Smishing Triad on DanSec Daily

Cybersecurity Brief – 2025-11-13

Thu, 13 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Synnovis, a UK pathology services provider, has notified healthcare providers of a data breach resulting from a ransomware attack in June 2024, which led to the theft of patient data.
Over 67,000 fake npm packages have been published in a large-scale, worm-like spam attack, likely financially motivated, flooding the npm registry since early 2024.
DanaBot malware has resumed activity, infecting Windows systems after a six-month hiatus following law enforcement disruption in May 2024.
A campaign targeting Microsoft 365 users is leveraging Quantum Route Redirection to bypass email security and steal credentials, impacting victims in over 90 countries.
Phishing emails disguised as spam filter alerts are being used to steal user credentials.

Newly Discovered Vulnerabilities

Amazon’s threat intelligence team disclosed that an advanced threat actor exploited two zero-day vulnerabilities: “Citrix Bleed 2” (CVE-2025-5777) in Citrix NetScaler ADC/Gateway and CVE-2025-20337 in Cisco Identity Service Engine (ISE).
Microsoft released fixes for 63 security vulnerabilities, including a Windows kernel zero-day flaw currently under active exploitation.
Google Chrome (version 142) and Mozilla Firefox (version 145) have patched multiple high-severity vulnerabilities in their latest releases.
Ivanti and Zoom have patched high-severity vulnerabilities that could enable arbitrary file writes, privilege escalation, code execution, and information disclosure.
Intel, AMD, and Nvidia have published advisories addressing over 60 vulnerabilities in their products as part of their regular security updates.
Siemens, Rockwell, Aveva, and Schneider Electric have addressed vulnerabilities affecting industrial control systems.

Notable Threat Actor Activity

Google has filed a lawsuit in the US District Court against China-based threat actors operating the “Lighthouse” Phishing-as-a-Service (PhaaS) platform, attributed to the group “Smishing Triad.” The platform facilitated large-scale SMS phishing campaigns, including US toll scam texts, using over 194,000 malicious domains.
Advanced persistent threat actors exploited Citrix NetScaler and Cisco ISE zero-day vulnerabilities in coordinated attacks, demonstrating increased targeting of identity and access management systems.
The SmartApeSG campaign is using ClickFix social engineering techniques, including fake Cloudflare verification pages, to push NetSupport RAT malware.
Ongoing cyber threats have been identified against Cisco ASA and Firepower devices, as reported by CISA.

Trends, Tools, or Tactics of Interest

ClickFix attacks are becoming more sophisticated, with recent campaigns mimicking Cloudflare verification checks to trick users into executing malicious commands.
The Quantum Route Redirection technique in phishing campaigns simplifies attack steps and is being used to bypass traditional email security controls.
There is increased adversary interest in targeting identity and access management infrastructure, as evidenced by recent zero-day exploitation of Citrix and Cisco products.
Passkey management on Windows 11 now supports third-party applications, with 1Password and Bitwarden as initial partners, improving passwordless authentication options.
The return of DanaBot and the scale of npm spam attacks highlight persistent threats to software supply chains and end-user systems.
Google introduced “Private AI Compute,” a privacy-enhancing technology for secure AI processing in the cloud.
Token Security outlined methods to extend Zero Trust principles to autonomous AI agents, emphasizing scoped access and continuous verification.
Behavioral (TTP-based) detection is being promoted as more effective than traditional IoC-based hunting for identifying privilege escalation, credential theft, and lateral movement.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced new legislation to strengthen cybersecurity requirements for critical infrastructure, including hospitals, energy, water, and transport sectors.
Kenya has launched the “Code Nation” initiative to train one million workers in technology skills, with a focus on cybersecurity, software engineering, and data science.

