Ploutus on DanSec Daily

Cybersecurity Brief – 2025-12-23

Tue, 23 Dec 2025 00:00:00 +0000

Nissan confirmed that thousands of customer records were compromised due to the Red Hat data breach in September.
The University of Phoenix disclosed a data breach impacting nearly 3.5 million students, staff, and suppliers, attributed to the Clop ransomware group.
Coupang, a major e-commerce company, reported a data breach affecting 33.7 million users, with unauthorized access to personal data persisting for almost five months.
The Romanian National Water Authority (Administrația Națională Apele Române) suffered a ransomware attack over the weekend.
France’s national postal service and associated banking operations experienced significant disruption from a cyberattack, impacting package deliveries and online payments during the Christmas period.
Pornhub warned users of potential sextortion emails following a data exposure incident.
The UK government acknowledged an ongoing investigation into a cyber incident after reports that hackers linked to China accessed thousands of confidential documents.

Over 115,000 WatchGuard Firebox firewall devices remain unpatched and exposed to a critical remote code execution (RCE) vulnerability in the Fireware OS’s iked process, which is being actively exploited in the wild. WatchGuard has released a patch.
A new phishing kit, “BlackForce,” was identified leveraging Man-in-the-Browser (MitB) techniques to steal credentials and bypass multi-factor authentication (MFA).
A malicious npm package masquerading as a WhatsApp API was discovered, capable of intercepting messages, collecting contacts, and stealing login tokens.
The latest variant of the MacSync information stealer for macOS is being distributed via a digitally signed, notarized Swift application, allowing it to evade Gatekeeper checks and eliminating the need for user terminal interaction.

The Clop ransomware group was responsible for the University of Phoenix breach, continuing its campaign against large organizations.
A Ukrainian national pleaded guilty in the US to conspiracy to commit computer fraud as an affiliate of the Nefilim ransomware gang, targeting high-revenue businesses internationally.
An Interpol-led operation (Operation Sentinel) resulted in 574 arrests and the recovery of $3 million related to business email compromise, extortion, and ransomware, and enabled the decryption of six ransomware strains.
ATM attacks using Ploutus malware led to charges against 54 individuals, including members of the Tren de Aragua crime syndicate.
Android SMS stealer malware is actively targeting Telegram users in Uzbekistan, with attackers refining their methods.

Attackers are increasingly targeting trusted edge devices, including firewalls and browser add-ons, to achieve significant impact without large-scale attacks.
The use of notarized, signed applications to bypass macOS security controls is on the rise, as demonstrated by the MacSync malware.
Phishing kits, such as BlackForce, are adopting advanced MitB tactics to defeat MFA protections.
Malicious npm packages continue to pose supply chain risks, as seen with the fake WhatsApp API library.

The US Federal Communications Commission (FCC) announced a ban on all drones and critical components manufactured in foreign countries, citing national security concerns.

Mon, 22 Dec 2025 00:00:00 +0000

Hackers stole millions of PornHub users’ data for extortion purposes.
The U.S. Department of Justice indicted 54 individuals for a multi-million dollar ATM jackpotting scheme involving the use of Ploutus malware.

Cisco disclosed a zero-day vulnerability for which no patch is currently available.

The Iranian Infy (aka Prince of Persia) APT group has resurfaced after nearly five years of inactivity, exhibiting new malware activity.

Android malware operations are increasingly merging the use of malicious dropper apps with SMS theft and remote access trojan (RAT) capabilities at scale, as seen in campaigns distributing the Wonderland SMS stealer.
RansomHouse ransomware-as-a-service has upgraded its encryptor, moving from a single-phase linear technique to a multi-layered data processing method, enhancing the complexity of its encryption process.

Sun, 21 Dec 2025 00:00:00 +0000

PornHub has suffered a data breach in which hackers stole data belonging to millions of users. The attackers are reportedly using the stolen information for extortion purposes.

The Iranian APT group Infy (also known as Prince of Persia) has resurfaced after nearly five years of inactivity. New malware activity attributed to Infy has been observed targeting victims in Sweden.
RansomHouse ransomware-as-a-service operators have upgraded their encryption techniques, moving from a single-phase linear approach to a more complex, multi-layered data processing method.
The U.S. Department of Justice has indicted 54 individuals involved in a large-scale ATM jackpotting scheme. The conspiracy utilised Ploutus malware to compromise ATMs and steal millions of dollars.

Cisco has disclosed a zero-day vulnerability for which there is currently no available patch.

RansomHouse’s enhancement of its encryptor to a multi-layered data processing model indicates a trend toward increased sophistication in ransomware encryption techniques.

The U.S. Department of Justice’s action against the ATM jackpotting scheme demonstrates ongoing law enforcement efforts targeting cybercrime operations involving malware and large-scale financial theft.