Cybersecurity Brief – 2025-05-29

Thu, 29 May 2025 00:00:00 +0000

Major Incidents or Breaches

Over 100,000 WordPress sites are at risk due to a critical, unpatched vulnerability (CVSS 10.0) in the TI WooCommerce Wishlist plugin, allowing unauthenticated attackers to upload arbitrary files.
Over 9,000 ASUS routers have been compromised by the “AyySSHush” botnet, which adds a persistent SSH backdoor. The botnet also targets SOHO routers from Cisco, D-Link, and Linksys.
Cellcom experienced a cyberattack impacting regional mobile services in Wisconsin and Michigan, with outages lasting nearly a week and continued intermittent service.
A financially motivated threat actor known as “Mimo” has exploited CVE-2025-32432 (RCE) in Craft CMS to deploy cryptominers and proxyware payloads.
The Interlock ransomware gang has deployed a new remote access trojan (NodeSnake RAT) against universities, enabling persistent access to networks.
The “Dark Partner” cybercrime group is conducting large-scale cryptocurrency theft through a network of fake AI, VPN, and crypto software download sites.
Researchers observed 251 Amazon-hosted IPs used in coordinated exploit scans targeting ColdFusion, Apache Struts, and Elasticsearch exposure points.

Newly Discovered Vulnerabilities

A critical unpatched vulnerability in the TI WooCommerce Wishlist WordPress plugin (CVSS 10.0) allows unauthenticated file uploads, exposing over 100,000 sites.
A security flaw in Microsoft OneDrive File Picker allows web applications to access a user’s entire cloud storage content, not just the files selected for upload.
CVE-2025-32432, a recently disclosed remote code execution vulnerability in Craft CMS, is being actively exploited.

Notable Threat Actor Activity

The Chinese APT31 group was formally attributed by the Czech Republic for cyberattacks against the Ministry of Foreign Affairs and critical infrastructure in 2022.
APT41 (China-linked) is using new malware (“ToughProgress”) that leverages Google Calendar for stealthy command-and-control communications.
The Iranian national Sina Gholinejad pleaded guilty in the US for involvement in the Robbinhood ransomware attack on Baltimore, part of a $19 million international extortion scheme.
Pakistan authorities arrested 21 individuals associated with the “Heartsender” malware and spam dissemination service, which operated for over a decade.
The newly identified PumaBot botnet, written in Go, is targeting Linux-based IoT devices by brute-forcing SSH credentials to deploy cryptominers and facilitate further attacks.
The Interlock ransomware group is using the NodeSnake RAT to maintain persistent access to university networks.

Trends, Tools, or Tactics of Interest

Stealer malware campaigns are increasingly focused on capturing live sessions and moving rapidly to account takeover, rather than just stealing static credentials.
“Browser-in-the-Middle” attacks are being used to hijack user sessions in seconds, bypassing traditional credential theft methods.
Alternate Data Streams are highlighted as a defense evasion technique for adversaries, with detection guidance provided.
The “Dark Partner” group utilises fake software download sites to distribute malware and facilitate cryptocurrency theft.
The evolution of the Zanubis Android banking trojan includes the adoption of RC4 and AES encryption, expanded credential theft capabilities, and new targeting in Peru.
PumaBot and AyySSHush botnets demonstrate ongoing targeting of IoT and SOHO network devices, focusing on SSH brute-forcing and persistent backdoor installation.

Regulatory or Policy Developments Affecting the Security Industry

The Czech Republic publicly attributed the 2022 Ministry of Foreign Affairs cyberattack to China-linked APT31, marking a formal diplomatic accusation.
Microsoft introduced a new update orchestration platform for Windows, aiming to unify software, driver, and system component updates.
Microsoft launched Windows Backup for Organizations, designed to streamline enterprise backup and migration processes.
Apple reported blocking over $9 billion in fraudulent App Store transactions since 2020, with $2 billion prevented in 2024.
Zscaler announced an agreement to acquire Red Canary, aiming to integrate threat detection and AI-powered security operations capabilities.

Cybersecurity Brief – 2025-05-28

Wed, 28 May 2025 00:00:00 +0000

Major Incidents or Breaches

Adidas has disclosed a data breach following a compromise at a customer service provider, resulting in the theft of data from individuals who contacted the company’s customer service help desk. Payment or financial information was not affected.
MathWorks, the developer of MATLAB, has confirmed a ransomware attack that caused ongoing service outages. The specific ransomware group involved and whether data was exfiltrated remain unclear.
Commvault’s Metallic SaaS service has been targeted by threat actors who gained access to Microsoft 365 environments of a small number of customers, according to a CISA alert.
DragonForce ransomware successfully breached a managed service provider (MSP) and used the SimpleHelp remote monitoring and management (RMM) platform to steal data and deploy ransomware encryptors on downstream customer networks.
Apple reported it prevented over $9 billion in fraudulent transactions via the App Store over the past five years, including $2 billion in 2024, amid rising threats targeting the platform.

Newly Discovered Vulnerabilities

Microsoft has released an emergency update for Windows Server 2022 to address a known issue causing Hyper-V virtual machines to freeze or restart unexpectedly.
Misconfigured Docker API instances are being exploited by new self-spreading malware that transforms them into Dero cryptocurrency mining botnets.

Notable Threat Actor Activity

Russian threat group Void Blizzard (also known as Laundry Bear) has been linked to breaches of over 20 NGOs using Evilginx phishing via fake Microsoft Entra pages. The group has also been connected to the September 2024 Dutch police security breach.
Cybercriminals are cloning legitimate antivirus websites (specifically Bitdefender) to distribute the Venom remote access trojan (RAT) and steal cryptocurrency wallets.
The Luna Moth (Silent Ransom Group) is conducting stealth phishing campaigns, including vishing (voice phishing) attacks, to extort law firms, as highlighted in a recent FBI alert.
A novel campaign is using search engine optimization (SEO) poisoning to trick employees searching for payroll portals into payroll fraud, targeting mobile devices.
The Danabot botnet infrastructure has been seized in the US and key operators indicted, disrupting a major Russian cybercrime operation.
An Iranian national has pleaded guilty to involvement in RobbinHood ransomware attacks that targeted US cities and organisations.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly using AI-generated audio to impersonate senior US officials in phishing attacks, according to an FBI warning.
Attackers are leveraging the SimpleHelp RMM platform in supply chain ransomware attacks, specifically in the DragonForce incident.
SEO poisoning is being used to redirect employees searching for payroll portals to malicious sites, facilitating payroll diversion fraud.
Self-spreading malware targeting Docker containers is automating the creation of cryptocurrency mining botnets.
There is a trend of cybercriminals cloning legitimate software vendor websites to distribute malware such as Venom RAT.
Law enforcement and industry partnerships are achieving significant disruption of cybercrime infrastructure, as demonstrated by the Danabot takedown.

Regulatory or Policy Developments Affecting the Security Industry

The FBI has issued multiple alerts regarding evolving social engineering and extortion tactics, including the use of AI-generated media and vishing campaigns.
CISA has published an advisory on attacks targeting Commvault’s SaaS environment, urging increased vigilance for SaaS providers and their customers.

Robbinhood on DanSec Daily

Cybersecurity Brief – 2025-05-29

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-05-28

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry