Mustang Panda on DanSec Daily

Cybersecurity Brief – 2026-06-30

Tue, 30 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Nissan disclosed a data breach affecting current and former employees after threat actors exploited an Oracle PeopleSoft vulnerability. This incident is linked to broader attacks involving the ShinyHunters group and the exploitation of a critical Oracle zero-day (CVE-2026-46817) ^[13]^[14]^[20]^[37].
The National Association of Insurance Commissioners (NAIC) confirmed a breach resulting from the same Oracle PeopleSoft vulnerability, with the ShinyHunters group claiming to have stolen 3.1 TB of data. NAIC stated that only publicly available data, outdated logs, and configuration files were taken ^[14]^[37].
Hackers are actively exploiting a critical authentication bypass vulnerability (CVE-2026-48558) in SimpleHelp to deploy Djinn Stealer, a new cross-platform infostealer targeting Windows, macOS, and Linux systems. The malware focuses on stealing credentials, including those related to cloud and AI environments ^[19]^[23].
Over 236,000 websites built with the DCloud Uni-App framework are being abused for crypto scams, phishing, and wallet-draining attacks, leveraging legitimate development tools to host malicious content ^[10].
Microsoft has removed more than 100 malicious Edge browser extensions that were delivering malware via images, after being advertised as useful tools ^[43].

Newly Discovered Vulnerabilities

Apple released patches for over 30 vulnerabilities across iOS, macOS, and Safari, including four WebKit flaws discovered using artificial intelligence techniques ^[4].
A critical vulnerability (CVE-2026-46817, CVSS 9.8) in Oracle E-Business Suite is under active exploitation, enabling attackers to compromise affected systems ^[5]^[20].
Researchers disclosed a critical vulnerability in SimpleHelp (CVE-2026-48558) that allows authentication bypass and is being used to deploy malware in the wild ^[19]^[23].
The “DirtyClone” Linux kernel vulnerability, a variant of DirtyFrag, was revealed to allow unprivileged local users to manipulate the page cache and gain root privileges ^[38].
Multiple vulnerabilities were reported in Daktronics controllers, exposing highway signs and billboards to remote hacking. CISA has issued an advisory regarding these flaws ^[33].
A flaw in the Amazon Q VS Extension could allow attackers to execute arbitrary code and steal cloud credentials by planting malicious repositories ^[27].

Notable Threat Actor Activity

The Gentlemen ransomware-as-a-service group has been observed deploying new ransomware variants and evolving its tactics, including the use of custom backdoors ^[1].
Mustang Panda, a China-aligned espionage group, is running two campaigns targeting Indian government and hydropower entities, using Zoho WorkDrive as a command-and-control channel and deploying new malware ^[8].
The Russian APT group Gamaredon continues to expand its attacks against Ukraine, updating its malware arsenal and abusing cloud services ^[12].
The ShinyHunters extortion group is linked to recent Oracle PeopleSoft breaches affecting organizations such as Nissan and NAIC ^[13]^[14]^[37].
Nation-state actors from Iran, Russia, and China have been targeting water systems for sabotage by exploiting weak passwords, exposed PLCs, and poor network segmentation ^[26].
The US Department of State has offered a $10 million reward for information on Russian-linked UNC5792 and UNC4221 hacker groups, which have targeted WhatsApp and Signal users, as well as US government and allied personnel ^[17]^[40].

Trends, Tools, or Tactics of Interest

Threat actors are increasingly abusing legitimate cloud services (such as Zoho WorkDrive) and open-source frameworks (such as DCloud Uni-App) for command and control or hosting malicious content ^[8]^[10].
Infostealer malware, such as Djinn Stealer, is being deployed via exploitation of newly disclosed vulnerabilities and is targeting credentials across cloud and AI services ^[19]^[23].
Malicious browser extensions remain a significant threat vector, with both Chrome and Edge extensions being used to log user activity or deliver malware ^[6]^[43].
Researchers demonstrated that indirect prompts embedded in code repositories can trigger AI coding assistants like Claude Code to execute malicious actions, such as spawning a reverse shell on a developer’s machine ^[35].
Business email compromise attacks are increasingly relying on convincing impersonation rather than malware, making detection by traditional security tools more difficult ^[21].
AI agents and agentic AI systems present new identity and access management challenges, as attackers seek to compromise their privileged identities to access enterprise resources ^[18]^[36].

Regulatory or Policy Developments Affecting the Security Industry

WhatsApp has begun rolling out a username feature globally, allowing users to hide their phone numbers and add an optional username key as a secondary credential for increased privacy ^[7]^[15]^[34].
Microsoft has extended Windows Server 2022 hotpatching support until October 2027, one year past its mainstream end date ^[16].
OpenAI and Anthropic are restricting access to new AI models to select customers during a cybersecurity review at the request of US authorities ^[39].
Google has warned that proposed EU pro-competition regulations could create privacy and security risks by requiring the opening of search and Android systems ^[29].
The US Justice Department seized nearly 400 domains used for illegal streaming of FIFA World Cup matches, disrupting illicit content distribution networks ^[22].
The US Department of State has issued a $10 million bounty for information on Russian state hackers targeting messaging app users and government personnel ^[17]^[40].

Sources

Nissan discloses employee data breach linked to Oracle zero-day attacks - bleepingcomputer.com
NAIC says public data stolen in ShinyHunters' PeopleSoft breach - bleepingcomputer.com
Hackers now exploit critical Oracle E-Business flaw in attacks - bleepingcomputer.com
Insurance Regulators Group NAIC Hit in Oracle PeopleSoft Hack - securityweek.com
Critical SimpleHelp flaw exploited to deploy new stealer malware - bleepingcomputer.com
'Djinn' Stealer Targets Cloud, AI Credentials - darkreading.com
236,000 DCloud Uni-App Sites Used in Crypto Scams, Phishing, and Wallet Drainers - thehackernews.com
119 Edge extensions promised useful tools, instead downloaded malware - malwarebytes.com
Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs - thehackernews.com
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild - thehackernews.com
‘DirtyClone’ Linux Kernel Vulnerability Leads to Root Access - securityweek.com
New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking - securityweek.com
Amazon Q VS Extension Flaw Leads to Cloud Credential Theft - darkreading.com
The Gentlemen are knocking: сustom backdoors and evolving tactics - securelist.com
Mustang Panda Uses Zoho WorkDrive as Command Channel in Indian Government Attacks - thehackernews.com
Gamaredon Expands Ukraine Attacks with New Malware and Cloud Service Abuse - thehackernews.com
Iran, Russia, China Target Water Systems for Sabotage - darkreading.com
U.S. offers $10 million for hackers targeting WhatsApp, Signal users - bleepingcomputer.com
US Offers $10 Million Bounty for Russian State Hackers as Messaging App Attacks Evolve - securityweek.com
Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input - thehackernews.com
Researchers Demo New Claude Code Attack Using Harmless-Looking Repositories to Hijack Developer Machines - securityweek.com
Webinar: Why business email compromise attacks keep succeeding - bleepingcomputer.com
Agentic AI Has an Identity Problem and Attackers Know It - bleepingcomputer.com
Straiker Raises $64 Million for AI Security Platform - securityweek.com
WhatsApp is Finally Getting Usernames to Help Keep Phone Numbers Private - thehackernews.com
WhatsApp rolls out usernames to help users hide their phone number - bleepingcomputer.com
WhatsApp Rolling Out Username Feature to Bolster Phone Number Privacy - securityweek.com
Microsoft extends Windows Server 2022 hotpatching until October 2027 - bleepingcomputer.com
OpenAI and Anthropic Limit New AI Models to Trump-Approved Customers During Cybersecurity Review - securityweek.com
Top Google Security Staff Warn Search Data Could Be Hacked if EU Rules Change - wired.com
US seizes hundreds of FIFA World Cup illegal streaming domains - bleepingcomputer.com

Cybersecurity Brief – 2026-01-29

Thu, 29 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

The Polish energy grid suffered a coordinated cyberattack in December 2025, impacting around 30 distributed energy resource sites, including combined heat and power facilities and wind farms. The incident has been attributed to the Russian state-sponsored group ELECTRUM.
eScan antivirus vendor MicroWorld Technologies confirmed its update server was breached and used to distribute a malicious update.
The FBI seized the RAMP cybercrime forum, a major platform for ransomware gangs and malware advertisements.
Google, in collaboration with partners, disrupted IPIDEA, one of the world’s largest residential proxy networks.
A malicious campaign, dubbed “Bizarre Bazaar,” is actively targeting exposed Large Language Model (LLM) service endpoints to commercialise unauthorised access to AI infrastructure.
Researchers found 16 malicious Chrome extensions capable of hijacking ChatGPT sessions and exfiltrating user data.
Two malicious Python packages masquerading as spellcheckers were discovered on PyPI, delivering remote access trojans.

Newly Discovered Vulnerabilities

Two high-severity vulnerabilities were disclosed in the n8n workflow automation platform, allowing authenticated remote code execution and potential compromise of affected instances.
A critical sandbox escape vulnerability was identified in the vm2 Node.js library, enabling arbitrary code execution on the host system.
SolarWinds released patches for critical vulnerabilities in its Web Help Desk software, addressing authentication bypass and remote command execution issues.
Fortinet patched a zero-day (CVE-2026-24858) in FortiCloud SSO authentication, which allowed attackers to log into devices registered to other accounts; the company temporarily disabled SSO authentication to mitigate ongoing attacks.
Oracle WebLogic vulnerability CVE-2026-21962 has been recently patched, with evidence of exploit attempts being observed.

Notable Threat Actor Activity

Russian state-sponsored group ELECTRUM was attributed with medium confidence to the December 2025 cyberattack on Poland’s power grid.
Chinese-linked Mustang Panda deployed an updated COOLCLIENT backdoor in cyber espionage attacks against government entities, facilitating extensive data theft.
China-backed threat actor “PeckBirdy” used the JScript C2 framework in cross-platform campaigns targeting Chinese gambling websites and Asian government entities with new backdoors.
Multiple threat actors, including Russian and Chinese state-sponsored groups, are actively exploiting the WinRAR vulnerability CVE-2025-8088 for initial access and data theft, despite the availability of a patch since July 2025.
Initial access broker TA584 is now leveraging the Tsundere Bot and XWorm RAT to gain network access, leading to ransomware attacks.
Fake dating apps are being used as lures in Android spyware campaigns in Pakistan, linked to broader espionage operations.

Trends, Tools, or Tactics of Interest

A surge in attacks targeting Latin America, including data-leak extortion, credential theft, edge-device exploitation, and attacker adoption of AI-driven tactics, has made it the riskiest region for cyberattacks.
Threat actors are increasingly exploiting exposed AI/LLM endpoints and insecure deployments, leading to unauthorised access and data leakage in enterprise environments.
Malicious VS Code extensions (e.g., fake Moltbot) are being distributed via the official marketplace, dropping malware and exposing sensitive data such as API keys and OAuth tokens.
Password reuse and risky credential workarounds remain prevalent attack vectors, often overlooked by security teams.
AI-driven security operations (AI SOC agents) are accelerating triage and threat hunting, but concerns remain about over-reliance on automation.
Malicious browser extensions continue to target high-profile services like ChatGPT to exfiltrate user data.

Regulatory or Policy Developments Affecting the Security Industry

WhatsApp has rolled out new lockdown-style security features, including Strict Account Settings, to protect high-risk users (journalists, public figures) from advanced exploits and spyware. These features block risky attachments, media, and calls from unknown sources.
AI is increasingly being used for compliance controls and regulated actions, prompting CISOs to reconsider identity, access, and auditability frameworks.
ICE in the US is using Palantir’s AI tools to process and summarise tips, highlighting increased adoption of AI in law enforcement and government operations.

Cybersecurity Brief – 2026-01-28

Wed, 28 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Nike is investigating a potential data breach after the World Leaks ransomware/extortion group published 1.4 TB of allegedly stolen corporate files, including 188,347 highly sensitive documents.
SoundCloud has suffered a data breach impacting 29.8 million accounts, with hackers stealing personal and contact information.
Over 100 organizations have been targeted in a phishing campaign attributed to ShinyHunters, with domains set up to impersonate brands such as Atlassian, Canva, Epic Games, HubSpot, Moderna, ZoomInfo, and WeWork.
Over 6,000 SmarterMail servers are exposed online and likely vulnerable to automated hijacking attacks exploiting a critical authentication bypass vulnerability.
Multiple threat actors, including state-sponsored and financially motivated groups, continue to exploit the CVE-2025-8088 WinRAR path traversal vulnerability for initial access and malware delivery.
Chrome and Edge browser extensions marketed as ChatGPT enhancement tools have been found stealing ChatGPT session data, granting threat actors access to user information.

Newly Discovered Vulnerabilities

Microsoft released emergency out-of-band patches for Office zero-day vulnerability CVE-2026-21509, which is actively exploited to bypass security features through malicious Office files.
Fortinet patched a critical authentication bypass vulnerability in FortiOS/FortiCloud SSO (CVE-2026-24858) after reports of active exploitation in the wild.
A critical remote code execution vulnerability has been disclosed in Grist-Core, an open-source spreadsheet-database platform, exploitable via spreadsheet formulas.
A critical sandbox escape flaw (CVE-2026-22709) was found in the vm2 Node.js library, allowing arbitrary code execution on host systems.
OpenSSL patched 12 vulnerabilities, including a high-severity remote code execution flaw.
‘PackageGate’ vulnerabilities in the JavaScript ecosystem allow bypassing NPM supply chain attack protections, leading to arbitrary code execution.
A critical Telnet server flaw exposes legacy and IoT systems to unauthenticated remote access and shell control.
Linux vulnerabilities are being actively exploited, enabling attackers to obtain root privileges or bypass authentication via Telnet.

Notable Threat Actor Activity

The HoneyMyte (aka Mustang Panda/Bronze President) APT group has updated its CoolClient backdoor and is deploying multiple infostealers, including three browser data stealer variants and clipboard monitoring tools, in recent campaigns.
China-aligned APT actors have been using a JScript-based command-and-control (C2) framework called PeckBirdy since 2023 to target multiple environments.
Pakistan-linked threat actors have conducted two cyber campaigns against Indian government entities using previously undocumented techniques.
The ShinyHunters group is running a large-scale phishing campaign targeting over 100 organizations with credential harvesting domains.
The World Leaks ransomware/extortion group claims responsibility for the Nike data breach and has published stolen data to pressure the victim.
Multiple threat actors continue to exploit the WinRAR CVE-2025-8088 vulnerability for initial access and malware deployment.
The ‘Stanley’ malware-as-a-service toolkit enables malicious Chrome extensions to overlay phishing content on legitimate websites without altering the visible URL.
A new ransomware strain, ‘Sicarii’, has emerged, featuring poor code quality and a possible false-flag Hebrew identity, and currently cannot be decrypted.

Trends, Tools, or Tactics of Interest

Attackers are increasingly weaponizing trusted Remote Monitoring and Management (RMM) tools to establish persistent backdoor access in victim networks.
Recent phishing campaigns are leveraging fake CAPTCHAs, Microsoft App-V scripts, and trusted web services to distribute infostealers (ClickFix-style attacks).
Modern ransomware operations are shifting from pure encryption to psychological extortion, leveraging stolen data and exposure threats to increase pressure on victims.
AI-generated data degradation (“model collapse”) is raising concerns about accuracy, malicious activity propagation, and PII protection in zero-trust environments.
Browser extensions are being used as undetectable phishing vectors, with malicious overlays on legitimate sites while maintaining the original URL.
Supply chain vulnerabilities in JavaScript/NPM environments remain a critical risk, with new bypass techniques emerging.
The exposure and exploitation of legacy protocols such as Telnet continue to present significant attack surfaces, especially in IoT and OT environments.

Regulatory or Policy Developments Affecting the Security Industry

Meta (WhatsApp) has introduced a ‘Strict Account Settings’ security mode to protect high-risk users from spyware and advanced cyber attacks, similar to Apple’s Lockdown Mode.
Criticism has been raised regarding MITRE’s management of the CVE vulnerability database, with calls to transfer oversight to the private sector for improved efficiency.
TikTok has narrowly avoided a US ban by forming a new American joint venture, impacting data governance and regulatory oversight for the platform in the US.

Cybersecurity Brief – 2025-12-31

Wed, 31 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The European Space Agency (ESA) confirmed a breach of external servers containing unclassified information related to collaborative engineering and project management activities. The compromised systems were outside ESA’s corporate network.
Korean Air reported that data belonging to approximately 30,000 employees was stolen following a breach at its former subsidiary KC&D, which was linked to an Oracle E-Business Suite (EBS) hack.
Two former employees of cybersecurity incident response firms Sygnia and DigitalMint pleaded guilty to conducting BlackCat (ALPHV) ransomware attacks against U.S. companies in 2023.

Newly Discovered Vulnerabilities

The Cyber Security Agency of Singapore (CSA) issued an alert regarding a critical remote code execution vulnerability in SmarterTools SmarterMail email software. The flaw is rated maximum severity and can be exploited for full compromise.
CISA ordered U.S. federal agencies to patch the actively exploited MongoBleed vulnerability in MongoDB, which can be used to steal credentials, API keys, and other sensitive data.

Notable Threat Actor Activity

The Chinese APT Mustang Panda was observed deploying a previously undocumented, signed kernel-mode rootkit driver to load a new variant of the TONESHELL backdoor. The driver contains user-mode shellcodes for execution.
The threat actor Silver Fox has shifted focus to India, conducting phishing campaigns using income tax-themed lures to deliver the ValleyRAT (Winos 4.0) modular remote access trojan.

Trends, Tools, or Tactics of Interest

Researchers at Push Security identified a new “ConsentFix” technique that blends OAuth consent phishing with ClickFix-style prompts, enabling attackers to trick users into handing over OAuth tokens and compromise accounts.
A new cybercrime service, ErrTraffic, is automating ClickFix attacks by generating fake browser glitches on compromised websites, luring users into downloading malicious payloads or following malicious prompts.
A campaign dubbed Zoom Stealer has been detected, in which 18 malicious browser extensions targeting Chrome, Firefox, and Edge have affected 2.2 million users. The extensions harvest online meeting data, including corporate meeting intelligence.
Analysis of cyber-insurance claims data identified six cybersecurity technologies that are most effective in reducing losses and are recommended for deployment by 2026.
The rapid deployment of artificial intelligence (AI) in security operations is exposing new risks, with practitioners struggling to consistently operationalise AI while maintaining security.

Regulatory or Policy Developments

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) lifted sanctions on three individuals previously linked to the Intellexa Consortium, the commercial spyware vendor behind Predator spyware.
The total disclosed value of cybersecurity M&A deals in 2025 exceeded $84 billion, with eight acquisitions surpassing the $1 billion mark.

Cybersecurity Brief – 2025-12-30

Tue, 30 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, South Korea’s largest retailer, will compensate 33.7 million customers with $1.17 billion following a data breach that exposed customer information.
Aflac suffered a data breach affecting 22 million individuals, with hackers stealing names, addresses, Social Security numbers, ID numbers, and medical/health insurance information.
Sax, a major US accounting firm, disclosed a 2024 data breach impacting 220,000 individuals; the investigation took over a year.
Korean Air experienced a data breach affecting thousands of employees after its in-flight catering supplier, KC&D, was hacked.
Trust Wallet reported that attackers compromised its browser extension, draining approximately $7 million from 2,596 cryptocurrency wallets.
Romanian energy provider Oltenia Energy Complex was hit by a Gentlemen ransomware attack, disrupting its IT infrastructure.
A hacker claimed theft of 40 million Condé Nast records following a Wired data leak, with 2.3 million Wired subscriber records made public.
The EmEditor website was compromised in a supply chain attack, serving a malicious installer that delivered infostealer malware.
Over 90% of parked domains now lead users to scams or malware, a significant increase from less than 5% a decade ago.
A Lithuanian national was arrested for distributing clipboard-stealing malware disguised as KMSAuto, infecting 2.8 million systems.
A former Coinbase support agent was arrested in India for assisting hackers in stealing sensitive customer information from a company database.

Newly Discovered Vulnerabilities

MongoDB vulnerability CVE-2025-14847 (“MongoBleed”) is under active exploitation, allowing unauthenticated, remote attackers to leak sensitive data. Over 87,000 potentially vulnerable instances are exposed worldwide.
Fortinet warned that the five-year-old critical FortiOS vulnerability (CVE-2020-12812), which allows 2FA bypass, is still being actively exploited in attacks against unpatched devices.

