RomCom on DanSec Daily

Cybersecurity Brief – 2025-11-27

Thu, 27 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Gainsight has expanded its list of impacted customers following a recent security alert from Salesforce, indicating the breach affected more customers than initially disclosed.
Multiple London councils, including the Royal Borough of Kensington and Chelsea and Westminster City Council, have experienced IT service disruptions due to a cyberattack.
Comcast will pay a $1.5 million fine after a vendor data breach in February 2024 exposed the personal information of nearly 275,000 customers.
Dartmouth College confirmed a data breach resulting from an Oracle hack, with over 226 GB of files stolen and leaked.
The OnSolve CodeRED emergency alert platform in the US was disrupted by a ransomware attack from the Inc Ransom group, resulting in operational impact and data breach.
Thousands of secrets, including credentials and private keys, were leaked by users of JSONFormatter and CodeBeautify code formatting platforms.
A major sportswear company was targeted by a high-volume phishing campaign between 29 and 30 October 2025, as detected by KnowBe4 analysts.

Newly Discovered Vulnerabilities

ASUS released firmware updates to address nine security vulnerabilities in AiCloud routers, including a critical authentication bypass flaw.
The ’node-forge’ JavaScript cryptography library patched a vulnerability that allowed attackers to bypass signature verification with specially crafted data.
A new malicious Chrome extension was discovered that injects hidden Solana transfer fees into Raydium swaps, diverting funds to attacker-controlled wallets.
Microsoft warned that FIDO2 security keys may prompt users for a PIN after recent Windows updates since September 2025.
Microsoft announced plans to secure Entra ID sign-ins from external script injection attacks, with implementation set for mid-to-late October 2026.

Notable Threat Actor Activity

The Shai-Hulud v2 supply chain attack has spread from npm to Maven, compromising over 830 npm packages and exposing thousands of secrets.
Qilin ransomware was deployed in a sophisticated supply chain attack targeting a South Korean managed service provider, resulting in data theft from 28 financial sector victims.
The RomCom threat group used SocGholish fake update attacks to deliver Mythic Agent malware to a US-based civil engineering company.
A new Mirai-based botnet, ShadowV2, has been observed exploiting known vulnerabilities in IoT devices from D-Link, TP-Link, and others, using the recent AWS outage as a test event.
Scammers are using fake LinkedIn job postings and video updates to distribute Flexible Ferret malware to Mac users, enabling multi-stage data theft and long-term access.
The “Scattered LAPSUS$ Hunters” group continued data theft and mass extortion campaigns against major corporations.
Cybercriminals have increasingly targeted financial institutions and individuals with account takeover fraud, causing $262 million in losses in 2025, according to the FBI.

Trends, Tools, or Tactics of Interest

NTLM relay and credential forwarding attacks continue to be exploited, with new vulnerabilities and abuse techniques identified in 2025.
The EMEA finance and banking sector faces escalating cybersecurity challenges, with increased targeting and advanced threats.
Advanced digital fraud attacks surged 180% in 2025, with generative AI used for creating deepfakes, synthetic IDs, and autonomous bots.
Attackers are integrating large language models (LLMs) into malware to evade detection and augment code in real time.
“Dark LLMs” are facilitating more competent attacks by low-level cybercriminals, though with limited technical sophistication.
Prompt injection vulnerabilities are a growing concern for agentic AI-enabled browsers, such as ChatGPT’s Atlas Browser.
Over half of surveyed enterprises are uncertain about their ability to secure non-human identities (NHIs), highlighting a gap in identity security controls.
Increased use of community-maintained tools (e.g., Chocolatey, Winget) for patching and updates presents both opportunities and risks for IT teams.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced a new Cyber Security and Resilience Bill, setting out enhanced requirements for critical infrastructure organisations.

Cybersecurity Brief – 2025-08-12

Tue, 12 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Connex Credit Union disclosed a data breach affecting 172,000 members, with attackers stealing personal and financial information after breaching its systems.
The Netherlands’ National Cyber Security Centre (NCSC) reported exploitation of Citrix NetScaler vulnerability CVE-2025-6543 to breach critical organisations in the country.
Air France experienced a data breach resulting in the leak of frequent flyer data (as per Check Point’s weekly threat bulletin).
A major automaker’s dealership platform used by over 1,000 US dealerships was found to be vulnerable, allowing car hacking and personal data theft, including the ability for unauthorised remote vehicle unlocking.
Two hackers reportedly breached North Korean state-sponsored group Kimsuky, stealing and leaking internal data.
Law enforcement, in collaboration with international partners, took down infrastructure and seized over $1 million associated with the BlackSuit (Royal) ransomware group.
Over 29,000 Microsoft Exchange servers remain unpatched against a high-severity vulnerability, leaving them exposed to lateral movement and cloud environment compromise.

Newly Discovered Vulnerabilities

Researchers identified new security flaws in the TETRA (Terrestrial Trunked Radio) communications protocol, including weaknesses in its proprietary end-to-end encryption, impacting law enforcement and critical infrastructure communications.
A critical vulnerability in the OPC UA industrial protocol was disclosed, exposing utilities and factories to risk despite the protocol’s use of complex cryptography.
A sandbox escape with remote code execution was discovered in Google Chrome, earning a $250,000 bug bounty.
A path traversal vulnerability in WinRAR (CVE-2025-8088) was exploited as a zero-day by the Russian ‘RomCom’ group, targeting financial, defence, manufacturing, and logistics sectors in Europe and Canada.
A BadUSB attack technique, dubbed BadCam, was demonstrated against Lenovo Linux webcams, allowing persistent compromise via malicious USB devices.
Flaws in a major automaker’s dealership portal exposed customer and vehicle data and enabled unauthorised remote access to vehicles.

