Play on DanSec Daily

Cybersecurity Brief – 2025-09-10

Wed, 10 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Plex has disclosed a data breach affecting emails, usernames, password hashes, and authentication data stored in a database. Users have been urged to reset their passwords.
Wayne Memorial Hospital suffered a breach in May 2024, with hackers stealing names, Social Security numbers, financial information, and protected health information of approximately 160,000 individuals.
Qantas reduced executive pay following a data breach earlier this year in which threat actors compromised a third-party platform and accessed customer personal information.

Newly Discovered Vulnerabilities

Adobe patched a critical vulnerability (CVE-2025-54236, also called SessionReaper) in its Commerce and Magento Open Source platforms, which allows attackers to take over customer accounts. This is described as one of the most severe flaws in the platform’s history. Adobe also released fixes for critical vulnerabilities in ColdFusion.
SAP released updates for 21 vulnerabilities, including three critical issues in NetWeaver (CVSS up to 10.0) that could enable remote code execution and privilege escalation, as well as high-severity flaws in S/4HANA.
Microsoft’s September 2025 Patch Tuesday addressed 81–86 vulnerabilities (depending on source), including two publicly disclosed zero-day flaws and numerous escalation of privilege bugs. No vulnerabilities were reported as actively exploited prior to release.
Researchers disclosed “catastrophic” vulnerabilities in the platforms operated by Restaurant Brands International (RBI) for Burger King, Tim Hortons, and Popeyes.
Microsoft released Windows 10 (KB5065429) and Windows 11 (KB5065426, KB5065431) cumulative updates, addressing security vulnerabilities and system issues.
Microsoft is investigating an anti-spam bug causing Exchange Online and Teams to mistakenly block URLs and quarantine emails.

Notable Threat Actor Activity

A TOR-based cryptojacking campaign is expanding, targeting exposed Docker APIs. Attackers mount host filesystems in new containers, fetch malicious scripts via TOR, and block Docker API access. Tooling updates suggest efforts to build a complex botnet.
A Kosovo national pleaded guilty to running BlackDB.cc, a cybercrime marketplace active since 2018.
The U.S. charged a Ukrainian national for administering the LockerGoga, MegaCortex, and Nefilim ransomware operations.
A threat actor has been identified as connected to Play, RansomHub, and DragonForce ransomware, deploying multiple malware families, backdoors, a proxy tunneller, and reconnaissance tools.
A large NPM supply chain attack involved phishing the Qix NPM account and publishing malicious versions of 18 popular open source packages, collectively receiving over 2 billion weekly downloads.

Trends, Tools, or Tactics of Interest

Axios HTTP client abuse and Salty 2FA phishing kits are being combined with Microsoft’s Direct Send feature in advanced Microsoft 365 phishing campaigns, creating highly efficient attack pipelines.
The Salty2FA phishing kit is being used at an enterprise level, with adversaries employing advanced strategy and planning.
RatOn Android malware has evolved from conducting NFC relay attacks to a sophisticated remote access trojan with Automated Transfer System (ATS) banking fraud capabilities.
Recent phishing campaigns are delivering MostereRAT, a banking malware now functioning as a remote access trojan, using a variety of evasion and delivery techniques.
Ransomware losses are increasing, with trends including triple extortion and more sophisticated social engineering, as reported in midyear insurance claims analysis.
The browser is increasingly viewed as a critical endpoint, with rising usage prompting calls for improved browser-focused security controls.
Shadow AI agents are proliferating within enterprise environments, raising risks related to detection and control.
External Attack Surface Management (EASM) is highlighted as a key approach for identifying and prioritizing remediation of unknown internet-facing assets.
Microsoft is testing new AI-powered features in Windows 11 File Explorer to improve file handling capabilities.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury imposed sanctions on networks of cyber scam operations in Southeast Asia, responsible for stealing over $10 billion from Americans in the past year. Firms in Burma and Cambodia cooperating with these cybercrime syndicates are also facing enforcement actions.
A court ordered Google to pay $425 million in a class action lawsuit for misleading users about their online privacy.
Mitsubishi Electric announced the acquisition of industrial cybersecurity firm Nozomi Networks for nearly $1 billion.
The Public Service Alliance launched a new platform offering privacy and threat monitoring tools to public servants.
Attaullah Baig, former WhatsApp security chief, filed a lawsuit against Meta, alleging retaliation over critical cybersecurity failures.

Cybersecurity Brief – 2025-08-20

Wed, 20 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Allianz Life (US): Hackers stole personal information of 1.1 million individuals in a Salesforce data theft attack. Exposed data includes physical addresses, dates of birth, phone numbers, and other sensitive information for life insurance customers.
Business Council of New York State (US): Data breach in February led to theft of personal, financial, and health information of over 47,000 individuals.
Inotiv (US): Ransomware attack resulted in encryption of systems and data, impacting business operations.
Bragg Gaming Group (Global): Hackers accessed internal systems, though operations reportedly unaffected.
TPG Telecom/iiNet (Australia): Unauthorised access detected in iiNet order management system; investigation ongoing.
Highly Sensitive Medical Cannabis Data (US): Nearly one million records, including SSNs, government IDs, and health data, exposed due to an unsecured database.
Polish Power Plant (Poland): Russian hacktivists launched a cyberattack causing operational disruption at a power plant.
RapperBot DDoS Botnet: US authorities charged a 22-year-old Oregon man for operating the RapperBot botnet, which powered over 370,000 distributed denial-of-service attacks.

Newly Discovered Vulnerabilities

Apache ActiveMQ: Threat actors are exploiting a nearly two-year-old security flaw to gain persistent access to cloud Linux systems, deploying the DripDropper malware. Attackers have been observed patching the exploited vulnerability post-compromise to maintain exclusive access.
SAP NetWeaver: A public exploit chaining two critical, now-patched vulnerabilities has been released, exposing unpatched systems to remote code execution and data theft.
Windows CLFS (CVE-2025-29824): Previously zero-day flaw exploited in the wild as part of Play ransomware attack chains, enabling attackers to gain system-level privileges.
Windows Recovery/Reset: August 2025 security updates introduced an issue breaking reset and recovery operations on Windows 10 and some Windows 11 versions. Microsoft has released emergency out-of-band updates to address the problem.

Notable Threat Actor Activity

GodRAT: Financial institutions, especially trading and brokerage firms, are being targeted by a new remote access trojan dubbed GodRAT. The malware uses steganography and is based on Gh0st RAT code, likely as a successor to AwesomePuppet and attributed to the Winnti group.
ScarCruft (North Korea): The group has added ransomware to its toolset, distributing it via phishing emails.
PipeMagic Backdoor: Attackers are using the modular PipeMagic malware, which masquerades as a ChatGPT application, in conjunction with exploitation of Windows CLFS vulnerabilities as part of Play ransomware campaigns.
Russian Hacktivists: Conducted a disruptive cyberattack against a Polish power plant.
Yemen Cyber Army: UK courts sentenced Al-Tahery Al-Mashriky to 20 months in prison for hacktivist campaigns involving website defacement.

Trends, Tools, or Tactics of Interest

DripDropper Malware: Attackers exploiting Apache ActiveMQ are patching the same vulnerability after deploying their malware, a tactic to prevent other actors from leveraging the same entry point.
Linux Evasion: RingReaper, a sophisticated post-compromise tool, abuses the Linux kernel’s io_uring interface to evade endpoint detection and response (EDR) systems.
Darknet Communications: Criminal actors are increasingly migrating from traditional IRC forums to Telegram networks for operational security and resilience.
AI and Security: Increased discussion on the dual-use nature of AI helpers, with risks of AI-powered tools being leveraged for malicious purposes, including zero-click exploits against AI agents.
Supply Chain Attacks: Ongoing concern over GitHub risk vectors and supply chain compromise, with new research highlighting overlooked attack surfaces.
Increased Reconnaissance: Rise in scans targeting Elasticsearch instances, seeking misconfigurations or exposed data.
Vendor Security Requirements: Asian organizations, including a Japanese chipmaker and the Singaporean government, are mandating cybersecurity checks for suppliers in response to breach upticks.

Regulatory or Policy Developments

UK Encryption Policy: The UK government has dropped its demand for Apple to implement encryption backdoors following pressure from US civil liberties groups.
PyPI Security: The Python Package Index has implemented protections against domain resurrection attacks, reducing the risk of account hijacking through expired domain-based password resets.
Okta/Threat Detection: Okta has open-sourced a catalog of Sigma-based Auth0 detection rules to help customers identify account takeovers, misconfigurations, and suspicious behaviors in event logs.

Cybersecurity Brief – 2025-06-05

Thu, 05 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The Play ransomware gang has breached approximately 900 organizations globally as of May 2025, including critical infrastructure and government entities, according to an FBI advisory.
Media giant Lee Enterprises has disclosed a data breach affecting nearly 40,000 individuals, resulting from a February 2025 ransomware attack.
Ukrainian police arrested a hacker who compromised 5,000 accounts at an international hosting company to mine cryptocurrency, causing $4.5 million in damages.
Ukrainian intelligence claims to have hacked Russian aerospace and defense company Tupolev, developers of strategic bombers.
Multiple domains of the BidenCash carding market, a dark web marketplace for stolen credit cards and personal data, have been seized in an international law enforcement operation.

Newly Discovered Vulnerabilities

Cisco released patches for a critical authentication bypass vulnerability (CVE-2025-20120) in Identity Services Engine (ISE), affecting cloud deployments on AWS, Azure, and OCI. Public exploit code is available.
Additional Cisco advisories address vulnerabilities in both ISE and Customer Collaboration Platform (CCP), with public exploit code circulating.
Over 35,000 solar energy devices, primarily in Europe, are exposed online and vulnerable to potential hijacking attacks.
Qualcomm has patched three security flaws that have been exploited in the wild; device manufacturers must still apply these updates to their products.
Thousands of Asus routers have been compromised and are being leveraged as part of a botnet.
Researchers have demonstrated that deepfake audio detection models can be bypassed via replay attacks, allowing rerecorded deepfake audio to evade current detection mechanisms.

Notable Threat Actor Activity

Google exposed a financially motivated threat group tracked as UNC6040, specializing in vishing (voice phishing) campaigns targeting Salesforce users. Attackers use fake Data Loader apps to steal Salesforce credentials and data.
Hackers, including those claiming to be the ShinyHunters group, are conducting social engineering and extortion attacks against multinational organizations via Salesforce platform compromise.
Ongoing open-source supply chain attacks involve malicious packages on PyPI, npm, and RubyGems. These packages drain cryptocurrency wallets, exfiltrate sensitive data, or wipe codebases after installation. Some RubyGems impersonate legitimate plugins for the Fastlane development platform in geopolitically motivated campaigns.
A hacker is distributing backdoored GitHub code, targeting other hackers, gamers, and researchers with exploits and game cheats containing hidden remote access backdoors.
Attackers are exploiting device code authentication flows (such as those used by Microsoft Teams and IoT devices) to phish for access tokens, bypassing multi-factor authentication (MFA).
The FBI has issued a warning about NFT airdrop scams on the Hedera Hashgraph network, where cybercriminals use fraudulent airdrops to steal cryptocurrency from wallets.

Trends, Tools, or Tactics of Interest

A new Chaos RAT variant is targeting both Windows and Linux systems through fake network tool downloads.
Traditional Data Loss Prevention (DLP) tools are being outpaced by the growth of SaaS applications, resulting in increased risk of SaaS data leakage.
AS-REP roasting attacks against Kerberos/Active Directory are resurging, exploiting accounts without Kerberos pre-authentication to obtain password hashes.
Phishing campaigns are using techniques to hide malicious links from Outlook users, evading detection.
Increased GPS jamming and spoofing attacks are raising concerns about the resilience of global navigation systems.
The use of AI for code generation at scale is emerging as a threat, with potential for advanced automated cyberattacks (“vibe hacking”).
Cybersecurity training initiatives in Africa are being expanded by international organizations to increase the number of skilled professionals and disrupt cybercrime recruitment pipelines.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of State is offering up to $10 million for information on state-sponsored hackers linked to the RedLine infostealer malware operation.
Microsoft has launched a new European Security Program, providing free cybersecurity resources and support to European governments.
Law enforcement has undertaken international action to disrupt dark web markets, as evidenced by the BidenCash domain seizures.

Cybersecurity Brief – 2025-05-08

Thu, 08 May 2025 00:00:00 +0000

Major Incidents and Breaches

LockBit Ransomware Gang Breach: The LockBit ransomware group suffered a significant breach, with its dark web affiliate panels defaced and victim negotiation data exposed via a leaked MySQL database. This incident may disrupt ongoing operations and expose sensitive data related to victims and affiliates.
PowerSchool Extortion Escalates: Following a December cyberattack, the PowerSchool hacker is now directly extorting individual school districts, threatening to release stolen student and teacher data if ransoms are not paid.
Masimo Cyberattack: Medical device manufacturer Masimo reported a cyberattack that has disrupted production and caused delays in fulfilling customer orders.
South African Airways Disruption: A cyberattack temporarily disrupted operational systems at South African Airways. The company is investigating potential data theft.