Rhysida on DanSec Daily

Cybersecurity Brief – 2026-09-01

Tue, 01 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

Berlin’s city administration confirmed data theft following a Rhysida ransomware attack, with cybercriminals attempting extortion after listing the city on a data leak site ^[18].
Hackers stole personal and health information affecting 9.5 million individuals from Aesto Health’s AWS infrastructure ^[33].
McKesson, a healthcare company, acknowledged a data breach after ShinyHunters claimed to have stolen hundreds of millions of records ^[42].
Nutex Health notified the SEC of a ransomware attack that compromised patient, employee, provider, business, and financial data ^[31].
Anthropic users were impacted by infostealer attacks, with session cookies stolen to gain access to Claude AI accounts and consume usage ^[19]^[41].
METR, an AI evaluation non-profit, suffered the theft of an API key, leading to the consumption of approximately $600,000 in AI credits ^[4].
Five Venezuelan nationals pleaded guilty in the US to ATM jackpotting attacks that involved attempting to physically install malware on ATMs to dispense cash ^[10]^[30].
The Cronos blockchain network was restarted after a price-manipulation exploit on the Tectonic lending platform enabled the theft of $74 million ^[12].

Newly Discovered Vulnerabilities

Nearly 22,000 Microsoft Exchange servers remain unpatched and exposed to a high-severity authentication bypass vulnerability, allowing attackers to hijack user mailboxes ^[9].
Two critical vulnerabilities in PaperCut NG and MF print management software (CVE-2026-82078 and CVE-2026-81578) are being actively exploited in data theft attacks; CISA has added these to its Known Exploited Vulnerabilities (KEV) catalog ^[11]^[35].
A critical authentication bypass vulnerability in JFrog Artifactory (CVE-2026-82329) is being exploited in the wild just days after disclosure ^[32].
WatchGuard patched three critical vulnerabilities in its Fireware OS iked process that could allow unauthenticated remote code execution ^[34].
ServiceNow patched three critical code injection vulnerabilities that could allow attackers to execute arbitrary code and access or tamper with data ^[37].
A critical flaw in Langflow (CVE-2026-0768) is under active exploitation, allowing unauthenticated remote execution of arbitrary Python code ^[6]^[29].
Kaspersky patched a vulnerability in its Endpoint Security product exploited by the Nightmare Eclipse group using the ‘HardBreacher’ technique ^[36].
Critical vulnerabilities in Ruby on Rails are being exploited for credential-probing and command and control activity ^[6].
JSCeal, a stealer targeting cryptocurrency applications, is delivered as compiled V8 bytecode and executed by a bundled Node.js runtime ^[38].

Notable Threat Actor Activity

Mirage Kitten, an Iran-linked threat actor, is targeting aviation and FinTech sectors across the Middle East and Africa with new malware families NodeRabbit (Node.js) and PollCat (JavaScript) ^[1].
The Russia-aligned UAC-0099 group is using a new technique, GuardBreaker, to plant nuclear weapon prompts in malware aimed at disrupting AI analysis in Ukraine ^[5].
North Korean threat actors are expanding job fraud operations beyond IT into healthcare and sales, seeking illicit employment in new sectors ^[7].
The Chinese Fire Ant group is using Cisco routers as spying platforms by establishing unauthorized GRE tunnel interfaces ^[16].
Rhysida ransomware is actively extorting the city of Berlin following a successful attack ^[18].
The Nightmare Eclipse group is exploiting a Kaspersky Endpoint Security vulnerability with a tool called ‘HardBreacher’ ^[36].

