveraging geopolitical tensions and AI-enhanced social engineering.
Malicious Android apps continue to proliferate on official app stores, using fake news and identification apps as lures for banking trojans and data theft.
Use of AI and cloud APIs (e.g., OpenAI) by threat actors for covert C2 and operational security.
Open source security: The Wazuh platform is being promoted for ransomware defense, reflecting ongoing interest in open source security tooling.

Regulatory or Policy Developments

Microsoft announced plans to remove Defender Application Guard from Office, starting with Office version 2602 in February 2026 and completing removal by December 2027.
California fined Sling TV for deceptive privacy practices, including misleading opt-out controls and improper use of children’s data for ad targeting.
The Swedish privacy regulator (IMY) is investigating the Miljödata breach for potential violations of data protection requirements.

Industry Moves

Bugcrowd acquired application security firm Mayhem, nearly doubling its valuation.
Zscaler acquired AI security company SPLX to enhance its Zero Trust Exchange platform with red teaming and threat inspection capabilities.

Cybersecurity Brief – 2025-11-04

Tue, 04 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers stole over $120 million from the Balancer DeFi crypto protocol by targeting its v2 pools.
A major breach at the Kansas City, Kansas, Police Department exposed a list of alleged officer misconduct, including dishonesty, sexual harassment, excessive force, and false arrests.
Everest ransomware group claimed responsibility for recent attacks, according to Check Point’s latest threat intelligence report.

Newly Discovered Vulnerabilities

XWiki (CVE-2025-24893): Exploit attempts have been observed against XWiki’s SolrSearch component, which allows arbitrary remote code execution. A patch was released in February.
Google Chrome: Two high-severity vulnerabilities in the V8 JavaScript engine (type confusion and inappropriate implementation) were disclosed, with Google awarding $100,000 in bug bounties.
Microsoft WSUS: An out-of-band update to patch an actively exploited Windows Server Update Service vulnerability has disabled hotpatching on some Windows Server 2025 systems.

Notable Threat Actor Activity

Lazarus Group targeted Web3 entities, using advanced tools and rapid exploitation of new vulnerabilities.
North Korea-linked Kimsuky group deployed a new backdoor, HttpTroy, disguised as a VPN invoice in a likely spear-phishing attack in South Korea.
Chinese APTs used new ‘Airstalk’ malware (PowerShell and .NET variants) in supply chain attacks, abusing AirWatch’s MDM API for C2 communication.
Cybercriminals are increasingly targeting logistics and freight networks by deploying remote monitoring and management (RMM) tools to hijack cargo and steal physical shipments.
Three former US cybersecurity professionals were indicted for conducting BlackCat (ALPHV) ransomware attacks against five US companies.
Ukrainian national Yuriy Igorevich Rybtsov (aka MrICQ) was extradited to the US to face charges related to the Jabber Zeus cybercrime operation.

Trends, Tools, or Tactics of Interest

AI Poisoning: New research indicates attackers can more easily poison AI models by introducing malicious data, increasing the risk of models producing harmful outputs.
Abuse of AI APIs: Microsoft identified the ‘SesameOp’ backdoor, which uses the OpenAI Assistants API as a covert C2 channel. Additionally, Claude AI APIs can be abused for data exfiltration via prompt injection.
Malicious VSCode Extensions: The ‘SleepyDuck’ remote access trojan was found in a fake Solidity extension on the Open VSX registry, using an Ethereum smart contract for C2.
Android Malware: BankBot-YNRK and DeliveryRAT trojans are actively stealing financial data from Android users, with BankBot-YNRK reportedly muting device alerts and draining cryptocurrency wallets, primarily targeting Indonesia.
TruffleNet Attack: Attackers use frameworks based on TruffleHog to leverage stolen credentials for AWS account compromise, leading to reconnaissance and business email compromise (BEC).
Device Code Phishing: Attackers are exploiting OAuth device flows, with significant differences in attack surfaces between Azure and Google.
Fake AI Apps: There is an increase in fake ChatGPT and AI-related apps in app stores, some containing adware or spyware.
SOC Operations: Security Operations Centers are increasingly overwhelmed by alert volumes, leading to a shift toward continuous exposure management and automation.
Generative AI in Malware Analysis: Generative AI is being used to accelerate reverse engineering of malware such as XLoader.

Regulatory or Policy Developments

OpenAI Safety Panel: A panel led by Zico Kolter at OpenAI now has the authority to halt the release of new AI systems if deemed unsafe.
Electrical Grid Security: Regulators and industry experts are advocating for the convergence of cyber and physical security strategies for the power grid, reflecting increased attack activity on critical infrastructure.

Cybersecurity Brief – 2025-09-17

Wed, 17 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover has extended its production shutdown for another week following a significant cyberattack that impacted systems at the end of August.
The US Department of Homeland Security exposed sensitive national security intelligence, including surveillance data on Americans, to thousands of unauthorized users due to a misconfigured data hub.
The RaccoonO365 phishing network, responsible for large-scale phishing campaigns, was dismantled following a joint operation by Microsoft and Cloudflare, resulting in the takedown of 338 malicious domains.
Google has removed 224 Android applications involved in the “SlopAds” ad fraud operation, which generated 2.3 billion ad requests daily and affected 38 million downloads globally.
At least 187 npm packages were compromised in a self-propagating supply chain attack, dubbed ‘Shai-Hulud’, which stole developer credentials and spread malware through infected packages.
The BreachForums hacking forum administrator, Conor Brian Fitzpatrick, was resentenced to three years in prison for cybercrime charges, including the operation of the forum and possession of CSAM.

Newly Discovered Vulnerabilities

Apple released security updates for iOS, macOS, and older iPhone/iPad models, addressing over 50 vulnerabilities, including CVE-2025-43300, an out-of-bounds flaw actively exploited in sophisticated spyware attacks.
Multiple critical vulnerabilities were disclosed in Chaos Mesh, a chaos engineering platform for Kubernetes, allowing for remote code execution and potential full cluster takeover.
A new Rowhammer attack, named Phoenix, was demonstrated against DDR5 memory, achieving root access on systems in under two minutes.
ChatGPT’s new calendar integration was shown to be exploitable for email exfiltration via crafted calendar invites.

Notable Threat Actor Activity

RevengeHotels, an established cybercrime group, has launched a new campaign in Latin America leveraging large language models (LLMs) to generate malicious scripts and using VenomRAT in targeted phishing attacks.
The North Korean group Kimsuky used ChatGPT to create deepfake military ID documents in attempts to compromise South Korean targets.
A new FileFix variant is delivering the StealC infostealer malware through multilingual phishing sites, using code obfuscation and steganography, and impersonating Meta account suspension warnings.
The Yurei ransomware group, believed to operate from Morocco, has claimed its first victims using a modified Prince-Ransomware binary.
The SlopAds fraud ring exploited commercial adtech infrastructure, including links to PropellerAds, to orchestrate its global ad fraud operation.
Security industry experts remain skeptical of claims by Scattered Spider and ShinyHunters that they are retiring, suggesting continued threat activity is likely.

Trends, Tools, or Tactics of Interest

Shadow AI threats are increasing, with reports highlighting the use of generative AI and autonomous agents in both attacks and enterprise workflows.
Phishing-as-a-service operations, such as RaccoonO365, continue to leverage large-scale domain infrastructure for credential theft.
Supply chain attacks targeting open-source repositories (npm) are increasingly employing self-replicating, worm-like malware to propagate and exfiltrate credentials.
AI chatbots, including ChatGPT and Grok, are being used to generate phishing emails and malicious code, with a noted focus on targeting vulnerable populations such as senior citizens.
Children and teenagers are increasingly involved in hacking school systems, often underestimating the consequences.
The FileFix campaign demonstrates advanced social engineering, using multilingual phishing, steganography, and code obfuscation.
The removal of WMIC (Windows Management Instrumentation Command-line) tool is planned for Windows 11 25H2 and later, impacting system administration and automation practices.
The emergence of new security solutions focused on AI agent management (Astrix), browser security (Neon Cyber), and real-time, AI-driven data protection (Ray Security) reflects a shift toward addressing AI-native and browser-based threats.

Regulatory or Policy Developments Affecting the Security Industry

CrowdStrike announced the acquisition of Pangea to launch AI Detection and Response (AIDR), expanding protection for enterprise AI models and applications.
Check Point is acquiring AI security firm Lakera, underlining growing industry demand for AI-native security solutions amid increased generative AI adoption.
Apple’s backporting of zero-day patches to older devices addresses ongoing exploitation concerns and highlights regulatory and customer pressure for extended device support.

Cybersecurity Brief – 2025-08-12

Tue, 12 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Connex Credit Union disclosed a data breach affecting 172,000 members, with attackers stealing personal and financial information after breaching its systems.
The Netherlands’ National Cyber Security Centre (NCSC) reported exploitation of Citrix NetScaler vulnerability CVE-2025-6543 to breach critical organisations in the country.
Air France experienced a data breach resulting in the leak of frequent flyer data (as per Check Point’s weekly threat bulletin).
A major automaker’s dealership platform used by over 1,000 US dealerships was found to be vulnerable, allowing car hacking and personal data theft, including the ability for unauthorised remote vehicle unlocking.
Two hackers reportedly breached North Korean state-sponsored group Kimsuky, stealing and leaking internal data.
Law enforcement, in collaboration with international partners, took down infrastructure and seized over $1 million associated with the BlackSuit (Royal) ransomware group.
Over 29,000 Microsoft Exchange servers remain unpatched against a high-severity vulnerability, leaving them exposed to lateral movement and cloud environment compromise.

Newly Discovered Vulnerabilities

Researchers identified new security flaws in the TETRA (Terrestrial Trunked Radio) communications protocol, including weaknesses in its proprietary end-to-end encryption, impacting law enforcement and critical infrastructure communications.
A critical vulnerability in the OPC UA industrial protocol was disclosed, exposing utilities and factories to risk despite the protocol’s use of complex cryptography.
A sandbox escape with remote code execution was discovered in Google Chrome, earning a $250,000 bug bounty.
A path traversal vulnerability in WinRAR (CVE-2025-8088) was exploited as a zero-day by the Russian ‘RomCom’ group, targeting financial, defence, manufacturing, and logistics sectors in Europe and Canada.
A BadUSB attack technique, dubbed BadCam, was demonstrated against Lenovo Linux webcams, allowing persistent compromise via malicious USB devices.
Flaws in a major automaker’s dealership portal exposed customer and vehicle data and enabled unauthorised remote access to vehicles.

Notable Threat Actor Activity

The Russian-linked ‘RomCom’ hacking group exploited the WinRAR CVE-2025-8088 zero-day in targeted attacks on organisations in Europe and Canada.
North Korean Kimsuky hackers were themselves compromised, with internal data reportedly leaked by adversarial actors.
US authorities charged four Ghanaian nationals for their involvement in a $100 million fraud ring involving romance scams and business email compromise attacks.
The BlackSuit (Royal) ransomware gang suffered infrastructure seizures and asset forfeiture following coordinated law enforcement action.
An affiliate of the REvil ransomware group accused the Russian government of orchestrating the 2021 Kaseya supply chain attack.
Malicious actors have been actively exploiting a critical Erlang/OTP SSH vulnerability, with 70% of detected attacks targeting operational technology (OT) firewalls.

Trends, Tools, or Tactics of Interest

Surge in exploitation of Erlang/OTP SSH vulnerabilities, with a focus on OT firewall targets.
Increase in “native phishing” campaigns, where attackers abuse Microsoft 365 apps such as OneNote and OneDrive to deliver internal phishing lures.
Jailbreaking techniques for GPT-5 were demonstrated using “echo chamber” prompts and storytelling, bypassing safeguards without using inappropriate language.
The DarkBit ransomware (linked to MuddyWater) encryption was cracked by researchers, enabling free victim data recovery.
Exposure of persistent threats via USB-based attacks (BadCam) targeting Linux webcams.
Ongoing risk from large numbers of unpatched Exchange servers, facilitating potential lateral movement and cloud compromise.

Regulatory or Policy Developments

The Netherlands’ NCSC issued a public warning regarding active exploitation of Citrix NetScaler CVE-2025-6543, urging immediate remediation for critical infrastructure.

Cybersecurity Brief – 2025-04-22

Tue, 22 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

NLRB Data Exfiltration by DOGE: A whistleblower alleges that employees from Elon Musk’s Department of Government Efficiency (DOGE) siphoned gigabytes of sensitive case data from the US National Labor Relations Board (NLRB).
City of Abilene Cyberattack: The city of Abilene, Texas, took systems offline following a detected cyber incident.
Japan Brokerage Account Breaches: Japanese regulators issued an urgent warning after hundreds of millions of dollars in unauthorized trades were made from hacked brokerage accounts.
Microsoft Entra Account Lockouts: Microsoft confirmed that recent Entra account lockouts were caused by a mishap involving the logging of short-lived user refresh tokens.
‘Fog’ Ransomware Campaign: The ‘Fog’ ransomware group, known for trolling victims with DOGE-themed ransom notes, has compromised over 100 victims since January.
WordPress Ad Fraud Operation ‘Scallywag’: A large-scale ad fraud operation using malicious WordPress plugins generated approximately 1.4 billion fraudulent ad requests daily, primarily monetizing pirating and URL shortening sites.

Newly Discovered Vulnerabilities

ASUS AiCloud Router Vulnerability: ASUS urged immediate patching of a critical 9.2 CVSS-rated vulnerability in its AiCloud router series, exploitable via crafted requests.
BlueKeep RDP Exploitation by Kimsuky: North Korean threat actor Kimsuky is actively exploiting the BlueKeep (CVE-2019-0708) RDP vulnerability, despite it being patched, to breach systems in South Korea and Japan.

Notable Threat Actor Activity

Lumma Stealer Distribution: Security researchers detailed the distribution channels of Lumma Stealer, observed in recent incident response cases, including its use of fake CAPTCHA attacks.
Lotus Panda Espionage: The China-linked Lotus Panda group conducted a campaign targeting Southeast Asian government entities, deploying browser stealers and sideloaded malware.
Kimsuky Campaigns: Kimsuky continues to leverage legacy vulnerabilities (BlueKeep) for initial access, targeting East Asian organisations.
SuperCard X Android Malware: A new malware-as-a-service (MaaS) platform, SuperCard X, enables cybercriminals to conduct NFC relay attacks for contactless ATM and PoS fraud.
‘Elusive Comet’ Social Engineering: This threat actor uses sophisticated social engineering via Zoom to deliver infostealers or RATs to victims.
SVG-based Phishing: Attackers are increasingly embedding HTML or JavaScript code within SVG email attachments to bypass detection and deliver phishing payloads.

Trends, Tools, and Tactics

Professionalisation of Southeast Asian Cyber Fraud: Organised cybercrime groups in Southeast Asia are expanding globally and deepening ties with other regional networks, despite ongoing crackdowns.
Nation-State Focus on SMBs: Nation-state actors are increasingly targeting small and medium-sized businesses, especially those in the supply chain for larger enterprises.
Ad Fraud via WordPress Plugins: Malicious plugins are being used at scale to automate ad fraud, highlighting ongoing abuse of open-source platforms.
Device Management Limitations: Industry commentary stresses that device management alone does not equate to device trust, as initial access often exploits credentials and unmanaged devices.
Ongoing Malicious Advertising: Despite advances in detection, malicious ad URLs remain prevalent, underscoring persistent gaps in web security and user awareness.
YARA Rule Automation: Tools like xorsearch.py are being used to generate ad hoc YARA rules from regex patterns for more efficient malware hunting.

Regulatory and Policy Developments

Japanese Regulatory Response: Japanese authorities are responding to major financial account breaches with urgent warnings and likely increased scrutiny of brokerage cybersecurity.
CISA Leadership Changes: Two senior officials, Bob Lord and Lauren Zabierek, have resigned from the US Cybersecurity and Infrastructure Security Agency (CISA), potentially impacting ongoing federal cybersecurity initiatives.

Emerging Security Concerns

AI and Privacy Risks: Demonstrations show that AI tools like ChatGPT can extract location data from photos without embedded metadata, raising privacy and OSINT concerns.
AI in Public Safety: Motorola Solutions is deploying AI-enabled body cameras for first responders, highlighting the growing integration of AI in law enforcement technology and associated security considerations.