RondoDox on DanSec Daily

Cybersecurity Brief – 2026-03-18

Wed, 18 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

UK Companies House disclosed a vulnerability that exposed details of millions of firms, which could have been exploited to obtain sensitive company information and alter official records.
Robotic surgery manufacturer Intuitive confirmed a cyberattack after an employee fell victim to a phishing scheme, resulting in unauthorised access to internal business applications.
GlassWorm malware resurfaced in a supply-chain attack targeting over 400 code repositories and packages on GitHub, npm, VSCode, and OpenVSX, impacting the software supply chain.
Sears exposed AI chatbot phone calls and text chats to the public web, allowing access to customer conversations containing contact information and personal details.
LeakNet ransomware adopted the ClickFix technique via compromised websites for initial access and deployed a Deno-based in-memory loader, increasing stealth in attacks.
The RondoDox botnet escalated its activity, targeting 174 vulnerabilities with up to 15,000 exploitation attempts per day.
A phishing attack targeted cybersecurity firm Outpost24, using trusted brands and domains in an attempt to compromise C-suite credentials; the attack was unsuccessful.

Newly Discovered Vulnerabilities

Apple released its first Background Security Improvements update to patch a WebKit vulnerability (CVE-2026-20643) affecting iOS, iPadOS, and macOS, which enabled same-origin policy bypass.
A critical unpatched vulnerability (CVE-2026-32746) in the GNU InetUtils telnet daemon (telnetd) allows unauthenticated remote code execution as root via port 23.
Multiple AI platforms, including Amazon Bedrock, LangSmith, and SGLang, were found vulnerable to data exfiltration and remote code execution attacks using DNS queries.
CISA flagged the year-old Wing FTP vulnerability (CVE-2025-47813) as actively exploited, which can disclose the full local installation path of the application.
A new font-rendering attack was identified that hides malicious commands from AI tools by embedding them in HTML, evading detection by AI-based security solutions.

Notable Threat Actor Activity

North Korean threat actor group Konni was observed deploying EndRAT through phishing campaigns and leveraging the KakaoTalk desktop app to propagate malware to victims’ contacts.
LeakNet ransomware group is now using ClickFix for social engineering and Deno runtime for in-memory malware loading, enhancing stealth and evasion.
The Warlock ransomware group demonstrated augmented post-exploitation activities, including a new Bring Your Own Vulnerable Driver (BYOVD) technique and advanced cross-network movement.
Attackers are increasingly using IPv4-mapped IPv6 addresses to obfuscate attack origins, as noted in recent web scanning activity.

Trends, Tools, or Tactics of Interest

Attackers are shifting from traditional intrusion methods to credential theft, with increased use of infostealer malware and AI-enabled social engineering, leading to more incidents of attackers “logging in, not breaking in.”
Ransomware actors are moving away from Cobalt Strike in favour of native Windows tools due to declining ransom payment rates and a surge in data theft.
Akamai reported a convergence of Layer 7 DDoS, API abuse, and AI-powered attacks into highly coordinated, multi-vector campaigns that are more challenging to detect and mitigate.
Integrated Cloud Email Security (ICES) is highlighted as a recommended solution for modern email threats, as attackers continue to evolve phishing techniques.
SEO poisoning is being used to lure users searching for VPNs into downloading malicious software that steals corporate login credentials.
AI security remains a concern: studies indicate most CISOs are relying on outdated tools and skills to secure AI systems, and 90% of surveyed users do not trust AI with their data.
Use of in-memory loaders and open-source runtimes (such as Deno) is increasing in ransomware deployment for stealthier attacks.
Supply chain threats continue to target open-source repositories and extensions, as evidenced by the GlassWorm campaign.
Google is implementing stricter controls on Android apps abusing accessibility features to combat mobile malware.
A new tactic was observed where malicious commands are hidden from AI-based detection tools using font-rendering tricks in HTML.

Regulatory or Policy Developments

The European Union Council imposed sanctions on three entities and two individuals from China and Iran for involvement in cyberattacks targeting critical infrastructure.
Major tech companies including Anthropic, AWS, Google, Microsoft, and OpenAI have collectively invested $12.5 million in the Linux Foundation for open source security initiatives.
Google, Meta, and Microsoft are among the signatories of a new industry pact to combat online scams and fraud.

Cybersecurity Brief – 2026-01-06

Tue, 06 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Brightspeed, a major US broadband provider, is investigating claims of a security breach and data theft made by the Crimson Collective extortion gang. The group alleges theft of personal information of over 1 million customers.
Sedgwick confirmed a cyberattack on a file transfer system at its government subsidiary, affecting agencies it serves.
Ledger notified customers of a data breach at third-party payment processor Global-e, resulting in exposure of personal data.
Multiple corporate data theft incidents have been linked to threat actor Zestix, who breached ShareFile, Nextcloud, and OwnCloud instances and is offering stolen data from dozens of companies.
Artisans’ Bank and VeraBank, two US banks, disclosed security incidents.
NordVPN denied breach claims, stating that attackers only accessed dummy data from a third-party automated testing platform.
No evidence of cyberattack was found in the communications failure that grounded flights in Greece.

Newly Discovered Vulnerabilities

n8n, an open-source workflow automation platform, disclosed a critical vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary system commands.
The “@adonisjs/bodyparser” npm package is affected by a critical vulnerability (CVSS 9.2) enabling arbitrary file writes on servers.
A critical ‘MongoBleed’ vulnerability in MongoDB allows unauthenticated attackers to extract passwords and tokens via a memory leak. The flaw is under active attack.
VSCode IDE forks, including Cursor, Windsurf, Google Antigravity, and Trae, expose users to attacks via non-existent “recommended extensions” that can be abused for malicious purposes.
Risks associated with newer IP-based KVM devices have been highlighted, as out-of-band access could introduce security concerns.
WhatsApp metadata leak through device fingerprinting was reported, with Meta rolling out fixes.

Notable Threat Actor Activity

Russia-aligned group UAC-0184 targeted Ukrainian military and government entities by delivering malicious ZIP archives via the Viber messaging platform.
The Kimwolf Android botnet has infected over 2 million devices, leveraging exposed ADB interfaces and residential proxy networks for DDoS attacks, app installs, and proxy bandwidth resale.
Zestix is offering for sale corporate data stolen from cloud file-sharing platforms.
The Crimson Collective extortion gang claimed responsibility for the Brightspeed breach.
US cyber professionals pleaded guilty to working as affiliates of the ALPHV/BlackCat ransomware group.
The RondoDox botnet has expanded operations by exploiting React2Shell vulnerabilities, targeting Next.js servers for cryptomining and botnet payload delivery.
New VVS Stealer malware, written in Python, is targeting Discord accounts to harvest credentials and tokens.

Trends, Tools, or Tactics of Interest

The ClickFix social engineering campaign is targeting the European hospitality sector, using fake Windows Blue Screen of Death (BSOD) screens to trick users into executing malware.
Threat actors are increasingly abusing cloud file-sharing platforms for corporate data theft.
The Kimwolf botnet demonstrates the growing use of residential proxy networks for botnet expansion and monetization.
AI-powered IDEs recommending non-existent extensions present a new supply chain risk vector.
Agentic AI adoption is raising identity management challenges, with AI agents acting as a new class of identity that CISOs must manage.
CISA’s Known Exploited Vulnerabilities (KEV) catalog expanded by 20% in 2025, now including 1,484 entries, with 24 new vulnerabilities known to be exploited by ransomware groups.
Automated License Plate Reader (ALPR) surveillance is discussed as a privacy and security concern.
Ineffectiveness of AI guardrails was highlighted following an incident involving Grok generating inappropriate content.

Regulatory or Policy Developments Affecting the Security Industry

The early release of Ilya Lichtenstein, convicted for the Bitfinex cryptocurrency exchange hack, under the US First Step Act, was reported.

Cybersecurity Brief – 2026-01-03

Sat, 03 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Covenant Health confirmed a data breach impacting nearly 478,000 individuals, with attribution to the Qilin ransomware group. Data was stolen from systems in May 2025.
Ongoing cryptocurrency thefts have been traced to the 2022 LastPass breach, with attackers draining wallets years after the theft of encrypted vaults.
Trust Wallet reported that approximately $8.5 million was stolen from over 2,500 crypto wallets, likely linked to the “Shai-Hulud” NPM supply chain attack in November, described as an industry-wide compromise.

Newly Discovered Vulnerabilities

Over 10,000 Fortinet firewalls remain exposed to a five-year-old two-factor authentication (2FA) bypass vulnerability that is actively being exploited.
The Kimwolf botnet is exploiting an undisclosed vulnerability that has been under attack for several months, with Internet-wide security advisories issued.
The RondoDox botnet is exploiting the React2Shell vulnerability to compromise vulnerable Next.js servers, with a campaign noted in December.
Thousands of requests have targeted a dozen vulnerabilities in Adobe ColdFusion servers in a coordinated campaign observed by GreyNoise during the Christmas 2025 holiday.

Notable Threat Actor Activity

Transparent Tribe has launched a new wave of remote access trojan (RAT) attacks targeting Indian government, academic, and strategic entities.
The Qilin ransomware group was responsible for the data theft from Covenant Health.
Two US cybersecurity professionals pleaded guilty to acting as affiliates of the BlackCat/Alphv ransomware group, participating in ransomware attacks.
Cybercriminals are abusing Google Cloud Application Integration to send multi-stage phishing emails that impersonate legitimate Google-generated messages.

Trends, Tools, or Tactics of Interest

AI-driven threats are predicted to rise, with a growing shift in the industry focus from prevention to resilience and an emphasis on advanced security measures.
Attack Surface Management (ASM) tools are generating large volumes of asset inventory data and alerts, raising concerns about actionable ROI.
AI technologies made scams more convincing throughout 2025, with rapid advancements leading to systems that can evade meaningful human oversight.
Protest surveillance tactics are shifting from cooperation to antagonism and political marketing, affecting privacy and civil liberties.

Regulatory or Policy Developments Affecting the Security Industry

CTOs and industry experts are prioritising the formal governance of AI and quantum technologies, as well as enhancements in supply chain and managed cloud provider (MCP) security, for 2026.

Cybersecurity Brief – 2026-01-02

Fri, 02 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Researchers have disclosed a persistent nine-month campaign by the RondoDox botnet, which has hijacked IoT devices and web applications by exploiting a critical vulnerability (React2Shell). Compromised devices are being enrolled into the botnet for further malicious activity.
A new wave of the GlassWorm malware campaign is targeting macOS developers. Attackers are distributing trojanized crypto wallet applications via malicious VSCode/OpenVSX extensions.

Newly Discovered Vulnerabilities

The React2Shell vulnerability has been identified as a critical flaw actively exploited by the RondoDox botnet to compromise IoT devices and web servers.

Notable Threat Actor Activity

The RondoDox botnet operators have been attributed to a sustained campaign targeting IoT and web infrastructure, leveraging the React2Shell vulnerability for botnet expansion.
GlassWorm threat actors are focusing on macOS environments, specifically targeting developers with supply chain attacks through compromised development tools and extensions.

Trends, Tools, or Tactics of Interest

There is an observable trend of threat actors leveraging supply chain attacks against developer ecosystems, particularly through malicious extensions for widely used tools such as VSCode and OpenVSX.
Botnet operators are increasingly exploiting vulnerabilities in IoT devices and web applications to expand their infrastructure and capabilities.
Attackers are using trojanized crypto wallet applications to target users in the cryptocurrency sector, with a focus on macOS platforms.

Cybersecurity Brief – 2026-01-01

Thu, 01 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Trust Wallet Chrome Extension Hack: Trust Wallet disclosed that a supply chain attack involving the Shai-Hulud worm in November 2025 compromised its Chrome extension, resulting in the theft of $8.5 million from 2,520 wallets. The attacker exploited exposed developer GitHub secrets to publish a backdoored browser extension.
Unleash Protocol Hack: The decentralized intellectual property platform Unleash Protocol suffered a loss of approximately $3.9 million in cryptocurrency after an unauthorized contract upgrade enabled asset withdrawals, attributed to a multisig hijack.
European Space Agency Breach: The European Space Agency confirmed that external science servers were compromised and that a hacker is offering to sell stolen data. An investigation is ongoing.
DarkSpectre Browser Extension Campaigns: The threat actor behind previous ShadyPanda and GhostPoster campaigns has been attributed to a third campaign, DarkSpectre, impacting 2.2 million users. In total, the campaigns have affected 8.8 million users worldwide.
Ivanti EPMM Attacks: April/May zero-day exploitations of Ivanti’s mobile device management platform resulted in the compromise of thousands of organisations by a Chinese APT.

Newly Discovered Vulnerabilities

IBM API Connect: IBM disclosed a critical authentication bypass vulnerability (CVE-2025-13915, CVSS 9.8) in API Connect that could allow remote attackers to access applications. Customers have been urged to patch immediately.
React2Shell Flaw in Next.js: The RondoDox botnet is actively exploiting the critical React2Shell vulnerability (CVE-2025-55182) to breach Next.js servers, deploying malware and cryptominers.

Notable Threat Actor Activity

North Korean Fraudulent Job Applicants: Amazon reported blocking more than 1,800 suspected North Korean job applicants since April 2024, indicating ongoing attempts by North Korean actors to infiltrate Western technology companies.
Shai-Hulud Worm Activity: Researchers have identified a new, modified strain of the Shai-Hulud worm on the npm registry, showing continued evolution and testing of payloads following the Trust Wallet supply chain attack.
RondoDox Botnet: Actively exploiting the React2Shell vulnerability to compromise Next.js servers.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks on Browser Extensions: The Shai-Hulud campaign demonstrates continued targeting of browser extension supply chains, leveraging compromised developer credentials to distribute malicious updates.
Malicious Browser Extensions: Large-scale campaigns such as DarkSpectre, ShadyPanda, and GhostPoster highlight the persistent threat from malicious browser extensions, impacting millions of users globally.
Cryptocurrency Platform Targeting: Both Trust Wallet and Unleash Protocol incidents reflect ongoing targeting of cryptocurrency platforms through supply chain and contract manipulation attacks.
IoT and Cloud Reliance: Reports discuss the risks associated with IoT device dependence on cloud services, with outages causing widespread disruption to connected devices.
AI and Identity Security: Industry predictions for 2026 note increased adoption of agentic AI, expansion of identity governance and administration (IGA) in the mid-market, SOC-identity team collaboration, and identity platform consolidation. Growing skepticism about AI’s ROI and economic sustainability is also noted.

Regulatory or Policy Developments

Disney COPPA Settlement: Disney agreed to pay a $10 million civil penalty to settle claims of violating the Children’s Online Privacy Protection Act (COPPA) by mislabeling videos and allowing targeted advertising data collection on YouTube.
Age Verification Laws: Enforcement of age checks in 2025 led to widespread internet access issues, with some websites blocking entire countries and users increasingly turning to VPNs to bypass restrictions.
Device Bans at Public Events: The NYC mayoral inauguration explicitly banned Flipper Zero and Raspberry Pi devices, reflecting growing concerns about the use of hacking tools at high-profile events.