Trends, Tools, or Tactics of Interest

Abuse of enterprise collaboration tools by threat actors has increased fourfold in the past year as attackers use these platforms to evade detection ^[2].
The TerminalFix campaign, a variant of ClickFix, uses fake Cloudflare CAPTCHA prompts to trick users into executing malicious PowerShell commands, establishing reverse tunnels for deeper network access ^[13]^[20]^[40].
Infostealers are being used to hijack AI service accounts such as Anthropic’s Claude by stealing session cookies, enabling unauthorized access and usage ^[19]^[41].
Attackers are exploiting critical vulnerabilities in Langflow and Rails for credential harvesting and establishing command and control channels ^[6]^[29].
A router backdoor was observed where devices shipped with remote access enabled, allowing attackers to collect traffic and credentials and then erase logs ^[8].
Researchers demonstrated that AI models, such as Claude, can be used to port PLC exploits between device models quickly, reducing the barrier for industrial exploit development ^[28].
Job fraud tactics by North Korean actors are diversifying to include healthcare and sales roles ^[7].
JSCeal stealer is delivered in compiled V8 bytecode format and executed by a bundled Node.js runtime, targeting cryptocurrency users ^[38].

Regulatory or Policy Developments Affecting the Security Industry

CISA added the actively exploited PaperCut vulnerabilities (CVE-2026-82078 and CVE-2026-81578) to its Known Exploited Vulnerabilities catalog, signaling increased urgency for patching ^[35].
Nutex Health disclosed its ransomware breach to the SEC, reflecting regulatory requirements for timely breach notification ^[31].

Sources

Berlin confirms data theft after Rhysida ransomware attack claims - bleepingcomputer.com
9.5 Million Impacted by Aesto Health Data Breach - securityweek.com
McKesson confirms cyber incident after ShinyHunters claims patient-data theft - malwarebytes.com
Ransomware Gang Claims Nutex Health Data Breach - securityweek.com
Anthropic Users Hit by Infostealer Attacks, Session Thefts - darkreading.com
Infostealers are hijacking Claude accounts at users’ expense - malwarebytes.com
Attackers Steal METR API Key and Consume AI Credits Worth About $600,000 - thehackernews.com
Five Venezuelans plead guilty to ATM jackpotting attacks in US - bleepingcomputer.com
Five Venezuelans Plead Guilty in US Court to ATM Jackpotting - securityweek.com
Cronos blockchain restarts after $74 million Tectonic exploit - bleepingcomputer.com
Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks - bleepingcomputer.com
Recently patched PaperCut zero-days used in data theft attacks - bleepingcomputer.com
PaperCut Exploitation Escalates to Active Intrusions - securityweek.com
Critical JFrog Artifactory Vulnerability Reportedly Exploited in the Wild - securityweek.com
WatchGuard Patches Critical Vulnerabilities - securityweek.com
ServiceNow Patches 3 Critical Code Injection Vulnerabilities - securityweek.com
Attackers Exploit Critical Langflow and Rails Flaws in Credential-Probing and C2 Activity - thehackernews.com
Hackers Start Exploiting Critical Langflow Vulnerability - securityweek.com
Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit - securityweek.com
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - research.checkpoint.com
Mirage Kitten targeting aviation and FinTech sectors across the Middle East and Africa with a new malware set - securelist.com
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis - thehackernews.com
North Korean Job Fraud Expands Beyond IT Into Healthcare and Sales - thehackernews.com
Chinese Fire Ant hackers turn Cisco routers into spying platforms - bleepingcomputer.com
Attackers Abuse Enterprise Collaboration Tools to Avoid Detection - blog.knowbe4.com
Microsoft warns of TerminalFix attacks deploying reverse tunnels - bleepingcomputer.com
'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks - darkreading.com
TerminalFix looks like ClickFix, but delivers a very different payload - malwarebytes.com
⚡ Weekly Recap: Chinese Spy Proxy, AI Agents Go Off-Task, Router Backdoors and More - thehackernews.com
Experiment: Porting a PLC Exploit With AI Takes Hours and Hundreds of Dollars - securityweek.com

Cybersecurity Brief – 2026-08-31

Mon, 31 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

McKesson, a major healthcare company, has confirmed a data breach after the ShinyHunters extortion group claimed responsibility for stealing 284 million records, which reportedly include patient data. The company is responding as the attacker’s deadline for extortion approaches ^[22]^[32].
Berlin city administration has confirmed data theft following a ransomware attack by the Rhysida group. Rhysida claims to have exfiltrated over 5TB of data, including personal information and credentials, and is attempting to extort the city. Berlin authorities have stated they will not pay the ransom ^[11]^[29].
Manchester Airports Group is the subject of a data breach claim by the extortion group FulcrumSec, which alleges theft of over 80GB of data and plans to leak it online ^[27]^[31].
Boston Scientific continues to recover from a cyberattack that caused global network disruption. CrowdStrike and other firms are assisting with the investigation ^[26].