Notable Threat Actor Activity

The Russian-linked ‘RomCom’ hacking group exploited the WinRAR CVE-2025-8088 zero-day in targeted attacks on organisations in Europe and Canada.
North Korean Kimsuky hackers were themselves compromised, with internal data reportedly leaked by adversarial actors.
US authorities charged four Ghanaian nationals for their involvement in a $100 million fraud ring involving romance scams and business email compromise attacks.
The BlackSuit (Royal) ransomware gang suffered infrastructure seizures and asset forfeiture following coordinated law enforcement action.
An affiliate of the REvil ransomware group accused the Russian government of orchestrating the 2021 Kaseya supply chain attack.
Malicious actors have been actively exploiting a critical Erlang/OTP SSH vulnerability, with 70% of detected attacks targeting operational technology (OT) firewalls.

Trends, Tools, or Tactics of Interest

Surge in exploitation of Erlang/OTP SSH vulnerabilities, with a focus on OT firewall targets.
Increase in “native phishing” campaigns, where attackers abuse Microsoft 365 apps such as OneNote and OneDrive to deliver internal phishing lures.
Jailbreaking techniques for GPT-5 were demonstrated using “echo chamber” prompts and storytelling, bypassing safeguards without using inappropriate language.
The DarkBit ransomware (linked to MuddyWater) encryption was cracked by researchers, enabling free victim data recovery.
Exposure of persistent threats via USB-based attacks (BadCam) targeting Linux webcams.
Ongoing risk from large numbers of unpatched Exchange servers, facilitating potential lateral movement and cloud compromise.

Regulatory or Policy Developments

The Netherlands’ NCSC issued a public warning regarding active exploitation of Citrix NetScaler CVE-2025-6543, urging immediate remediation for critical infrastructure.

Cybersecurity Brief – 2025-08-09

Sat, 09 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Columbia University suffered a significant data breach impacting nearly 870,000 individuals, including students, applicants, and employees. Stolen data includes personal, financial, and health information.
French telecom provider Bouygues disclosed a breach affecting 6.4 million customers, with personal information compromised.
Allianz Life reported a cybersecurity incident exposing personal information of hundreds of thousands of individuals.
The U.S. Federal Judiciary confirmed a cyberattack on its electronic case management systems, impacting confidential court documents.
Royal and BlackSuit ransomware operations breached over 450 U.S. companies before their infrastructure was dismantled, according to the U.S. Department of Homeland Security.
FTC reported that Americans aged 60 and older lost a record $700 million to online scams in 2024, indicating a sharp increase in fraud targeting seniors.

Newly Discovered Vulnerabilities

Over a dozen vulnerabilities were identified in enterprise secure vaults from CyberArk and HashiCorp, enabling potential remote takeover without credentials if exploited.
A WinRAR vulnerability (CVE-2025-8088) was exploited as a zero-day in phishing attacks to install RomCom malware.
Security researchers found two techniques to crack at least eight brands of electronic safes using Securam Prologic locks, allowing unauthorized access within seconds.
A misconfiguration in corporate livestreaming platforms’ APIs was discovered, potentially exposing internal company meetings.
A feature in stream-oriented UNIX domain sockets (MSG_OOB) was leveraged to escalate privileges from Chrome renderer code execution to Linux kernel code execution.

Notable Threat Actor Activity

The Efimer Trojan is being mass-mailed via email and hacked WordPress sites to steal cryptocurrency by substituting clipboard wallet addresses, with over 5,000 victims reported.
A campaign dubbed GreedyBear used over 150 malicious Firefox extensions impersonating popular crypto wallets to steal more than $1 million in cryptocurrency.
60 new malicious packages were found on RubyGems, targeting credential and crypto theft. Similar activity was reported on PyPI, leading to changes in security practices for these software repositories.
AI-powered website builders (DeepSite AI, BlackBox AI) are being leveraged in Brazilian phishing scams to create convincing malicious sites.
Data from an APT actor, believed to be affiliated with China or North Korea, was leaked, revealing details on recent campaigns, attacker tools, compromised credentials, and command files.
Scattered Spider threat actor has been targeting help desks and identity systems, exploiting social engineering to bypass traditional security perimeters.

Trends, Tools, or Tactics of Interest

Leaked credentials incidents increased by 160%, with attackers using them for a range of malicious activities beyond immediate compromise.
Attackers are increasingly targeting the foundations of cryptocurrency, including smart contracts, through both scams and exploitation of vulnerabilities.
Red teams demonstrated that GPT-5’s prompt-level filters can be easily bypassed using multi-turn “storytelling” attacks, raising concerns about the model’s enterprise security.
Shadow AI and rogue AI models are being identified as new risks, with tools like BigID’s Shadow AI Discovery launched to uncover such instances.
There is a notable drop in ransomware attacks in Q2, with reported incidents falling by nearly half.
Security flaws in IoT devices, such as school bathroom vape detectors, can enable covert audio surveillance due to embedded microphones and insecure configurations.

Regulatory or Policy Developments

Microsoft 365 apps for Windows will block file access via the insecure FPRPC legacy authentication protocol by default from late August.
Microsoft will retire the Lens PDF scanner app for iOS and Android as of September 15, 2025.
The U.S. Judiciary is implementing enhanced cybersecurity measures following the breach of its electronic case management systems.
Software repositories RubyGems and PyPI are enforcing new security measures in response to the discovery of malicious packages.
Ex-NSA chief Paul Nakasone indicated at Defcon that major policy changes for the tech community may be forthcoming.