Cybersecurity Brief – 2025-10-25

Sat, 25 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Toys ‘R’ Us Canada experienced a data breach resulting in customer information, including names, addresses, phone numbers, and email addresses, being leaked and published on the dark web.
A major AWS outage occurred this week due to a significant DNS failure, impacting multiple websites and online services.
A large-scale malicious network on YouTube has been identified, with over 3,000 videos used as malware delivery traps, leveraging trusted platforms for distribution.
Multiple fraudulent domains and fake applications have targeted users of the newly launched Perplexity Comet browser.
LastPass customers are being targeted by a phishing campaign involving fake death claims to illicitly access password vaults via legacy inheritance processes.

Newly Discovered Vulnerabilities

Microsoft released out-of-band patches for a critical Windows Server Update Services (WSUS) vulnerability (CVE-2025-59287). This flaw allows remote, unauthenticated code execution and is under active exploitation, with public proof-of-concept exploit code available.
WordPress websites using outdated GutenKit and Hunk Companion plugins are being targeted in a mass exploitation campaign, with attackers leveraging old, critical vulnerabilities to achieve remote code execution.

Notable Threat Actor Activity

The Smishing Triad group has been linked to over 194,000 malicious domains used in a global smishing campaign since January 2024, targeting a wide range of services.
APT36, a Pakistan-linked threat actor, has been observed targeting Indian government entities using spear-phishing emails to deliver Golang-based DeskRAT malware.
North Korean Lazarus Group has targeted European drone technology companies using fake job offers in order to steal sensitive information.
The Everest group has claimed responsibility for a cyberattack on Collins Aerospace.
Gamers are being targeted with red teaming tools and remote access trojans (RATs) in ongoing campaigns.

Trends, Tools, or Tactics of Interest

Phishing campaigns are increasingly impersonating trusted brands and services, including Google Careers recruiters and LastPass, to target job seekers and password management users.
Large-scale abuse of trusted platforms such as YouTube is being used for widespread malware distribution.
Attackers are rapidly exploiting newly disclosed vulnerabilities, particularly in widely used software such as Microsoft WSUS and WordPress plugins.
There is a reported increase in cyberattacks against financially constrained US government agencies during periods of shutdown and resource reduction.
Microsoft has disabled downloaded file previews in Windows to prevent NTLM hash leaks via HTML tags referencing external paths.
Shadow Escape and other red teaming tools are being used in active campaigns targeting specific user groups, including gamers.

Regulatory or Policy Developments Affecting the Security Industry

Mozilla will require, starting next month, that Firefox extension developers disclose whether their add-ons collect or share user data with third parties.
CISA layoffs in the US are reducing federal cybersecurity resources, prompting calls for enterprises to strengthen their own cyber defences.
The US Department of Homeland Security is soliciting proposals for AI-powered surveillance trucks to enhance border monitoring capabilities.

Cybersecurity Brief – 2025-10-24

Fri, 24 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Toys “R” Us Canada has notified customers of a data breach involving leaked customer records previously stolen from its systems.
Collin’s Aerospace suffered a cyberattack impacting check-in and passenger systems at several European airports in late September 2025, resulting in significant delays and flight cancellations.
The Universe Browser, downloaded millions of times, has been identified as behaving like malware, with links to Asian cybercrime and illegal gambling networks.
Jingle Thief, a cybercriminal group, has been observed exploiting cloud infrastructure in the retail and consumer services sectors to steal millions in gift cards.
WIRED reported that hacked Deckmate 2 card shufflers enabled a mob-related poker scam that resulted in millions of dollars in losses.

Newly Discovered Vulnerabilities

Microsoft released emergency out-of-band patches for a critical Windows Server Update Service (WSUS) remote code execution flaw, which has publicly available proof-of-concept exploit code.
CISA and researchers reported active exploitation of a critical zero-day vulnerability in Motex Lanscope Endpoint Manager, prompting inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
A critical vulnerability (CVE-2025-54236, “SessionReaper”) in Adobe Commerce (Magento) is being actively exploited to hijack user sessions on e-commerce platforms, affecting thousands of online stores.
BIND released security updates addressing high-severity cache poisoning vulnerabilities, which could allow attackers to predict source ports and query IDs and inject forged DNS records.
Microsoft has disabled File Explorer’s preview pane for downloaded files to mitigate NTLM credential theft attacks via malicious documents.
OpenAI’s Atlas and Perplexity’s Comet browsers are vulnerable to sidebar spoofing attacks, allowing malicious extensions to impersonate AI sidebar interfaces and mislead users.