Newly Discovered Vulnerabilities

ServiceNow has patched three critical code injection vulnerabilities that could allow attackers to execute arbitrary code and access or tamper with data ^[21].
Kaspersky has patched a vulnerability in its Endpoint Security product after the exploit “HardBreacher” was released by the threat group Nightmare Eclipse ^[20].
A critical Ruby on Rails vulnerability, named KindaRails2Shell, allows attackers to perform arbitrary file reads to extract secrets and execute code remotely. This flaw is actively being targeted by attackers ^[25].
A security researcher has disclosed nine vulnerabilities affecting ATM encryption and authentication software, highlighting systemic weaknesses in the software supply chain for ATM systems ^[17].

Notable Threat Actor Activity

The threat actor known as Silver Fox is distributing the ValleyRAT backdoor disguised as signed Chinese adware. The malware is run under trusted processes and users are sometimes tricked into adding it to antivirus exclusions ^[1]^[4].
The Aurora (Aur0ra) ransomware group has used SpaceX’s AI-powered coding assistant, Cursor, in attacks against at least ten targets ^[5].
The China-linked cyber espionage group Fire Ant has expanded operations to compromise Cisco IOS XR routers, using them to steal credentials and blind security logs. Fire Ant has also been observed creating unexplained GRE tunnel interfaces on compromised routers, turning them into spying platforms ^[7]^[9].

Trends, Tools, or Tactics of Interest

There is increased use of AI-powered tools and agents in cyberattacks, as demonstrated by Aurora ransomware’s use of Cursor and the need for security teams to treat AI agents as highly privileged identities following incidents involving Hugging Face and Claude ^[5]^[23]^[24].
Offensive security toolkits such as Praetorian are consolidating established workflows into portable Go-based tools, supporting direct pipelines and shared SDKs for red team operations ^[19].
JSCeal, a stealer targeting cryptocurrency applications, is being delivered as compiled V8 bytecode executed by a bundled Node.js runtime, representing a novel malware delivery technique ^[30].

Regulatory or Policy Developments Affecting the Security Industry

A judge has ruled that the Pentagon’s measures against Anthropic, which labeled the company as a supply chain risk, were illegal and baseless. This decision is part of an ongoing legal dispute between Anthropic and the US government ^[28].
The US Department of Justice has corrected a previous statement regarding Chinese cyberattacks, clarifying that US agencies were targets but not confirmed victims ^[8].

Sources

McKesson Confirms Data Breach as Attacker Deadline Looms - securityweek.com
McKesson confirms cyber incident after ShinyHunters claims patient-data theft - malwarebytes.com
Berlin confirms data theft after Rhysida ransomware attack claims - bleepingcomputer.com
Berlin Won’t Pay Extortion Group Claiming Data Theft - securityweek.com
Extortion Group Claims Manchester Airports Group Data Breach - securityweek.com
31th August – Threat Intelligence Report - research.checkpoint.com
Boston Scientific Still Recovering From Cyberattack - securityweek.com
ServiceNow Patches 3 Critical Code Injection Vulnerabilities - securityweek.com
Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit - securityweek.com
Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs - securityweek.com
ATM Flaws Reveal Key Weaknesses in the Software Supply Chain - wired.com
ValleyRAT masquerading as adware - securelist.com
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions - thehackernews.com
Aurora Ransomware Operators Use Cursor AI in Attacks Against 10 Targets - thehackernews.com
China-Linked Fire Ant Hijacks Cisco Routers to Steal Credentials and Blind Security Logs - thehackernews.com
Chinese Fire Ant hackers turn Cisco routers into spying platforms - bleepingcomputer.com
What the Hugging Face Incident Teaches Security Leaders About AI Agent Access - securityweek.com
Anthropic Warns Claude Users of Infostealer Malware Infections - securityweek.com
Praetorian – Offensive Security Tools Built Around Portable Go Workflows - darknet.org.uk
Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode - research.checkpoint.com
Judge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’ - securityweek.com
DoJ Corrects China Hacking Claim, Says U.S. Agencies Were Targets, Not Victims - thehackernews.com

Cybersecurity Brief – 2026-04-17

Fri, 17 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group leaked data from 13.5 million McGraw Hill user accounts, obtained after breaching the company’s Salesforce environment.
Cookeville Regional Medical Center in Tennessee reported a data breach affecting 337,000 individuals after a Rhysida ransomware attack that resulted in 500GB of data theft.
A new campaign in the Czech Republic is actively targeting workers with the previously undocumented PowMix botnet, using randomized C2 traffic.
ZionSiphon malware has been identified as targeting operational technology in water treatment and desalination facilities, aiming to sabotage operations.
A DHL-themed phishing campaign is distributing remote access software designed to facilitate further malware deployment, including ransomware.
Attackers are exploiting a critical vulnerability in Marimo reactive Python notebook to deploy NKAbuse malware via Hugging Face Spaces.
A fake Slack installer is being used to provide attackers with a hidden desktop environment on victim machines for data and account access.
The ShinyHunters group leaked data from 13.5 million McGraw Hill user accounts, stolen via a Salesforce breach.
A data breach at Cookeville Regional Medical Center affected 337,000 individuals due to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco released patches for four critical vulnerabilities in Identity Services Engine (ISE) and Webex Services, which could allow remote code execution or user impersonation. One Webex flaw requires customer action to be fully remediated.
A high-severity vulnerability in Apache ActiveMQ Classic (CVE-2026-34197) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Splunk Enterprise patched a vulnerability allowing low-privileged users to upload files to a temporary directory and achieve remote code execution.
A critical vulnerability in Cursor AI could be exploited through chained prompt injection and sandbox bypass, enabling shell access to developer machines.
Three recently disclosed Windows zero-days are being actively exploited to gain SYSTEM or elevated administrator privileges.
A second Microsoft Defender zero-day, “RedSun,” with a published proof-of-concept, enables SYSTEM privilege escalation.
Microsoft’s April 2026 security updates are causing reboot loops on some Windows domain controllers.
A 17-year-old remote code execution vulnerability in Microsoft Excel has been highlighted as still present and exploitable.

Notable Threat Actor Activity

Operation PowerOFF, an international law enforcement effort, seized 53 DDoS-for-hire domains, arrested four individuals, and identified 75,000 DDoS service users across 21 countries, exposing 3 million criminal accounts.
The North Korean threat group Sapphire Sleet is using fake job offers and fraudulent Zoom updates to deliver ClickFix malware, targeting macOS users to steal credentials and sensitive data.
U.S. nationals were sentenced for operating a “laptop farm” supporting North Korean IT workers in obtaining jobs at over 100 U.S. companies, including defense contractors.
Adware previously considered benign, “Dragon Boss,” was updated to establish persistence and disable Windows Defender, facilitating future malware delivery.
The Lumma Stealer malware is being used in conjunction with the Sectop RAT (ArechClient2) for credential theft and remote access.
A new cybercrime platform, ATHR, is enabling automated voice phishing (vishing) attacks using both human operators and AI agents to harvest credentials.
Hackers are exploiting a Marimo notebook flaw to deploy NKAbuse malware hosted on Hugging Face Spaces.

Trends, Tools, or Tactics of Interest

AI is increasingly being integrated into security operations, with mixed results: KnowBe4 reports improved administration and lower cyber risk using AI agents, while most “AI SOCs” are noted as only improving triage speed rather than reducing workload.
Google is expanding the use of Gemini AI models to detect and block malicious ads as threat actors evolve their tactics to evade detection.
Social engineering through software supply chain attacks continues, with Obsidian plugin abuse delivering PHANTOMPULSE RAT in targeted attacks on finance and cryptocurrency sectors.
Forgotten or unmanaged non-human identities (e.g., service accounts, API keys) are cited as a leading cause of cloud breaches, accounting for 68% in 2024.
A Taboola pixel approved by a bank was found to redirect logged-in banking sessions to a Temu tracking endpoint without consent or security review.
Two-factor authentication is being promoted as a needed security layer beyond traditional IT environments due to increasing threat actor sophistication.
OpenAI has expanded access to its GPT‑5.4‑Cyber model, designed to support defenders in cybersecurity operations.
Malware campaigns are increasingly leveraging trojanized installers (e.g., Slack) and themed phishing emails (e.g., DHL, iCloud) to distribute remote access tools and steal credentials.

Regulatory or Policy Developments Affecting the Security Industry

NIST announced it will limit enrichment of CVEs in the National Vulnerability Database due to a 263% increase in submissions, prioritizing those in the CISA KEV catalog and critical software.
Microsoft’s original Windows Secure Boot certificate is expiring, requiring coordinated updates across the Windows ecosystem.
The EU has launched an anonymous online age verification app, making it freely available to companies for compliance with age-restriction regulations.

Cybersecurity Brief – 2025-10-18

Sat, 18 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Envoy Air, a subsidiary of American Airlines, confirmed a data compromise involving its Oracle E-Business Suite application. The Clop extortion gang has claimed responsibility.
Sotheby’s disclosed a data breach involving theft of sensitive personal information, including Social Security Numbers.
Prosper suffered a data breach impacting 17.6 million accounts, with exposed data including names, addresses, dates of birth, email addresses, Social Security numbers, government IDs, and other sensitive information.
Cybercriminals exploited lax authentication in Zendesk’s customer service platform to execute email bombing attacks, flooding targeted inboxes with abusive messages from legitimate Zendesk accounts.

Newly Discovered Vulnerabilities

A malicious npm package was identified delivering the AdaptixC2 post-exploitation agent, targeting Windows, Linux, and macOS platforms.
Researchers disclosed a critical vulnerability in WatchGuard Fireware’s VPN functionality, allowing unauthenticated remote code execution. The flaw has been patched.
ConnectWise issued a security update for its Automate product, addressing critical vulnerabilities that could allow adversary-in-the-middle (AiTM) update attacks and interception/modification of sensitive communications.
Microsoft patched CVE-2025-55315, an HTTP request smuggling vulnerability in ASP.NET Core with the highest-ever severity score for the platform. The flaw can lead to information leaks, file tampering, and server crashes.
Over 266,000 F5 BIG-IP instances remain exposed online following a recently disclosed security breach.
Gladinet patched an actively exploited CentreStack vulnerability, an unauthenticated local file inclusion bug enabling remote code execution via ViewState deserialization.
Vulnerabilities in Phoenix Contact UPS devices were disclosed, allowing attackers to trigger a permanent denial-of-service condition that prevents remote restoration.

Notable Threat Actor Activity

The Silver Fox threat group has expanded operations using the Winos 4.0 (ValleyRAT) malware, now targeting Japan and Malaysia with the HoldingHands RAT, in addition to previous campaigns in China and Taiwan.
North Korean threat actors associated with the Contagious Interview campaign have merged BeaverTail and OtterCookie malware into an advanced JavaScript-based strain, indicating ongoing tool development.
Microsoft disrupted a ransomware campaign abusing Azure certificates, revoking over 200 digital certificates used to sign malicious Teams binaries for Rhysida ransomware distribution.
Europol dismantled a SIM-box operation (SIMCARTEL) that facilitated over 3,200 fraud cases and caused losses exceeding €4.5 million by renting numbers for cybercrime.
TikTok videos are being used to promote malware installation, leveraging social engineering and new communication channels.

Trends, Tools, or Tactics of Interest

Phishing remains the leading initial access vector for cyberattacks across Europe, accounting for 60% of incidents between July 2024 and June 2025, per ENISA.
Microsoft reports increasing use of AI by Russian and Chinese threat actors to escalate cyberattacks, particularly targeting the United States.
Attackers are exploiting AI chat data as a rich source of sensitive enterprise information, raising concerns about privacy, accountability, and law enforcement access.
Shared responsibility models for securing AI agents and agentic services are becoming more prominent, with ongoing challenges in user and team awareness.
Social engineering tactics continue to evolve, with attackers leveraging platforms like TikTok and exploiting authentication weaknesses in SaaS products such as Zendesk.

