SideWinder on DanSec Daily

Cybersecurity Brief – 2026-03-19

Thu, 19 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Aura, an identity protection company, confirmed a data breach exposing nearly 900,000 marketing contacts, including names and email addresses.
Marquis, a Texas-based financial services provider, disclosed that a ransomware attack in August 2025 led to the theft of data belonging to 672,000 individuals and operational disruption.
Nordstrom’s email system was abused to send cryptocurrency scam emails to customers from a legitimate company address.
Stryker, a medtech company, continues recovery efforts following a cyberattack attributed to the Iranian-linked Handala group, likely using malware-stolen credentials.

Newly Discovered Vulnerabilities

Cisco Secure Firewall Management Center (FMC): CVE-2026-20131, a critical zero-day vulnerability, is being actively exploited by the Interlock ransomware group for remote code execution and root access.
GNU InetUtils telnetd: CVE-2026-32746, a critical unpatched flaw, allows unauthenticated remote attackers to execute arbitrary code as root.
Ubuntu Desktop: CVE-2026-3888, a high-severity vulnerability in default installations (24.04+), allows privilege escalation to root via a systemd cleanup timing exploit.
ConnectWise ScreenConnect: A cryptographic signature verification vulnerability has been patched, which could have allowed unauthorized access and privilege escalation.
Zimbra Collaboration Suite: An XSS vulnerability is being actively exploited; CISA has ordered urgent patching. Microsoft SharePoint is also under active exploitation for a separate flaw.
Claude AI: A trio of vulnerabilities, including prompt injection, exposes Claude users to potential data theft through chained attacks initiated from Google searches.
Apple WebKit: CVE-2026-20643, a vulnerability that could allow sites to access user data, has been patched via a background security update.
IP KVM Devices: Nine critical vulnerabilities across four vendors allow unauthenticated attackers to gain root access and take control of host systems.

Notable Threat Actor Activity

Interlock ransomware: Actively exploiting the Cisco FMC zero-day (CVE-2026-20131) in a campaign ongoing since January 2026.
Horabot: New campaign in Mexico identified, involving sophisticated multi-stage malware delivery and targeting financial information.
SideWinder: Espionage group, suspected to be India-linked, expanding operations across Southeast Asia targeting governments, telecom, and critical infrastructure using spear-phishing, old vulnerabilities, and rotating infrastructure.
DPRK IT Worker Network: OFAC sanctioned six individuals and two entities for funding North Korean WMD programs through fraudulent remote IT work.
Iranian-linked Handala group: Attributed to the Stryker breach, leveraging credentials stolen via malware.
Magecart: Ongoing use of novel techniques, such as hiding payloads in EXIF data of third-party favicons, to evade repository scanners and steal payment information.
Darksword iOS Exploit Kit: Used by state-sponsored and criminal actors, this kit chains multiple iOS zero-days to compromise devices for surveillance and data theft, targeting users in Saudi Arabia, Turkey, Malaysia, Ukraine, and reportedly by Russian hackers.
SnappyClient: A new C2 implant targeting cryptocurrency wallets, supporting remote access, data theft, and spyware capabilities.
Shipping-Themed Phishing: Surge in phishing campaigns targeting Middle East and Africa, leveraging shipping themes.

Trends, Tools, or Tactics of Interest

Refund Fraud Economy: Increase in organized refund fraud exploiting major retailers and payment platforms, with methods and tutorials being commercialized.
Fake Shop Networks: Discovery of a network of over 20,000 fake online shops designed to steal payment and personal data.
Font-Rendering Evasion: Researchers demonstrated a method to hide malicious commands from AI assistants using font-rendering tricks.
Scanning Activity: Increased scans for “adminer” and “phpMyAdmin” observed in honeypots.
Shadow AI: SaaS applications are enabling unmonitored AI activity, increasing risk of data exposure and breaches.
Security Tooling: Emergence of autonomous offensive security platforms (e.g., XBOW) and new AI detection/response startups (e.g., Manifold, Native) focused on vulnerability discovery and endpoint security.

Regulatory or Policy Developments

OFAC Sanctions: The US Treasury’s OFAC sanctioned individuals and entities tied to North Korean IT worker schemes funding WMD programs.
EU Sanctions: The European Union sanctioned Chinese and Iranian companies and individuals for cyberattacks against EU member states, expanding measures already in place in the US and UK.
CISA Directives: CISA issued emergency directives for US government agencies to patch actively exploited vulnerabilities in Zimbra and SharePoint.

Cybersecurity Brief – 2025-10-28

Tue, 28 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

A database containing information on individuals with ‘Top Secret’ clearance who applied for jobs with US House Democrats was left openly accessible online.
Toys “R” Us Canada suffered a data breach, as noted in recent threat intelligence reporting.

Newly Discovered Vulnerabilities

A new vulnerability in OpenAI’s ChatGPT Atlas web browser allows attackers to inject persistent, hidden commands into the AI platform.
QNAP warned customers of a critical ASP.NET Core vulnerability affecting its NetBak PC Agent Windows backup utility, urging immediate patching.
A zero-day vulnerability in Google Chrome, exploited in Operation ForumTroll, was used to deliver spyware linked to Italian vendor Memento Labs (formerly IntheCyber Group/Hacking Team).
Mass exploitation of year-old critical WordPress plugin vulnerabilities has resumed, with roughly 9 million exploit attempts observed this month.
The US Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch a critical Windows Server Update Services (WSUS) vulnerability actively exploited in attacks.

Notable Threat Actor Activity

The BlueNoroff APT, linked to North Korea, was observed conducting GhostCall and GhostHire campaigns targeting the cryptocurrency sector, using malware chains against macOS and deploying stealer suites and fake job/funding lures.
The SideWinder group launched a new campaign targeting South Asian diplomats and a European embassy in New Delhi, using a ClickOnce-based attack chain.
Qilin ransomware (aka Agenda, Gold Feather, Water Galura) continues to combine Linux payloads with BYOVD (Bring Your Own Vulnerable Driver) exploits in hybrid attacks, targeting both Linux and Windows hosts, with over 40 victims per month in 2025 (excluding January).
A large-scale China-linked smishing campaign used 194,000 domains to harvest sensitive information, including Social Security numbers.
A Morocco-based group is conducting a significant gift card fraud campaign (“Jingle Thief”), targeting retailers.
Threat actors are exploiting old vulnerabilities in WordPress plugins for mass website compromise.
Phishing campaigns are targeting LastPass users with fake death notices to capture master passwords via the digital will feature.

Trends, Tools, or Tactics of Interest

Ransomware profits have declined, with only 23% of breached organisations paying ransoms, attributed to large enterprises increasingly refusing to pay and lower payments from mid-market firms.
Attackers are leveraging AI to weaponise old vulnerabilities, while defenders face expanding attack surfaces and resource limitations.
Malware continues to use DNS tunneling (e.g., BASE64 over DNS) for command and control communications.
Chatbots, including ChatGPT, Gemini, DeepSeek, and Grok, are serving users Russian state-backed propaganda in response to queries about the Ukraine invasion.
The Qilin ransomware group demonstrates cross-platform evasion by deploying Linux-based ransomware on Windows hosts.
Smishing and phishing campaigns are increasingly sophisticated, leveraging large domain infrastructures and social engineering lures (e.g., fake job offers, death notices).

Regulatory or Policy Developments Affecting the Security Industry

X (formerly Twitter) is requiring users to re-enrol their two-factor authentication (2FA) security keys or passkeys by 10 November to avoid account lockout.
Mozilla now requires all new Firefox extensions to declare data collection practices in their manifest files.
Microsoft has introduced a policy enabling IT administrators to remove pre-installed Microsoft Store apps from Windows systems.
Microsoft is testing a feature in Windows 11 that prompts users to run a memory scan following a blue screen of death (BSOD) crash.
CISA has mandated patching of the actively exploited WSUS vulnerability across US federal agencies.