Notable Threat Actor Activity

The HoneyMyte APT (also known as Mustang Panda or Bronze President), linked to Chinese state actors, has evolved its tactics to use a kernel-mode rootkit for delivering and protecting the ToneShell backdoor in attacks against government organisations.
Researchers disclosed a spear-phishing campaign that published over two dozen malicious npm packages, used as phishing infrastructure to steal login credentials.
Chinese state-affiliated hackers are using a kernel-mode loader to hide ToneShell malware activity during cyberespionage campaigns targeting government entities.

Trends, Tools, or Tactics of Interest

Malware in 2025 increasingly targeted platforms beyond Windows, including Android, macOS, and cross-platform environments.
OWASP’s Agentic AI Top 10 highlights real-world attacks on autonomous AI systems, including goal hijacking and malicious MCP servers.
Supply chain attacks remain prominent, as evidenced by the EmEditor installer compromise and malicious npm package campaigns.
There is a significant rise in malicious use of parked domains, now serving as a major vector for scams and malware distribution.
2025 saw a shift from singular large incidents to widespread smaller breaches and attacks, with trusted tools being abused and old vulnerabilities resurfacing.

Regulatory or Policy Developments Affecting the Security Industry

Debate continues over the utility of Software Bill of Materials (SBOMs), with industry experts expressing mixed views on their practical effectiveness as regulatory and compliance requirements evolve.

Cybersecurity Brief – 2025-11-01

Sat, 01 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Ribbon Communications, a US telecom company, disclosed a breach attributed to suspected nation-state actors, with initial access dating back to December of the previous year. The company has not confirmed whether sensitive data was accessed.
The University of Pennsylvania experienced a cybersecurity incident in which students and alumni received offensive emails from compromised university addresses, with threats to leak data.
Open VSX (Eclipse Foundation) revoked a small number of leaked tokens after discovery by Wiz. The incident was contained, and the foundation downplayed the impact, stating it was not a self-replicating worm.
Australian authorities issued warnings regarding ongoing attacks on unpatched Cisco IOS XE devices, with routers being compromised via the BadCandy webshell.

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Motex Lanscope Endpoint Manager (CVE-2025-xxxx) is being actively exploited by the China-linked Tick group for cyber espionage and system hijacking.
An unpatched Windows shortcut vulnerability is being exploited by China-affiliated threat actors, including UNC6384 and Mustang Panda, to target European diplomatic and government entities. Attacks use spear-phishing with European Commission and NATO-themed lures to deliver malware, including PlugX.
CISA confirmed active exploitation of a high-severity Linux kernel privilege escalation flaw by ransomware groups.
Broadcom updated its advisory to confirm in-the-wild exploitation of a VMware vulnerability (CVE-2025-41244), now added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Google released a Chrome update addressing 20 security issues, including seven serious flaws that could allow remote code execution via malicious web pages.

Notable Threat Actor Activity

Nation-state threat actors are distributing new malware named Airstalk as part of a suspected supply chain attack, according to Palo Alto Networks Unit 42.
China-linked UNC6384 and Mustang Panda are conducting targeted attacks against European diplomatic entities, exploiting unpatched Windows vulnerabilities.
The China-linked Tick group is exploiting a Lanscope zero-day for corporate system compromise.
Russian authorities arrested three individuals believed to be administrators of the Meduza Stealer malware operation after attacks on Russian organizations.
A Ukrainian national was extradited from Ireland to the US on charges related to participation in the Conti ransomware group.

Trends, Tools, or Tactics of Interest

OpenAI announced Aardvark, an agentic security researcher powered by GPT-5, designed to autonomously identify and remediate code flaws.
Microsoft Edge introduced a new scareware sensor to enhance scam detection capabilities and improve Defender SmartScreen response times.
Ongoing exploitation of unpatched networking devices (notably Cisco IOS XE) continues to be leveraged for webshell deployment and persistent access.
The use of spear-phishing with themed lures (European Commission, NATO) remains prevalent in targeted attacks on diplomatic sectors.
MSPs are facing increased client expectations for cybersecurity and compliance, amid evolving threats and regulatory demands.

Regulatory or Policy Developments

The United Nations adopted a new Convention Against Cybercrime, establishing an international framework for cross-border cybercrime cooperation.
CISA and NSA, in coordination with Australian and Canadian partners, issued urgent guidance to secure on-premises WSUS and Microsoft Exchange servers.
Japan released comprehensive OT security guidance for semiconductor factories, available in both Japanese and English.
CISA added exploited XWiki and VMware vulnerabilities to the Known Exploited Vulnerabilities catalog.

Cybersecurity Brief – 2025-09-16

Tue, 16 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Over 40 npm packages were compromised in a software supply chain attack, with attackers leveraging a malicious bundle.js file to steal credentials from affected developers and users.
FinWise Bank disclosed an insider breach impacting 689,000 American First Finance customers. A former employee accessed sensitive files after termination, exposing customer information.
KillSec ransomware group breached a major Brazilian healthcare software provider, stealing sensitive patient data and affecting a critical element of the healthcare technology supply chain.
Google confirmed that hackers created a fraudulent account in its Law Enforcement Request System (LERS), potentially enabling unauthorised access to sensitive law enforcement data requests.
The FBI’s IC3 issued a warning regarding threat actors UNC6040 and UNC6395 targeting Salesforce customers. These groups have conducted data theft and extortion campaigns against organisations using Salesforce, with the FBI sharing indicators of compromise (IoCs).
Panama’s Ministry of Economy and Finance (MEF) was affected by a cyber incident, as reported in recent threat intelligence bulletins.
Fairmont Federal Credit Union in West Virginia is notifying 187,000 people of a 2023 data breach that compromised personal, financial, and medical information.

Newly Discovered Vulnerabilities

Samsung patched a zero-day vulnerability affecting Android devices, which allowed remote code execution and was reportedly exploited by a spyware vendor. The flaw was reported by Meta and WhatsApp.
Academic researchers disclosed a new “Phoenix” Rowhammer attack variant that bypasses current DDR5 memory protection mechanisms from SK Hynix, allowing bit-flipping attacks despite existing mitigations.
Apple released iOS/iPadOS/macOS/watchOS/tvOS 26, addressing multiple security issues across its ecosystem.
Microsoft confirmed that the September 2025 Windows updates are causing connection issues to SMBv1 shares.
Microsoft has removed a safeguard hold for Windows 11 24H2 upgrades after resolving compatibility issues causing Bluetooth audio device malfunctions.

Notable Threat Actor Activity

Mustang Panda, a China-aligned threat group, was observed deploying an updated TONESHELL backdoor and a previously undocumented USB worm named SnakeDisk. The worm targets Thailand-based IPs and is used to deliver the Yokai backdoor.
Threat actors UNC6040 and UNC6395 continue to target Salesforce customers, conducting data theft and extortion campaigns.
Researchers demonstrated a “Lies-in-the-Loop” attack against Anthropic’s AI coding agent, tricking it into unsafe behaviour and enabling a potential supply chain attack.

Trends, Tools, or Tactics of Interest

Supply chain attacks continue to target open-source software repositories, as evidenced by the npm package compromise.
Increased focus on browser-based attacks, with reports highlighting a significant rise in attacks targeting users via web browsers.
AI integration protocols, specifically the Model Context Protocol (MCP), are being scrutinised for potential abuse in supply chain attacks, with proof-of-concept attacks demonstrating risks associated with insufficient validation of AI agent interactions.
Zero Trust security adoption remains inconsistent, with uneven implementation leaving organisations exposed despite its status as a security standard.
The use of USB worms for lateral movement and payload delivery, as seen with Mustang Panda’s SnakeDisk, indicates ongoing innovation in threat actor tactics.
“AI-powered” attacks and the security of AI agents are emerging as key areas of concern, including the manipulation of AI coding assistants.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft Exchange Server 2016 and 2019 will reach end of extended support next month, with Microsoft providing guidance for decommissioning outdated servers.
Microsoft will begin automatically installing the Microsoft 365 Copilot app on Windows devices outside of the EEA region for users with Microsoft 365 desktop client apps, starting in October.
Google reportedly conducted a behind-the-scenes campaign against new California privacy legislation, though the legislation ultimately passed, potentially impacting privacy compliance requirements for tech companies operating in California.
CISA’s “Secure by Design” initiative is emphasising the need for resilient IT infrastructure and secure system design practices.

Cybersecurity Brief – 2025-08-28

Thu, 28 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

A cyberattack on Swedish IT systems supplier Miljödata has disrupted services across more than 200 municipalities, impacting approximately 80% of Sweden’s municipal systems.
Nevada state agencies experienced a disruptive cyberattack, leading to the shutdown of in-person services and state websites; emergency services reportedly remain unaffected.
Healthcare Services Group (HSGI) disclosed a data breach affecting 624,000 individuals, exposing personal information.
Hundreds of Salesforce customers were affected by a widespread data theft campaign, traced to compromised OAuth tokens associated with the Drift AI chat agent via the Salesloft platform. Attackers exported corporate data, including AWS and Snowflake keys.
TheTruthSpy stalkerware suffered a new vulnerability, exposing all user records to compromise.
77 malicious apps, including adware and advanced banking trojans, were removed from the Google Play Store following researcher discovery.

Newly Discovered Vulnerabilities

Over 28,000 Citrix NetScaler devices remain vulnerable to a critical remote code execution flaw (CVE-2025-7775), which is actively being exploited in the wild. Citrix and CISA have issued emergency patch deadlines.
Sangoma FreePBX issued an emergency fix for a zero-day vulnerability in its Administrator Control Panel, which has been actively exploited on internet-exposed systems.
A new vulnerability in TheTruthSpy Android stalkerware allows attackers to compromise any record in the system.

