Storm-2657 on DanSec Daily

Cybersecurity Brief – 2025-10-12

Sun, 12 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall SSL VPN devices: Huntress reported a widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into over 100 customer environments to access internal systems.
Gladinet CentreStack and TrioFox: Active exploitation of a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox products has been observed, allowing unauthenticated local file access and potential escalation to remote code execution. The flaw remains unpatched.
BreachForums Takedown: The FBI seized all domains of the BreachForums hacking forum operated by the ShinyHunters group, which was used for leaking data from ransomware and extortion attacks, including recent Salesforce-related incidents.
AI Companion Apps Data Leak: Two AI “girlfriend” apps exposed millions of private chat logs belonging to over 400,000 users.
Oracle EBS Zero-Day Attacks: Sophisticated malware was deployed in attacks exploiting a zero-day in Oracle E-Business Suite (EBS), affecting dozens of organizations since at least 10 July.
Discord Age-Verification Data Exposure: A hack exposed sensitive age-verification data of Discord users.
Manufacturing Sector Ransomware: Reports highlight continued ransomware attacks targeting the manufacturing industry, with attackers exploiting unpatched vulnerabilities.
US Universities Payroll Attacks: US universities were targeted by attackers hijacking HR SaaS accounts to divert payroll payments, attributed to the Storm-2657 threat actor.

Newly Discovered Vulnerabilities

Juniper Networks Junos Space: More than 200 vulnerabilities, including nine critical-severity flaws, were patched in Junos Space and Junos Space Security Director.
Ivanti Endpoint Manager: The Zero Day Initiative (ZDI) disclosed 13 unpatched vulnerabilities in Ivanti Endpoint Manager, enabling remote code execution and privilege escalation.
GoAnywhere MFT (CVE-2025-10035): Fortra detailed active exploitation of this critical flaw in GoAnywhere Managed File Transfer, which has since been patched.
Node.js SEA Feature Abuse: The Stealit malware campaign uses Node.js’ Single Executable Application feature to distribute payloads via trojanized game and VPN installers.
Malicious npm Packages: 175 malicious npm packages with over 26,000 downloads were found harvesting credentials as part of a phishing campaign.

Notable Threat Actor Activity

North Korean IT Worker Schemes: North Korean threat actors have expanded fraudulent remote employment operations to target a broad range of industries, including architectural design, using fake identities and documentation.
LockBit/Storm-2603: The LockBit ransomware group (Storm-2603) has been observed abusing the Velociraptor DFIR tool to maintain persistence and facilitate attacks.
Storm-2657: This actor is actively hijacking HR SaaS accounts to redirect payroll payments, targeting a variety of organizations, including universities.
Coordinated Attacks on Network Devices: Infrastructure linked to coordinated attacks is being used to exploit vulnerabilities in Cisco, Fortinet, and Palo Alto Networks devices.
RondoDox Botnet: The RondoDox botnet employs over 50 exploits in a “shotgun” approach to compromise routers, DVRs, NVRs, CCTV systems, and other edge devices globally.
Aisuru DDoS Botnet: The Aisuru botnet is responsible for record-setting DDoS attacks against US ISPs, leveraging large numbers of compromised IoT devices.

Trends, Tools, or Tactics of Interest

Abuse of Legitimate Tools: Increased weaponization of legitimate digital forensics and incident response tools (e.g., Velociraptor) by ransomware groups for persistence and post-exploitation.
AI and Deepfake Threats: OpenAI’s new video and audio generation system raises concerns about the proliferation of deepfakes. Organizations report high awareness but insufficient investment in deepfake detection capabilities.
AI in Security Operations: Advancements in AI-powered Security Operations Center (SOC) platforms, with Microsoft introducing agentic AI capabilities in Sentinel, and the emergence of AI browser agents presenting new authentication challenges.
Supply Chain Risks: Discovery of malicious packages in npm and abuse of Node.js SEA highlight ongoing supply chain threats to software development environments.
Password Guidance: NIST updates suggest a shift away from overly complex password requirements, focusing on usability and security balance.

Regulatory or Policy Developments Affecting the Security Industry

Apple Bug Bounty Expansion: Apple has doubled its maximum bug bounty payout to $2 million for zero-click RCE vulnerabilities, introduced new research categories, and increased transparency in its rewards structure. Total payouts have reached $35 million, with bonuses for iPhone exploits potentially raising rewards to $5 million.
Windows 11 23H2 End of Support: Microsoft reminded users that Home and Pro editions of Windows 11 23H2 will stop receiving security updates next month.
Chrome Notification Permissions: Google Chrome will automatically revoke notification permissions for inactive websites to reduce notification spam.
Age-Verification Law Privacy Concerns: Apple raised privacy concerns regarding proposed age-verification laws, citing risks associated with increased sensitive data collection.

Cybersecurity Brief – 2025-10-11

Sat, 11 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has seized all domains associated with BreachForums, operated by the ShinyHunters group, which was used as a portal for leaking corporate data obtained through ransomware and extortion attacks, including recent Salesforce-related incidents. Despite the takedown, ShinyHunters continues to issue extortion threats against Salesforce victims.
Two AI companion applications exposed millions of private chat records from over 400,000 users due to inadequate security controls.
A critical zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox file sharing products is being actively exploited in the wild, allowing unauthenticated local attackers to access system files.
Sophisticated malware has been deployed in Oracle E-Business Suite (EBS) zero-day attacks, with exploitation believed to have started as early as July 10 and affecting dozens of organizations.
A large-scale DDoS attack was launched by the Aisuru botnet, leveraging compromised IoT devices hosted on major US ISPs.
Microsoft has observed a threat actor, Storm-2657, hijacking HR SaaS accounts to divert employee salary payments to attacker-controlled accounts; US universities have been specifically targeted in these payroll diversion attacks.

Newly Discovered Vulnerabilities

Fortra disclosed details of active exploitation of CVE-2025-10035, a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
13 unpatched vulnerabilities in Ivanti Endpoint Manager have been publicly released by the Zero Day Initiative (ZDI), permitting remote code execution and privilege escalation.
Juniper Networks released patches for over 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
175 malicious npm packages, collectively downloaded over 26,000 times, have been used in a credential phishing campaign.
Security researchers have detailed an active Stealit malware campaign abusing the Node.js Single Executable Application (SEA) feature, distributed via game and VPN installers.

Notable Threat Actor Activity

North Korean threat actors have expanded their fraudulent remote employment schemes to target nearly every industry hiring remote workers, including architectural design roles, using fake identities and documentation.
Chinese APT group Storm-2603 is abusing the Velociraptor digital forensics and incident response (DFIR) tool to gain persistent access to victim networks and facilitate ransomware deployment.
A coordinated campaign has been identified targeting Cisco, Fortinet, and Palo Alto Networks devices, with attacks originating from shared infrastructure.
The RondoDox botnet employs a “shotgun” approach, using more than 50 exploits against unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices globally.

Trends, Tools, or Tactics of Interest

AI-generated deepfakes are proliferating, with OpenAI releasing an updated AI video and audio generation system, raising concerns about the acceleration and accessibility of deepfake creation.
The security industry is experiencing inadequate investment in deepfake detection, despite high organizational awareness and frequent encounters with AI-augmented threats.
Security Operations Centres (SOCs) are increasingly integrating AI-powered agents, with projections indicating significant transformation in SOC workflows by 2026.
Microsoft has added agentic AI capabilities to its Sentinel platform, previewing new security graph and MCP server features.
Attackers are leveraging malicious npm packages and abusing legitimate software features (e.g., Node.js SEA) to distribute malware and harvest credentials.
1Password addressed a critical security gap in its AI browser agent, which posed risks of credential leakage.
Timely patch management is highlighted as a key defense against escalating ransomware attacks on manufacturing and industrial control system (ICS) environments.

Regulatory or Policy Developments Affecting the Security Industry

Apple has expanded its bug bounty program, doubling the maximum payout to $2 million for zero-click remote code execution vulnerabilities, with potential bonuses raising the maximum to $5 million. The program now includes new research categories and a more transparent reward structure.
Microsoft reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 30 days, after which security updates will cease.
Google Chrome will automatically revoke notification permissions for inactive websites to reduce user alert fatigue.
Apple voiced concerns over proposed age-verification laws, warning that increased data collection for compliance could heighten user privacy risks.
NIST is revising password guidance, indicating that excessively complex password requirements may no longer be necessary.

Cybersecurity Brief – 2025-10-10

Fri, 10 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall Cloud Backup Breach: SonicWall confirmed that all customers using its cloud backup service had their firewall configuration backup files accessed by an unauthorized party. The files included encrypted credentials and other sensitive configuration data.
Oracle E-Business Suite Exploitation: A zero-day vulnerability in Oracle’s E-Business Suite has been exploited since August 2025 by threat actors linked to the CL0P ransomware group, impacting dozens of organizations.
Discord Data Breach: Discord disclosed that 70,000 users had government-issued IDs exposed in a recent data breach, with attackers claiming theft of over 2 million ID photos submitted for age verification.
Law Firm Williams & Connolly Breach: Chinese threat actors exploited a zero-day vulnerability to breach the US law firm Williams & Connolly. The firm reports no evidence of client data theft.
Microsoft Azure Outage: An outage affecting Azure Front Door CDN disrupted access to Microsoft 365 services and admin portals.
University Payroll Hijacking: The cybercrime group Storm-2657 has been targeting US university HR employees since March 2025 in “payroll pirate” attacks, rerouting salary payments.
Fake Android Apps and Banking Trojan: Malware campaigns using fake VPN and streaming apps (e.g., Mobdro Pro IP TV + VPN) are distributing the Klopatra Android trojan, which steals banking credentials.

Newly Discovered Vulnerabilities

Oracle EBS Zero-Day: Actively exploited by CL0P-linked actors, affecting Oracle E-Business Suite installations.
GitHub Copilot Chat Flaw: A vulnerability in GitHub Copilot Chat allowed hidden comments to manipulate responses and leak sensitive information, including data from private repositories.
HTTP/1.1 Desync Attacks: New HTTP desynchronisation techniques targeting HTTP/1.1 were demonstrated, exposing critical web infrastructure to novel attack vectors.
RondoDox Botnet Targeting N-Day Flaws: The RondoDox botnet is exploiting 56 known vulnerabilities across more than 30 device types, including those disclosed at Pwn2Own competitions.

Notable Threat Actor Activity

CL0P Ransomware Group: Exploiting Oracle EBS zero-day to breach multiple organizations.
UTA0388 (China-Aligned): Conducting spear-phishing campaigns across North America, Asia, and Europe, deploying a Go-based malware implant known as GOVERSHELL.
Storm-2657: Targeting US university payroll systems to hijack salary payments.
Russian Threat Actors: Increasing use of AI to enhance phishing and malware campaigns against Ukrainian targets.
Pro-Russian Hacktivist Group TwoNet: Shifting from DDoS to targeting critical infrastructure, including decoy industrial plants.
Android Spyware Campaigns: ClayRat spyware is distributed via fake WhatsApp, TikTok, Google Photos, and YouTube apps, primarily targeting Russian users via phishing sites and Telegram channels.
Ransomware Actors Using Velociraptor: LockBit and Babuk ransomware operators are leveraging the Velociraptor DFIR tool for post-exploitation and lateral movement.

Trends, Tools, or Tactics of Interest

Surge in Vishing: Voice-based phishing (vishing) incidents are increasing, highlighting the need for robust human risk management.
Multitasking and Phishing: Employees who multitask are more susceptible to phishing attacks, according to recent academic research.
SaaS Token Theft: OAuth and API token theft is a leading cause of SaaS breaches, with attackers exploiting poor token hygiene.
AI in Cyber Attacks: Russian actors are leveraging AI for more effective phishing and malware delivery.
Velociraptor in Ransomware: Increased use of legitimate DFIR tools like Velociraptor by ransomware operators for stealth and persistence.
Chaos Ransomware Evolution: The Chaos ransomware-as-a-service has introduced a new C++ variant with enhanced encryption, wiper, and cryptocurrency-stealing capabilities.
Risks with AI Notetakers: Security and compliance risks are emerging as AI-powered transcription tools become common in online meetings.
Exfiltration via AI Coding Assistants: Proof-of-concept attacks demonstrate data exfiltration from GitHub Copilot using hidden prompts (“CamoLeak”).
PureRAT Campaign Evolution: Attackers are escalating from simple infostealers to deploying full-featured remote access trojans with advanced evasion and secure C2 channels.

Regulatory or Policy Developments Affecting the Security Industry

California Privacy and AI Laws: California enacted 14 new privacy and AI-related laws, granting users greater control over personal data and setting new standards for data handling and AI transparency.
Microsoft Defender False Positive: Microsoft is addressing an issue where Defender for Endpoint incorrectly flags SQL Server as end-of-life, potentially affecting compliance and patch management processes.
Apple App Store Enforcement: Apple removed ICE-tracking apps from the App Store, raising questions about platform policy and developer recourse.