Scattered LAPSUS$ Hunters on DanSec Daily

Cybersecurity Brief – 2026-02-26

Thu, 26 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Google, Mandiant, and partners disrupted a global espionage campaign by suspected China-nexus threat actor UNC2814, which breached at least 53 organizations across 42 countries, including telecom firms and government agencies. The campaign leveraged SaaS API calls to conceal malicious traffic.
UFP Technologies, a US-based medical device manufacturer, disclosed a cyberattack involving data theft and file-encrypting ransomware.
CarGurus suffered a data breach impacting over 12 million users, with hackers claiming theft of personally identifiable information and internal corporate data.
Wynn Resorts confirmed a data breach in which the ShinyHunters group exfiltrated employee data.
Marquis Software Solutions filed a lawsuit against SonicWall, alleging gross negligence and misrepresentation after a backup breach led to a ransomware attack.

Newly Discovered Vulnerabilities

Cisco disclosed CVE-2026-20127, a critical authentication bypass vulnerability in Catalyst SD-WAN Controller and Manager, actively exploited in the wild since 2023. The flaw allows remote attackers to gain administrative access.
Anthropic’s Claude Code AI-powered coding assistant was found to have multiple vulnerabilities (including CVE-2025-59536 and CVE-2026-21852) enabling remote code execution and API key exfiltration via project files.
Four malicious NuGet packages targeting ASP.NET developers were discovered, designed to steal sensitive data through supply chain compromise.
Zyxel released patches for a critical remote code execution vulnerability affecting over a dozen router models, which could allow unauthenticated attackers to execute commands remotely.
SolarWinds patched four critical vulnerabilities in its Serv-U product; exploitation would require administrative privileges.

Notable Threat Actor Activity

Scattered LAPSUS$ Hunters (SLH) cybercrime group was observed offering $500–$1,000 per call to recruit women for IT help desk vishing attacks, focusing on social engineering.
North Korean threat actors were linked to a campaign using malicious Next.js repositories and fake job interviews to backdoor developers’ devices and establish persistent access.
A former L3Harris (US defense contractor) employee was sentenced to over seven years in prison for selling eight zero-day exploits to a Russian broker. The US Treasury also sanctioned the Russian broker involved in purchasing stolen exploits.
RAMP ransomware forum was seized, causing disruption and fragmentation within the ransomware ecosystem.
Chinese police were implicated in using ChatGPT for politically motivated influence operations targeting foreign officials.

Trends, Tools, or Tactics of Interest

Google’s latest GTIG AI Threat Tracker report highlights increasing adversarial use of AI, including distillation, experimentation, and integration of AI for malicious purposes.
Attackers are increasingly using telephone-oriented attack delivery (TOAD) emails, which contain only a phone number as payload, to bypass email security gateways.
The OpenClaw supply chain threat has generated significant discussion on dark web and Telegram channels, though current telemetry suggests more hype than widespread exploitation.
The PCI Security Standards Council reported that threats to payment systems are accelerating, requiring faster adaptation by the industry.
IBM X-Force reported that 56% of tracked vulnerabilities in 2025 required no authentication for exploitation, raising concerns about the weaponisation of agentic AI and the impact of stolen credentials.
A “Richter Scale” model has been introduced to rate the severity and effects of cybersecurity incidents in operational technology (OT) environments.
Drug cartels, such as Mexico’s CJNG, are adopting AI, drones, and social media for criminal operations.
Manual processes for sensitive data transfers remain prevalent in national security organizations, increasing risk exposure.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued an emergency directive requiring immediate action to secure Cisco SD-WAN systems affected by CVE-2026-20127.
Reddit was fined nearly $20 million by the UK data privacy watchdog for failures related to the protection of children’s personal information.

Cybersecurity Brief – 2026-02-17

Tue, 17 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Washington Hotel in Japan disclosed a ransomware attack that compromised its servers and exposed business data.
Eurail B.V. confirmed that data stolen in a breach earlier this year is now being sold on the dark web. The breach impacted traveler data for the European rail operator.
Dutch telecom provider Odido was hit by a data breach, as noted in Check Point’s weekly threat intelligence report.
Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea following data breaches linked to attacks on Salesforce instances by the Scattered LAPSUS$ Hunters group.

Newly Discovered Vulnerabilities

Google released emergency updates for Chrome, patching CVE-2026-2441, a high-severity vulnerability exploited in zero-day attacks. The flaw could allow arbitrary code execution and marks the first actively exploited Chrome zero-day patched in 2026.
CISA ordered US federal agencies to patch a vulnerability in BeyondTrust Remote Support within three days due to active exploitation.
A study identified 25 password recovery attack vectors in major cloud-based password managers, including Bitwarden, Dashlane, and LastPass, which could allow account compromise under certain conditions.

Notable Threat Actor Activity

The GS7 cyberthreat group (Operation DoppelBrand) is targeting US financial institutions by creating highly convincing fake corporate portals to steal credentials and gain remote access.
A new mobile spyware platform, ZeroDayRAT, is being advertised on Telegram, offering real-time surveillance and data theft capabilities.
Information-stealing malware has been observed targeting OpenClaw (formerly Clawdbot/Moltbot) AI agent configuration files, exfiltrating API keys, authentication tokens, and gateway credentials.
Attackers are leveraging the ClickFix attack technique, abusing DNS lookups (nslookup commands) to deliver the ModeloRAT remote access trojan to targeted systems.
A phishing campaign has been observed using fake incident reports as lures.

Trends, Tools, or Tactics of Interest

Over 260,000 Chrome users were deceived by 30 fake AI browser extensions posing as legitimate tools, indicating a continued trend in leveraging AI-themed lures for malware distribution.
The ClickFix campaign’s use of nslookup for RAT delivery highlights increased abuse of built-in system tools for malware deployment.
Infostealer malware is adapting to target secrets and configuration files associated with widely adopted AI agentic frameworks such as OpenClaw.
There is a growing focus on passwordless authentication and passkey adoption, with organisations seeking to maintain ISO/IEC 27001 compliance while moving away from traditional passwords.
Android 17 Beta introduces further secure-by-default features, strengthening privacy and app security controls.
Apple is testing end-to-end encryption for RCS messaging in the iOS 26.4 developer beta, expanding secure messaging capabilities.

Regulatory or Policy Developments

Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea for data breaches involving Salesforce, following regulatory action related to the Scattered LAPSUS$ Hunters attacks.
CISA is operating at 38% staff capacity due to the ongoing DHS shutdown, potentially impacting the agency’s ability to respond to cyber incidents.
Amazon’s Ring terminated its partnership with Flock Safety, a police surveillance technology company, following public backlash.
Lithuania is advancing national initiatives to address AI-driven cyber fraud, with the KTU Consortium outlining strategies for a safe and inclusive digital society.

Cybersecurity Brief – 2025-12-09

Tue, 09 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Tri-Century Eye Care suffered a data breach attributed to the Pear ransomware group, impacting approximately 200,000 individuals and resulting in the theft of over 3 TB of data.
The University of Pennsylvania and the University of California, San Diego were listed among recent victims in threat intelligence reporting, with details on the nature and impact of the incidents pending.
Malicious Visual Studio Code extensions were discovered in Microsoft’s Marketplace, delivering infostealer malware capable of taking screenshots, stealing credentials, and hijacking browser sessions.
Phishing campaigns are leveraging Cloudflare Pages to host fake banking login pages, with stolen credentials exfiltrated to attackers via Telegram.

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2025-xxxx) in the Sneeit Framework plugin for WordPress is being actively exploited in the wild.
The Apache Software Foundation issued an updated advisory for a max-severity vulnerability in Apache Tika after the initial patch was found incomplete. The flaw enables XML External Entity (XXE) injection attacks via crafted XFA files embedded in PDFs.
A critical vulnerability in React (CVE-2025-55182, “React2Shell”) is seeing increased exploitation activity by multiple threat actors following recent public disclosure.
The ICTBroadcast platform contains a vulnerability currently being exploited to facilitate Frost botnet attacks.

Notable Threat Actor Activity

The “Scattered Lapsus$ Hunters” cybercriminal group is conducting social engineering attacks targeting organizations’ Zendesk instances.
Ransomware gangs are increasingly using the Shanya EXE packer-as-a-service to obfuscate malware and conceal EDR (Endpoint Detection and Response) killer modules.
The Pear ransomware group claimed responsibility for the Tri-Century Eye Care data breach.
A new Mirai variant, “Broadside,” is targeting DVR systems in the maritime logistics sector, exploiting command injection flaws for device hijacking and lateral movement.
JS#SMUGGLER campaign is distributing the NetSupport RAT via compromised websites.
Polish authorities arrested three Ukrainian nationals accused of using advanced hacking equipment to attempt attacks on Polish IT systems and acquire sensitive data.
Android malware families FvncBot and SeedSnatcher, along with an upgraded version of ClayRat, have been identified with enhanced data theft capabilities.

Trends, Tools, or Tactics of Interest

Ransomware activity peaked in 2023, with FinCEN and US Treasury reporting over $2.1 billion extorted from 2022 to 2024, and total ransomware payments since 2013 surpassing $4.5 billion.
Ransomware operators are adopting packer-as-a-service solutions like Shanya to better evade detection by security tools.
Threat actors are exploiting VSCode extensions as a vector to compromise developer environments and exfiltrate sensitive data.
There is a rise in the use of compromised websites and free hosting services (e.g., Cloudflare Pages) for malware delivery and phishing operations.
AI and agentic AI systems are being targeted by attackers, prompting vendors to introduce new security layers to mitigate indirect prompt injection and other AI-specific threats.
Phishing tactics now include leveraging publicly available social media photos for virtual kidnapping scams.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome is implementing a new security architecture to protect Gemini-powered agentic AI browsing, including user alignment critics, expanded origin isolation, and mandatory user confirmations.
Financial Crimes Enforcement Network (FinCEN) and the US Treasury released updated data on ransomware payments, providing insight into the evolving threat landscape and the impact of recent law enforcement actions.

Cybersecurity Brief – 2025-11-27

Thu, 27 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Gainsight has expanded its list of impacted customers following a recent security alert from Salesforce, indicating the breach affected more customers than initially disclosed.
Multiple London councils, including the Royal Borough of Kensington and Chelsea and Westminster City Council, have experienced IT service disruptions due to a cyberattack.
Comcast will pay a $1.5 million fine after a vendor data breach in February 2024 exposed the personal information of nearly 275,000 customers.
Dartmouth College confirmed a data breach resulting from an Oracle hack, with over 226 GB of files stolen and leaked.
The OnSolve CodeRED emergency alert platform in the US was disrupted by a ransomware attack from the Inc Ransom group, resulting in operational impact and data breach.
Thousands of secrets, including credentials and private keys, were leaked by users of JSONFormatter and CodeBeautify code formatting platforms.
A major sportswear company was targeted by a high-volume phishing campaign between 29 and 30 October 2025, as detected by KnowBe4 analysts.

Newly Discovered Vulnerabilities

ASUS released firmware updates to address nine security vulnerabilities in AiCloud routers, including a critical authentication bypass flaw.
The ’node-forge’ JavaScript cryptography library patched a vulnerability that allowed attackers to bypass signature verification with specially crafted data.
A new malicious Chrome extension was discovered that injects hidden Solana transfer fees into Raydium swaps, diverting funds to attacker-controlled wallets.
Microsoft warned that FIDO2 security keys may prompt users for a PIN after recent Windows updates since September 2025.
Microsoft announced plans to secure Entra ID sign-ins from external script injection attacks, with implementation set for mid-to-late October 2026.

Notable Threat Actor Activity

The Shai-Hulud v2 supply chain attack has spread from npm to Maven, compromising over 830 npm packages and exposing thousands of secrets.
Qilin ransomware was deployed in a sophisticated supply chain attack targeting a South Korean managed service provider, resulting in data theft from 28 financial sector victims.
The RomCom threat group used SocGholish fake update attacks to deliver Mythic Agent malware to a US-based civil engineering company.
A new Mirai-based botnet, ShadowV2, has been observed exploiting known vulnerabilities in IoT devices from D-Link, TP-Link, and others, using the recent AWS outage as a test event.
Scammers are using fake LinkedIn job postings and video updates to distribute Flexible Ferret malware to Mac users, enabling multi-stage data theft and long-term access.
The “Scattered LAPSUS$ Hunters” group continued data theft and mass extortion campaigns against major corporations.
Cybercriminals have increasingly targeted financial institutions and individuals with account takeover fraud, causing $262 million in losses in 2025, according to the FBI.

Trends, Tools, or Tactics of Interest

NTLM relay and credential forwarding attacks continue to be exploited, with new vulnerabilities and abuse techniques identified in 2025.
The EMEA finance and banking sector faces escalating cybersecurity challenges, with increased targeting and advanced threats.
Advanced digital fraud attacks surged 180% in 2025, with generative AI used for creating deepfakes, synthetic IDs, and autonomous bots.
Attackers are integrating large language models (LLMs) into malware to evade detection and augment code in real time.
“Dark LLMs” are facilitating more competent attacks by low-level cybercriminals, though with limited technical sophistication.
Prompt injection vulnerabilities are a growing concern for agentic AI-enabled browsers, such as ChatGPT’s Atlas Browser.
Over half of surveyed enterprises are uncertain about their ability to secure non-human identities (NHIs), highlighting a gap in identity security controls.
Increased use of community-maintained tools (e.g., Chocolatey, Winget) for patching and updates presents both opportunities and risks for IT teams.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced a new Cyber Security and Resilience Bill, setting out enhanced requirements for critical infrastructure organisations.

Cybersecurity Brief – 2025-11-25

Tue, 25 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

SitusAMC, a major real-estate finance services provider, disclosed a data breach impacting customer data.
Harvard University reported a compromise of its Alumni Affairs and Development systems via a voice phishing attack, resulting in exposure of personal data of students, alumni, donors, and staff.
Delta Dental of Virginia suffered a breach affecting 146,000 individuals, with names, Social Security numbers, ID numbers, and health information stolen from a compromised email account.
Spanish airline Iberia notified customers of a data breach following claims of 77GB of stolen data.
Multiple organisations, including Canon, Cox, and Mazda, have been named as victims in the Oracle E-Business Suite (EBS) extortion campaign, with Cox confirming over 1.6 TB of data was stolen and Canon confirming subsidiary impact. Mazda reported no data leakage or operational impact.
Illegal streaming devices (e.g., Superbox, modded Amazon Fire TV Sticks) have been implicated in widespread scams, data theft, and integration into botnets.
Russian-linked threat actors are distributing StealC V2 infostealer malware via malicious Blender 3D model files uploaded to online marketplaces.
CISA issued a warning about active spyware campaigns targeting high-value Signal and WhatsApp users, leveraging commercial spyware and remote access trojans (RATs).

Newly Discovered Vulnerabilities

Five vulnerabilities have been identified in Fluent Bit, a widely used open-source telemetry agent, which can be chained to achieve remote code execution and stealthy intrusions into cloud infrastructure.
A critical flaw in Oracle Identity Manager (CVE-2025-61757) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities catalog.
New Chrome and Fortinet zero-day vulnerabilities were reported as being actively exploited.
Microsoft confirmed a critical bug in Windows 11 24H2 causing File Explorer and Start Menu crashes when provisioning systems with cumulative updates.
Issues with URL mapping and URL-based access control continue to present high-profile vulnerabilities, notably in Oracle Identity Manager.
The Ray framework, used in AI clusters, has an exploitable flaw being used to hijack infrastructure for cryptomining and data theft.

Notable Threat Actor Activity

A new wave of Shai-Hulud malware attacks is targeting the npm registry, infecting over 500 packages (including well-known names like Zapier and Postman) and leaking secrets on GitHub. The campaign now executes malicious code during the preinstall phase, increasing exposure risks in build and runtime environments.
Threat actors are exploiting Black Friday by distributing phishing emails, scams, and malware targeting online shoppers and gamers. They are also selling stolen data and compromised accounts on the dark web.
The “ClickFix” attack uses a fake Windows Update animation in browsers to trick users and deliver malware, with the payload hidden in image files.
Matrix Push C2 is abusing browser push notifications to deliver realistic phishing and malware alerts.
CrowdStrike terminated an insider who aided hackers in falsely claiming a system breach by sharing internal screenshots.
The “Scattered LAPSUS$ Hunters” group continues to be active, according to recent threat intelligence reporting.

Trends, Tools, or Tactics of Interest

Vision language models are being advanced for physical security applications, enhancing employee safety monitoring.
Amazon has deployed an Autonomous Threat Analysis system using specialised AI agents for automated bug detection and remediation.
Research shows that the Chinese DeepSeek-R1 AI model generates insecure code, particularly when prompted with topics related to Tibet or Uyghurs.
Microsoft highlighted security risks introduced by new agentic AI features, warning that AI agents could perform malicious actions without proper controls.
Increased use of cloud-native patching is being advocated due to limitations and deprecation of traditional tools (SCCM and WSUS) in hybrid work environments.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced the removal of Windows Internet Name Service (WINS) support from Windows Server releases starting November 2034.
CISA’s alert and addition of Oracle Identity Manager’s CVE-2025-61757 to the KEV catalog increases urgency for remediation across affected organisations.

Cybersecurity Brief – 2025-11-22

Sat, 22 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Salesforce Customers Breached via Gainsight Integrations: Threat actors affiliated with the ShinyHunters extortion group used third-party Gainsight applications to steal data from Salesforce instances, repeating tactics seen in previous attacks earlier in the year.
CrowdStrike Insider Incident: An insider at CrowdStrike leaked internal system screenshots to hackers, with the material subsequently appearing on Telegram via the Scattered Lapsus$ Hunters threat group.
Transport for London Breach: Two British teenagers, allegedly linked to the Scattered Spider group, pleaded not guilty to charges related to the August 2024 breach of Transport for London, which caused significant financial and data exposure impacts.
WEL Companies Data Breach: A data breach at WEL Companies affected 120,000 individuals.
Cloudflare Outage: A recent Cloudflare outage highlighted the widespread impact a failure at a major provider can have on the global digital economy.

Newly Discovered Vulnerabilities

Grafana SCIM Flaw (CVE-2025-41115): Grafana has patched a critical vulnerability in its Enterprise product that could allow privilege escalation or user impersonation under certain configurations. The flaw has a CVSS score of 10.0.
Oracle Identity Manager RCE (CVE-2025-61757): An unauthenticated remote code execution vulnerability in Oracle Identity Manager is being actively exploited in the wild. CISA has issued a warning to patch immediately.
SonicWall Firewall and Email Security Appliance: SonicWall released patches for high-severity vulnerabilities that could lead to denial-of-service, arbitrary code execution, or unauthorized file access.
LINE Messaging App Protocol Bugs: Vulnerabilities in the custom protocol used by the LINE messaging app allow for message replay, impersonation attacks, and exposure of sensitive information, potentially facilitating cyber espionage.

Notable Threat Actor Activity

APT24 (China Nexus): APT24 has been observed deploying a new malware family, BADAUDIO, as part of a multi-year espionage campaign targeting over 1,000 domains, including Taiwanese entities. The group used supply chain attacks to deliver the BadAudio downloader and subsequent payloads.
ToddyCat APT: Kaspersky identified new versions of ToddyCat APT tools (TomBerBil, TCSectorCopy, XstReader) being used to steal email data and access tokens from Microsoft Outlook in targeted corporate environments.
ShinyHunters: Continued targeting of Salesforce customers through exploitation of Gainsight integrations.
Scattered Spider/Lapsus$: Ongoing legal developments involving alleged members in the UK; continued insider threat activity linked to Lapsus$-affiliated groups.

Trends, Tools, or Tactics of Interest

Deepfake Attacks: Entrust reports deepfake attacks now comprise 20% of biometric fraud attempts, with a 58% increase in deepfaked selfies, indicating rapid growth in synthetic identity threats.
CSS Stuffing in Phishing: Observations of CSS stuffing being used as an obfuscation technique in phishing emails to bypass security filters.
AI-Driven Scam Detection: Avast has launched Scam Guardian, a free AI-powered tool for detecting scams in websites, messages, and links, reflecting the increasing adoption of AI for consumer security.
Calendar Invite Spam: There is a growing trend of fake calendar invites being used to deliver spam and potentially malicious content via email and messaging apps.
Supply Chain Attacks: APT24’s use of supply chain vectors to deliver BadAudio malware highlights continued adversary focus on third-party compromise.
Insider Threats: The CrowdStrike incident underscores the persistent risk of insiders leaking sensitive information to external threat actors.
Automation and Entry-Level Cybersecurity: Increased automation and AI adoption are impacting entry-level cybersecurity roles, potentially affecting the security talent pipeline.
AI Content Risks: AI-powered toys, such as FoloToy’s Kumma teddy bear, have been found to provide inappropriate responses, raising concerns about content moderation and safety in AI-driven products for children.

Regulatory or Policy Developments Affecting the Security Industry

SEC Drops SolarWinds Lawsuit: The U.S. Securities and Exchange Commission has dropped its case against SolarWinds and its CISO regarding alleged investor misrepresentation related to the 2020 breach.
FCC Cybersecurity Rollback: The U.S. Federal Communications Commission has rescinded a rule requiring telecom carriers to implement stricter cybersecurity measures, despite ongoing state-sponsored hacking concerns.
US Cyber Strategy Shift: The US national cyber director announced a strategic shift toward more aggressive, offensive actions aimed at shaping adversary behaviour and imposing consequences for cyber operations.
CISA Directive: CISA has issued a directive for immediate patching of the actively exploited Oracle Identity Manager vulnerability (CVE-2025-61757).

Cybersecurity Brief – 2025-10-09

Thu, 09 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Discord has confirmed a breach of its Zendesk support system, with threat actors claiming to have exfiltrated data on 5.5 million users, including government IDs and email addresses.
The Qilin ransomware group has claimed responsibility for an attack on Asahi brewery, leaking 27GB of data comprising contracts, employee information, and financial documents.
The Crimson Collective threat group has targeted AWS cloud environments for data theft and extortion, and is also reported to have breached the GitLab instance of Red Hat Consulting in collaboration with the Scattered Lapsus$ group.
The UK Metropolitan Police arrested two individuals in connection with a ransomware attack on a chain of London nurseries, which resulted in the doxing of children online.
Microsoft 365 services, including Teams and Exchange Online, experienced an outage, preventing user access.
DraftKings has alerted users to a credential stuffing attack leading to unauthorised access to user accounts and exposure of personal information.

Newly Discovered Vulnerabilities

A critical authentication bypass vulnerability in the Service Finder WordPress theme is under active exploitation, enabling attackers to gain administrator-level access to affected sites.
A severe vulnerability (CVE-2025-53967) in the Figma-developer-MCP Model Context Protocol server, now patched, allowed remote code execution, exposing organisations to potential agentic AI compromise.
A new variant of the FileFix social engineering attack leverages cache smuggling to covertly deliver malicious ZIP files and evade security controls.
Researchers have demonstrated a technique (“Mic-E-Mouse”) to turn computer mice into covert audio surveillance devices.
Hundreds of Oracle E-Business Suite instances remain vulnerable to a zero-day exploit that was actively targeted two months prior to the official patch release.

Notable Threat Actor Activity

LockBit, Qilin, and DragonForce ransomware groups have announced a strategic alliance to share attack resources and intelligence, forming a ransomware “cartel” and inviting other e-crime actors to join.
Suspected China-nexus threat actors are weaponising the open-source Nezha monitoring tool to deploy Gh0st RAT malware in new attack campaigns.
The BatShadow group, operating from Vietnam, is running a campaign using Vampire Bot malware to target job seekers.
Cybercriminals are exploiting compromised WordPress sites to inject malicious JavaScript for next-generation ClickFix phishing attacks.
North Korean threat actors are reported to have stolen $2 billion in cryptocurrency in 2025, contributing to over $6 billion in total thefts for the regime.

Trends, Tools, or Tactics of Interest

Increased use of artificial intelligence by both attackers and defenders is reshaping the threat landscape, with AI-powered tools being leveraged for both attack automation and defensive noise reduction.
Attackers are increasingly targeting third-party integrations (e.g., OAuth in Google Workspace) rather than core platforms.
Social engineering campaigns are evolving, including job-themed phishing targeting influencers and job seekers, and modeling scams targeting older adults on social media.
Polymorphic Python remote access trojans (RATs) and self-modifying malware are being observed in the wild.
Fake gaming pages (e.g., on itch.io) are being used to distribute malware via stealthy stagers.
Cache smuggling and other advanced evasion techniques are being adopted to bypass traditional security controls.

Regulatory or Policy Developments

Google has expanded its bug bounty programme to cover AI-specific abuse and security issues, offering up to $20,000 per submission.
Microsoft is enabling threshold-based auto-archiving by default in Exchange Online to address mailbox overflow and ensure email continuity.

