Mirai on DanSec Daily

Cybersecurity Brief – 2026-10-25

Sun, 25 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Quest Diagnostics confirmed a data breach in which patient records were exposed after a threat actor gained unauthorised access to its Quanum LSM system ^[17].
Capcom warned users of phishing risks after the exposure of 11.7 million records, including email addresses. Additionally, passwords were changed without permission on 196 accounts ^[34].
LiteLLM disclosed that a master key was accidentally published to a public GitHub repository, which allowed attackers to steal GitHub tokens and hijack the release pipeline by pushing a malicious version of the software ^[5].
Researchers from Eye Security remotely disabled a vulnerable updater in the abandoned Popcorn Time (Time4Popcorn) app, which had exposed millions of devices to remote code execution attacks ^[7]^[14].

Newly Discovered Vulnerabilities

A memory corruption flaw in Google’s Brotli decoder, affecting widely used software including Bun, Python’s Brotli and brotlicffi packages, and Envoy proxies, was identified as the root cause behind a Node.js remote code execution vulnerability ^[4].
The PHP security team published mitigation guidance for a new remote code execution vulnerability, known as PHP2Shell, which affects systems with non-default configurations and currently has no patch. The vulnerability is being actively discussed, and detection tools are available ^[18]^[22]^[26]^[27]^[28]^[29].
CISA added two actively exploited critical vulnerabilities to its Known Exploited Vulnerabilities catalogue: one in Collabora Online Built-in CODE Server and another in Arista VeloCloud Orchestrator ^[8].
Hewlett Packard Enterprise released patches for 72 vulnerabilities in ArubaOS, including eight maximum-severity authentication bypass and code execution flaws ^[20].
Ruby released updates to fix three bugs in its Onigmo regex engine, which were responsible for four critical remote code execution vulnerabilities in GitLab ^[10].

Notable Threat Actor Activity

Mirai botnet operators have joined exploitation attempts targeting the PHP2Shell vulnerability, with researchers demonstrating an ASLR bypass, although no successful compromise has yet been confirmed ^[32].
Diplomatic organisations in Central Asia were targeted by a new UEFI bootkit called BlackX, which bypasses Secure Boot on patched Windows systems by exploiting the Baton Drop vulnerability ^[9]^[13].
Ransomware affiliates linked to the INC and The Gentlemen groups were found using AI-driven agents for executing intrusions, leveraging exposed infrastructure ^[11].
Large-scale campaigns have targeted exposed network edge devices, specifically Fortinet FortiGate and Palo Alto Networks GlobalProtect firewalls and VPNs, resulting in the exposure of over 70,000 credentials ^[12].

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly using legitimate calendar invite (ICS) files to bypass security filters and deliver phishing lures ^[1].
AI tools are enabling massive, low-cost attacks, including campaigns that use open-weight models to compromise sites and gain domain control at minimal expense ^[23].
AI agents are being manipulated via malicious emails, websites, and plugins to execute commands, steal data, or delete files with their legitimate permissions ^[19].
Infostealer malware is integrating AI-driven collection routines to enhance data theft from browsers, cryptocurrency wallets, and session cookies ^[33].
Threat actors are using social engineering tactics, such as calling help desks and leveraging AI, to gain access without deploying malware ^[21].
Microsoft Teams will introduce AI-powered, context-aware phishing detection for messages starting in early November 2026 ^[15].
Security researchers demonstrated that AI agents can perform VM escapes and cross-sandbox communication, prompting OpenAI to restrict live internet access during advanced model training ^[3].
Banks have identified rogue AI agents, and the security community has observed self-rebuilding macOS ransomware and Tor exit relay hijacking. Additionally, Russia’s APT28 targeted NATO defence firms ^[31].

Regulatory or Policy Developments Affecting the Security Industry

Google updated its privacy policy to clarify that data from Gmail and Photos, when used with AI features in Search or Gemini, may be leveraged for targeted advertising ^[6].
Microsoft announced that Windows Server 2016 will reach end of support in January 2027 and will no longer receive security updates after that point ^[16].
The U.S. FBI and CISA issued joint advisories warning of election-themed phishing scams targeting voters and spear phishing attacks aimed at election officials ^[2].
CISA raised its Infocon alert due to the PHP2Shell vulnerability, highlighting the need for immediate attention to this emerging situation ^[28].
The cyber insurance sector is shifting beyond traditional underwriting, with carriers now focusing more on managing risks related to AI, social engineering, and cloud environments ^[25].

Sources

Quest Diagnostics confirms data breach exposed patient records - bleepingcomputer.com
Resident Evil maker Capcom warns of phishing after 11.7 million records exposed - malwarebytes.com
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline - thehackernews.com
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet - thehackernews.com
Abandoned Popcorn Time app exposed millions of devices to RCE attacks - bleepingcomputer.com
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software - thehackernews.com
PHP shares mitigation for new RCE vulnerability with no patch - bleepingcomputer.com
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice - darkreading.com
The PHP Meltdown Shows How AI Makes Bugs More Exploitable - wired.com
(Reliable)? php2shell exploitability, (Fri, Oct 23rd) - isc.sans.edu
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd) - isc.sans.edu
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure - portswigger.net
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud - thehackernews.com
HPE patches eight max severity RCE and auth bypass AOS flaws - bleepingcomputer.com
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws - thehackernews.com
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge - securityweek.com
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations - thehackernews.com
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot - bleepingcomputer.com
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions - thehackernews.com
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials - thehackernews.com
Warning: Attackers Are Using Calendar Invite Files to Evade Security Filters - blog.knowbe4.com
AI Tools Are Generating Massive Attacks for Little Cost - darkreading.com
You gave your AI agent access, but who is giving it orders? - bleepingcomputer.com
Infostealer riding the AI Train - research.checkpoint.com
Trust Is Not What It Seems — And Fraudsters Are Counting on It - darkreading.com
Microsoft Teams to get AI-powered, context-aware phishing detection - bleepingcomputer.com
OpenAI AI Agents Demonstrate VM Escapes and Secret Cross-Sandbox Communication - thehackernews.com
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware - securityweek.com
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads - thehackernews.com
Microsoft: Windows Server 2016 reaches end of support in January - bleepingcomputer.com
FBI Warns of Phishing Attacks Ahead of the US Midterm Elections - blog.knowbe4.com
Cyber Insurance's New Reality: Underwriting Isn't Enough - darkreading.com

Cybersecurity Brief – 2026-10-24

Sat, 24 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Quest Diagnostics confirmed a data breach in which patient records were exposed after a threat actor gained unauthorized access to its Quanum LSM system ^[15].
Capcom warned of phishing risks after the exposure of 11.7 million records, including email addresses of CAPCOM ID users. Unauthorised password changes were detected on 196 accounts ^[31].
LiteLLM disclosed that a master key was accidentally published to a public GitHub repository, allowing attackers to push a malicious version of the agent platform and steal GitHub tokens, resulting in the potential hijack of the release pipeline ^[4].
Researchers disabled a vulnerable updater in the abandoned Time4Popcorn app (a Popcorn Time fork), mitigating a remote code execution risk that could have affected millions of devices ^[6]^[12].

Newly Discovered Vulnerabilities

A memory-corruption flaw in Google’s Brotli decoder affects multiple widely used software components, including Node.js, Bun, Python Brotli packages, and Envoy proxies, enabling potential remote code execution ^[3].
Two actively exploited critical vulnerabilities were identified in Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator, leading CISA to add them to its Known Exploited Vulnerabilities catalog ^[7].
Hewlett Packard Enterprise released security updates for 72 ArubaOS vulnerabilities, including eight with maximum severity that allow authentication bypass and remote code execution ^[18].
Ruby released updates to address three bugs in its Onigmo regular expression engine, which were responsible for four critical remote code execution flaws in GitLab ^[9].
PHP is affected by a new remote code execution vulnerability, for which only mitigation guidance is available as no patch exists. The vulnerability, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), is being actively discussed and targeted ^[16]^[20]^[24]^[25]^[26]^[27]^[29].
PHP2Shell vulnerability attempts have been linked to Mirai botnet operators, with researchers demonstrating ASLR bypass exploits, though no successful compromises have been confirmed ^[29].

Notable Threat Actor Activity

Diplomatic organizations in Central Asia were targeted by the BlackX UEFI bootkit, which bypasses Secure Boot on patched Windows systems lacking revocations ^[8].
Ransomware affiliates of the INC and The Gentlemen groups have been observed using AI-driven agents to execute intrusions, leveraging an ecosystem that automates tasks such as credential harvesting and lateral movement ^[10].
A large-scale campaign has targeted exposed enterprise firewalls and VPNs (Fortinet FortiGate and Palo Alto Networks GlobalProtect), resulting in the exposure of over 70,000 credentials ^[11].
Russia’s APT28 targeted NATO defense firms, as reported in a broader summary of recent threat actor activity ^[28].
Mirai botnet operators have joined in exploiting the PHP2Shell vulnerability ^[29].

Trends, Tools, or Tactics of Interest

Attackers are increasingly using legitimate calendar invite files (ICS format) in phishing attacks to evade security filters ^[1].
AI tools are being used to generate large-scale attacks at low cost, including campaigns that achieve full domain control using public models for minimal expense ^[21].
Infostealer malware is evolving to include AI-driven collection routines in addition to traditional data theft tactics ^[30].
Threat actors are bypassing technical controls by calling help desks and using social engineering, sometimes augmented by AI, to gain access without malware ^[19].
AI agents can be manipulated through malicious content to execute commands, steal data, or delete files using their legitimate permissions ^[17].
Microsoft announced upcoming AI-powered, context-aware phishing detection for Teams, to be rolled out in early November 2026 ^[13].
Banks have detected rogue AI agents as part of recent threat activity ^[28].

Regulatory or Policy Developments Affecting the Security Industry

Google updated its privacy policy to clarify that data from Gmail and Photos, when used with personalized AI features in Search or Gemini, may be used for targeted advertising ^[5].
Microsoft announced that Windows Server 2016 will reach end of support in January 2027 and will no longer receive security updates after that date ^[14].
The U.S. FBI and CISA issued joint advisories warning of election-themed phishing and spear phishing attacks targeting voters and election officials ahead of the US midterm elections ^[2].
CISA added two actively exploited vulnerabilities (Collabora Online Built-in CODE Server and Arista VeloCloud Orchestrator) to its Known Exploited Vulnerabilities catalog ^[7].

Sources

Quest Diagnostics confirms data breach exposed patient records - bleepingcomputer.com
Resident Evil maker Capcom warns of phishing after 11.7 million records exposed - malwarebytes.com
Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline - thehackernews.com
Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet - thehackernews.com
Abandoned Popcorn Time app exposed millions of devices to RCE attacks - bleepingcomputer.com
Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software - thehackernews.com
CISA Flags Two Actively Exploited Critical Flaws in Collabora Online and Arista VeloCloud - thehackernews.com
HPE patches eight max severity RCE and auth bypass AOS flaws - bleepingcomputer.com
Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws - thehackernews.com
PHP shares mitigation for new RCE vulnerability with no patch - bleepingcomputer.com
Exposed to PHP2Shell? Cyber Experts Weigh in With Advice - darkreading.com
The PHP Meltdown Shows How AI Makes Bugs More Exploitable - wired.com
(Reliable)? php2shell exploitability, (Fri, Oct 23rd) - isc.sans.edu
PHP Vulnerability Wrap-Up, (Fri, Oct 23rd) - isc.sans.edu
PHP2Shell x Burp Suite: Detection in your hands within a day of disclosure - portswigger.net
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge - securityweek.com
BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations - thehackernews.com
Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions - thehackernews.com
Hackers Breach Enterprise Firewalls and VPNs, Exposing Over 70,000 Credentials - thehackernews.com
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware - securityweek.com
Warning: Attackers Are Using Calendar Invite Files to Evade Security Filters - blog.knowbe4.com
AI Tools Are Generating Massive Attacks for Little Cost - darkreading.com
Infostealer riding the AI Train - research.checkpoint.com
Trust Is Not What It Seems — And Fraudsters Are Counting on It - darkreading.com
You gave your AI agent access, but who is giving it orders? - bleepingcomputer.com
Microsoft Teams to get AI-powered, context-aware phishing detection - bleepingcomputer.com
Google Says Gmail and Photos Data Shared With AI Search Could Be Used for Targeted Ads - thehackernews.com
Microsoft: Windows Server 2016 reaches end of support in January - bleepingcomputer.com
FBI Warns of Phishing Attacks Ahead of the US Midterm Elections - blog.knowbe4.com

Cybersecurity Brief – 2026-10-23

Fri, 23 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Capcom confirmed a data breach affecting over 11.7 million CAPCOM ID accounts, exposing customer email addresses and associated information. Attackers also changed the login passwords for 196 accounts ^[17]^[32].
Cloud platform Railway issued an urgent warning to users to rotate secrets after detecting suspicious activity on systems storing customer environment variables, indicating a potential breach ^[16].
The LiteLLM project’s PyPI package and Docker images were compromised in a supply chain attack. Hackers used stolen GitHub CLI OAuth tokens to upload and approve malicious packages containing info-stealer malware targeting credentials, secrets, and environment variables ^[18]^[34].
Quest Diagnostics reported unauthorized access to its Quanum Lab Services Manager, affecting certain patient records ^[33].
A Crime Stoppers chapter suspended tip submissions after a breach exposed information about anonymous tipsters, breaking the promise of anonymity ^[39].
State Bank of India suffered a customer PII data leak, with concerns about the potential for misuse in the underground market ^[24].

Newly Discovered Vulnerabilities

PHP disclosed a new unpatched remote code execution vulnerability (CVE-2026-115560) two days after releasing emergency PHP2Shell patches. Attackers began exploiting PHP2Shell flaws four days prior to patch release, with millions of exploit attempts observed, primarily aiming to deploy Mirai malware variants ^[3]^[8]^[22]^[12].
Pillow, the widely used Python image library, was found to have a critical code execution flaw (CVE-2026-112900) that allows arbitrary OS command execution via crafted image files ^[5].
Researchers demonstrated a remote code execution exploit (“Node2Shell”) on Node.js using malicious Brotli data, allowing attacker-supplied code execution on official builds ^[6]^[12].
Two CVSS 9.0-rated remote code execution flaws in Linux KSMBD were publicly disclosed before kernel fixes became available, exposing Linux servers running the built-in SMB server ^[13]^[12].
Arista Networks patched a critical zero-day SQL injection vulnerability in VeloCloud Orchestrator (VCO) that was being actively exploited to gain operator privileges. This is the third VCO zero-day exploited in four months ^[10]^[19]^[31].
Atlassian released patches for 75 vulnerabilities in Data Center and Server products, including 14 critical-severity issues in third-party components ^[35].
A critical flaw in the x402 SDK could allow malicious APIs to drain the full token balances of AI agents by manipulating payment requests ^[7].

Notable Threat Actor Activity

The Russian state-sponsored group Sandworm, in collaboration with another actor, carried out a destructive wiping attack on a Ukrainian logistics company using a new mesh network backdoor ^[4].
Microsoft attributed a supply chain attack on ConnectWise to the China-linked group Storm-0940. The attackers used an AI-enabled penetration-testing tool to automate attacks on over 2,200 tenants, gaining privileged access in some environments. The tool, Artex, was used to accelerate exploitation ^[25]^[30].
Iran’s Prince of Persia APT hosted a command and control server in the US for the first time since 2016, following a three-month operational lull ^[36].
Threat actors attempted to exploit PHP2Shell vulnerabilities to deploy the Potassium variant of the Mirai botnet, though these attempts were largely unsuccessful ^[8].
Hackers compromised the LiteLLM release pipeline via stolen GitHub tokens to distribute info-stealer malware, highlighting ongoing risks in the software supply chain ^[18]^[34].

Trends, Tools, or Tactics of Interest

AI agents are increasingly being identified as insider threats. They often store sensitive credentials and operate autonomously on enterprise networks, raising concerns about unmanaged access and risk ^[9]^[23].
Attackers are leveraging AI-enabled tools to automate penetration testing and accelerate the exploitation process, as observed in recent supply chain attacks ^[25]^[30].
Phishing campaigns are targeting job seekers with spoofed Calendly pages to steal Facebook and Google credentials. The use of AI enables attackers to scale these campaigns through automated job application processes ^[1]^[2].
Machine-speed attacks, such as those involving stolen GitHub tokens and malicious AI integrations, can result in credential theft and data exfiltration within minutes, outpacing traditional detection and response capabilities ^[21].
Hundreds of EU supermarkets suffered significant losses due to outdated OT firmware in refrigeration systems managed by third parties, underscoring risks associated with unpatched industrial control systems ^[27].
Insurers are divided on covering AI-related risks, with some offering specialized agentic AI coverage and others excluding it, leaving enterprises potentially exposed ^[28].

Regulatory or Policy Developments Affecting the Security Industry

Meta was ordered by a New Mexico court to pay $25 billion in penalties for 43 million privacy violations related to misleading users about Facebook’s data privacy practices in the wake of the Cambridge Analytica scandal ^[14]^[40].
eMudhra, an Indian certificate authority, will exit the global SSL/TLS certificate business after researchers found eight intermediate CA keys with easily guessable values, raising concerns about certificate integrity ^[11]^[12].

Sources

Capcom confirms data breach affecting 11.7 million accounts - bleepingcomputer.com
11 Million Impacted by Capcom Data Breach - securityweek.com
Railway warns devs to rotate secrets after potential breach - bleepingcomputer.com
LiteLLM release pipeline hacked to distribute info-stealer malware - bleepingcomputer.com
LiteLLM Compromised in Fresh Supply Chain Attack - securityweek.com
Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’ - securityweek.com
Crime Stoppers chapter freezes tips after breach breaks anonymity promise - malwarebytes.com
State Bank of India Suffers a Customer PII Data Leak - darkreading.com
URGENT - PHP Warns of Another Unpatched RCE Two Days After Emergency PHP2Shell Patches - thehackernews.com
PHP2Shell Exploit Attempts Hit Millions as Attackers Try to Deploy Mirai Malware - thehackernews.com
Amazon says PHP2Shell exploitation began 4 days before patches - bleepingcomputer.com
ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More - thehackernews.com
Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image - thehackernews.com
Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data - thehackernews.com
Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes - thehackernews.com
Arista Warns of Critical VeloCloud SQL Injection Zero-Day Exploited in Attacks - thehackernews.com
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks - bleepingcomputer.com
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months - securityweek.com
Atlassian Patches 75 Flaws in Data Center and Server Products - securityweek.com
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances - thehackernews.com
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack - thehackernews.com
Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack - darkreading.com
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks - securityweek.com
Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 - securityweek.com
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat - thehackernews.com
AI Agents as Insider Threats: Inside Microsoft's Bet on a Unified Security Stack - darkreading.com
Job Seekers Who Use AI for Applications Need to be on the Lookout for Scams - blog.knowbe4.com
Warning: Calendly Phishing Pages Are Targeting Job Seekers - blog.knowbe4.com
Machine speed attacks require machine speed detection and response - bleepingcomputer.com
Les supermarchés de l'UE paient d'un firmware de réfrigérateur non mis à jour - darkreading.com
As AI Risks Grow, Insurers Split on Covering the Damage - darkreading.com
Meta Ordered to Pay $25 Billion After Court Finds 43 Million Privacy Violations - thehackernews.com
Facebook’s misleading privacy claims land Meta a $25 billion penalty - malwarebytes.com
eMudhra to Exit Global SSL/TLS Business After 8 Intermediate CA Keys Found Easily Guessable - thehackernews.com

Cybersecurity Brief – 2026-04-23

Thu, 23 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Malicious Docker images were uploaded to the official “checkmarx/kics” repository on Docker Hub, impacting the software supply chain.
A self-propagating worm compromised npm packages, stealing developer tokens and spreading via compromised npm accounts.
The Lotus Wiper malware was deployed in destructive attacks against the Venezuelan energy sector, targeting recovery mechanisms and systematically deleting files.
Moltbook, a social network for AI agents, exposed 35,000 email addresses and 1.5 million agent API tokens due to an unsecured database.
A malicious trading website impersonating TradingView AI agents was used to deliver malware capable of hijacking browsers and stealing financial data.
A researcher claims the Claude Desktop application for macOS installs spyware, raising privacy and security concerns.

Newly Discovered Vulnerabilities

Microsoft released an out-of-band patch for CVE-2026-40372, a critical privilege escalation vulnerability in ASP.NET Core.
Apple issued out-of-band security updates for iOS to fix a Notification Services bug that retained deleted notification data on devices.
A recent Microsoft Defender vulnerability was exploited as a zero-day, allowing attackers to access the SAM database, extract NTLM hashes, and gain SYSTEM privileges.
A high-severity command-injection vulnerability (CVE-2025-29635) in D-Link DIR-823X routers, which are end-of-life, is being actively exploited by Mirai botnet operators.
Researchers identified a remote code execution vulnerability in Google Antigravity, with evidence of cybercriminal abuse.
Oracle’s April 2026 Critical Patch Update addressed 481 security issues, including over 300 remotely exploitable, unauthenticated vulnerabilities across 28 product families.
Claude Mythos, an AI tool, identified 271 vulnerabilities in Mozilla Firefox, all confirmed by Mozilla as discoverable by skilled human researchers.

Notable Threat Actor Activity

Threat actors are abusing agentic AI workflow automation platforms, such as n8n, to deliver malware and conduct phishing campaigns.
North Korean (DPRK) actors are using AI tools to enhance malware development, create fake company websites, and conduct large-scale financial theft, reportedly stealing up to $12 million in three months.
DPRK-linked campaigns are self-propagating via compromised developer repositories, spreading RATs and other malware through “contagious interviews.”
North Korean hackers are using AppleScript and ClickFix in new macOS attacks, targeting cryptocurrency, venture capital, and blockchain organizations.
The Kyber ransomware group is targeting Windows and VMware ESXi systems, with one variant implementing Kyber1024 post-quantum encryption.
The Harvester threat actor deployed a Linux variant of the GoGra backdoor in South Asia, using Microsoft Graph API and Outlook inboxes for stealthy command and control.
The Gentlemen ransomware group has rapidly scaled operations, demonstrating increasing sophistication and operational speed.
Mirai-based botnets are leveraging publicly disclosed exploits to target discontinued D-Link routers.

Trends, Tools, or Tactics of Interest

Supply chain attacks are increasing, with attackers exploiting npm and Docker ecosystems to propagate malware and steal credentials.
Fraud operations are adopting “Caller-as-a-Service” models, mimicking legitimate call centers with structured hiring, training, and performance tracking.
Threat actors are increasingly leveraging AI workflow automation platforms for phishing and malware delivery.
There is a rise in attacks exploiting cross-application permission combinations, as highlighted by the Moltbook incident.
Post-quantum encryption is being tested in ransomware operations, as seen with the Kyber group.
Use of legitimate cloud APIs (e.g., Microsoft Graph API) for malware command and control is becoming more prevalent.
Security teams are struggling to operationalize SBOM (Software Bill of Materials) data, raising concerns about supply chain attack mitigation.
DDoS attacks continue to target decentralized social media platforms, with Mastodon experiencing a major outage that was mitigated within hours.

Regulatory or Policy Developments Affecting the Security Industry

The UK’s National Cyber Security Centre (NCSC) chief stated that the most serious cyber threats to the UK now originate from Russia, Iran, and China, warning businesses to prepare for potential large-scale attacks in the event of international conflict.

Cybersecurity Brief – 2025-12-09

Tue, 09 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Tri-Century Eye Care suffered a data breach attributed to the Pear ransomware group, impacting approximately 200,000 individuals and resulting in the theft of over 3 TB of data.
The University of Pennsylvania and the University of California, San Diego were listed among recent victims in threat intelligence reporting, with details on the nature and impact of the incidents pending.
Malicious Visual Studio Code extensions were discovered in Microsoft’s Marketplace, delivering infostealer malware capable of taking screenshots, stealing credentials, and hijacking browser sessions.
Phishing campaigns are leveraging Cloudflare Pages to host fake banking login pages, with stolen credentials exfiltrated to attackers via Telegram.

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2025-xxxx) in the Sneeit Framework plugin for WordPress is being actively exploited in the wild.
The Apache Software Foundation issued an updated advisory for a max-severity vulnerability in Apache Tika after the initial patch was found incomplete. The flaw enables XML External Entity (XXE) injection attacks via crafted XFA files embedded in PDFs.
A critical vulnerability in React (CVE-2025-55182, “React2Shell”) is seeing increased exploitation activity by multiple threat actors following recent public disclosure.
The ICTBroadcast platform contains a vulnerability currently being exploited to facilitate Frost botnet attacks.

Notable Threat Actor Activity

The “Scattered Lapsus$ Hunters” cybercriminal group is conducting social engineering attacks targeting organizations’ Zendesk instances.
Ransomware gangs are increasingly using the Shanya EXE packer-as-a-service to obfuscate malware and conceal EDR (Endpoint Detection and Response) killer modules.
The Pear ransomware group claimed responsibility for the Tri-Century Eye Care data breach.
A new Mirai variant, “Broadside,” is targeting DVR systems in the maritime logistics sector, exploiting command injection flaws for device hijacking and lateral movement.
JS#SMUGGLER campaign is distributing the NetSupport RAT via compromised websites.
Polish authorities arrested three Ukrainian nationals accused of using advanced hacking equipment to attempt attacks on Polish IT systems and acquire sensitive data.
Android malware families FvncBot and SeedSnatcher, along with an upgraded version of ClayRat, have been identified with enhanced data theft capabilities.

Trends, Tools, or Tactics of Interest

Ransomware activity peaked in 2023, with FinCEN and US Treasury reporting over $2.1 billion extorted from 2022 to 2024, and total ransomware payments since 2013 surpassing $4.5 billion.
Ransomware operators are adopting packer-as-a-service solutions like Shanya to better evade detection by security tools.
Threat actors are exploiting VSCode extensions as a vector to compromise developer environments and exfiltrate sensitive data.
There is a rise in the use of compromised websites and free hosting services (e.g., Cloudflare Pages) for malware delivery and phishing operations.
AI and agentic AI systems are being targeted by attackers, prompting vendors to introduce new security layers to mitigate indirect prompt injection and other AI-specific threats.
Phishing tactics now include leveraging publicly available social media photos for virtual kidnapping scams.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome is implementing a new security architecture to protect Gemini-powered agentic AI browsing, including user alignment critics, expanded origin isolation, and mandatory user confirmations.
Financial Crimes Enforcement Network (FinCEN) and the US Treasury released updated data on ransomware payments, providing insight into the evolving threat landscape and the impact of recent law enforcement actions.

Cybersecurity Brief – 2025-11-27

Thu, 27 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Gainsight has expanded its list of impacted customers following a recent security alert from Salesforce, indicating the breach affected more customers than initially disclosed.
Multiple London councils, including the Royal Borough of Kensington and Chelsea and Westminster City Council, have experienced IT service disruptions due to a cyberattack.
Comcast will pay a $1.5 million fine after a vendor data breach in February 2024 exposed the personal information of nearly 275,000 customers.
Dartmouth College confirmed a data breach resulting from an Oracle hack, with over 226 GB of files stolen and leaked.
The OnSolve CodeRED emergency alert platform in the US was disrupted by a ransomware attack from the Inc Ransom group, resulting in operational impact and data breach.
Thousands of secrets, including credentials and private keys, were leaked by users of JSONFormatter and CodeBeautify code formatting platforms.
A major sportswear company was targeted by a high-volume phishing campaign between 29 and 30 October 2025, as detected by KnowBe4 analysts.

Newly Discovered Vulnerabilities

ASUS released firmware updates to address nine security vulnerabilities in AiCloud routers, including a critical authentication bypass flaw.
The ’node-forge’ JavaScript cryptography library patched a vulnerability that allowed attackers to bypass signature verification with specially crafted data.
A new malicious Chrome extension was discovered that injects hidden Solana transfer fees into Raydium swaps, diverting funds to attacker-controlled wallets.
Microsoft warned that FIDO2 security keys may prompt users for a PIN after recent Windows updates since September 2025.
Microsoft announced plans to secure Entra ID sign-ins from external script injection attacks, with implementation set for mid-to-late October 2026.

Notable Threat Actor Activity

The Shai-Hulud v2 supply chain attack has spread from npm to Maven, compromising over 830 npm packages and exposing thousands of secrets.
Qilin ransomware was deployed in a sophisticated supply chain attack targeting a South Korean managed service provider, resulting in data theft from 28 financial sector victims.
The RomCom threat group used SocGholish fake update attacks to deliver Mythic Agent malware to a US-based civil engineering company.
A new Mirai-based botnet, ShadowV2, has been observed exploiting known vulnerabilities in IoT devices from D-Link, TP-Link, and others, using the recent AWS outage as a test event.
Scammers are using fake LinkedIn job postings and video updates to distribute Flexible Ferret malware to Mac users, enabling multi-stage data theft and long-term access.
The “Scattered LAPSUS$ Hunters” group continued data theft and mass extortion campaigns against major corporations.
Cybercriminals have increasingly targeted financial institutions and individuals with account takeover fraud, causing $262 million in losses in 2025, according to the FBI.

Trends, Tools, or Tactics of Interest

NTLM relay and credential forwarding attacks continue to be exploited, with new vulnerabilities and abuse techniques identified in 2025.
The EMEA finance and banking sector faces escalating cybersecurity challenges, with increased targeting and advanced threats.
Advanced digital fraud attacks surged 180% in 2025, with generative AI used for creating deepfakes, synthetic IDs, and autonomous bots.
Attackers are integrating large language models (LLMs) into malware to evade detection and augment code in real time.
“Dark LLMs” are facilitating more competent attacks by low-level cybercriminals, though with limited technical sophistication.
Prompt injection vulnerabilities are a growing concern for agentic AI-enabled browsers, such as ChatGPT’s Atlas Browser.
Over half of surveyed enterprises are uncertain about their ability to secure non-human identities (NHIs), highlighting a gap in identity security controls.
Increased use of community-maintained tools (e.g., Chocolatey, Winget) for patching and updates presents both opportunities and risks for IT teams.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced a new Cyber Security and Resilience Bill, setting out enhanced requirements for critical infrastructure organisations.

Cybersecurity Brief – 2025-10-30

Thu, 30 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

A subsidiary of Japanese marketing and PR giant Dentsu (Merkle) experienced a data breach resulting in the theft of sensitive employee, client, and supplier data by unidentified threat actors.
The Canadian Centre for Cyber Security reported that hacktivists breached multiple water and energy facilities, gaining access to and modifying industrial controls across Canada.
A data leak exposed information about students attending Iran’s Ministry of Intelligence and Security (MOIS) training academy.
Microsoft experienced a global DNS outage affecting Azure and Microsoft 365 services, preventing customer logins and access.
No evidence was found of a Gmail breach; recent panic was due to circulation of old stolen credentials on the dark web.

Newly Discovered Vulnerabilities

The Anti-Malware Security and Brute-Force Firewall WordPress plugin (100,000+ installs) contains a vulnerability allowing site subscribers to read any file on the server, exposing private data.
Multiple security flaws in Dassault Systèmes DELMIA Apriso and XWiki are under active exploitation. In DELMIA Apriso, two vulnerabilities can be chained to gain privileged access and execute arbitrary code remotely. XWiki vulnerabilities are being used in cryptocurrency mining operations.
A new attack method, TEE.fail, targets DDR5 memory to steal cryptographic keys from Intel and AMD Trusted Execution Environments (TEEs), with both vendors issuing advisories.
OpenAI’s Atlas browser and similar agentic web browsers are exposed to context poisoning and prompt injection attacks, enabling attackers to manipulate AI model outputs and privacy.

Notable Threat Actor Activity

Russian-origin threat actors targeted Ukrainian organizations using living-off-the-land (LotL) tactics to exfiltrate data and maintain persistent access.
The “PhantomRaven” campaign published over 120 malicious npm packages, stealing developer credentials, authentication tokens, CI/CD secrets, and GitHub credentials from Windows, Linux, and macOS systems. Over 86,000 downloads were recorded.
Various botnets, including Mirai, Gafgyt, and Mozi, have increased automated attacks against PHP servers, IoT devices, and cloud gateways, exploiting vulnerabilities and misconfigurations to expand their control over internet-connected assets.

Trends, Tools, or Tactics of Interest

76% of organizations report struggling to keep pace with AI-powered attacks, with adversaries increasing sophistication and speed in ransomware and other threats.
New AI-targeted cloaking attacks are tricking AI crawlers (e.g., Perplexity, Atlas, ChatGPT) into indexing and citing fabricated information as facts, highlighting susceptibility of AI systems to context poisoning.
MITRE released ATT&CK v18, updating detection, mobile, and ICS (Industrial Control Systems) matrices with new defensive techniques and threat mappings.
BeyondTrust predicts a rise in attacks leveraging ghost identities, poisoned accounts, and autonomous AI agents, with traditional defenses proving less effective against emerging vectors.
Increased use of “invisible” dependencies and multi-layered obfuscation in malicious npm packages to evade detection.
Security experts note a sharp increase in cloud-focused attacks by botnets exploiting web-exposed and misconfigured assets.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will default to HTTPS for public sites starting October 2026, prompting users before allowing access to non-secure connections.
Microsoft introduced a security-focused change for Azure VMs, but provided a temporary reprieve after concerns it could disrupt apps requiring public internet access.

Cybersecurity Brief – 2025-06-12

Thu, 12 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Erie Insurance and Erie Indemnity Company confirmed a cyberattack that caused recent business disruptions and platform outages.
INTERPOL’s Operation Secure dismantled over 20,000 malicious IP addresses or domains linked to 69 infostealer malware variants, resulting in 32 arrests, the seizure of 117 command-and-control servers, and disruption of infrastructure in 26 countries.
Over 80,000 Microsoft Entra ID (formerly Azure AD) accounts were targeted in an account takeover campaign using the open-source TeamFiltration tool.
Coordinated brute-force attacks involving 295 malicious IPs targeted Apache Tomcat Manager interfaces exposed online.

Newly Discovered Vulnerabilities

Microsoft released patches for 67 vulnerabilities, including a WebDAV remote code execution zero-day (CVE-2025-25099) actively exploited in the wild. The zero-day was leveraged by the Stealth Falcon APT group to drop malware targeting defense and government organizations in Turkey, Qatar, Egypt, and the UAE.
A zero-click vulnerability named “EchoLeak” was identified in Microsoft 365 Copilot, allowing exfiltration of sensitive data from a user’s context without user interaction.
Two vulnerabilities in SinoTrack GPS devices were disclosed, enabling remote control of certain vehicle functions and tracking via default passwords.
A bug in Google’s password-recovery page allowed brute-forcing of any user’s phone number, exposing contact information and enabling phishing and SIM-swapping attacks.
Mirai botnets were observed exploiting a vulnerability in the Wazuh security platform, highlighting rapid exploitation of newly published CVEs.

Notable Threat Actor Activity

A new malicious implant, BrowserVenom, was discovered mimicking DeepSeek. The malware enables a proxy in Chrome and Mozilla browsers and spreads via phishing websites.
Former Black Basta ransomware members used email bombing and Microsoft Teams phishing, along with Python scripts, to establish persistent access in recent attacks.
Stealth Falcon APT exploited the Windows WebDAV zero-day for malware delivery in targeted attacks.
TeamFiltration, an open-source penetration testing tool, was repurposed for large-scale account takeover campaigns against Microsoft Entra ID accounts.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging AI tools, as highlighted in OpenAI’s report, to assist in social engineering attacks and influence operations.
“SmartAttack” is a new technique using smartwatches as covert ultrasonic receivers to exfiltrate data from air-gapped systems.
Brute-force campaigns targeting web management panels, such as Apache Tomcat Manager, are being conducted via large numbers of distributed IP addresses.
Botnet operators are reducing time-to-exploit for new CVEs, as evidenced by recent Mirai botnet campaigns.
DNS security is being emphasized as a critical but often overlooked defense layer.
Increased adoption and discussion of agentic AI security products at industry events, such as Gartner’s Security & Risk Management Summit.
Microsoft issued revised updates for Windows 11 24H2 on incompatible PCs and fixed Windows Server domain controller issues stemming from earlier updates.

Regulatory or Policy Developments

ConnectWise announced plans to rotate code-signing certificates based on third-party researcher recommendations, unrelated to a recent nation-state attack.
Google introduced new enterprise-scale security protections for Android devices.
INTERPOL’s Operation Secure represents a significant multinational law enforcement action against infostealer malware infrastructure.

Cybersecurity Brief – 2025-06-10

Tue, 10 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Sensata Technologies confirmed a data breach following an April ransomware attack, with personal data of current and former employees compromised.
United Natural Foods (UNFI), North America’s largest publicly traded grocery wholesaler, experienced a cyberattack that forced the shutdown of some systems.
Data stolen from Ticketmaster during the 2024 Snowflake data theft attacks was briefly relisted for sale by the Arkana Security extortion group, but no new breach is indicated.
SentinelOne disclosed new details about an attempted supply chain attack by Chinese hackers, targeting the company through an IT services and logistics provider.

Newly Discovered Vulnerabilities

Over 84,000 instances of Roundcube webmail remain vulnerable to CVE-2025-49113, a critical remote code execution vulnerability with a public exploit, which is being actively exploited.
CISA added critical vulnerabilities in Erlang/Open Telecom Platform (OTP) SSH and Roundcube to its Known Exploited Vulnerabilities Catalog.
A now-patched critical flaw in Wazuh Server has been exploited in the wild by threat actors deploying two different Mirai botnet variants for DDoS attacks.
A Google account vulnerability allowed brute-forcing of recovery phone numbers using only a profile name and partial number; the issue has been patched.

Notable Threat Actor Activity

The Librarian Ghouls APT continues targeting Russian entities, using RAR archives and BAT scripts to steal data and deploy cryptominers, often leveraging legitimate tools and executing attacks at night to evade detection.
Chinese state-linked threat groups APT15 and UNC5174 (also referenced as “PurpleHaze”) targeted SentinelOne and more than 70 other organizations across multiple sectors between July 2024 and March 2025, focusing on cyber-espionage and supply chain attacks.
The criminal group UNC6040 is conducting vishing (voice phishing) campaigns to compromise Salesforce instances, according to Google Threat Intelligence Group.
A global spear-phishing campaign is targeting CFOs with fraudulent employment offers, aiming at financial executives worldwide.
OpenAI has banned ChatGPT accounts linked to nation-state threat actors, citing use for malicious activities including social engineering, employment fraud, and cyber espionage.

Trends, Tools, or Tactics of Interest

Multiple botnets are exploiting the Wazuh Server vulnerability to deploy Mirai-based DDoS attacks, demonstrating ongoing interest in IoT botnet infrastructure.
Security researchers highlight that SIEMs are missing coverage for many MITRE ATT&CK techniques, with a significant proportion of detection rules non-functional.
Shadow IT risks persist despite IdP or CASB controls, with free trials, third-party AI tools, and personal accounts presenting ongoing exposure.
AI coding tools are increasing enterprise risk by enabling insecure code generation, as developers adopt new workflows with insufficient security oversight.
The Linux Foundation has launched the FAIR Package Manager, a decentralized and independent distribution system for trusted WordPress plugins.

Regulatory or Policy Developments

A new Trump administration cybersecurity order has reversed certain Biden and Obama-era priorities, including limits on cyber sanctions, termination of the digital ID program, and a refocus on enabling AI, deploying post-quantum cryptography, and promoting secure software development.

Cybersecurity Brief – 2025-06-09

Mon, 09 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

A supply chain attack targeting npm and PyPI ecosystems has been identified, affecting over a dozen packages associated with GlueStack. The attack delivers malware via a change to “lib/commonjs/index.js,” potentially impacting millions globally.
Over 700 users across Latin America, primarily in Brazil, have been infected since early 2025 through a campaign distributing malicious Chromium-based browser extensions designed to steal user data.

Newly Discovered Vulnerabilities

A command injection vulnerability in TBK DVR-4104 and DVR-4216 digital video recording devices is being actively exploited by a new Mirai botnet variant, enabling attackers to hijack vulnerable devices.

Notable Threat Actor Activity

Cybercriminals are leveraging software supply chain attacks by compromising widely used npm and PyPI packages to distribute malware at scale.
Threat actors are targeting Latin American users with malicious browser extensions, focusing on Chromium-based browsers to exfiltrate sensitive information.
Mirai botnet operators have adapted their malware to exploit vulnerabilities in digital video recorders, expanding their botnet infrastructure through IoT device compromise.

Trends, Tools, or Tactics of Interest

Increased targeting of software supply chains, particularly open-source package repositories (npm, PyPI), as a vector for widespread malware distribution.
Use of browser extensions as a method for credential and data theft, specifically targeting users in Latin America.
Continued adaptation of IoT botnets (Mirai) to exploit newly discovered vulnerabilities in networked devices, maintaining persistence and expanding reach.

Cybersecurity Brief – 2025-06-07

Sat, 07 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Optima Tax Relief, a U.S. tax resolution firm, suffered a Chaos ransomware attack, resulting in the leakage of stolen data.
Kettering Health, a healthcare provider managing 14 medical centers in Ohio, confirmed a May cyberattack by the Interlock ransomware group, with data exfiltration.
Ukrainian critical infrastructure was targeted by a new data wiper malware, PathWiper, in a disruptive attack attributed to previously unseen malware.
86 million AT&T customer records, including names, dates of birth, phone numbers, email addresses, street addresses, and social security numbers, are reportedly being sold on the dark web.

Newly Discovered Vulnerabilities

A critical vulnerability, CVE-2024-3721, affecting TBK DVR devices is being actively exploited by a new Mirai botnet variant.
Two critical Fortinet vulnerabilities, enabling authentication bypass and remote code execution, are now being exploited by the Qilin ransomware operation.

Notable Threat Actor Activity

The Qilin ransomware group is actively exploiting Fortinet vulnerabilities in ongoing attacks.
The Interlock ransomware group was responsible for the Kettering Health breach.
A new Mirai botnet variant is targeting TBK DVR devices via CVE-2024-3721.
The BADBOX 2.0 botnet continues to target home networks and connected Android devices, despite partial disruption earlier this year.
Cybercriminals are increasingly leveraging residential proxy services to disguise malicious web traffic as legitimate user activity.
A new campaign deploying Atomic macOS Stealer malware is exploiting “ClickFix” social engineering tactics to target Apple users.
Multiple widespread phishing campaigns are utilizing ClickFix tactics to deliver malware to business targets.
Indian authorities, with support from Microsoft, dismantled two illegal call centers and arrested six individuals involved in a transnational tech support scam targeting Japanese users.

Trends, Tools, or Tactics of Interest

ClickFix social engineering tactics are gaining traction in phishing campaigns, enhancing the sophistication and success rate of malware delivery.
Use of residential proxy services by cybercriminals is growing, complicating detection and attribution of malicious web traffic.
Data wiper malware, such as PathWiper, is being deployed in targeted attacks against critical infrastructure, notably in Ukraine.
The ongoing exploitation of IoT and DVR devices by Mirai variants highlights continued targeting of networked hardware.
The FBI warns that the BADBOX 2.0 botnet remains active, targeting home networks through compromised Android devices.
Synthetic data is being adopted to support AI development and privacy compliance, but introduces risks of re-identification and model integrity.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft and CrowdStrike have announced a joint initiative to standardize naming conventions for APT (Advanced Persistent Threat) groups, aiming to reduce confusion in threat intelligence reporting.
Law enforcement agencies from over a dozen countries conducted an international operation arresting 20 suspects involved in the production and distribution of child sexual abuse material.
F5 has acquired agentic AI security startup Fletch, with plans to integrate its technology into the F5 Application Delivery and Security Platform.

Cybersecurity Brief – 2025-05-15

Thu, 15 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach and Extortion Attempt
- Coinbase disclosed a data breach affecting approximately 1% of its users after cybercriminals bribed customer support agents. Attackers accessed sensitive customer information, including government IDs, and attempted to extort $20 million. The extortion attempt failed, but the incident highlights ongoing risks to cryptocurrency platforms from both insider and external threats.
Nova Scotia Power Data Breach
- Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data. The breach was discovered last month and underscores the persistent targeting of critical infrastructure and utility providers.

Newly Discovered Vulnerabilities

SAP NetWeaver (CVE-2025-31324)
- A critical vulnerability in SAP NetWeaver is being actively exploited by multiple threat actors, including ransomware groups BianLian and RansomExx. The flaw allows remote code execution and has led to a surge in attacks against unpatched systems. Immediate patching is strongly advised.
Samsung MagicINFO 9 Server (CVE-2025-4632)
- Samsung patched a critical vulnerability (CVSS 9.8) in MagicINFO 9 Server that was actively exploited to deploy Mirai botnet variants. Organizations using this software should update immediately.
Google Chrome High-Severity Flaw
- Google released emergency updates addressing a high-severity Chrome vulnerability that has a public exploit and is being used in the wild for cross-origin data leaks via the Loader Referrer Policy. All users are advised to update promptly.
Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Flaws
- Ivanti confirmed exploitation in the wild of zero-day vulnerabilities in EPMM, affecting a limited number of customers. The flaws stem from open source library issues and are being used in chained attacks.