Cybersecurity Brief – 2025-11-18

Tue, 18 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Eurofiber France disclosed a data breach after hackers exploited a vulnerability in its ticket management system, resulting in exfiltration of customer information. The breach was discovered after the attacker attempted to sell the data.
Princeton University reported a data breach on 10 November 2025, exposing personal information of alumni, donors, faculty, and students.
DoorDash confirmed a data breach involving compromise of names, addresses, email addresses, and phone numbers after an employee was targeted in a social engineering attack.
The Pennsylvania Attorney General’s office confirmed a data breach following an August 2025 ransomware attack by the INC Ransom group, with personal and medical information stolen.
Logitech confirmed a data breach after being listed by the Cl0p ransomware group. The incident is linked to the Oracle E-Business Suite exploitation.
Dutch police seized approximately 250 servers used by a bulletproof hosting service that provided infrastructure for cybercriminals.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two vulnerabilities, including CVE-2025-xxxx, a V8 zero-day flaw under active exploitation, reportedly by a commercial spyware vendor.
A critical remote code execution vulnerability in Fortinet FortiWeb WAF is being actively exploited in the wild, allowing unauthenticated attackers to execute administrative commands.
The RondoDox botnet is exploiting CVE-2025-24893, a critical RCE vulnerability in XWiki Platform. Widespread exploitation has been observed, including by botnets, crypto miners, and custom tools.
Seven malicious npm packages are abusing the Adspect cloud-based service to redirect researchers while leading victims to malicious payloads.
A vulnerability in DoorDash’s email systems allowed attackers to send spoofed, official-looking emails from DoorDash servers, creating a significant phishing risk. DoorDash has since patched the issue.
Researchers identified a security weakness in the AI-powered coding tool Cursor, enabling credential-stealing attacks via a malicious MCP server hijacking the internal browser.

Notable Threat Actor Activity

The Dragon Breath threat actor is using a multi-stage loader (RONINGLOADER) to disable security tools and deploy a modified Gh0st RAT in recent campaigns.
Iranian state-sponsored APTs are targeting defense and government officials, including their family members, in ongoing campaigns to increase pressure on primary targets.
The Aisuru botnet launched a 15.72 Tbps DDoS attack against Microsoft Azure, leveraging over 500,000 IP addresses.
The EVALUSION ClickFix campaign is deploying Amatera Stealer and NetSupport RAT via social engineering techniques.
Cl0p ransomware group continues to exploit Oracle E-Business Suite (CVE-2025-61882), with associated data breaches including Logitech.
Scammers are sending fake copyright violation messages to steal X (formerly Twitter) logins.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly shifting to non-email channels, with LinkedIn and other platforms now accounting for 1 in 3 phishing incidents.
ClickFix social engineering tactics are being widely adopted in malware distribution campaigns.
Malicious packages in open-source repositories such as npm are using cloud-based redirectors to evade detection and target victims.
Bulletproof hosting services remain a critical enabler for cybercriminal infrastructure, as evidenced by recent law enforcement action in the Netherlands.
Attackers are leveraging vulnerabilities in widely used platforms (e.g., XWiki, FortiWeb, Oracle E-Business Suite) for large-scale exploitation.
DDoS attacks are increasing in scale and sophistication, as demonstrated by the recent record-setting attack on Microsoft Azure.

Regulatory or Policy Developments Affecting the Security Industry

In the US, five individuals pleaded guilty to assisting North Korean IT workers in obtaining employment at US companies by providing false identities and remote access to company laptops, highlighting ongoing law enforcement efforts against supply chain and insider threats.
Microsoft released an out-of-band Windows 10 update (KB5072653) to address issues with installing Extended Security Updates, ensuring continued compliance for organizations relying on legacy systems.

Cybersecurity Brief – 2025-11-16

Sun, 16 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover reported that the financial impact of a recent cyberattack reached £196 million ($220 million) for the July–September quarter.

Newly Discovered Vulnerabilities

FortiWeb CVE-2025-64446: Exploit attempts for this vulnerability have been detected in honeypots, indicating active targeting in the wild.
XWiki Critical Flaw: The RondoDox botnet is exploiting an unpatched critical vulnerability in XWiki instances, enabling arbitrary code execution and expanding its botnet footprint.

Notable Threat Actor Activity

RondoDox Botnet: Actively targeting unpatched XWiki servers to compromise additional devices through a critical security flaw.
ClickFix Malware: Threat actors are abusing the legacy “finger” protocol (finger.exe) to retrieve and execute remote commands on Windows devices.
North Korean IT Worker Operations: Five individuals in the U.S. pleaded guilty to facilitating North Korean IT workers’ infiltration of 136 companies, supporting illicit revenue generation and evasion of sanctions.
Chinese Hacking Contractor Leak: A significant leak has exposed tools and targeting information linked to a Chinese hacking contractor, providing insight into their operations and capabilities.

Trends, Tools, or Tactics of Interest

Revival of Legacy Protocols: The “finger” protocol, long considered obsolete, is being repurposed by malware such as ClickFix for command and control on modern Windows systems.
Botnet Expansion via Open Source Platforms: RondoDox’s focus on XWiki highlights ongoing botnet campaigns leveraging unpatched open-source software.

Regulatory or Policy Developments Affecting the Security Industry

U.S. Department of Justice Enforcement: The prosecution and guilty pleas of five U.S. individuals involved in supporting North Korean cyber operations underscore continued law enforcement focus on countering nation-state cybercrime and sanctions evasion.

Other Noteworthy Developments

Microsoft Windows 10 ESU Update Issue: Microsoft is investigating installation failures (error 0x800f0922) affecting the KB5068781 Extended Security Update on devices with corporate licensing.

Cybersecurity Brief – 2025-10-14

Tue, 14 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SimonMed Imaging disclosed a data breach impacting over 1.2 million individuals, attributed to the Medusa ransomware group, which claims to have exfiltrated 200GB of sensitive data.
Harvard University is investigating a breach potentially linked to exploitation of an Oracle E-Business Suite zero-day vulnerability, with the Clop ransomware group listing the institution on its leak site.
An extortion group has leaked millions of records allegedly obtained via Salesforce hacks, affecting organizations including Albertsons, Engie Resources, Fujifilm, GAP, Qantas, and Vietnam Airlines.
Unity’s SpeedTree website suffered a supply chain attack, with malicious code skimming customer information from hundreds of users.
A large-scale botnet is targeting Remote Desktop Protocol (RDP) services in the US, leveraging more than 100,000 IP addresses.
Over 100 SonicWall SSL VPN accounts across more than a dozen entities were compromised in a widespread campaign using stolen credentials.
Microsoft 365 experienced an outage impacting customer access to applications.

Newly Discovered Vulnerabilities

Oracle released an emergency security patch for a new remotely exploitable E-Business Suite (EBS) vulnerability. The flaw allows unauthenticated access to sensitive data and is linked to active exploitation.
Microsoft has restricted Internet Explorer (IE) mode in Edge after reports of zero-day attacks abusing the Chakra JavaScript engine, with attackers leveraging the legacy feature as a backdoor.
Multiple malicious packages were discovered in npm, PyPI, and RubyGems ecosystems, exfiltrating developer data to Discord channels used as C2 infrastructure.
Researchers identified a possible XSS vulnerability in the ESAFENET CDG electronic document security management system, adding to a series of previously reported flaws.
The RondoDox botnet is actively exploiting over 50 vulnerabilities across more than 30 vendors in ongoing malware campaigns.
Unmonitored JavaScript on websites is highlighted as a significant risk, allowing attackers to steal payment data undetected by WAF and IDS solutions.

Notable Threat Actor Activity

TA585, a previously undocumented threat actor, has been observed distributing MonsterV2 malware via phishing campaigns.
The RondoDox botnet has expanded its exploitation operations, targeting a wide range of vulnerabilities across multiple vendors.
Threat actors used automation to create and distribute over 175 malicious npm packages targeting more than 135 industrial and electronics organizations.
The Medusa ransomware group claimed responsibility for the SimonMed Imaging breach.
The Clop ransomware gang is suspected in the Harvard University breach via Oracle EBS zero-day.
Spanish authorities dismantled the GXC Team crime-as-a-service operation, arresting its administrator “GoogleXcoder,” who provided phishing kits and Android malware.
Researchers broke recently released OpenAI guardrails designed to protect its AI models, demonstrating ongoing challenges in AI security.
Extortion groups continue to leak data obtained from Salesforce compromises, affecting multiple major organizations.

Trends, Tools, or Tactics of Interest

There is a significant surge in SMS phishing (smishing) scams targeting individuals aged 18-29 in the US.
Job-related scams increased by over 1000% between May and July 2025.
Deepfakes are increasingly used in social engineering attacks against organizations and individuals.
AI-generated phishing and social engineering attacks are outpacing traditional email defenses; new solutions such as Varonis Interceptor leverage multimodal AI to detect advanced threats.
Cybercriminals are abusing Discord as a C2 channel for exfiltrating data from compromised developer environments.
Large-scale RDP brute-force attacks are being conducted by botnets leveraging vast distributed infrastructures.
Unmonitored “back-office” data in critical infrastructure organizations is an increasing target for nation-state actors.
Satellite communications are leaking unencrypted sensitive data, including calls, texts, and military communications, accessible with basic hardware.
Scams exploiting government programs, such as New York’s inflation refund, are being distributed via phishing SMS campaigns.
Generation AI: The rise of AI in security is reducing entry-level opportunities for graduates, shifting the skills landscape in the industry.

Regulatory or Policy Developments Affecting the Security Industry

JPMorgan announced plans to invest up to $10 billion in US companies with critical ties to national security, focusing on artificial intelligence, cybersecurity, and quantum computing.
Financial and other industries are being urged to prepare for the eventual impact of quantum computers on public-key cryptography, with a timeline for potential threat estimated at one to two decades.

Cybersecurity Brief – 2025-10-12

Sun, 12 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall SSL VPN devices: Huntress reported a widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into over 100 customer environments to access internal systems.
Gladinet CentreStack and TrioFox: Active exploitation of a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox products has been observed, allowing unauthenticated local file access and potential escalation to remote code execution. The flaw remains unpatched.
BreachForums Takedown: The FBI seized all domains of the BreachForums hacking forum operated by the ShinyHunters group, which was used for leaking data from ransomware and extortion attacks, including recent Salesforce-related incidents.
AI Companion Apps Data Leak: Two AI “girlfriend” apps exposed millions of private chat logs belonging to over 400,000 users.
Oracle EBS Zero-Day Attacks: Sophisticated malware was deployed in attacks exploiting a zero-day in Oracle E-Business Suite (EBS), affecting dozens of organizations since at least 10 July.
Discord Age-Verification Data Exposure: A hack exposed sensitive age-verification data of Discord users.
Manufacturing Sector Ransomware: Reports highlight continued ransomware attacks targeting the manufacturing industry, with attackers exploiting unpatched vulnerabilities.
US Universities Payroll Attacks: US universities were targeted by attackers hijacking HR SaaS accounts to divert payroll payments, attributed to the Storm-2657 threat actor.