Notable Threat Actor Activity

The financially motivated Storm-0501 group has shifted tactics, exploiting Microsoft Entra ID to conduct data exfiltration and extortion attacks targeting hybrid and cloud environments, moving away from traditional ransomware to cloud-based encryption and data theft.
ShadowSilk, a threat cluster, targeted 35 government organizations in Central Asia and APAC using Telegram bots for command and control.
Blind Eagle, linked to five distinct activity clusters, targeted Colombia with RATs, phishing lures, and dynamic DNS infrastructure between May 2024 and July 2025.
China-linked actors, including Salt Typhoon and Mustang Panda, have been attributed to global espionage campaigns. Salt Typhoon operations were linked to Chinese tech firms and targeted networks worldwide. Mustang Panda hijacked captive portals to redirect Asian diplomats’ browsers to phishing sites.
UNC6395 engaged in widespread data theft, exploiting OAuth tokens from the Salesloft Drift app to compromise Salesforce customers.
UNC6384, another China-linked group, used social engineering, signed malware, and adversary-in-the-middle attacks to hijack web traffic and deliver backdoors.
“ZipLine” phishing campaign employed a novel technique where victims initiate email contact, affecting organizations across multiple sectors.
The Purgatory group has been identified as responsible for swatting attacks against US universities, offering such services for payment.

Trends, Tools, or Tactics of Interest

AI-powered ransomware has emerged with the discovery of PromptLock, a cross-platform strain using OpenAI’s gpt-oss:20b model and Lua scripts to encrypt and steal data on Windows, macOS, and Linux. PromptLock dynamically generates attack scripts in real time.
Anthropic disrupted an operation in which its Claude AI chatbot was weaponized for large-scale theft and extortion, automating reconnaissance, credential harvesting, and intrusions across critical sectors.
AI-generated phishing campaigns are increasingly sophisticated, with attackers crafting emails to deploy tools such as ConnectWise ScreenConnect for remote access.
Malware-as-a-service competition has led to more refined and accessible infostealers, driving modern cybercrime.
The Q2 2025 vulnerabilities and exploits report noted a significant number of published vulnerabilities and increased use of command-and-control frameworks.
Zero trust is highlighted as an ongoing, adaptive process in response to evolving threats, including supply chain attacks and policy drift.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. NSA, UK NCSC, and international partners issued a joint advisory attributing global hacking campaigns to Chinese state-sponsored actors, specifically Salt Typhoon, and provided guidance on countering such threats.
CISA and partners are providing real-time incident response support for the Nevada state cyberattack.
Google announced new developer verification requirements aimed at reducing harmful apps on Android, enhancing platform security.

Cybersecurity Brief – 2025-06-28

Sat, 28 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Ahold Delhaize, a global food retail chain, disclosed that a ransomware attack in November resulted in a data breach affecting 2.2 million individuals, compromising personal, financial, and health information.
Cloudflare successfully mitigated the largest recorded DDoS attack to date.
Russian ISPs began throttling access to websites and services protected by Cloudflare as of 9 June 2025, causing widespread inaccessibility.

Newly Discovered Vulnerabilities

A critical vulnerability in NetScaler ADC and Gateway, dubbed “Citrix Bleed 2” (CVE-2025-5777), is now believed to be actively exploited. This flaw allows attackers to maintain undetected access for extended periods.
Researchers identified security weaknesses in aftermarket smart tractor steering systems, allowing potential full takeover and surveillance of connected tractors.

Notable Threat Actor Activity

Over 1,000 SOHO devices have been compromised in China-linked “LapDogs” cyber espionage operations.
Mustang Panda, a China-based threat actor, conducted a targeted cyber espionage campaign against the Tibetan community using spear-phishing and custom malware (PUBLOAD and Pubshell).
The Chinese group “Silver Fox” has been observed using fake websites mimicking popular software to distribute Sainbox RAT and the Hidden rootkit, targeting users in China and Japan.
Scattered Spider hackers have shifted their targeting to aviation and transportation sectors after previously attacking insurance and retail. In a recent incident, they accessed CyberArk vaults, extracted over 1,400 secrets, and compromised Azure, VMware, and Snowflake environments.
Increased scanning activity targeting Progress MOVEit Transfer systems has been detected since 27 May 2025, indicating preparation for further exploitation of known CVEs.

Trends, Tools, or Tactics of Interest

64% of US C-suite executives in cybersecurity or data center roles cite data breaches and ransomware as the top threats for the next decade.
Threat actors are increasingly leveraging fake websites and spear-phishing with regionally relevant topics to deliver custom malware in espionage campaigns.
Security operations centers are under pressure due to increasingly complex threats and stagnant budgets, prompting interest in agentic AI SOC analysts.
There is a noted increase in the scale and sophistication of DDoS attacks.
The US is reported to be lagging behind China in exploit production capabilities.
Researchers allege that VPN apps from Apple and Google app stores may be enabling surveillance by Chinese authorities.

Regulatory or Policy Developments Affecting the Security Industry

The US Supreme Court upheld the constitutionality of Texas’ age verification law for explicit websites, setting a precedent for similar regulatory measures.