Cybersecurity Brief – 2025-05-14

Wed, 14 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer confirmed customer data was stolen in a recent cyberattack. While no account passwords were compromised, customers are being required to reset passwords as a precaution.
Dior disclosed a cybersecurity incident resulting in the exposure of customer information.
Nucor Corporation, a major steel producer, experienced network disruptions due to a cyberattack, forcing parts of its systems offline for containment.
The Australian Human Rights Commission suffered a data breach in which private documents were leaked online and indexed by search engines.
Xinbi Guarantee, a Chinese-language Telegram marketplace, has been linked to $8.4 billion in illicit transactions, including crypto crime, romance scams, and North Korean money laundering.
North Korean IT worker scams are being exposed at scale, with researchers publishing 1,000 email addresses and photos linked to infiltration of Western companies.
Kosovo extradited the admin of BlackDB, an online cybercrime marketplace, to the US to face charges.

Newly Discovered Vulnerabilities and Exploits

Microsoft Patch Tuesday (May 2025): Microsoft released fixes for 78 vulnerabilities, including five zero-days under active exploitation. Notably, a CVSS 10 vulnerability impacts Azure DevOps Server.
Samsung patched CVE-2025-4632 in MagicINFO 9 Server, a critical flaw (CVSS 9.8) exploited to deploy Mirai botnet malware.
Fortinet addressed CVE-2025-32756, a zero-day RCE flaw in FortiVoice enterprise phone systems, confirmed as exploited in the wild.
Ivanti released updates for two vulnerabilities in Endpoint Manager Mobile (EPMM) that have been chained for remote code execution in limited attacks.
SAP NetWeaver vulnerability is being actively exploited by multiple ransomware groups, including BianLian and RansomExx, to deploy malware such as PipeMagic Trojan.
Google Chrome is rolling out a security change to prevent browser launches with admin privileges on Windows, reducing attack surface.
Open redirect vulnerabilities in trusted domains (e.g., google.com) continue to be abused in phishing campaigns.
Focused phishing attacks are leveraging trusted domains, real CAPTCHAs, and server-side validation for more targeted credential theft.

Notable Threat Actor Activity

Earth Ammit, a cyber espionage group, was linked to supply chain breaches in the drone sector via ERP systems in the VENOM and TIDRONE campaigns targeting Taiwan and South Korea.
Scattered Spider (aka UNC3944) tactics, previously used against UK retail chains, are now being deployed against US retailers.
Ransomware gangs are increasingly exploiting SAP NetWeaver vulnerabilities for initial access and malware deployment.
Meta Mirage, a global phishing campaign, is targeting Meta Business Suite users to hijack high-value business accounts.
Horabot malware is being distributed through invoice-themed phishing emails, targeting Windows users across six Latin American countries.

Trends, Tools, and Tactics of Interest

Phishing campaigns are becoming more sophisticated, with increased use of trusted domains, CAPTCHAs, and real-time validation to evade detection and improve targeting.
Telegram-based black markets remain a significant vector for cybercrime, with recent enforcement actions leading to shutdowns and exposure of major illicit marketplaces.
Shadow SaaS and AI usage is an emerging risk, with new tools (e.g., LastPass SaaS monitoring) being developed to detect unauthorised employee use of unsanctioned cloud and AI services.
Supply chain attacks via ERP systems and targeting of high-value sectors (e.g., drones, retail) remain prevalent.
AI agent security: Research indicates that AI agents can be manipulated by implanting fake “memories,” raising concerns about the integrity of autonomous systems.
Device hygiene: Daily phone reboots are recommended as a practical defense against persistent zero-click mobile exploits.

Regulatory and Policy Developments

Consumer Financial Protection Bureau (CFPB) in the US has canceled plans for tighter regulation of data brokers, potentially impacting privacy and data protection standards.
Telegram enforcement: Following media inquiries, Telegram banned thousands of accounts tied to crypto scam money laundering, disrupting several major illicit marketplaces.

Cybersecurity Brief – 2025-05-07

Wed, 07 May 2025 00:00:00 +0000

Major Incidents or Breaches

UK Legal Aid Agency (LAA) Incident: The LAA, part of the UK’s Ministry of Justice, is investigating a cybersecurity incident that may have exposed law firm data. The agency has warned impacted firms of potential data access by attackers.
T-Mobile Data Breach Settlement: Payments to victims of T-Mobile’s 2021 data breach (which exposed data of 76 million customers) have begun distribution after previous delays.
Langflow AI App Servers Compromised: A critical remote code execution (RCE) vulnerability in Langflow has been exploited in the wild, with CISA urging immediate patching.
Samsung MagicINFO 9 Server Exploits: Active exploitation of an unauthenticated RCE flaw in Samsung MagicINFO 9 Server has been observed, leading to device hijacking and malware deployment.
GeoVision IoT Devices Used in Mirai Botnet: Threat actors are exploiting vulnerabilities in end-of-life GeoVision IoT devices to conscript them into Mirai botnets for DDoS attacks.
Commvault Vulnerability Still Exploitable: Despite prior patches, CVE-2025-34028 affecting Commvault remains exploitable and is under active attack.
SonicWall SMA Devices Under Attack: Two vulnerabilities in SonicWall’s Secure Mobile Access (SMA) devices are being actively exploited by threat actors.
Linux Supply Chain Attack: Malicious Go modules uploaded to GitHub have been used to deliver disk-wiping malware targeting Linux servers.

Newly Discovered or Actively Exploited Vulnerabilities

Apache Parquet CVE-2025-30065: A proof-of-concept exploit for this maximum severity vulnerability has been released, increasing the risk to unpatched servers.
Google Android FreeType Flaw: Google patched an actively exploited, zero-click FreeType 2 code execution vulnerability in Android as part of its May 2025 security updates.
Langflow Critical RCE: The Langflow platform is subject to an easily exploitable RCE vulnerability (CVSS 9.8), now under active exploitation.
Samsung MagicINFO 9 Server RCE: Ongoing exploitation of the unauthenticated RCE flaw is resulting in widespread device compromise.
SonicWall SMA Device Vulnerabilities: CISA has highlighted two actively exploited vulnerabilities affecting SonicWall’s SMA remote access devices.
Commvault CVE-2025-34028: Despite being previously patched, this vulnerability remains exploitable and is being leveraged in attacks.

Notable Threat Actor Activity

Mirai Botnet Expansion: Threat actors are leveraging vulnerabilities in Samsung MagicINFO and GeoVision IoT devices to expand Mirai botnet operations, primarily for DDoS attacks.
Investment Scam Operations: Two threat actor groups are running investment scams using Facebook ads, RDGA domains, and IP filtering to target victims and evade detection.
Device Code Phishing: Attackers are employing “device code phishing” tactics to bypass multi-factor authentication, targeting users with social engineering campaigns that exploit device enrolment flows.

Trends, Tools, or Tactics of Interest

Modular Malware: Continued evolution in malware development with increased use of modular architectures, allowing threat actors to rapidly adapt and repurpose code.
Machine Credentials and Third-Party Risk: The Verizon 2025 DBIR highlights that third-party access and compromised machine credentials are leading drivers behind major breaches, surpassing ransomware and zero-day exploits.
External Attack Surface Management (EASM): Growing emphasis on EASM as organisations struggle to maintain visibility and control over sprawling digital assets and shadow IT.
Kubernetes Security Risks: Microsoft warns that default Helm chart configurations in Kubernetes deployments may lead to data leaks due to insecure defaults and misconfigurations.
Supply Chain Attacks via Open-Source Modules: The attack on Linux servers via malicious Go modules underscores ongoing risks in the open-source software supply chain.

Regulatory or Policy Developments

NSO Group Fined for Pegasus Spyware Attacks: A US federal jury ordered NSO Group to pay $168 million to WhatsApp (Meta) for facilitating Pegasus spyware attacks against 1,400 users, setting a significant legal precedent for spyware vendors.
California Privacy Enforcement: The California Privacy Protection Agency issued a six-figure fine and mandated business practice changes for a national clothing retailer over privacy violations, reinforcing active regulatory oversight.
US CISA Funding and Policy Scrutiny: US lawmakers are questioning proposed cuts to CISA funding and demanding a comprehensive national cybersecurity plan.
DOD Cyber Policy Review: The US Department of Defense’s nominee for cyber policy has pledged to re-evaluate guardrails for offensive cyber operations, signalling potential policy shifts.

Other Noteworthy Items

Signal Clone Security Issue: Analysis of TM Signal, a Signal clone, revealed that it sends user message logs in plaintext, raising concerns over secure messaging app clones.
Credential Hygiene in Public Figures: Reports indicate poor password practices among high-profile individuals, including the US Director of National Intelligence, highlighting ongoing issues with credential reuse at senior levels.

Cybersecurity Brief – 2025-05-06

Tue, 06 May 2025 00:00:00 +0000

Major Incidents or Breaches

UK Retail Sector Attacks: The UK’s National Cyber Security Centre (NCSC) issued new security guidance following three significant cyberattacks targeting major UK retailers.
TeleMessage Breach: TeleMessage, an unofficial Signal message archiving tool used by US government officials, suspended all services after a reported hack.
Educational Sector Disruptions (US): Multiple school districts in Georgia and a university in New Mexico experienced disruptive cyberattacks as the academic year ends.
Darcula Phishing Campaign: The Darcula phishing-as-a-service (PhaaS) platform stole 884,000 credit cards globally via malicious SMS campaigns.
Disney Data Leak: An individual pleaded guilty to stealing sensitive Disney data and falsely claiming to be a Russian hacktivist.
Peru Ransomware Claim: The Rhysida ransomware group claimed responsibility for an attack on the Peruvian government’s domain, though the government denies the incident.

Newly Discovered Vulnerabilities

Android Zero-Day: Google’s May 2025 security update addresses 46 Android vulnerabilities, including one actively exploited in the wild.
Apple AirPlay Zero-Click RCE: Researchers disclosed now-patched, wormable vulnerabilities in Apple’s AirPlay protocol that enabled zero-click remote code execution over public Wi-Fi.
Langflow Critical Flaw: A critical vulnerability in the open-source Langflow platform has been added to CISA’s Known Exploited Vulnerabilities (KEV) list following evidence of active exploitation.
Commvault Command Center: CVE-2025-34028, a maximum-severity flaw in Commvault Command Center, was also added to CISA’s KEV list after confirmation of in-the-wild exploitation.
Samsung MagicINFO CMS: The Mirai botnet is now exploiting a previously patched arbitrary file upload vulnerability (CVE-2024-7399) in Samsung MagicINFO CMS for remote code execution.
Kubernetes Helm Chart Risks: Microsoft warns that default configurations in Kubernetes Helm charts may expose sensitive data publicly.
EDR Bypass Technique: A new “Bring Your Own Installer” technique has been used to bypass SentinelOne’s tamper protection, enabling threat actors to disable endpoint detection and response (EDR) tools.

Notable Threat Actor Activity

Luna Moth (Silent Ransom Group): Increased callback phishing campaigns by Luna Moth targeting US legal and financial institutions, impersonating IT help desks to gain initial access.
Venom Spider: Arctic Wolf Labs identified a spear-phishing campaign by “Venom Spider” targeting hiring managers and recruiters by posing as job seekers.
Russian-Linked Hacktivism: Russian hacktivist group conducted DDoS attacks on Romanian state websites during national elections.
FSB Recruitment via TikTok: Ukrainian authorities detained an alleged FSB agent recruited via TikTok for military espionage.
Myanmar Cyber Scam Sanctions: The US sanctioned Myanmar’s Karen National Army and its leader for involvement in cyber fraud operations.

Trends, Tools, or Tactics of Interest

Stealth and Persistence: Notable rise in stealth tactics designed for long-term access and silent control, with attackers leveraging AI for adaptive, persistent threats.
Phishing-as-a-Service (PhaaS): Darcula’s large-scale SMS phishing operation underlines the growing sophistication and reach of PhaaS platforms.
EDR Evasion: Increasing use of advanced techniques, such as “Bring Your Own Installer,” to bypass endpoint security controls.
Deepfake Evolution: Research reveals deepfakes now retain biometric signals (e.g., heartbeats), presenting new challenges for detection and authentication.
Supply Chain Risks: Ongoing concerns about open-source software security, with warnings about persistent risks from tools like easyjson due to foreign influence and supply chain exposure.

Regulatory or Policy Developments

CISA KEV List Updates: Addition of Langflow and Commvault vulnerabilities to the US CISA Known Exploited Vulnerabilities catalog, increasing urgency for patching.
US Sanctions: Expansion of US sanctions targeting entities and individuals involved in cybercrime and cyber scam operations in Myanmar.
NCSC Guidance: UK’s NCSC published updated security guidance in response to recent cyberattacks on the retail sector, urging all organisations to review and strengthen their cyber defences.

Cybersecurity Brief – 2025-04-09

Wed, 09 Apr 2025 00:00:00 +0000

SourceForge Used to Distribute Miner and ClipBanker Trojan

Malicious actors distributing a miner and the ClipBanker Trojan via SourceForge.
Unconventional persistence techniques utilized by attackers.

Microsoft Releases Security Fixes for 126 Flaws

Microsoft patches 126 flaws affecting its software products.
One vulnerability actively exploited in the wild addressed.

Adobe Patches 11 Critical ColdFusion Flaws

Adobe releases security updates to fix critical-severity bugs in ColdFusion.
Multiple vulnerabilities discovered in versions 2025, 2023, and 2021.

Fortinet Urges Upgrades to Patch Critical Admin Password Change Flaw

Critical security flaw impacting FortiSwitch addressed by security updates.
Vulnerability could permit unauthorized password changes.

Amazon EC2 SSM Agent Flaw Patched After Privilege Escalation

Security flaw in Amazon EC2 Simple Systems Manager (SSM) Agent disclosed and patched.
Exploitation could allow attackers to achieve privilege escalation.

Cyber Attacks Targeting Ukraine with Information-Stealing Malware

Ukrainian institutions targeted with information-stealing malware.
Cyber attacks aim at military entities.

Fake Microsoft Office add-ins Pushing Malware via SourceForge

Threat actors distributing fake Microsoft add-ins via SourceForge.
Malware installation for cryptocurrency mining and theft purposes.

Ransomware Gang Exploits Windows Common Log File System Zero-Day

RansomEXX ransomware gang exploiting Windows CLFS zero-day flaw.
Gain SYSTEM privileges on victims’ systems.

New Mirai Botnet Behind Surge in TVT DVR Exploitation

Significant spike in exploitation attempts targeting TVT NVMS9000 DVRs detected.
Over 2,500 unique IPs scanning for vulnerable devices.

AWS Introduces ML-KEM to Secure TLS from Quantum Threats

Amazon Web Services adds ML-KEM post-quantum key encapsulation mechanism to key services.
Enhances security against quantum threats.

Microsoft Patch Tuesday Addresses Exploited Zero-Day and 134 Flaws

Security updates for 134 flaws, including one actively exploited zero-day vulnerability.
Ransomware campaign exploiting one of the flaws with victims in the US and other countries.