Cybersecurity Brief – 2025-05-21

Wed, 21 May 2025 00:00:00 +0000

Major Incidents or Breaches

Cellcom Cyberattack: Wisconsin-based mobile carrier Cellcom confirmed a cyberattack caused widespread service outages beginning 14 May 2025.
SK Telecom Data Breach: SK Telecom disclosed a malware breach lasting three years (since 2022), exposing USIM data of 27 million subscribers.
RVTools Supply Chain Attack: The official website for RVTools, a VMware management utility, was compromised in a supply chain attack. Trojanized installers delivered the Bumblebee malware loader.
PowerSchool Extortion: A 19-year-old has pleaded guilty to a cyberattack on PowerSchool, involving extortion and exposure of student data.
KrebsOnSecurity DDoS Attack: KrebsOnSecurity experienced a near-record DDoS attack peaking at 6.3 Tbps.

Newly Discovered Vulnerabilities

WordPress ‘Motors’ Theme: A critical privilege escalation vulnerability allows unauthenticated attackers to take over admin accounts on sites using the premium Motors theme.
Virgin Media O2 Location Leak: A security flaw in Virgin Media O2’s mobile network could allow attackers to pinpoint call recipient locations within 100 square meters.
AWS Default IAM Roles: Researchers identified risky default IAM roles in AWS that can enable lateral movement and cross-service exploitation if misconfigured.

Notable Threat Actor Activity

Hazy Hawk: This group has been actively hijacking abandoned cloud resources (e.g., S3 buckets, Azure endpoints) via DNS misconfigurations and CNAME hijacking, targeting high-profile organizations including the US CDC, to deliver malware and conduct scams.
Scattered Spider: The group continues to target large retailers, shifting focus from UK to US organizations, leveraging IT help desk social engineering for initial access.
SideWinder APT: Targeted ministries in Sri Lanka, Bangladesh, and Pakistan using spear phishing, exploiting old Microsoft Office vulnerabilities, and deploying custom malware.
UnsolicitedBooker (China-aligned): Deployed the new MarsSnake backdoor in a multi-year campaign against a Saudi Arabian organization.
RedisRaider: A new Go-based cryptojacking campaign targets publicly accessible Redis servers to deploy XMRig miners.
VanHelsing Ransomware: The ransomware builder, affiliate panel, and data leak blog source code were leaked online, increasing the risk of further ransomware proliferation.
Fake Chrome Extensions: Over 100 malicious Chrome extensions have been discovered since February 2024, used to hijack browser sessions, steal credentials, and inject ads.

Trends, Tools, and Tactics

Service Desk Social Engineering: Attackers are increasingly targeting IT service desks with social engineering to bypass security controls (e.g., password resets, disabling MFA).
Novel Phishing Techniques: Recent phishing campaigns combine AES encryption with malicious npm packages to evade detection.
Supply Chain Threats: The RVTools incident highlights ongoing risks in software supply chains, with attackers distributing malware via compromised legitimate utilities.
Rise in Asia-based APTs: China and North Korea-aligned groups now account for over half of global APT attacks, with expanding international focus.
Exposure Management Enhancements: Tenable has added third-party connectors (AWS, Microsoft, competitors) to its platform for improved attack surface visibility.
Security Key Solutions: Yubico has expanded its YubiKey-as-a-Service globally, supporting hardware-based authentication in 175 countries.
AI Security Impacts: Increased adoption of AI agents is driving both new security opportunities and challenges, with most security leaders anticipating compliance and threat management implications.

Regulatory or Policy Developments

Genetic Data Privacy Concerns: Regeneron’s planned acquisition of 23andMe raises privacy concerns due to the lack of comprehensive federal regulation on genetic information transfers.