Cybersecurity Brief – 2025-06-12

Thu, 12 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Erie Insurance and Erie Indemnity Company confirmed a cyberattack that caused recent business disruptions and platform outages.
INTERPOL’s Operation Secure dismantled over 20,000 malicious IP addresses or domains linked to 69 infostealer malware variants, resulting in 32 arrests, the seizure of 117 command-and-control servers, and disruption of infrastructure in 26 countries.
Over 80,000 Microsoft Entra ID (formerly Azure AD) accounts were targeted in an account takeover campaign using the open-source TeamFiltration tool.
Coordinated brute-force attacks involving 295 malicious IPs targeted Apache Tomcat Manager interfaces exposed online.

Newly Discovered Vulnerabilities

Microsoft released patches for 67 vulnerabilities, including a WebDAV remote code execution zero-day (CVE-2025-25099) actively exploited in the wild. The zero-day was leveraged by the Stealth Falcon APT group to drop malware targeting defense and government organizations in Turkey, Qatar, Egypt, and the UAE.
A zero-click vulnerability named “EchoLeak” was identified in Microsoft 365 Copilot, allowing exfiltration of sensitive data from a user’s context without user interaction.
Two vulnerabilities in SinoTrack GPS devices were disclosed, enabling remote control of certain vehicle functions and tracking via default passwords.
A bug in Google’s password-recovery page allowed brute-forcing of any user’s phone number, exposing contact information and enabling phishing and SIM-swapping attacks.
Mirai botnets were observed exploiting a vulnerability in the Wazuh security platform, highlighting rapid exploitation of newly published CVEs.

Notable Threat Actor Activity

A new malicious implant, BrowserVenom, was discovered mimicking DeepSeek. The malware enables a proxy in Chrome and Mozilla browsers and spreads via phishing websites.
Former Black Basta ransomware members used email bombing and Microsoft Teams phishing, along with Python scripts, to establish persistent access in recent attacks.
Stealth Falcon APT exploited the Windows WebDAV zero-day for malware delivery in targeted attacks.
TeamFiltration, an open-source penetration testing tool, was repurposed for large-scale account takeover campaigns against Microsoft Entra ID accounts.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging AI tools, as highlighted in OpenAI’s report, to assist in social engineering attacks and influence operations.
“SmartAttack” is a new technique using smartwatches as covert ultrasonic receivers to exfiltrate data from air-gapped systems.
Brute-force campaigns targeting web management panels, such as Apache Tomcat Manager, are being conducted via large numbers of distributed IP addresses.
Botnet operators are reducing time-to-exploit for new CVEs, as evidenced by recent Mirai botnet campaigns.
DNS security is being emphasized as a critical but often overlooked defense layer.
Increased adoption and discussion of agentic AI security products at industry events, such as Gartner’s Security & Risk Management Summit.
Microsoft issued revised updates for Windows 11 24H2 on incompatible PCs and fixed Windows Server domain controller issues stemming from earlier updates.

Regulatory or Policy Developments

ConnectWise announced plans to rotate code-signing certificates based on third-party researcher recommendations, unrelated to a recent nation-state attack.
Google introduced new enterprise-scale security protections for Android devices.
INTERPOL’s Operation Secure represents a significant multinational law enforcement action against infostealer malware infrastructure.

Cybersecurity Brief – 2025-06-11

Wed, 11 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The Texas Department of Transportation (TxDOT) suffered a data breach in which a threat actor downloaded 300,000 crash records from its database.
United Natural Foods, Inc. (UNFI) experienced a cybersecurity incident, leading to proactive system shutdowns and operational disruption. The exact attack vector remains unknown.
A widespread outage impacted Heroku, preventing developers from accessing the platform and disrupting web services for over six hours.
OpenAI’s ChatGPT experienced a global outage, affecting user access across web, mobile, and desktop platforms.

Newly Discovered Vulnerabilities

Adobe released security patches addressing 254 vulnerabilities, primarily affecting Experience Manager (AEM).
Microsoft’s June 2025 Patch Tuesday addressed 66-67 vulnerabilities, including one actively exploited zero-day and another publicly disclosed flaw. Notably, a Microsoft Outlook update will expand the list of blocked risky attachments.
A new Secure Boot bypass vulnerability (CVE-2025-3052) was disclosed, allowing attackers to disable security controls and install bootkit malware.
Ivanti patched three high-severity hardcoded key vulnerabilities in Workspace Control, which exposed SQL credentials.
Researchers identified over 20 configuration-related risks, including five CVEs, in Salesforce Industry Cloud, potentially exposing sensitive data.
A researcher discovered a flaw in Google’s account recovery process that allowed brute-forcing of linked phone numbers, which has since been addressed.
Proof-of-concept code was released for a Roundcube webmail vulnerability, enabling authenticated attackers to fully compromise servers.

Notable Threat Actor Activity

FIN6 has been observed impersonating job seekers and using AWS-hosted fake resumes on LinkedIn to deliver the More_eggs malware, targeting recruiters with malicious payloads.
The Rare Werewolf (formerly Rare Wolf) APT group has conducted attacks against Russian and CIS enterprises, leveraging legitimate software in their operations.
Stealth Falcon APT exploited a Microsoft remote code execution zero-day in the Middle East, which was patched in the latest Patch Tuesday.
DanaBot malware operators were exposed and dismantled due to a command-and-control server bug introduced in 2022.
Quasar RAT is being distributed through malicious BAT files in ongoing campaigns.
Poisoned npm packages disguised as utilities were found containing backdoors with file-deletion commands, posing a threat to software supply chains.
A new Rust-based information stealer, Myth Stealer, is being distributed via fraudulent gaming websites, targeting Chrome and Firefox users.

Trends, Tools, or Tactics of Interest

Increased targeting of educational institutions, with reports highlighting worsening cybersecurity in schools.
AI-related data exposure risks are rising; a report found that 99% of organizations analyzed had sensitive data accessible to AI systems.
Non-human identity management is emerging as a critical security challenge due to the proliferation of automated services and applications.
SSH key mismanagement continues to be a significant risk, with untracked and unrotated credentials creating vulnerabilities.
Cisco announced new tools to monitor and control AI agent behavior within enterprise networks amid concerns about rogue AI activity.
GitHub is promoting artifact attestation and the SLSA framework to prevent software supply chain attacks.
Microsoft Outlook will block additional risky attachment types to mitigate malware delivery.
Android devices are receiving new enterprise-scale security protections.
Red Canary is expanding AI-driven solutions to reduce alert fatigue in security operations centers.

Regulatory or Policy Developments Affecting the Security Industry

ConnectWise is rotating code signing certificates for ScreenConnect, Automate, and RMM products due to security concerns.
India’s security leaders are grappling with new digital privacy regulations and AI governance, amid a shortage of cybersecurity talent.
Apple is emphasizing on-device processing for its new AI features, positioning privacy as a key differentiator.

Stealth Falcon on DanSec Daily

Cybersecurity Brief – 2025-06-12

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2025-06-11

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry