Lumma on DanSec Daily

Cybersecurity Brief – 2026-04-17

Fri, 17 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked data from 13.5 million McGraw Hill user accounts, obtained after breaching the company’s Salesforce environment.
Cookeville Regional Medical Center in Tennessee reported a data breach affecting 337,000 individuals after a Rhysida ransomware attack that resulted in 500GB of data theft.
A new campaign in the Czech Republic is actively targeting workers with the previously undocumented PowMix botnet, using randomized C2 traffic.
ZionSiphon malware has been identified as targeting operational technology in water treatment and desalination facilities, aiming to sabotage operations.
A DHL-themed phishing campaign is distributing remote access software designed to facilitate further malware deployment, including ransomware.
Attackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy NKAbuse malware via Hugging Face Spaces.
A fake Slack installer is being used to provide attackers with a hidden desktop environment on victim machines for data and account access.
The ShinyHunters group leaked data from 13.5 million McGraw Hill user accounts, stolen via a Salesforce breach.
A data breach at Cookeville Regional Medical Center affected 337,000 individuals due to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco released patches for four critical vulnerabilities in Identity Services Engine (ISE) and Webex Services, which could allow remote code execution or user impersonation. One Webex flaw requires customer action to be fully remediated.
A high-severity vulnerability in Apache ActiveMQ Classic (CVE-2026-34197) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Splunk Enterprise patched a vulnerability allowing low-privileged users to upload files to a temporary directory and achieve remote code execution.
A critical vulnerability in Cursor AI could be exploited through chained prompt injection and sandbox bypass, enabling shell access to developer machines.
Three recently disclosed Windows zero-days are being actively exploited to gain SYSTEM or elevated administrator privileges.
A second Microsoft Defender zero-day, “RedSun,” with a published proof-of-concept, enables SYSTEM privilege escalation.
Microsoft’s April 2026 security updates are causing reboot loops on some Windows domain controllers.
A 17-year-old remote code execution vulnerability in Microsoft Excel has been highlighted as still present and exploitable.

Notable Threat Actor Activity

Operation PowerOFF, an international law enforcement effort, seized 53 DDoS-for-hire domains, arrested four individuals, and identified 75,000 DDoS service users across 21 countries, exposing 3 million criminal accounts.
The North Korean threat group Sapphire Sleet is using fake job offers and fraudulent Zoom updates to deliver ClickFix malware, targeting macOS users to steal credentials and sensitive data.
U.S. nationals were sentenced for operating a “laptop farm” supporting North Korean IT workers in obtaining jobs at over 100 U.S. companies, including defense contractors.
Adware previously considered benign, “Dragon Boss,” was updated to establish persistence and disable Windows Defender, facilitating future malware delivery.
The Lumma Stealer malware is being used in conjunction with the Sectop RAT (ArechClient2) for credential theft and remote access.
A new cybercrime platform, ATHR, is enabling automated voice phishing (vishing) attacks using both human operators and AI agents to harvest credentials.
Hackers are exploiting a Marimo notebook flaw to deploy NKAbuse malware hosted on Hugging Face Spaces.

Trends, Tools, or Tactics of Interest

AI is increasingly being integrated into security operations, with mixed results: KnowBe4 reports improved administration and lower cyber risk using AI agents, while most “AI SOCs” are noted as only improving triage speed rather than reducing workload.
Google is expanding the use of Gemini AI models to detect and block malicious ads as threat actors evolve their tactics to evade detection.
Social engineering through software supply chain attacks continues, with Obsidian plugin abuse delivering PHANTOMPULSE RAT in targeted attacks on finance and cryptocurrency sectors.
Forgotten or unmanaged non-human identities (e.g., service accounts, API keys) are cited as a leading cause of cloud breaches, accounting for 68% in 2024.
A Taboola pixel approved by a bank was found to redirect logged-in banking sessions to a Temu tracking endpoint without consent or security review.
Two-factor authentication is being promoted as a needed security layer beyond traditional IT environments due to increasing threat actor sophistication.
OpenAI has expanded access to its GPT‑5.4‑Cyber model, designed to support defenders in cybersecurity operations.
Malware campaigns are increasingly leveraging trojanized installers (e.g., Slack) and themed phishing emails (e.g., DHL, iCloud) to distribute remote access tools and steal credentials.

Regulatory or Policy Developments Affecting the Security Industry

NIST announced it will limit enrichment of CVEs in the National Vulnerability Database due to a 263% increase in submissions, prioritizing those in the CISA KEV catalog and critical software.
Microsoft’s original Windows Secure Boot certificate is expiring, requiring coordinated updates across the Windows ecosystem.
The EU has launched an anonymous online age verification app, making it freely available to companies for compliance with age-restriction regulations.

Cybersecurity Brief – 2025-10-21

Tue, 21 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

F5 disclosed a cyber attack, reportedly carried out by threat actors who maintained long-term, undetected access to internal systems.
Retailer Muji suspended online sales after a ransomware attack on its delivery partner, Askul, caused a logistics outage.
Envoy Air, an American Airlines subsidiary, confirmed a breach resulting in the theft of business information following an Oracle-related hack.
A European telecommunications organization was breached using Snappybee malware and a Citrix vulnerability, attributed to the China-linked Salt Typhoon group.
AWS suffered a significant outage, disrupting Amazon.com, Prime Video, Fortnite, Perplexity AI, Canva, and other major services for approximately two hours.
A phishing campaign impersonating Home Depot used fake giveaways and tracking pixels to lure victims and compromise data.
Over 75,000 WatchGuard Firebox security appliances remain exposed online and vulnerable to a critical remote code execution flaw (CVE-2025-9242).
131 malicious Chrome extensions, cloned from a WhatsApp Web automation tool, were used to hijack WhatsApp Web sessions and conduct large-scale spam campaigns, primarily targeting Brazilian users.
A self-propagating malware named GlassWorm targeted the OpenVSX and Visual Studio Code extension registries, infecting an estimated 36,000 developer systems and acting as a criminal proxy network.

Newly Discovered Vulnerabilities

U.S. CISA added five new exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, including flaws in Oracle and Microsoft products.
A high-severity Windows SMB privilege escalation vulnerability is now being actively exploited in the wild, allowing attackers to gain SYSTEM privileges on unpatched systems.
A critical flaw (CVE-2025-9242) in WatchGuard Firebox appliances remains unpatched in tens of thousands of devices, enabling remote code execution.
ConnectWise patched a critical vulnerability in its Automate RMM tool that could allow attackers to intercept and tamper with communications in certain configurations.
A vulnerability in Dolby Decoder on Android allows for zero-click attacks via out-of-bounds writes during media file processing.
Microsoft released fixes for Windows Server Active Directory sync issues and addressed smart card authentication problems caused by recent security updates.
October Windows security updates introduced issues with USB input devices (mice and keyboards) in the Windows Recovery Environment (WinRE).
Oracle E-Business Suite customers were exposed to risk due to conflicting vendor guidance on deploying a recent zero-day patch.

Notable Threat Actor Activity

The Russia-linked COLDRIVER (a.k.a. ColdRiver) group developed and deployed three new malware families, demonstrating increased operational tempo and rapid adaptation.
The China-linked Salt Typhoon group used Snappybee malware and a Citrix flaw to conduct cyber espionage against a European telecom operator.
The Lumma Stealer group saw a significant drop in activity after the core members’ identities were exposed in an underground doxxing campaign.
Chinese cybercriminal gangs utilized US SIM farms and money mules to run large-scale text message scams targeting Americans, generating over $1 billion in illicit proceeds.
Law enforcement dismantled a major SIM box criminal network in Europe, arresting seven individuals and disrupting a cybercrime-as-a-service platform responsible for €5 million in losses.

Trends, Tools, or Tactics of Interest

Long-term, stealthy breaches are increasingly common, as evidenced by the F5 incident and recent rootkit discoveries in Linux environments.
ClickFix and similar browser-based copy/paste attacks are a growing cause of security breaches, exploiting user interaction with malicious scripts.
Malicious OAuth applications are being used to infiltrate Microsoft 365 tenants; tools like Cazadora are being deployed to detect hidden rogue apps.
The GlassWorm malware campaign highlights the ongoing risk of supply-chain attacks against developer ecosystems, with self-spreading malware targeting code extension marketplaces.
SIM farms and SIM box infrastructure continue to enable cybercrime-as-a-service offerings, facilitating large-scale fraud and spam operations.
New microchip technology (“FD-SOI”) is being developed to protect vehicles from laser-based hardware attacks, with implications for regulatory compliance in the automotive sector.
BYOD risks are expanding to include vehicles, with researchers demonstrating that attacks on connected cars can potentially bridge to corporate networks via employee devices.

Regulatory or Policy Developments

The DNS0.EU non-profit public DNS service for European users announced an immediate shutdown due to sustainability issues, impacting privacy-focused DNS options in the region.
A U.S. judge ordered NSO Group to cease hacking WhatsApp but reduced damages from $167 million to $4 million.
South Korea is intensifying efforts to prosecute online scam suspects repatriated from Cambodia, responding to public pressure over overseas cybercrime.
Anthropic, in partnership with the U.S. government, introduced a filter to prevent its Claude AI from providing information relevant to nuclear weapon construction, reflecting ongoing policy attention to AI misuse.

Cybersecurity Brief – 2025-07-24

Thu, 24 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The US National Nuclear Security Administration was breached via exploitation of a Microsoft SharePoint zero-day vulnerability chain. At least three Chinese nation-state cyber-espionage groups are implicated in targeting older, on-premises SharePoint instances after a flawed patch attempt.
Clorox has filed a $380M lawsuit against Cognizant, alleging gross negligence after hackers successfully impersonated an employee and convinced the help desk to reset credentials, enabling a major August 2023 cyberattack.
Ongoing phishing campaigns are mimicking the US Department of Education’s G5 grant portal, exploiting recent layoffs and political turmoil to target users.
The npm package ‘is’, with 2.8 million weekly downloads, was compromised in a supply chain attack, injecting backdoor malware that gave attackers full device access.
npm accidentally removed the Stylus package, breaking builds and pipelines globally that depend on the library.
Ukraine arrested the suspected administrator of the Russian-language cybercrime forum XSS.is at the request of French authorities.

Newly Discovered Vulnerabilities

Sophos patched five critical vulnerabilities in Sophos Firewall that allowed for remote code execution by unauthenticated attackers.
CISA issued an alert regarding active exploitation of two vulnerabilities in SysAid ITSM software, which attackers are using to hijack administrator accounts.
Cisco reported active exploitation attempts of critical Cisco Identity Services Engine (ISE) vulnerabilities, which could lead to unauthenticated remote code execution.
Multiple high-severity memory safety vulnerabilities were patched in both Chrome and Firefox browsers.
Persistent exploitation of known Ivanti remote code execution vulnerabilities continues, particularly affecting Japanese organizations due to patching complications.

Notable Threat Actor Activity

Threat actor “Mimo” has shifted tactics to target Magento CMS and misconfigured Docker instances for crypto mining and proxyware deployment, expanding from previous campaigns against Craft CMS.
Chinese threat actors continue to exploit Ivanti RCE vulnerabilities in targeted attacks.
The Lumma Stealer malware re-emerged and resumed activity after a prior law enforcement takedown.
The Interlock ransomware group is actively targeting organizations through drive-by download attacks, prompting a government alert.
Hackers are using stolen credit cards and loyalty points to book travel for clients, with risks extending to remote workers, SMBs, and travel brands.

Trends, Tools, or Tactics of Interest

Researchers identified a new stealthy WordPress backdoor hidden in the “mu-plugins” directory, enabling persistent administrative access and evading standard detection.
The Coyote banking trojan is the first known malware to abuse the Windows UI Automation (UIA) accessibility framework to steal banking credentials, with attacks observed against banks and crypto exchanges in Brazil.
Kerberoasting attacks remain effective due to weaknesses in current detection methods; new approaches to detection and Active Directory hardening are being discussed.
Increased exploitation of SharePoint vulnerabilities is observed, with multiple exploit attempts and scanning activity detected shortly after public disclosure.
File integrity monitoring receives renewed focus with the release of the ficheck.py tool for forensic analysis.
Google launched the OSS Rebuild initiative to enhance security in open-source package ecosystems and address software supply chain attack risks.
Brave browser implemented a feature to block Windows Recall from capturing screenshots of browser activity by default.
Proton launched “Lumo,” a privacy-focused encrypted AI assistant that does not log user conversations or use prompts for training.
OpenAI is rolling out new ChatGPT features, including “personality” toggles and a “Study together” mode for exam preparation.
AI bot traffic is increasingly impacting website performance, with new mitigation strategies under discussion.
OpenAI CEO Sam Altman warned of the rising threat of AI voice fraud in banking, stating that voice clones are becoming indistinguishable from real voices and require new verification methods.

Regulatory or Policy Developments

The UK is considering a ban on ransomware payments, with debate over potential unintended consequences such as victims hiding incidents or attackers shifting tactics.
ISO 42001, a new international standard for AI governance, is being highlighted as a framework for responsible AI development and deployment.

Cybersecurity Brief – 2025-07-23

Wed, 23 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

AMEOS Group, a large Central European healthcare network, disclosed a security breach potentially exposing customer, employee, and partner information.
Dior confirmed a cyberattack from January 2025 that resulted in the theft of personal information. Payment information was not compromised.
Dell reported a breach of its Customer Solution Center demo environment by the World Leaks group. The company stated the leaked data was synthetic and not from real customers or partners.
A tech startup was found to be selling personal data stolen by infostealer malware and sourced from the dark web.

Newly Discovered Vulnerabilities

Microsoft SharePoint: Two critical vulnerabilities (CVE-2025-49704, CVE-2025-49706) are under active exploitation, with CISA adding them to its Known Exploited Vulnerabilities (KEV) catalog. The flaws have been exploited since at least July 7, 2025.
Cisco Identity Services Engine (ISE): Three recently patched critical remote code execution vulnerabilities are being actively exploited, allowing unauthenticated root access.
Helmholz REX 100 Industrial Routers: Eight vulnerabilities, including those enabling full device control, were discovered and patched.
Microsoft Windows Server: KB5062557 update is causing cluster service and virtual machine restart issues.
Coyote Banking Trojan: A new variant is abusing Microsoft’s UI Automation framework to identify and target banking and cryptocurrency exchange sites.