Regulatory or Policy Developments Affecting the Security Industry

Capita has been fined £14 million in connection with a security incident.
The European Union Agency for Cybersecurity (ENISA) published statistics on initial access vectors, highlighting phishing as the predominant method in Europe.

Cybersecurity Brief – 2025-10-17

Fri, 17 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Sotheby’s disclosed a data breach in which threat actors accessed sensitive information, including financial details of individuals.
Financial services company Prosper suffered a breach impacting over 17.6 million accounts, with personal information stolen.
F5 confirmed a long-term breach of its systems, with attribution linked to Chinese threat actors. The attack exploited BIG-IP vulnerabilities, prompting patch releases and government alerts.
Video call app Huddle01 exposed over 600,000 user logs due to a misconfigured Kafka broker.
Fashion retailer Mango reported a data breach at a third-party marketing provider, exposing limited contact details.
LastPass and other top password managers are being targeted by phishing campaigns aiming to exploit user trust in password vaults.

Newly Discovered Vulnerabilities

Cisco IOS and IOS XE Software: CVE-2025-20352, a remote code execution vulnerability, is being actively exploited to deploy Linux rootkits on older networking devices.
Gladinet CentreStack: A local file inclusion vulnerability (CVE-2025-11371) has been exploited as a zero-day since late September; security updates have been released.
Adobe Experience Manager: A maximum-severity vulnerability in AEM Forms is being actively exploited to execute code on unpatched systems.
Fuji Electric HMI Configurator: Multiple vulnerabilities have been disclosed and patched, with advisories issued to industrial organizations.
Windows Kernel (Rust-based GDI component): A security vulnerability identified by Check Point Research in January 2025.
Microsoft Windows 11: Recent updates have broken HTTP/2 connections to localhost (127.0.0.1), impacting applications relying on this functionality.

Notable Threat Actor Activity

North Korean-affiliated actors are leveraging the EtherHiding technique to distribute malware and steal cryptocurrency, using blockchain smart contracts for resilience and stealth.
Financially motivated threat actor UNC5142 is abusing blockchain smart contracts to distribute information stealers such as Atomic (AMOS), Lumma, and RedLine via infected WordPress sites.
Chinese threat actors have been linked to the F5 breach and are reportedly testing AI-optimized attack chains in Taiwan.
Vanilla Tempest (aka Vice Spider/Vice Society) used over 200 fraudulent certificates to sign malicious binaries in Rhysida ransomware campaigns, targeting Microsoft Teams users. Microsoft has revoked these certificates to disrupt ongoing attacks.
Attackers are exploiting a Cisco SNMP flaw to deploy Linux rootkits (including the newly discovered LinkPro rootkit, which uses eBPF for stealth and activates via magic TCP packets) on AWS-hosted and on-premises infrastructure.

Trends, Tools, or Tactics of Interest

Increased abuse of blockchain technologies (smart contracts) for malware distribution and command-and-control, notably by both state-aligned and financially motivated actors.
Emergence of new Linux rootkits (e.g., LinkPro) employing advanced stealth techniques such as eBPF and covert activation mechanisms.
Phishing campaigns specifically targeting users of password managers, exploiting trust in these platforms.
Security risks in the software supply chain highlighted by the discovery of over 550 unique secrets exposed in Microsoft Visual Studio Code marketplaces.
AI-driven security tools are gaining traction, with new products emerging to automate vulnerability remediation and enterprise data protection.
Security Operations Centers (SOCs) are under pressure to adopt AI-based platforms for scaling detection and response capabilities.
Ongoing concerns regarding secure coding practices in AI-generated code, with emphasis on the need for improved training and oversight.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft Office 2016 and Office 2019 have reached end of extended support as of October 14, 2025, with implications for continued security updates and compliance.
Regulatory scrutiny on data handling practices, as evidenced by allegations against Roku for collecting and selling children’s data in violation of privacy laws.
Financial institutions are facing increasing challenges in data governance and regulatory risk management amid evolving compliance requirements.

Cybersecurity Brief – 2025-05-06

Tue, 06 May 2025 00:00:00 +0000

Major Incidents or Breaches

UK Retail Sector Attacks: The UK’s National Cyber Security Centre (NCSC) issued new security guidance following three significant cyberattacks targeting major UK retailers.
TeleMessage Breach: TeleMessage, an unofficial Signal message archiving tool used by US government officials, suspended all services after a reported hack.
Educational Sector Disruptions (US): Multiple school districts in Georgia and a university in New Mexico experienced disruptive cyberattacks as the academic year ends.
Darcula Phishing Campaign: The Darcula phishing-as-a-service (PhaaS) platform stole 884,000 credit cards globally via malicious SMS campaigns.
Disney Data Leak: An individual pleaded guilty to stealing sensitive Disney data and falsely claiming to be a Russian hacktivist.
Peru Ransomware Claim: The Rhysida ransomware group claimed responsibility for an attack on the Peruvian government’s domain, though the government denies the incident.

Newly Discovered Vulnerabilities

Android Zero-Day: Google’s May 2025 security update addresses 46 Android vulnerabilities, including one actively exploited in the wild.
Apple AirPlay Zero-Click RCE: Researchers disclosed now-patched, wormable vulnerabilities in Apple’s AirPlay protocol that enabled zero-click remote code execution over public Wi-Fi.
Langflow Critical Flaw: A critical vulnerability in the open-source Langflow platform has been added to CISA’s Known Exploited Vulnerabilities (KEV) list following evidence of active exploitation.
Commvault Command Center: CVE-2025-34028, a maximum-severity flaw in Commvault Command Center, was also added to CISA’s KEV list after confirmation of in-the-wild exploitation.
Samsung MagicINFO CMS: The Mirai botnet is now exploiting a previously patched arbitrary file upload vulnerability (CVE-2024-7399) in Samsung MagicINFO CMS for remote code execution.
Kubernetes Helm Chart Risks: Microsoft warns that default configurations in Kubernetes Helm charts may expose sensitive data publicly.
EDR Bypass Technique: A new “Bring Your Own Installer” technique has been used to bypass SentinelOne’s tamper protection, enabling threat actors to disable endpoint detection and response (EDR) tools.

Notable Threat Actor Activity

Luna Moth (Silent Ransom Group): Increased callback phishing campaigns by Luna Moth targeting US legal and financial institutions, impersonating IT help desks to gain initial access.
Venom Spider: Arctic Wolf Labs identified a spear-phishing campaign by “Venom Spider” targeting hiring managers and recruiters by posing as job seekers.
Russian-Linked Hacktivism: Russian hacktivist group conducted DDoS attacks on Romanian state websites during national elections.
FSB Recruitment via TikTok: Ukrainian authorities detained an alleged FSB agent recruited via TikTok for military espionage.
Myanmar Cyber Scam Sanctions: The US sanctioned Myanmar’s Karen National Army and its leader for involvement in cyber fraud operations.

Trends, Tools, or Tactics of Interest

Stealth and Persistence: Notable rise in stealth tactics designed for long-term access and silent control, with attackers leveraging AI for adaptive, persistent threats.
Phishing-as-a-Service (PhaaS): Darcula’s large-scale SMS phishing operation underlines the growing sophistication and reach of PhaaS platforms.
EDR Evasion: Increasing use of advanced techniques, such as “Bring Your Own Installer,” to bypass endpoint security controls.
Deepfake Evolution: Research reveals deepfakes now retain biometric signals (e.g., heartbeats), presenting new challenges for detection and authentication.
Supply Chain Risks: Ongoing concerns about open-source software security, with warnings about persistent risks from tools like easyjson due to foreign influence and supply chain exposure.

Regulatory or Policy Developments

CISA KEV List Updates: Addition of Langflow and Commvault vulnerabilities to the US CISA Known Exploited Vulnerabilities catalog, increasing urgency for patching.
US Sanctions: Expansion of US sanctions targeting entities and individuals involved in cybercrime and cyber scam operations in Myanmar.
NCSC Guidance: UK’s NCSC published updated security guidance in response to recent cyberattacks on the retail sector, urging all organisations to review and strengthen their cyber defences.