Cybersecurity Brief – 2025-10-04

Sat, 04 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Renault and Dacia UK notified customers of a data breach affecting sensitive information, resulting from a compromise at a third-party provider.
Japanese beer company Asahi confirmed a ransomware attack that caused IT disruptions and factory shutdowns.
ShinyHunters launched a new data leak site to extort 39 victims impacted by recent Salesforce breaches, leaking samples of stolen data. The Scattered Lapsus$ Hunters group also resurfaced with threats to publish Salesforce customer data if extortion demands are unmet.
Jaguar Land Rover experienced repeat cyberattacks, reportedly due to incomplete remediation from a previous breach, highlighting ongoing operational and financial impacts.
Hackers who targeted Kido nurseries with ransom demands and posted children’s data online have reportedly removed the data following public backlash.
Dutch authorities arrested two teenagers for alleged pro-Russian espionage, noted as part of a broader Russian hybrid attack campaign in Europe.

Newly Discovered Vulnerabilities

CISA added CVE-2025-4008, a high-severity flaw in Smartbedded Meteobridge, to its Known Exploited Vulnerabilities catalog. The vulnerability allows remote unauthenticated attackers to execute arbitrary commands with root privileges; it was patched in mid-May but is being actively exploited.
An unauthenticated remote code execution (RCE) vulnerability affecting DrayTek routers was patched. The flaw could be exploited via crafted HTTP/S requests to the device’s web interface.
Chrome 141 and Firefox 143 released patches for high-severity vulnerabilities. Chrome addressed issues in WebGPU and Video components, while Firefox fixed flaws in Graphics and JavaScript Engine components.
A new attack, ‘CometJacking,’ exploits URL parameters in Perplexity’s Comet AI browser to access sensitive user data, such as emails and calendars, from connected services.

Notable Threat Actor Activity

The North Korean group “DeceptiveDevelopment” is using social engineering tactics to target job seekers, according to ESET.
The Detour Dog threat actor has been identified as operating DNS-powered malware campaigns distributing Strela Stealer, an information-stealing malware.
The Rhadamanthys Stealer threat actor has updated their stealer to include device fingerprinting and payloads concealed via PNG steganography. They are also advertising additional tools, Elysium Proxy Bot and Crypt Service.
A new self-propagating malware campaign, SORVEPOTEL, is targeting Brazilian WhatsApp users, spreading via trusted contacts on the messaging platform.
The “Cavalry Werewolf” threat actor, with links to YoroTrooper, has targeted Russian public sector entities using the FoalShell and StallionRAT malware families.
UAT-8099, a Chinese-language threat actor, is hijacking reputable websites for SEO fraud and data theft, infecting servers, poisoning sites with SEO spam, and stealing organizational data.
Oracle linked ongoing Clop ransomware extortion attacks to E-Business Suite vulnerabilities patched in July 2025, indicating exploitation of known flaws.
Cybercriminals reportedly offered money to a BBC journalist for cooperation, highlighting ongoing targeting of media professionals.

Trends, Tools, or Tactics of Interest

A Gartner survey found that 62% of organizations experienced a deepfake attack in the past 12 months, indicating a significant increase in the use of deepfakes in cyberattacks.
Signal introduced Sparse Post-Quantum Ratchet (SPQR), a cryptographic protocol designed to protect against quantum computing threats.
Gmail business users can now send end-to-end encrypted emails to recipients on any platform.
Microsoft’s “Windows Speak for Me” voice cloning technology has been identified as a potential vector for attacks, enabling creation of convincing voice replicas for use in SaaS platforms and communications.
Brain-computer interface (BCI) technology is being highlighted for its potential cybersecurity risks as adoption increases.
A free template was released to help CISOs present AI adoption, risks, and controls to boards, reflecting growing governance concerns around GenAI.
MokN, a French cybersecurity startup, introduced a “phish-back” solution that tricks attackers into revealing stolen credentials.
Passwork 7 was released as an on-premises platform for enterprise password and secrets management, addressing credential storage and sharing complexity.

Regulatory or Policy Developments Affecting the Security Industry

ICE (U.S. Immigration and Customs Enforcement) plans to build a 24/7 social media surveillance team, hiring contractors to monitor platforms such as X, Facebook, and TikTok for enforcement purposes.
LinkedIn user data will be used to train AI systems, raising privacy and data protection considerations.
Oneleet and MokN, cybersecurity startups, raised significant funding to expand operations and AI capabilities, indicating continued investment in compliance and anti-phishing technologies.