Rhadamanthys on DanSec Daily

Cybersecurity Brief – 2025-11-14

Fri, 14 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

DoorDash disclosed a data breach in October affecting user information across the US, Canada, Australia, and New Zealand.
The Washington Post is notifying nearly 10,000 employees and contractors of personal and financial data exposure following the Oracle data theft attack.
Synnovis confirmed patient information was stolen in a ransomware attack that disrupted pathology services at several London hospitals.
The NHS is investigating claims of an Oracle E-Business Suite (EBS) hack after hackers named over 40 alleged victims, with the National Cyber Security Centre involved.

Newly Discovered Vulnerabilities

Fortinet FortiWeb is affected by a path traversal vulnerability that allows unauthenticated attackers to create administrative users. The flaw is being actively exploited and a public proof-of-concept (PoC) is available.
ImunifyAV, a malware scanner for Linux servers used by tens of millions of websites, has a remote code execution vulnerability that could compromise hosting environments.
WatchGuard Firebox firewalls are impacted by CVE-2025-9242, a critical (CVSS 9.3) unauthenticated remote code execution vulnerability, which is being actively exploited.
Cisco Adaptive Security Appliances (ASA) and Firepower devices are subject to two actively exploited vulnerabilities, prompting urgent patching advisories from CISA.
Cisco Identity Services Engine (ISE) and Citrix products are affected by CVE-2025-20337 and CVE-2025-5777, both of which have been exploited as zero-days.
Uhale Android-based digital picture frames contain multiple critical vulnerabilities, including the ability to download and execute malware at boot time.
A vulnerability in ChatGPT’s custom GPTs allowed exploitation via server-side request forgery (SSRF) to obtain Azure access tokens.

Notable Threat Actor Activity

Russian-speaking threat actors have registered over 4,300 fake travel domains in a mass phishing campaign targeting hotel guests’ payment data.
A malicious Chrome extension, “Safery,” steals Ethereum wallet seed phrases and exfiltrates them using the Sui blockchain.
Indonesian threat actors are likely behind the ‘IndonesianFoods’ worm, which has spammed npm with over 100,000 self-replicating malicious packages.
The Coyote and Maverick banking trojans are active in Brazil, with Maverick terminating itself if run outside the country.
Google has taken legal action against the China-based Lighthouse phishing kit, disrupting a platform responsible for SMS phishing and toll-fee scams affecting over a million victims and 17,500 fake sites.

Trends, Tools, or Tactics of Interest

The Tycoon 2FA phishing kit has evolved, enabling unskilled actors to launch sophisticated social engineering attacks bypassing two-factor authentication.
Ransomware operators are increasingly targeting virtual environments: Akira ransomware is encrypting Nutanix AHV VMs; Kraken ransomware benchmarks systems to optimise encryption without overloading them.
Kerberoasting attacks remain a significant threat for Active Directory environments, with attackers stealing service account passwords to escalate privileges.
Formbook malware is being delivered through multiple scripting techniques to evade detection.
A surge in exploit weaponisation speed: 50–61% of new vulnerabilities in 2025 had exploit code available within 48 hours of disclosure.
Organisations are moving toward single sign-on (SSO) and passkeys to address persistent weak password usage among employees.
Microsoft Teams is rolling out screen capture prevention for Premium customers, blocking screenshots and recordings during meetings.
Attackers continue to leverage phishing-as-a-service platforms, with new kits and services supporting rapid deployment of phishing campaigns.

Law Enforcement and Regulatory Developments

Operation Endgame, coordinated by Europol and Eurojust, disrupted the Rhadamanthys, Venom RAT, and Elysium botnet operations, taking down over 1,025 servers and arresting at least one individual.
CISA, FBI, and partners have released updated guidance for defending against Akira ransomware, and have reiterated patching requirements for actively exploited Cisco and WatchGuard vulnerabilities.
Google’s legal actions have resulted in the disruption of the Lighthouse phishing kit infrastructure.
The UK’s National Cyber Security Centre is assisting the NHS following claims of an Oracle EBS breach.
New York State is investigating the use of algorithmic surveillance pricing in consumer markets, highlighting regulatory scrutiny over data-driven practices.

Cybersecurity Brief – 2025-11-12

Wed, 12 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

GlobalLogic, a Hitachi group company, is notifying over 10,000 current and former employees of data theft following a breach of Oracle E-Business Suite (EBS).
The Rhadamanthys infostealer malware operation has been disrupted, with operators and customers losing access to their servers.
A Chinese national known as the “Bitcoin Queen” was sentenced in London to over 11 years in prison for laundering Bitcoin from a $7.3 billion cryptocurrency investment scam.

Newly Discovered Vulnerabilities

Microsoft’s November 2025 Patch Tuesday addressed 63 vulnerabilities, including one actively exploited Windows kernel zero-day and several critical flaws. Emergency and cumulative updates were also released for Windows 10 and Windows 11 to address security vulnerabilities and ESU enrollment issues.
Synology patched a critical remote code execution vulnerability in BeeStation products, demonstrated at Pwn2Own Ireland.
Gladinet’s Triofox file-sharing and remote-access platform was found to have a critical vulnerability that allowed attackers to exploit the built-in antivirus feature to gain SYSTEM privileges and deploy remote access tools.
SAP released patches for multiple vulnerabilities, including a maximum severity flaw in SQL Anywhere Monitor due to hardcoded credentials and a critical code execution issue in Solution Manager.
Adobe released security updates addressing 29 vulnerabilities across multiple products, including InDesign, InCopy, Photoshop, Illustrator, Pass, Substance 3D Stager, and Format Plugins.
A critical zero-day vulnerability affecting Samsung mobile devices was exploited in the wild to deliver LANDFALL spyware.
Mozilla introduced new fingerprinting protections in Firefox, reducing the number of trackable users.
A new side-channel attack, dubbed “Whisper Leak,” allows attackers intercepting network traffic to infer user prompt topics in large language model (LLM) conversations, despite end-to-end encryption.

Notable Threat Actor Activity

Threat actors are distributing a new banking malware called “Maverick” via WhatsApp, targeting major Brazilian banks. Maverick shares similarities with the Coyote banking malware.
GootLoader malware has resurfaced, now using a novel font-based obfuscation technique to hide malicious payloads on compromised WordPress sites.
A malicious npm package, “@acitons/artifact”, was discovered typosquatting the legitimate “@actions/artifact” package, targeting GitHub-owned repositories.
The Fantasy Hub Android remote access trojan (RAT) is being sold on Russian-speaking Telegram channels as a Malware-as-a-Service (MaaS), turning Telegram into a distribution hub for threat actors.
Kimsuky (DPRK-linked) APT group is exploiting Google Find Hub to compromise South Korean Android devices, remotely wiping devices and abusing the KakaoTalk messaging app.
RansomHub ransomware was detected during an in-progress attack, initiated via fake browser updates and leading to domain-admin privilege escalation.
Scammers are using AI-generated fake faces combined with real body images in extortion scams, and leveraging AI voice cloning and open-source data for social engineering attacks, particularly targeting the elderly.
Thieves are increasingly phishing Apple ID credentials through fake “Find My” messages to unlock stolen iPhones.

Trends, Tools, or Tactics of Interest

AI-enabled supply chain attacks increased by 156% over the past year, with CISOs advised to reassess traditional defenses.
Script-kiddie-level phishing campaigns remain effective at rapidly stealing credentials, even with poorly crafted lures.
The use of Telegram as a central hub for malware distribution and MaaS offerings is increasing.
Threat actors are exploiting built-in software features (e.g., antivirus in Triofox) to escalate privileges and deploy malware.
Fake browser update lures are being used as initial access vectors for ransomware attacks.
Social engineering attacks are leveraging AI-generated content and public data to bypass human defences.

Regulatory or Policy Developments

The US Department of Defense began enforcement of Cybersecurity Maturity Model Certification (CMMC) requirements for contractors on 10 November 2025.
Microsoft announced end of security update support for Windows 11 23H2 Home and Pro editions; extended security updates for Windows 10 are now available.
Firefox introduced new privacy protections to reduce user tracking.
Tenzai, an Israeli startup, raised $75 million in seed funding to develop an AI-powered penetration testing platform.

