Cybersecurity Brief – 2025-08-21

Thu, 21 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a pharmaceutical company, confirmed a ransomware attack that resulted in the compromise and encryption of internal systems, with business operations impacted.
Vulnerabilities in a Workhorse Software application used by hundreds of municipalities exposed sensitive data; CERT/CC disclosed details following the release of patches.
Vulnerable internal services at Intel exposed information of 270,000 employees, as reported by a security researcher.
Microsoft is investigating an outage affecting Copilot and Office.com, impacting user access across North America.
Six major password managers are currently vulnerable to unpatched clickjacking flaws, potentially exposing user credentials, two-factor authentication codes, and credit card information.
McDonald’s staff and partner portals were found to have exposed APIs, sensitive data, and corporate documents due to security flaws.
Hackers are using legitimate ADFS redirects via office.com links to steal Microsoft 365 login credentials through phishing attacks.
The RapperBot DDoS-for-hire botnet was disrupted, and the alleged developer and administrator has been charged by the US Department of Justice.
A member of the “Scattered Spider” cybercrime group was sentenced to 10 years in prison and ordered to pay $13 million in restitution for SIM-swapping and related cyber offences.
Europol has clarified that a purported $50,000 reward for Qilin ransomware group members is a scam.

Newly Discovered Vulnerabilities

Apple released emergency security updates for iOS, iPadOS, and macOS, patching CVE-2025-43300, an out-of-bounds write zero-day vulnerability actively exploited in targeted attacks.
Google and Mozilla issued patches for multiple high-severity vulnerabilities in Chrome and Firefox browsers.
DOM-based clickjacking vulnerabilities affecting major password manager browser extensions could allow attackers to steal credentials and sensitive data.
A vulnerability in GPT-5’s routing mechanism can redirect user queries to older, less secure models, risking exposure to jailbreaks and unsafe outputs.
Researchers identified prompt injection vulnerabilities in AI browsers, such as Perplexity’s Comet, allowing malicious prompts to trigger unintended actions, including fraudulent purchases.
Vulnerabilities in McDonald’s internal portals exposed sensitive APIs and corporate documents.
CERT/CC disclosed information exposure vulnerabilities in Workhorse Software, used by local governments, after patch release.

Notable Threat Actor Activity

The Russian state-sponsored group “Static Tundra” (aka Energetic Bear) is exploiting a seven-year-old flaw in Cisco IOS/IOS XE software, targeting unpatched, end-of-life devices for cyber espionage against enterprises and critical infrastructure.
North Korean threat actors have conducted a coordinated cyber espionage campaign against diplomatic missions in South Korea, leveraging GitHub for command and control and deploying spear-phishing tactics.
Detailed spear-phishing attacks targeting European government entities in Seoul have been attributed to North Korea, China, or both.
Cybercriminals are increasingly abusing the AI-powered Lovable website builder to generate phishing pages, malware delivery sites, and fraudulent portals.
Low-skill attackers are leveraging LLM-generated scripts and services like Lovable to rapidly create convincing malicious websites.
Increased scanning activity targeting Airtell routers and web servers has been observed via honeypots.

Trends, Tools, or Tactics of Interest

HR-themed phishing attacks have surged by 120% in Q1 2025, with attackers impersonating internal HR communications to increase success rates.
The use of legitimate infrastructure (e.g., office.com, ADFS) in phishing campaigns is on the rise, enabling more convincing credential theft schemes.
AI browsers and agentic tools are being actively researched for vulnerabilities, with prompt injection and clickjacking emerging as significant risks.
The “Warlock” ransomware group is specifically targeting vulnerable on-premises SharePoint servers using sophisticated attack methods.
There is a notable increase in the abuse of AI-driven website builders (e.g., Lovable, Vibe) to lower barriers for cybercriminals, enabling rapid deployment of malicious sites.
The disruption of the RapperBot botnet and law enforcement action against its administrator highlight ongoing efforts to combat DDoS-for-hire operations.
Increased focus on shadow AI agents within enterprises, with concerns that unmonitored deployments could introduce significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced its Quantum-Safe Program, aiming to ensure all products and services are secured against quantum-based attacks by 2033.
Incode has acquired AuthenticID to enhance AI-driven identity verification, combining AI models with large-scale, regulated identity programme experience.
Europol issued a warning about fraudulent reward offers targeting ransomware group members, clarifying that a recently publicised Qilin reward is a scam.

Cybersecurity Brief – 2025-08-20

Wed, 20 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Allianz Life (US): Hackers stole personal information of 1.1 million individuals in a Salesforce data theft attack. Exposed data includes physical addresses, dates of birth, phone numbers, and other sensitive information for life insurance customers.
Business Council of New York State (US): Data breach in February led to theft of personal, financial, and health information of over 47,000 individuals.
Inotiv (US): Ransomware attack resulted in encryption of systems and data, impacting business operations.
Bragg Gaming Group (Global): Hackers accessed internal systems, though operations reportedly unaffected.
TPG Telecom/iiNet (Australia): Unauthorised access detected in iiNet order management system; investigation ongoing.
Highly Sensitive Medical Cannabis Data (US): Nearly one million records, including SSNs, government IDs, and health data, exposed due to an unsecured database.
Polish Power Plant (Poland): Russian hacktivists launched a cyberattack causing operational disruption at a power plant.
RapperBot DDoS Botnet: US authorities charged a 22-year-old Oregon man for operating the RapperBot botnet, which powered over 370,000 distributed denial-of-service attacks.

Newly Discovered Vulnerabilities

Apache ActiveMQ: Threat actors are exploiting a nearly two-year-old security flaw to gain persistent access to cloud Linux systems, deploying the DripDropper malware. Attackers have been observed patching the exploited vulnerability post-compromise to maintain exclusive access.
SAP NetWeaver: A public exploit chaining two critical, now-patched vulnerabilities has been released, exposing unpatched systems to remote code execution and data theft.
Windows CLFS (CVE-2025-29824): Previously zero-day flaw exploited in the wild as part of Play ransomware attack chains, enabling attackers to gain system-level privileges.
Windows Recovery/Reset: August 2025 security updates introduced an issue breaking reset and recovery operations on Windows 10 and some Windows 11 versions. Microsoft has released emergency out-of-band updates to address the problem.

Notable Threat Actor Activity

GodRAT: Financial institutions, especially trading and brokerage firms, are being targeted by a new remote access trojan dubbed GodRAT. The malware uses steganography and is based on Gh0st RAT code, likely as a successor to AwesomePuppet and attributed to the Winnti group.
ScarCruft (North Korea): The group has added ransomware to its toolset, distributing it via phishing emails.
PipeMagic Backdoor: Attackers are using the modular PipeMagic malware, which masquerades as a ChatGPT application, in conjunction with exploitation of Windows CLFS vulnerabilities as part of Play ransomware campaigns.
Russian Hacktivists: Conducted a disruptive cyberattack against a Polish power plant.
Yemen Cyber Army: UK courts sentenced Al-Tahery Al-Mashriky to 20 months in prison for hacktivist campaigns involving website defacement.

Trends, Tools, or Tactics of Interest

DripDropper Malware: Attackers exploiting Apache ActiveMQ are patching the same vulnerability after deploying their malware, a tactic to prevent other actors from leveraging the same entry point.
Linux Evasion: RingReaper, a sophisticated post-compromise tool, abuses the Linux kernel’s io_uring interface to evade endpoint detection and response (EDR) systems.
Darknet Communications: Criminal actors are increasingly migrating from traditional IRC forums to Telegram networks for operational security and resilience.
AI and Security: Increased discussion on the dual-use nature of AI helpers, with risks of AI-powered tools being leveraged for malicious purposes, including zero-click exploits against AI agents.
Supply Chain Attacks: Ongoing concern over GitHub risk vectors and supply chain compromise, with new research highlighting overlooked attack surfaces.
Increased Reconnaissance: Rise in scans targeting Elasticsearch instances, seeking misconfigurations or exposed data.
Vendor Security Requirements: Asian organizations, including a Japanese chipmaker and the Singaporean government, are mandating cybersecurity checks for suppliers in response to breach upticks.

Regulatory or Policy Developments

UK Encryption Policy: The UK government has dropped its demand for Apple to implement encryption backdoors following pressure from US civil liberties groups.
PyPI Security: The Python Package Index has implemented protections against domain resurrection attacks, reducing the risk of account hijacking through expired domain-based password resets.
Okta/Threat Detection: Okta has open-sourced a catalog of Sigma-based Auth0 detection rules to help customers identify account takeovers, misconfigurations, and suspicious behaviors in event logs.

RapperBot on DanSec Daily

Cybersecurity Brief – 2025-08-21

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-08-20

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments