https://blog.dansec.red/actors/predator/Recent content in Predator on DanSec DailyHugoen-gbThu, 15 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-15-cybersecurity-news/Thu, 15 Jan 2026 00:00:00 +0000https://blog.dansec.red/posts/2026-01-15-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Kyowon Group, a major South Korean conglomerate, confirmed a ransomware attack resulting in operational disruption and potential exposure of customer data.</li> <li>Cloud marketplace Pax8 inadvertently exposed internal business information, including MSP customer data, to fewer than 40 UK-based partners via email.</li> <li>Robo-advisor Betterment disclosed a breach where a threat actor accessed customer information and sent scam crypto-related messages.</li> <li>Free Mobile and its parent company, Free, were fined €42 million by the French CNIL for inadequate protection of customer data related to a 2024 breach.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Fortinet patched a critical unauthenticated remote code execution vulnerability in FortiSIEM. Public exploit code and technical details for this flaw have been released.</li> <li>Additional critical vulnerabilities in Fortinet products, including FortiFone, were disclosed and patched, with risks of configuration leaks and code execution.</li> <li>Chrome 144 and Firefox 147 released patches for high-severity vulnerabilities, addressing 26 security defects including code execution risks.</li> <li>Microsoft’s January 2026 Patch Tuesday addressed 114 Windows vulnerabilities, including one actively exploited in the wild.</li> <li>A DLL side-loading vulnerability in the open-source c-ares library is being actively exploited to bypass security controls and deploy malware.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Microsoft and law enforcement disrupted the RedVDS cybercrime-as-a-service platform, which facilitated phishing, BEC, account takeover, and fraud, and was linked to over $40 million in losses.</li> <li>Researchers null-routed over 550 command-and-control servers associated with the AISURU/Kimwolf botnet, which had infected over two million devices since October 2025.</li> <li>A major phishing campaign abused Google’s infrastructure, targeting over 3,000 organizations (primarily in manufacturing) to bypass email security defenses.</li> <li>Magecart skimming attacks are targeting online checkouts using major payment networks such as AmEx, Diners Club, and Mastercard.</li> <li>The newly emerged Sicarii Ransomware-as-a-Service operation began advertising across underground forums in December 2025.</li> <li>Predator spyware has been found to use failed attacks for intelligence gathering to improve future exploit attempts.</li> <li>Fake “account restricted” comments are being posted on LinkedIn as part of phishing campaigns to steal user credentials.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Microsoft was the most impersonated brand in phishing attacks during Q4 2025, followed by Facebook, Roblox, McAfee, and Steam.</li> <li>OAuth phishing attacks using the ConsentFix technique are evolving, with attackers hijacking Microsoft accounts via browser-based authorization flows.</li> <li>The “Reprompt” attack technique allowed hijacking of Microsoft Copilot sessions for sensitive data exfiltration.</li> <li>AI agents are increasingly being integrated into core workflows, raising concerns about privilege escalation pathways.</li> <li>64% of third-party applications on leading websites now access sensitive data without business justification, up from 51% in 2024.</li> <li>Attackers are leveraging legitimate open-source software downloads to conceal remote backdoors.</li> <li>The “VoidLink” modular malware framework is targeting Linux systems, designed for stealthy, long-term access in cloud-first environments.</li> <li>Infection campaigns are repeatedly adding scheduled tasks and increasing communication with persistent C2 domains.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>The French CNIL imposed a €42 million fine on Free Mobile and Free for failing to adequately protect customer data in a 2024 breach incident.</li> <li>An investor lawsuit related to the CrowdStrike outage was dismissed due to lack of evidence of investor fraud.</li> </ul>https://blog.dansec.red/posts/2025-12-05-cybersecurity-news/Fri, 05 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-05-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Inotiv, a US-based company, disclosed a ransomware attack resulting in the theft of names, addresses, Social Security numbers, and financial and medical information of 9,542 individuals.</li> <li>Freedom Mobile reported a data breach involving the compromise of customer personal information through its account management platform.</li> <li>Marquis suffered a data breach impacting over 780,000 people, with compromised data including names, addresses, Social Security numbers, and card numbers.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A critical command injection vulnerability in Array Networks AG Series secure access gateways (ArrayOS AG VPN devices) has been actively exploited since August 2025. Threat actors are deploying webshells and creating rogue users.</li> <li>A maximum-severity vulnerability, CVE-2025-55182 (“React2Shell”), exists in React Server Components’ ‘Flight’ protocol, enabling remote code execution without authentication in React and Next.js applications. AWS and other sources confirm active exploitation attempts, including by China-linked threat groups. Only instances using a newer feature are affected.</li> <li>Google released a Chrome update addressing 13 security issues, including a high-severity vulnerability in Digital Credentials.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Chinese state-sponsored actors are actively exploiting the React2Shell vulnerability and targeting VMware vSphere servers with BrickStorm malware, as warned by CISA, NSA, and international partners. The BrickStorm malware is being used to backdoor VMware servers in government and technology sectors.</li> <li>The Predator spyware, developed by Intellexa, is leveraging a new zero-click infection vector (“Aladdin”) that compromises targets via malicious advertisements without user interaction.</li> <li>The financially motivated group GoldFactory is distributing modified banking apps in Southeast Asia (Indonesia, Thailand, Vietnam), resulting in over 11,000 mobile infections.</li> <li>The Silver Fox threat actor is conducting a false flag campaign in China, distributing ValleyRAT malware via fake Microsoft Teams installers and search engine optimization (SEO) poisoning.</li> <li>Russian state-sponsored hackers targeted Reporters Without Borders (RSF) using phishing emails to deliver malware.</li> <li>China-based SMS phishing groups have shifted tactics to promote scams involving loyalty points, taxes, and fake retailers during the holiday season.</li> <li>A student was found selling access to compromised government and university websites to Chinese threat actors for low prices.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Sophisticated fraud attacks are increasing, driven by the accessibility of AI tools and fraud-as-a-service platforms, making advanced techniques available to unskilled attackers.</li> <li>Multi-stage phishing campaigns targeting Microsoft 365 credentials have been observed since November 2025, employing advanced evasion techniques.</li> <li>AutoIT3 compiled scripts are being used to deliver shellcode payloads in Windows environments.</li> <li>There is a marked increase in AI-powered attacks, evolving injection techniques, and the use of automation in both offensive and defensive cyber operations.</li> <li>Cloudflare reported blocking 416 billion AI bot requests since July 1, indicating a surge in automated scraping and reconnaissance activity.</li> <li>SMS phishing campaigns are adapting to current events and seasonal trends, with new lures targeting points, taxes, and fake retailers.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>The UK National Cyber Security Centre (NCSC) announced the testing of a “Proactive Notifications” service to alert UK organizations about vulnerabilities in exposed devices.</li> <li>CISA, NSA, and allied cyber agencies published security guidance for the integration of AI in operational technology (OT) environments, outlining principles for secure AI deployment in critical infrastructure.</li> <li>India’s Ministry of Communications rescinded an order that would have required smartphone manufacturers to preinstall a government cybersecurity app (“Sanchar Saathi”) and prevent users from disabling it.</li> <li>Canadian police are trialing facial recognition body cameras, raising potential privacy and accuracy concerns.</li> <li>The US Inspector General’s report on the “Signalgate” incident recommended a single procedural change to improve the handling of classified material.</li> <li>ServiceNow acquired Veza, a provider of non-human identity (NHI) access control, to enhance its governance and AI Control Tower offerings.</li> </ul>