Cybersecurity Brief – 2025-04-19

Sat, 19 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

SonicWall SMA VPN Devices Under Active Attack
- A remote code execution vulnerability in SonicWall Secure Mobile Access (SMA) appliances has been actively exploited since at least January 2025. Organisations using these devices are at heightened risk and should prioritise patching and mitigation.
Apple Zero-Day Exploits
- Two zero-day vulnerabilities in Apple iOS devices have been used in sophisticated attacks targeting specific individuals, indicating likely involvement of spyware or nation-state actors. Details remain limited.
Smishing Surge Tied to Chinese Threat Actors
- A China-based cybercriminal group, “Smishing Triad,” is conducting widespread toll-themed SMS phishing attacks across the US and UK, aiming for financial theft. A custom Chinese smishing kit is enabling these campaigns.
FBI Impersonation Scam
- Scammers are posing as FBI IC3 employees, contacting previous fraud victims and offering assistance in recovering lost funds as a means to further defraud them.
Payment Card Scam with Malware Component
- A new scam involves phone calls and malware disguised as security or verification tools to capture payment card details and access funds.
Alleged SmokeLoader Operator Charged
- US authorities have charged an individual accused of operating the SmokeLoader malware, responsible for stealing personal data of over 65,000 individuals.

Cybersecurity Brief – 2025-04-18

Fri, 18 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Ahold Delhaize Data Breach: Food retail giant Ahold Delhaize confirmed data theft from its U.S. business systems during a November 2024 cyberattack, attributed to the INC ransomware group. The breach impacted operations at several of its 2,000 U.S. stores.
Legends International Breach: Entertainment venue management firm Legends International disclosed a data breach from November 2024 affecting both employees and venue visitors.
Airport Retailer Ransomware Settlement: An airport retailer agreed to a $6.9 million settlement after a ransomware attack exfiltrated personal data (including names and Social Security numbers) of approximately 76,000 current and former employees.
Surge in SMS Phishing Scams: CTM360 reported a global spike in SMS-based reward and toll scams, notably PointyPhish and TollShark, operating via the Darcula Phishing-as-a-Service (PhaaS) platform. Over 5,000 domains are implicated in payment information theft.
Real Cash Scam in the U.S.: A widespread scam is tricking individuals into withdrawing and transferring large sums of cash to fraudsters, resulting in significant financial losses.

Newly Discovered Vulnerabilities

CVE-2025-32433 (Erlang/OTP SSH): A critical pre-auth remote code execution vulnerability in Erlang/OTP SSH was disclosed. The flaw is easily exploitable and requires immediate patching.
CVE-2025-24054 (Microsoft Windows): Actively exploited vulnerability allows NTLM credential theft via file downloads (notably .library-ms files). The flaw is being leveraged in phishing campaigns targeting government and private sector entities.
Chrome Extensions with Hidden Tracking: 57 Chrome extensions (6 million installs) were found to contain hidden tracking code, with capabilities to monitor browsing, access cookies, and potentially execute remote code.

Notable Threat Actor Activity

Mustang Panda: The China-linked Mustang Panda group targeted a Myanmar organization using new tooling, including StarProxy, EDR bypass techniques, and updated TONESHELL malware, demonstrating ongoing innovation.
XorDDoS Malware Expansion: Researchers identified a new XorDDoS controller and expanded infrastructure. The malware now targets Docker, Linux, and IoT environments, with 71% of attacks observed between Nov 2023–Feb 2024.
State-Sponsored ClickFix Campaigns: State-backed actors from Iran, North Korea, and Russia are actively using the ClickFix social engineering technique in targeted malware campaigns over the past three months.
Android Pre-Downloaded Malware: Threat actors are pre-installing malware on Android devices to steal cryptocurrency by covertly swapping wallet addresses.

Trends, Tools, and Tactics

Abuse of Legitimate Platforms: There is a continued increase in the abuse of legitimate domains (e.g., Google Drive, QuickBooks, Microsoft) for phishing attacks, with predictions that this trend will escalate in 2025.
AI in SaaS and Data Exposure: Employees are increasingly using AI-enabled tools (e.g., ChatGPT, SaaS integrations), inadvertently risking sensitive data exposure.
Security Awareness as a Top Challenge: A CyberEdge Group survey found that lack of security awareness among employees remains the primary obstacle to effective cyber defense.
Phishing-as-a-Service (PhaaS): Platforms like Darcula are enabling large-scale, sophisticated SMS phishing operations globally.

Regulatory and Policy Developments

CVE Program Funding Uncertainty: CISA extended MITRE’s CVE program contract by 11 months after initial cuts threatened continuity. The program’s long-term future remains uncertain, raising sector-wide concerns.
Cybersecurity Information Sharing Act Renewal: U.S. senators proposed a 10-year extension of the Cybersecurity Information Sharing Act of 2015 to facilitate continued information sharing between businesses and federal agencies.
Microsoft Office 2016/2019 End-of-Support: Microsoft reminded customers that Office 2016 and 2019 will reach end of extended support on October 14, 2025, impacting security update availability.
Discord Facing Legal and Regulatory Scrutiny: New Jersey filed suit against Discord for alleged failures in protecting children online. Discord is also piloting age verification via facial scans to enhance age-gating.
Leadership Change at SentinelOne: Chris Krebs resigned from SentinelOne after his security clearance was revoked by the Trump administration, reflecting ongoing political tensions impacting cybersecurity leadership.

AI Security

PromptArmor Platform Launch: PromptArmor, a new AI security startup, launched to help organizations assess and monitor third-party AI risks, following notable AI-related vulnerability discoveries.

Other Notable Developments

Security Usability Concerns: Reports highlight that complex security tools lead users to seek workarounds, undermining cyber defense efforts.