Newly Discovered Vulnerabilities

Juniper Networks Junos Space: More than 200 vulnerabilities, including nine critical-severity flaws, were patched in Junos Space and Junos Space Security Director.
Ivanti Endpoint Manager: The Zero Day Initiative (ZDI) disclosed 13 unpatched vulnerabilities in Ivanti Endpoint Manager, enabling remote code execution and privilege escalation.
GoAnywhere MFT (CVE-2025-10035): Fortra detailed active exploitation of this critical flaw in GoAnywhere Managed File Transfer, which has since been patched.
Node.js SEA Feature Abuse: The Stealit malware campaign uses Node.js’ Single Executable Application feature to distribute payloads via trojanized game and VPN installers.
Malicious npm Packages: 175 malicious npm packages with over 26,000 downloads were found harvesting credentials as part of a phishing campaign.

Notable Threat Actor Activity

North Korean IT Worker Schemes: North Korean threat actors have expanded fraudulent remote employment operations to target a broad range of industries, including architectural design, using fake identities and documentation.
LockBit/Storm-2603: The LockBit ransomware group (Storm-2603) has been observed abusing the Velociraptor DFIR tool to maintain persistence and facilitate attacks.
Storm-2657: This actor is actively hijacking HR SaaS accounts to redirect payroll payments, targeting a variety of organizations, including universities.
Coordinated Attacks on Network Devices: Infrastructure linked to coordinated attacks is being used to exploit vulnerabilities in Cisco, Fortinet, and Palo Alto Networks devices.
RondoDox Botnet: The RondoDox botnet employs over 50 exploits in a “shotgun” approach to compromise routers, DVRs, NVRs, CCTV systems, and other edge devices globally.
Aisuru DDoS Botnet: The Aisuru botnet is responsible for record-setting DDoS attacks against US ISPs, leveraging large numbers of compromised IoT devices.

Trends, Tools, or Tactics of Interest

Abuse of Legitimate Tools: Increased weaponization of legitimate digital forensics and incident response tools (e.g., Velociraptor) by ransomware groups for persistence and post-exploitation.
AI and Deepfake Threats: OpenAI’s new video and audio generation system raises concerns about the proliferation of deepfakes. Organizations report high awareness but insufficient investment in deepfake detection capabilities.
AI in Security Operations: Advancements in AI-powered Security Operations Center (SOC) platforms, with Microsoft introducing agentic AI capabilities in Sentinel, and the emergence of AI browser agents presenting new authentication challenges.
Supply Chain Risks: Discovery of malicious packages in npm and abuse of Node.js SEA highlight ongoing supply chain threats to software development environments.
Password Guidance: NIST updates suggest a shift away from overly complex password requirements, focusing on usability and security balance.

Regulatory or Policy Developments Affecting the Security Industry

Apple Bug Bounty Expansion: Apple has doubled its maximum bug bounty payout to $2 million for zero-click RCE vulnerabilities, introduced new research categories, and increased transparency in its rewards structure. Total payouts have reached $35 million, with bonuses for iPhone exploits potentially raising rewards to $5 million.
Windows 11 23H2 End of Support: Microsoft reminded users that Home and Pro editions of Windows 11 23H2 will stop receiving security updates next month.
Chrome Notification Permissions: Google Chrome will automatically revoke notification permissions for inactive websites to reduce notification spam.
Age-Verification Law Privacy Concerns: Apple raised privacy concerns regarding proposed age-verification laws, citing risks associated with increased sensitive data collection.

Cybersecurity Brief – 2025-10-11

Sat, 11 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has seized all domains associated with BreachForums, operated by the ShinyHunters group, which was used as a portal for leaking corporate data obtained through ransomware and extortion attacks, including recent Salesforce-related incidents. Despite the takedown, ShinyHunters continues to issue extortion threats against Salesforce victims.
Two AI companion applications exposed millions of private chat records from over 400,000 users due to inadequate security controls.
A critical zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox file sharing products is being actively exploited in the wild, allowing unauthenticated local attackers to access system files.
Sophisticated malware has been deployed in Oracle E-Business Suite (EBS) zero-day attacks, with exploitation believed to have started as early as July 10 and affecting dozens of organizations.
A large-scale DDoS attack was launched by the Aisuru botnet, leveraging compromised IoT devices hosted on major US ISPs.
Microsoft has observed a threat actor, Storm-2657, hijacking HR SaaS accounts to divert employee salary payments to attacker-controlled accounts; US universities have been specifically targeted in these payroll diversion attacks.

Newly Discovered Vulnerabilities

Fortra disclosed details of active exploitation of CVE-2025-10035, a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
13 unpatched vulnerabilities in Ivanti Endpoint Manager have been publicly released by the Zero Day Initiative (ZDI), permitting remote code execution and privilege escalation.
Juniper Networks released patches for over 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
175 malicious npm packages, collectively downloaded over 26,000 times, have been used in a credential phishing campaign.
Security researchers have detailed an active Stealit malware campaign abusing the Node.js Single Executable Application (SEA) feature, distributed via game and VPN installers.