Notable Threat Actor Activity

Chinese APTs (Linen Typhoon, Violet Typhoon, Storm-2603): Attributed to the exploitation of SharePoint zero-day vulnerabilities (ToolShell chain) targeting internet-facing SharePoint servers, with activity traced back to early July 2025.
China-backed APT41: Conducted a sophisticated cyber-espionage attack on an African IT company, marking the group’s expansion into new geographic regions.
Russian APTs: Three groups and 18 individuals sanctioned by the UK government for involvement in cyber operations against Ukraine, NATO, and the EU.
Interlock Ransomware: CISA and the FBI reported escalating double extortion attacks targeting businesses and critical infrastructure.
AllaKore RAT, SystemBC, PureRAT, and Hijack Loader: Continued use in credential theft and remote access campaigns, particularly targeting Mexican organizations.
Lumma Infostealer: Resumed operations after law enforcement disruption in May 2025, with the infrastructure gradually coming back online.

Trends, Tools, or Tactics of Interest

Ransomware: Increased double extortion tactics and a notable rise in attacks on critical infrastructure and public sector organizations.
AI-Driven Threats: AI is being used to create convincing fake travel destinations and to clone voices for social engineering scams, as demonstrated in a recent AI voice scam extorting money from a victim.
Fake E-commerce Platforms: Surge in AI-powered scam sites used as attack vectors for data theft and fraud.
Infostealer Malware: The ecosystem for trading stolen personal data is expanding, with startups commercializing access to data harvested by malware.
Windows Accessibility Abuse: Malware such as Coyote is exploiting accessibility frameworks for more targeted credential theft.
Windows 11 Resilience: Microsoft introduced new recovery and resilience features, including a Black Screen of Death and automated recovery tools, in the KB5062660 update.

Regulatory or Policy Developments Affecting the Security Industry

UK Ransomware Payment Ban: The UK government is planning to prohibit public sector and critical infrastructure organizations from paying ransoms following ransomware attacks.
UK Sanctions: The UK imposed sanctions on Russian APT groups and individuals associated with high-profile cyber operations.
US Coast Guard Cybersecurity Rule: New cybersecurity requirements for maritime transport safety were issued, with phased implementation over two years to secure shipping ports.
China National Cyber ID: China launched a voluntary national Internet identity system aimed at protecting online identities, raising privacy and surveillance concerns.
Darktrace Acquisition: UK-based Darktrace acquired Mira Security to enhance network visibility and encrypted traffic decryption capabilities.

Cybersecurity Brief – 2025-07-09

Wed, 09 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

M&S confirmed a significant ransomware attack by DragonForce, initiated via a sophisticated social engineering/impersonation attack.
Qantas experienced a data breach resulting in an extortion demand after customer data was stolen from a contact centre.
South Korean telecommunications provider SK Telecom suffered a breach exposing 27 million records; the government imposed a monetary penalty and new regulatory requirements.
Over 17,000 fake news websites were uncovered globally as part of a large-scale investment fraud campaign (“BaitTrap”).
More than 1.7 million installations of malicious Chrome extensions were identified, capable of tracking users, stealing browser activity, and redirecting to unsafe sites.
The Anatsa Android banking trojan was distributed via a fake PDF viewer app on Google Play, impacting over 90,000 users, primarily targeting US banks.
Russian organisations were targeted by a new Windows spyware dubbed Batavia, used in ongoing espionage campaigns.
A supply chain attack compromised the Ethcode Visual Studio Code extension, exposing over 6,000 developers to malicious pull requests.
The RondoDox botnet exploited vulnerabilities in TBK DVRs and Four-Faith routers to conscript devices for DDoS attacks.

Newly Discovered Vulnerabilities

Microsoft’s July 2025 Patch Tuesday addressed 130–137 vulnerabilities, including a publicly disclosed zero-day in SQL Server. Seventeen bugs are considered high risk, including multiple remote code execution vulnerabilities in Office and SharePoint.
Adobe released patches for critical code execution vulnerabilities affecting several products, including After Effects, Audition, Illustrator, and others.
SAP patched critical insecure deserialization vulnerabilities in NetWeaver, which could allow remote code execution and full system takeover.
Technical details and exploit code for CitrixBleed2 (CVE-2025-5777) in Citrix NetScaler have been released, increasing the risk of exploitation.
A new Android “TapTrap” attack was disclosed, using invisible UI tricks to bypass permission systems and trick users into granting sensitive access.

Notable Threat Actor Activity

Threat actors repurposed the legitimate Shellter red teaming tool to distribute Lumma Stealer, SectopRAT, Arechclient2, and Rhadamanthys malware, leveraging its AV/EDR evasion features.
A suspected Chinese state-sponsored hacker linked to Silk Typhoon (Hafnium) was arrested in Milan, facing charges including wire fraud and unauthorized computer access.
Russian organisations faced an ongoing campaign involving the newly identified Batavia Windows spyware.
A large-scale operation using Baiting News Sites (BNS) was uncovered, leveraging fake news for investment fraud.
RondoDox botnet activity increased, exploiting IoT device vulnerabilities for DDoS.

Trends, Tools, or Tactics of Interest

Malicious open source packages increased by 188% year-over-year, with data exfiltration as the most common malware function.
Threat actors continue to exploit legitimate security and pen-testing tools (e.g., Shellter) for malware delivery and AV/EDR evasion.
Supply chain attacks targeting development environments (e.g., VS Code extensions) remain a significant threat vector.
Identity-based attacks in the retail sector are exploiting overprivileged admin roles and neglected vendor tokens.
Agentic AI is emerging as a growing attack surface, with increased risk from invisible threats and novel vectors.
Human risk management and measurement in security awareness programs remain a focus area for evaluating organisational resilience.

Regulatory or Policy Developments Affecting the Security Industry

South Korea imposed regulatory requirements on SK Telecom following a major data breach, in addition to a monetary penalty.
SSL/TLS certificate lifespan reduction to 47 days by 2029 is prompting organisations to prepare for operational changes in certificate management.
Samsung announced major security and privacy enhancements for its upcoming One UI 8 release on Galaxy smartphones.
Microsoft clarified options for extended Windows 10 security updates through October 2026, including free alternatives with certain conditions.

Cybersecurity Brief – 2025-07-03

Thu, 03 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas Airlines suffered a data breach impacting 6 million customers. Personal information was accessed via a third-party call center platform; passport and credit card data were not included.
Spanish authorities arrested two individuals in Las Palmas for cybercriminal activity, including data theft from government entities, politicians, and journalists.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical vulnerability in Unified Communications Manager (Unified CM) and Session Management Edition, involving hardcoded root SSH credentials that allowed remote root access. The backdoor account has now been removed.
The Forminator WordPress plugin is vulnerable to an unauthenticated arbitrary file deletion flaw, enabling potential full site takeover attacks.
Google Chrome was updated to address a serious security flaw that has been exploited in the wild.
Citrix issued a warning that patching recent authentication bypass vulnerabilities in NetScaler ADC and Gateway may cause login page failures.
Multiple fake cryptocurrency wallet extensions were discovered in the Firefox add-ons store, designed to steal wallet credentials and sensitive data.

Notable Threat Actor Activity

The Russian APT group Gamaredon continues aggressive spearphishing campaigns targeting Ukrainian government entities in 2024, utilizing an evolved cyberespionage toolset and new stealth-focused techniques, including weaponization of network drives.
North Korean state-backed actors are targeting Web3 and cryptocurrency organizations with new malware written in Nim, including a macOS variant named NimDoor, which can revive itself if terminated. They are also leveraging the ClickFix technique in the BabyShark campaign to bypass browser safeguards.
A China-nexus initial access broker has been observed exploiting unpatched Ivanti vulnerabilities for initial access, then self-patching the vulnerabilities to block other threat actors.
Scattered Spider, a group of young cybercriminals, is identified as a significant and imminent threat, having targeted retailers, insurers, and airlines with a flexible and difficult-to-defend structure.
Threat actors are increasingly using callback phishing campaigns, impersonating brands such as Microsoft and DocuSign via PDFs to trick users into calling attacker-controlled phone numbers.
Attackers are using AI to rapidly generate convincing phishing sites impersonating Okta and Microsoft 365 login pages.
Attack chains such as ClickFix and FileFix exploit browser and user behavior to bypass security controls and enable malicious script execution.

Trends, Tools, or Tactics of Interest

Nearly 80% of cyber threats now mimic legitimate user behavior, complicating network threat detection.
Modern phishing campaigns are leveraging AI and social engineering to increase the speed and realism of attacks.
Social engineering tactics are being used in attack chains to manipulate victims into saving and renaming files that execute malicious scripts.
Fake browser extensions and add-ons targeting cryptocurrency wallets are proliferating in official app stores.
New malware written in the Nim programming language is being used in targeted attacks, reflecting an ongoing trend of threat actors adopting less common languages to evade detection.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Russia-based bulletproof hosting provider Aeza Group for supporting ransomware and malware operations, including affiliations with BianLian and Lumma Stealer.
The U.S. Department of Justice is investigating a former ransomware negotiator for alleged criminal collaboration with ransomware gangs to profit from extortion payment deals.
A U.S. judge approved the sale of 23andMe’s DNA data to TTAM Research Institute, prompting privacy concerns and increased user requests for data deletion.

Cybersecurity Brief – 2025-07-01

Tue, 01 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Switzerland’s government reported that sensitive data from multiple federal offices was compromised following a ransomware attack on the third-party provider Radix.
Europol, in coordination with Spanish authorities, dismantled a cryptocurrency investment fraud ring responsible for laundering approximately $540 million (€460 million) from over 5,000 victims. Five suspects were arrested.
Over 1,200 Citrix NetScaler ADC and NetScaler Gateway servers remain unpatched against a critical authentication bypass vulnerability, which is reportedly being actively exploited.
The hacker collective Scattered Spider continues its campaign targeting the airline sector, with Microsoft designating the group as a significant cyber threat.
The FBI disclosed that cybercriminals are impersonating health fraud investigators to steal sensitive health information from US citizens.
The US Justice Department revealed that the identities of more than 80 Americans were stolen to facilitate North Korean IT worker scams, with action taken against associated “laptop farms.”
A government report indicated that a hacker was hired by the Sinaloa drug cartel to identify and target individuals connected to the FBI’s investigation, leading to fatal outcomes.

Newly Discovered Vulnerabilities

Vulnerabilities in Airoha Bluetooth chips, used in Sony and Bose earbuds and headphones, could allow attackers to hijack both the audio devices and any connected host systems. Details of the vulnerabilities have not yet been published.
Some Brother printers are affected by a critical security flaw that can be mitigated by changing the default admin password.
Microsoft warned of delays in the delivery of June 2025 Windows security updates due to an incorrect metadata timestamp.

Notable Threat Actor Activity

US agencies (CISA, FBI, NSA, DC3) issued a joint advisory regarding increased Iranian state-sponsored cyber activity targeting US defense, operational technology (OT) networks, and critical infrastructure.
Blind Eagle, a known threat actor, has been linked to the use of the Russian bulletproof hosting service Proton66 for phishing campaigns and remote access trojan (RAT) deployment targeting Colombian banks.
Ongoing AI-themed SEO poisoning attacks are distributing Lumma and Vidar infostealers and other malware via malicious websites optimized for AI-related search terms.

Trends, Tools, or Tactics of Interest

Microsoft Defender for Office 365 now automatically detects and blocks email bombing attacks.
Identity-based attacks, including impersonation and credential theft, continue to rise in frequency and sophistication.
Attackers are increasingly leveraging legitimate system functionality and user credentials, often exploiting “by design” behaviors rather than technical flaws.

Regulatory or Policy Developments Affecting the Security Industry

The Canadian government ordered Hikvision Canada to cease all operations due to national security concerns, though individuals and private businesses may still purchase Hikvision products.
The Berlin Data Protection Commissioner formally requested Google and Apple to remove the DeepSeek AI application from their app stores for GDPR violations.
Microsoft announced it will remove password management functionality from its Authenticator app starting August 1, 2025, as part of a shift towards passkey-based authentication.
Proposed US legislation aims to reduce federal AI funding for states that enact AI regulations, with exemptions for laws addressing unfair practices and child sexual abuse material.

Cybersecurity Brief – 2025-06-04

Wed, 04 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Victoria’s Secret has delayed its Q1 2025 earnings release due to ongoing corporate system restoration efforts following a security incident on 24 May.
A data breach at Coinbase has been attributed to bribed customer support representatives at TaskUs in India, leading to data theft from the crypto exchange.

Newly Discovered Vulnerabilities

Hewlett Packard Enterprise (HPE) released security patches for eight vulnerabilities in StoreOnce, including a critical remote authentication bypass flaw.
A critical 10-year-old vulnerability in Roundcube webmail software allows authenticated users to execute malicious code.
Google patched a new Chrome zero-day vulnerability currently being exploited in the wild; this is the third Chrome zero-day exploited this year.
Two newly disclosed vBulletin vulnerabilities (CVE-2025-48827, CVE-2025-48828) are easily exploitable and present risks to bulletin board deployments.
CISA has issued a warning regarding active exploitation of a recently patched ConnectWise ScreenConnect vulnerability that allows remote code execution.

Notable Threat Actor Activity

Scattered Spider has been linked to high-profile attacks on UK retailers Marks & Spencer and Co-op, using tactics such as vishing, adversary-in-the-middle (AiTM) phishing, and exploiting multi-factor authentication gaps to hijack cloud accounts. The group operates as an identity-first threat model rather than a single entity.
Threat actors are using fake DocuSign and Gitcode websites to distribute the NetSupport RAT via multi-stage PowerShell attacks.
The Acreed infostealer has overtaken LummaC2 as the dominant credential theft malware on the Russian Market, reflecting a shift in the threat landscape.
Malicious RubyGems packages impersonating Fastlane CI/CD plugins have been found redirecting Telegram API requests to attacker-controlled servers to steal data.

Trends, Tools, or Tactics of Interest

The Crocodilus Android banking trojan has expanded its targeting from Turkey to eight countries across Europe and South America, now incorporating tactics such as adding fake contacts to victims’ devices to spoof trusted callers.
A new unrestricted AI chatbot, Venice[.]ai, has emerged, capable of generating phishing messages and malware code to assist cybercriminal activity.
Kaspersky research highlights the challenge of determining attack origins in environments lacking container visibility, emphasizing the importance of distinguishing between host-based and container-based threats.
Mozilla has introduced a new system to detect and block Firefox add-ons that function as cryptocurrency drainers.
LayerX has launched ExtensionPedia, and TXOne Networks introduced intelligent vulnerability mitigation capabilities, both reflecting ongoing innovation in endpoint and OT security.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will distrust digital certificates issued by Chunghwa Telecom and Netlock due to compliance and conduct issues, effective from August.
Microsoft and CrowdStrike have launched a shared threat actor glossary to align their threat actor taxonomies and reduce attribution confusion.

Cybersecurity Brief – 2025-05-23

Fri, 23 May 2025 00:00:00 +0000

Major Incidents or Breaches

Chinese Threat Actor Activity:
- Chinese-speaking group UAT-6382 exploited a now-patched remote code execution vulnerability in Trimble Cityworks to breach multiple US local government networks, deploying Cobalt Strike and VShell.
- Chinese nexus actors exploited recently patched Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities to target government agencies and enterprises across Europe, North America, and Asia.
Phishing Campaign Targeting International Students:
- The FBI reported an ongoing phishing campaign specifically targeting Middle Eastern students studying in the US, aiming to steal personal and financial information.
Database Exposure:
- A database containing 184 million login credentials, including those for Apple, Google, Meta, and various government services, was discovered and subsequently taken offline.
Cryptocurrency Theft via Fake Apps:
- Cybercriminals are distributing fake Ledger apps targeting macOS users to steal cryptocurrency seed phrases and digital assets.

Cybersecurity Brief – 2025-05-22

Thu, 22 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack
- Marks & Spencer, a major UK retailer, suffered a cyberattack resulting in widespread operational disruption and a projected profit loss of up to £300 million ($402 million). The company anticipates continued online disruptions until at least July.
Kettering Health Ransomware Attack
- Kettering Health, a US healthcare network, experienced a ransomware attack leading to a system-wide outage and the cancellation of both inpatient and outpatient procedures.
Coinbase Data Breach
- Cryptocurrency exchange Coinbase reported a data breach impacting 69,461 customers. Both customer and corporate data were stolen. Coinbase is offering a $20 million reward for information leading to the perpetrators.
Lumma Infostealer Disruption
- Law enforcement agencies, with support from tech companies, disrupted the Lumma infostealer malware operation, seizing over 2,300 domains and dismantling a major malware-as-a-service infrastructure used globally.

Cybersecurity Brief – 2025-04-22

Tue, 22 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

NLRB Data Exfiltration by DOGE: A whistleblower alleges that employees from Elon Musk’s Department of Government Efficiency (DOGE) siphoned gigabytes of sensitive case data from the US National Labor Relations Board (NLRB).
City of Abilene Cyberattack: The city of Abilene, Texas, took systems offline following a detected cyber incident.
Japan Brokerage Account Breaches: Japanese regulators issued an urgent warning after hundreds of millions of dollars in unauthorized trades were made from hacked brokerage accounts.
Microsoft Entra Account Lockouts: Microsoft confirmed that recent Entra account lockouts were caused by a mishap involving the logging of short-lived user refresh tokens.
‘Fog’ Ransomware Campaign: The ‘Fog’ ransomware group, known for trolling victims with DOGE-themed ransom notes, has compromised over 100 victims since January.
WordPress Ad Fraud Operation ‘Scallywag’: A large-scale ad fraud operation using malicious WordPress plugins generated approximately 1.4 billion fraudulent ad requests daily, primarily monetizing pirating and URL shortening sites.

Newly Discovered Vulnerabilities

ASUS AiCloud Router Vulnerability: ASUS urged immediate patching of a critical 9.2 CVSS-rated vulnerability in its AiCloud router series, exploitable via crafted requests.
BlueKeep RDP Exploitation by Kimsuky: North Korean threat actor Kimsuky is actively exploiting the BlueKeep (CVE-2019-0708) RDP vulnerability, despite it being patched, to breach systems in South Korea and Japan.

Notable Threat Actor Activity

Lumma Stealer Distribution: Security researchers detailed the distribution channels of Lumma Stealer, observed in recent incident response cases, including its use of fake CAPTCHA attacks.
Lotus Panda Espionage: The China-linked Lotus Panda group conducted a campaign targeting Southeast Asian government entities, deploying browser stealers and sideloaded malware.
Kimsuky Campaigns: Kimsuky continues to leverage legacy vulnerabilities (BlueKeep) for initial access, targeting East Asian organisations.
SuperCard X Android Malware: A new malware-as-a-service (MaaS) platform, SuperCard X, enables cybercriminals to conduct NFC relay attacks for contactless ATM and PoS fraud.
‘Elusive Comet’ Social Engineering: This threat actor uses sophisticated social engineering via Zoom to deliver infostealers or RATs to victims.
SVG-based Phishing: Attackers are increasingly embedding HTML or JavaScript code within SVG email attachments to bypass detection and deliver phishing payloads.

Trends, Tools, and Tactics

Professionalisation of Southeast Asian Cyber Fraud: Organised cybercrime groups in Southeast Asia are expanding globally and deepening ties with other regional networks, despite ongoing crackdowns.
Nation-State Focus on SMBs: Nation-state actors are increasingly targeting small and medium-sized businesses, especially those in the supply chain for larger enterprises.
Ad Fraud via WordPress Plugins: Malicious plugins are being used at scale to automate ad fraud, highlighting ongoing abuse of open-source platforms.
Device Management Limitations: Industry commentary stresses that device management alone does not equate to device trust, as initial access often exploits credentials and unmanaged devices.
Ongoing Malicious Advertising: Despite advances in detection, malicious ad URLs remain prevalent, underscoring persistent gaps in web security and user awareness.
YARA Rule Automation: Tools like xorsearch.py are being used to generate ad hoc YARA rules from regex patterns for more efficient malware hunting.

Regulatory and Policy Developments

Japanese Regulatory Response: Japanese authorities are responding to major financial account breaches with urgent warnings and likely increased scrutiny of brokerage cybersecurity.
CISA Leadership Changes: Two senior officials, Bob Lord and Lauren Zabierek, have resigned from the US Cybersecurity and Infrastructure Security Agency (CISA), potentially impacting ongoing federal cybersecurity initiatives.

Emerging Security Concerns

AI and Privacy Risks: Demonstrations show that AI tools like ChatGPT can extract location data from photos without embedded metadata, raising privacy and OSINT concerns.
AI in Public Safety: Motorola Solutions is deploying AI-enabled body cameras for first responders, highlighting the growing integration of AI in law enforcement technology and associated security considerations.

Cybersecurity Brief – 2025-04-21

Mon, 21 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Japanese regulators issued an urgent warning regarding hundreds of millions of dollars in unauthorized trades from hacked brokerage accounts, indicating a significant financial sector breach.
A large-scale ad fraud operation, ‘Scallywag’, was uncovered, leveraging malicious WordPress plugins to generate up to 1.4 billion fraudulent ad requests per day, primarily targeting pirating and URL shortening sites.

Newly Discovered Vulnerabilities

ASUS urged immediate patching of a critical vulnerability (CVSS 9.2) in its AiCloud router series, which can be exploited via crafted requests, posing significant risk to affected users.
Researchers highlighted ongoing exploitation of NTLM and iOS zero-day vulnerabilities, as referenced in weekly threat recaps.

Notable Threat Actor Activity

Lumma Stealer, identified during incident response, is using sophisticated distribution channels, including fake CAPTCHA attacks, to infiltrate target environments.
A surge in mass scanning, credential brute-forcing, and exploitation attempts has been traced to IP addresses linked to the Russian bulletproof hosting provider Proton66, facilitating global malware campaigns.
SuperCard X, a new Android malware-as-a-service platform, enables cybercriminals to conduct contactless ATM and PoS fraud via NFC relay attacks.
Phishers are abusing Google OAuth weaknesses to conduct DKIM replay attacks, allowing spoofed emails that appear to originate legitimately from Google and pass authentication checks.

Trends, Tools, and Tactics

Attackers are increasingly leveraging SVG attachments containing embedded HTML or JavaScript in phishing campaigns, bypassing traditional email security filters.
The use of malicious advertising URLs remains prevalent, with attackers exploiting both technical and human vulnerabilities for distribution.
ChatGPT and similar AI tools demonstrate capabilities to infer sensitive information (such as photo locations) even without explicit metadata, raising privacy and security concerns.
The proliferation of malware-as-a-service platforms (e.g., SuperCard X) and advanced phishing techniques (e.g., OAuth abuse, SVG-based payloads) highlights continued innovation in cybercriminal tactics.

Regulatory and Policy Developments

Two senior officials (Bob Lord and Lauren Zabierek) resigned from the US Cybersecurity and Infrastructure Security Agency (CISA), potentially impacting the agency’s leadership and policy direction.
Japanese financial regulators are actively responding to large-scale brokerage account breaches, indicating increased regulatory scrutiny and potential for new compliance measures in the financial sector.

Other Sector Developments

Advancements in AI-enabled security tools, such as Motorola’s new AI-powered body cameras for first responders and AI-driven home security cameras, reflect ongoing integration of artificial intelligence in physical and digital security solutions.