https://blog.dansec.red/actors/qakbot/Recent content in Qakbot on DanSec DailyHugoen-gbFri, 23 May 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-05-23-cybersecurity-news/Fri, 23 May 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-05-23-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li> <p><strong>Chinese Threat Actor Activity</strong>:</p> <ul> <li>Chinese-speaking group UAT-6382 exploited a now-patched remote code execution vulnerability in Trimble Cityworks to breach multiple US local government networks, deploying Cobalt Strike and VShell.</li> <li>Chinese nexus actors exploited recently patched Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities to target government agencies and enterprises across Europe, North America, and Asia.</li> </ul> </li> <li> <p><strong>Phishing Campaign Targeting International Students</strong>:</p> <ul> <li>The FBI reported an ongoing phishing campaign specifically targeting Middle Eastern students studying in the US, aiming to steal personal and financial information.</li> </ul> </li> <li> <p><strong>Database Exposure</strong>:</p> <ul> <li>A database containing 184 million login credentials, including those for Apple, Google, Meta, and various government services, was discovered and subsequently taken offline.</li> </ul> </li> <li> <p><strong>Cryptocurrency Theft via Fake Apps</strong>:</p> <ul> <li>Cybercriminals are distributing fake Ledger apps targeting macOS users to steal cryptocurrency seed phrases and digital assets.</li> </ul> </li> </ul>