Notable Threat Actor Activity

North Korean threat actors have expanded their fraudulent remote employment schemes to target nearly every industry hiring remote workers, including architectural design roles, using fake identities and documentation.
Chinese APT group Storm-2603 is abusing the Velociraptor digital forensics and incident response (DFIR) tool to gain persistent access to victim networks and facilitate ransomware deployment.
A coordinated campaign has been identified targeting Cisco, Fortinet, and Palo Alto Networks devices, with attacks originating from shared infrastructure.
The RondoDox botnet employs a “shotgun” approach, using more than 50 exploits against unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices globally.

Trends, Tools, or Tactics of Interest

AI-generated deepfakes are proliferating, with OpenAI releasing an updated AI video and audio generation system, raising concerns about the acceleration and accessibility of deepfake creation.
The security industry is experiencing inadequate investment in deepfake detection, despite high organizational awareness and frequent encounters with AI-augmented threats.
Security Operations Centres (SOCs) are increasingly integrating AI-powered agents, with projections indicating significant transformation in SOC workflows by 2026.
Microsoft has added agentic AI capabilities to its Sentinel platform, previewing new security graph and MCP server features.
Attackers are leveraging malicious npm packages and abusing legitimate software features (e.g., Node.js SEA) to distribute malware and harvest credentials.
1Password addressed a critical security gap in its AI browser agent, which posed risks of credential leakage.
Timely patch management is highlighted as a key defense against escalating ransomware attacks on manufacturing and industrial control system (ICS) environments.

Regulatory or Policy Developments Affecting the Security Industry

Apple has expanded its bug bounty program, doubling the maximum payout to $2 million for zero-click remote code execution vulnerabilities, with potential bonuses raising the maximum to $5 million. The program now includes new research categories and a more transparent reward structure.
Microsoft reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 30 days, after which security updates will cease.
Google Chrome will automatically revoke notification permissions for inactive websites to reduce user alert fatigue.
Apple voiced concerns over proposed age-verification laws, warning that increased data collection for compliance could heighten user privacy risks.
NIST is revising password guidance, indicating that excessively complex password requirements may no longer be necessary.

Cybersecurity Brief – 2025-10-10

Fri, 10 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall Cloud Backup Breach: SonicWall confirmed that all customers using its cloud backup service had their firewall configuration backup files accessed by an unauthorized party. The files included encrypted credentials and other sensitive configuration data.
Oracle E-Business Suite Exploitation: A zero-day vulnerability in Oracle’s E-Business Suite has been exploited since August 2025 by threat actors linked to the CL0P ransomware group, impacting dozens of organizations.
Discord Data Breach: Discord disclosed that 70,000 users had government-issued IDs exposed in a recent data breach, with attackers claiming theft of over 2 million ID photos submitted for age verification.
Law Firm Williams & Connolly Breach: Chinese threat actors exploited a zero-day vulnerability to breach the US law firm Williams & Connolly. The firm reports no evidence of client data theft.
Microsoft Azure Outage: An outage affecting Azure Front Door CDN disrupted access to Microsoft 365 services and admin portals.
University Payroll Hijacking: The cybercrime group Storm-2657 has been targeting US university HR employees since March 2025 in “payroll pirate” attacks, rerouting salary payments.
Fake Android Apps and Banking Trojan: Malware campaigns using fake VPN and streaming apps (e.g., Mobdro Pro IP TV + VPN) are distributing the Klopatra Android trojan, which steals banking credentials.

Newly Discovered Vulnerabilities

Oracle EBS Zero-Day: Actively exploited by CL0P-linked actors, affecting Oracle E-Business Suite installations.
GitHub Copilot Chat Flaw: A vulnerability in GitHub Copilot Chat allowed hidden comments to manipulate responses and leak sensitive information, including data from private repositories.
HTTP/1.1 Desync Attacks: New HTTP desynchronisation techniques targeting HTTP/1.1 were demonstrated, exposing critical web infrastructure to novel attack vectors.
RondoDox Botnet Targeting N-Day Flaws: The RondoDox botnet is exploiting 56 known vulnerabilities across more than 30 device types, including those disclosed at Pwn2Own competitions.

Notable Threat Actor Activity

CL0P Ransomware Group: Exploiting Oracle EBS zero-day to breach multiple organizations.
UTA0388 (China-Aligned): Conducting spear-phishing campaigns across North America, Asia, and Europe, deploying a Go-based malware implant known as GOVERSHELL.
Storm-2657: Targeting US university payroll systems to hijack salary payments.
Russian Threat Actors: Increasing use of AI to enhance phishing and malware campaigns against Ukrainian targets.
Pro-Russian Hacktivist Group TwoNet: Shifting from DDoS to targeting critical infrastructure, including decoy industrial plants.
Android Spyware Campaigns: ClayRat spyware is distributed via fake WhatsApp, TikTok, Google Photos, and YouTube apps, primarily targeting Russian users via phishing sites and Telegram channels.
Ransomware Actors Using Velociraptor: LockBit and Babuk ransomware operators are leveraging the Velociraptor DFIR tool for post-exploitation and lateral movement.

Trends, Tools, or Tactics of Interest

Surge in Vishing: Voice-based phishing (vishing) incidents are increasing, highlighting the need for robust human risk management.
Multitasking and Phishing: Employees who multitask are more susceptible to phishing attacks, according to recent academic research.
SaaS Token Theft: OAuth and API token theft is a leading cause of SaaS breaches, with attackers exploiting poor token hygiene.
AI in Cyber Attacks: Russian actors are leveraging AI for more effective phishing and malware delivery.
Velociraptor in Ransomware: Increased use of legitimate DFIR tools like Velociraptor by ransomware operators for stealth and persistence.
Chaos Ransomware Evolution: The Chaos ransomware-as-a-service has introduced a new C++ variant with enhanced encryption, wiper, and cryptocurrency-stealing capabilities.
Risks with AI Notetakers: Security and compliance risks are emerging as AI-powered transcription tools become common in online meetings.
Exfiltration via AI Coding Assistants: Proof-of-concept attacks demonstrate data exfiltration from GitHub Copilot using hidden prompts (“CamoLeak”).
PureRAT Campaign Evolution: Attackers are escalating from simple infostealers to deploying full-featured remote access trojans with advanced evasion and secure C2 channels.

Regulatory or Policy Developments Affecting the Security Industry

California Privacy and AI Laws: California enacted 14 new privacy and AI-related laws, granting users greater control over personal data and setting new standards for data handling and AI transparency.
Microsoft Defender False Positive: Microsoft is addressing an issue where Defender for Endpoint incorrectly flags SQL Server as end-of-life, potentially affecting compliance and patch management processes.
Apple App Store Enforcement: Apple removed ICE-tracking apps from the App Store, raising questions about platform policy and developer recourse.

Cybersecurity Brief – 2025-07-09

Wed, 09 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

M&S confirmed a significant ransomware attack by DragonForce, initiated via a sophisticated social engineering/impersonation attack.
Qantas experienced a data breach resulting in an extortion demand after customer data was stolen from a contact centre.
South Korean telecommunications provider SK Telecom suffered a breach exposing 27 million records; the government imposed a monetary penalty and new regulatory requirements.
Over 17,000 fake news websites were uncovered globally as part of a large-scale investment fraud campaign (“BaitTrap”).
More than 1.7 million installations of malicious Chrome extensions were identified, capable of tracking users, stealing browser activity, and redirecting to unsafe sites.
The Anatsa Android banking trojan was distributed via a fake PDF viewer app on Google Play, impacting over 90,000 users, primarily targeting US banks.
Russian organisations were targeted by a new Windows spyware dubbed Batavia, used in ongoing espionage campaigns.
A supply chain attack compromised the Ethcode Visual Studio Code extension, exposing over 6,000 developers to malicious pull requests.
The RondoDox botnet exploited vulnerabilities in TBK DVRs and Four-Faith routers to conscript devices for DDoS attacks.

Newly Discovered Vulnerabilities

Microsoft’s July 2025 Patch Tuesday addressed 130–137 vulnerabilities, including a publicly disclosed zero-day in SQL Server. Seventeen bugs are considered high risk, including multiple remote code execution vulnerabilities in Office and SharePoint.
Adobe released patches for critical code execution vulnerabilities affecting several products, including After Effects, Audition, Illustrator, and others.
SAP patched critical insecure deserialization vulnerabilities in NetWeaver, which could allow remote code execution and full system takeover.
Technical details and exploit code for CitrixBleed2 (CVE-2025-5777) in Citrix NetScaler have been released, increasing the risk of exploitation.
A new Android “TapTrap” attack was disclosed, using invisible UI tricks to bypass permission systems and trick users into granting sensitive access.

Notable Threat Actor Activity

Threat actors repurposed the legitimate Shellter red teaming tool to distribute Lumma Stealer, SectopRAT, Arechclient2, and Rhadamanthys malware, leveraging its AV/EDR evasion features.
A suspected Chinese state-sponsored hacker linked to Silk Typhoon (Hafnium) was arrested in Milan, facing charges including wire fraud and unauthorized computer access.
Russian organisations faced an ongoing campaign involving the newly identified Batavia Windows spyware.
A large-scale operation using Baiting News Sites (BNS) was uncovered, leveraging fake news for investment fraud.
RondoDox botnet activity increased, exploiting IoT device vulnerabilities for DDoS.

Trends, Tools, or Tactics of Interest

Malicious open source packages increased by 188% year-over-year, with data exfiltration as the most common malware function.
Threat actors continue to exploit legitimate security and pen-testing tools (e.g., Shellter) for malware delivery and AV/EDR evasion.
Supply chain attacks targeting development environments (e.g., VS Code extensions) remain a significant threat vector.
Identity-based attacks in the retail sector are exploiting overprivileged admin roles and neglected vendor tokens.
Agentic AI is emerging as a growing attack surface, with increased risk from invisible threats and novel vectors.
Human risk management and measurement in security awareness programs remain a focus area for evaluating organisational resilience.

Regulatory or Policy Developments Affecting the Security Industry

South Korea imposed regulatory requirements on SK Telecom following a major data breach, in addition to a monetary penalty.
SSL/TLS certificate lifespan reduction to 47 days by 2029 is prompting organisations to prepare for operational changes in certificate management.
Samsung announced major security and privacy enhancements for its upcoming One UI 8 release on Galaxy smartphones.
Microsoft clarified options for extended Windows 10 security updates through October 2026, including free alternatives with certain conditions.