Notable Threat Actor Activity

North Korean Lazarus Group targeted at least three European defense companies with Operation DreamJob, leveraging fake job offers to compromise systems and steal drone-related intellectual property.
Russian government involvement with cybercrime groups has shifted from passive tolerance to active management, according to recent security firm analysis.
The “Smishing Triad,” a Chinese cybercriminal group, has shifted tactics to lower-frequency, higher-impact government impersonation SMS phishing attacks.
Researchers identified a new infostealer targeting Android devices, as part of an ongoing expansion in the infostealer threat landscape.
YouTube continues to be leveraged by threat actors as a malware distribution network, with evolving tactics for wider reach.

Trends, Tools, or Tactics of Interest

A phishing campaign is impersonating password managers (LastPass and Bitwarden) with fake breach notifications to steal credentials.
Phishing emails targeting cloud accounts, often in French and English, have been observed, warning recipients about purported payment issues to lure credentials.
Enterprises are increasingly abandoning static secrets in favour of managed identities to address risks associated with machine identities in cloud environments.
The Verizon 2025 Mobile Security Index reports that 85% of organizations believe mobile device attacks are increasing, with AI-powered threats raising particular concern.
AI sidebar spoofing, where browser extensions imitate trusted AI interfaces, is an emerging attack vector against users of AI-enabled browsers.
Zero Trust models are facing challenges in governing AI agents, with new blind spots emerging as AI agents gain broader access and autonomy.
Security researchers at Pwn2Own Ireland 2025 exploited 73 zero-day vulnerabilities, earning over $1 million in rewards, highlighting the ongoing prevalence of unknown flaws in widely used software.
Meta has enhanced scam protection features on WhatsApp and Messenger, as part of efforts to combat impersonation and fraud, following the removal of over 21,000 fake customer support pages from Facebook.
AI coding tools are introducing security risks by generating functional but flawed code, prompting calls for embedding security checks directly into AI development workflows.

Regulatory or Policy Developments Affecting the Security Industry

The UK Competition and Markets Authority (CMA) is considering measures that may require Apple to allow rival app stores on iPhones, challenging its current “walled garden” approach.
A $14 billion cryptocurrency seizure by US authorities signals increased regulatory scrutiny on the use of cryptocurrencies by cybercrime syndicates.
HP withdrew a software update for Windows 11 AI PCs after it caused the deletion of Microsoft certificates necessary for Entra ID authentication, disrupting organizational access.

Cybersecurity Brief – 2025-04-19

Sat, 19 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

SonicWall SMA VPN Devices Under Active Attack
- A remote code execution vulnerability in SonicWall Secure Mobile Access (SMA) appliances has been actively exploited since at least January 2025. Organisations using these devices are at heightened risk and should prioritise patching and mitigation.
Apple Zero-Day Exploits
- Two zero-day vulnerabilities in Apple iOS devices have been used in sophisticated attacks targeting specific individuals, indicating likely involvement of spyware or nation-state actors. Details remain limited.
Smishing Surge Tied to Chinese Threat Actors
- A China-based cybercriminal group, “Smishing Triad,” is conducting widespread toll-themed SMS phishing attacks across the US and UK, aiming for financial theft. A custom Chinese smishing kit is enabling these campaigns.
FBI Impersonation Scam
- Scammers are posing as FBI IC3 employees, contacting previous fraud victims and offering assistance in recovering lost funds as a means to further defraud them.
Payment Card Scam with Malware Component
- A new scam involves phone calls and malware disguised as security or verification tools to capture payment card details and access funds.
Alleged SmokeLoader Operator Charged
- US authorities have charged an individual accused of operating the SmokeLoader malware, responsible for stealing personal data of over 65,000 individuals.