Cybersecurity Brief – 2025-10-04

Sat, 04 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Renault and Dacia UK notified customers of a data breach affecting sensitive information, resulting from a compromise at a third-party provider.
Japanese beer company Asahi confirmed a ransomware attack that caused IT disruptions and factory shutdowns.
ShinyHunters launched a new data leak site to extort 39 victims impacted by recent Salesforce breaches, leaking samples of stolen data. The Scattered Lapsus$ Hunters group also resurfaced with threats to publish Salesforce customer data if extortion demands are unmet.
Jaguar Land Rover experienced repeat cyberattacks, reportedly due to incomplete remediation from a previous breach, highlighting ongoing operational and financial impacts.
Hackers who targeted Kido nurseries with ransom demands and posted children’s data online have reportedly removed the data following public backlash.
Dutch authorities arrested two teenagers for alleged pro-Russian espionage, noted as part of a broader Russian hybrid attack campaign in Europe.

Newly Discovered Vulnerabilities

CISA added CVE-2025-4008, a high-severity flaw in Smartbedded Meteobridge, to its Known Exploited Vulnerabilities catalog. The vulnerability allows remote unauthenticated attackers to execute arbitrary commands with root privileges; it was patched in mid-May but is being actively exploited.
An unauthenticated remote code execution (RCE) vulnerability affecting DrayTek routers was patched. The flaw could be exploited via crafted HTTP/S requests to the device’s web interface.
Chrome 141 and Firefox 143 released patches for high-severity vulnerabilities. Chrome addressed issues in WebGPU and Video components, while Firefox fixed flaws in Graphics and JavaScript Engine components.
A new attack, ‘CometJacking,’ exploits URL parameters in Perplexity’s Comet AI browser to access sensitive user data, such as emails and calendars, from connected services.

Notable Threat Actor Activity

The North Korean group “DeceptiveDevelopment” is using social engineering tactics to target job seekers, according to ESET.
The Detour Dog threat actor has been identified as operating DNS-powered malware campaigns distributing Strela Stealer, an information-stealing malware.
The Rhadamanthys Stealer threat actor has updated their stealer to include device fingerprinting and payloads concealed via PNG steganography. They are also advertising additional tools, Elysium Proxy Bot and Crypt Service.
A new self-propagating malware campaign, SORVEPOTEL, is targeting Brazilian WhatsApp users, spreading via trusted contacts on the messaging platform.
The “Cavalry Werewolf” threat actor, with links to YoroTrooper, has targeted Russian public sector entities using the FoalShell and StallionRAT malware families.
UAT-8099, a Chinese-language threat actor, is hijacking reputable websites for SEO fraud and data theft, infecting servers, poisoning sites with SEO spam, and stealing organizational data.
Oracle linked ongoing Clop ransomware extortion attacks to E-Business Suite vulnerabilities patched in July 2025, indicating exploitation of known flaws.
Cybercriminals reportedly offered money to a BBC journalist for cooperation, highlighting ongoing targeting of media professionals.

Trends, Tools, or Tactics of Interest

A Gartner survey found that 62% of organizations experienced a deepfake attack in the past 12 months, indicating a significant increase in the use of deepfakes in cyberattacks.
Signal introduced Sparse Post-Quantum Ratchet (SPQR), a cryptographic protocol designed to protect against quantum computing threats.
Gmail business users can now send end-to-end encrypted emails to recipients on any platform.
Microsoft’s “Windows Speak for Me” voice cloning technology has been identified as a potential vector for attacks, enabling creation of convincing voice replicas for use in SaaS platforms and communications.
Brain-computer interface (BCI) technology is being highlighted for its potential cybersecurity risks as adoption increases.
A free template was released to help CISOs present AI adoption, risks, and controls to boards, reflecting growing governance concerns around GenAI.
MokN, a French cybersecurity startup, introduced a “phish-back” solution that tricks attackers into revealing stolen credentials.
Passwork 7 was released as an on-premises platform for enterprise password and secrets management, addressing credential storage and sharing complexity.

Regulatory or Policy Developments Affecting the Security Industry

ICE (U.S. Immigration and Customs Enforcement) plans to build a 24/7 social media surveillance team, hiring contractors to monitor platforms such as X, Facebook, and TikTok for enforcement purposes.
LinkedIn user data will be used to train AI systems, raising privacy and data protection considerations.
Oneleet and MokN, cybersecurity startups, raised significant funding to expand operations and AI capabilities, indicating continued investment in compliance and anti-phishing technologies.

Cybersecurity Brief – 2025-10-02

Thu, 02 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Motility Software Solutions suffered a ransomware attack exposing sensitive data of 766,000 dealership software clients.
WestJet confirmed that a cyberattack compromised personal information, including passport and ID documents, of 1.2 million customers.
Allianz Life announced that a July data breach impacted nearly 1.5 million individuals.
Adobe disclosed an ingestion bug in its Analytics platform that resulted in customer tracking data being exposed to other tenants for approximately one day.
Executives at multiple companies received extortion emails from the Clop ransomware group, claiming theft of sensitive data from Oracle E-Business Suite systems.
Unknown threat actors have exploited Milesight industrial cellular routers since at least February 2022 to send smishing SMS messages targeting European users.

Newly Discovered Vulnerabilities

A critical vulnerability in Red Hat OpenShift AI could allow attackers to escalate privileges and gain full control over hybrid cloud infrastructure under specific conditions.
A high-severity flaw in One Identity OneLogin IAM allowed attackers to use API keys to steal OpenID Connect (OIDC) secrets and impersonate applications.
OpenSSL patched three vulnerabilities that could allow private key recovery, code execution, and denial-of-service attacks.
Google’s Gemini AI suite contained vulnerabilities permitting attackers to embed malicious instructions in user web activity.
A bug in classic Outlook causes the client to crash on launch, with resolution only available via Microsoft Exchange Online support.
A newly demonstrated attack, dubbed “WireTap” or “Battering RAM,” enables attackers with physical access to extract Intel SGX ECDSA keys and break confidential computing protections on Intel and AMD processors via DDR4 memory-bus interposers.
Broadcom failed to disclose zero-day exploitation of a VMware vulnerability affecting Aria Operations and VMware Tools, which could allow privilege escalation on virtual machines.

Notable Threat Actor Activity

The Clop ransomware group is conducting a new extortion campaign targeting Oracle E-Business Suite users.
A previously undocumented Android banking trojan, “Klopatra,” has infected over 3,000 devices, mainly in Spain and Italy, using hidden VNC for remote control.
Chinese APT “Phantom Taurus” is targeting organisations with the Net-Star malware, focusing on espionage and using infrastructure linked to other Chinese APTs but employing distinct TTPs.
Threat group UNC6040 (ShinyHunters) has been observed using advanced social engineering tactics to breach Salesforce environments.
The Rhadamanthys malware, a complex multi-modular stealer sold on underground markets since 2022, has received notable updates.

Trends, Tools, or Tactics of Interest

Bitdefender’s 2025 Cybersecurity Assessment Report highlights increased pressure to conceal breaches, expanding attack surfaces, and rising misperceptions around AI security.
Attackers are leveraging industrial IoT devices (Milesight routers) to conduct large-scale smishing campaigns.
The Klopatra Android malware uses hidden VNC for hands-on device control, indicating a trend towards more interactive mobile banking attacks.
Research demonstrates that confidential computing protections (Intel SGX, AMD SEV) can be bypassed with low-cost hardware if physical access is obtained.
“Burp AI” is being adopted by security professionals for automated vulnerability scanning in bug bounty workflows.
Google Drive for desktop is rolling out AI-powered ransomware detection that pauses file syncing upon detecting an attack.
AmCache forensic artifact analysis is highlighted as valuable for incident investigations, with new command-line tools available for data extraction.
Undead (unsupported) operating systems, especially with Windows 10 reaching end-of-life, are set to significantly increase the vulnerable attack surface in enterprise environments.

Regulatory or Policy Developments Affecting the Security Industry

KnowBe4 is pursuing ISO 42001 certification for AI governance as it integrates more AI into its human risk management platform.
F-Droid project warns it may cease operations due to Google’s new developer identity verification requirements.
NIST published Special Publication 1334, offering guidance on mitigating USB-borne threats in industrial control system (ICS) and OT environments.
CISA reiterates that microsegmentation is foundational, not optional, for zero trust architectures, and highlights modern, automated approaches to implementation.
Microsoft will begin automatic installation of Microsoft 365 companion apps on Windows 11 devices with existing Microsoft 365 desktop clients later this month.