SystemBC on DanSec Daily

Cybersecurity Brief – 2026-04-22

Wed, 22 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

French Government Agency Data Breach: France Titres, responsible for issuing administrative documents, confirmed a breach after a hacker claimed to have stolen citizen data and offered it for sale.
Healthcare Data Breaches in the US: Data breaches were reported by Southern Illinois Dermatology, Saint Anthony Hospital, and North Texas Behavioral Health Authority, collectively affecting approximately 600,000 individuals.
Kelp DAO Crypto Heist: North Korean threat actors are attributed to a $290 million theft from Kelp DAO, exploiting LayerZero’s DVN by compromising RPC endpoints and using DDoS attacks to force failover to malicious infrastructure.
Perforce Server Exposures: Over 1,500 Perforce P4 version control servers were found to be unsecured, exposing sensitive data from major organizations.

Cybersecurity Brief – 2026-04-21

Tue, 21 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

KelpDAO suffered a $290 million cryptocurrency theft, attributed to North Korean state-sponsored Lazarus Group hackers. The attackers exploited the DeFi platform to drain assets.
Vercel, the creator of Next.js, confirmed a data breach after a threat actor claimed to have stolen data and offered it for sale for $2 million. The breach reportedly stemmed from compromised OAuth tokens used by an employee’s AI tool.
Seiko USA’s website was defaced, with attackers claiming theft of the Shopify customer database and threatening to leak the data unless a ransom is paid.
Bluesky social network experienced a 24-hour disruption due to a sophisticated DDoS attack, with a pro-Iran hacker group claiming responsibility.
Booking.com was reported as a recent victim of a cyberattack, with further details pending.
A British national, identified as a leader of the Scattered Spider cybercrime collective, pleaded guilty in the US to wire fraud and aggravated identity theft related to cryptocurrency theft.

Newly Discovered Vulnerabilities

Over twenty malicious apps impersonating popular crypto wallets (Metamask, Coinbase, Trust Wallet, OneKey, etc.) were discovered on the Apple App Store, primarily targeting users in China. These apps phished for recovery/seed phrases to steal cryptocurrency.
SGLang (CVE-2026-5760, CVSS 9.8): A critical vulnerability allows remote code execution via malicious GGUF model files.
Anthropic Model Context Protocol (MCP): A critical design weakness was disclosed, enabling remote code execution and posing a supply chain risk for AI deployments.
Serial-to-IP converters from Lantronix and Silex were found to contain 20 new vulnerabilities, exposing OT and healthcare systems to potential attacks.
CISA added eight new exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three affecting Cisco devices.
WhatsApp was found to leak user metadata, allowing attackers to infer limited information about users without direct contact.
Half of the 6 million internet-facing FTP servers were found to lack encryption, exposing users and enterprises to various attacks.

Notable Threat Actor Activity

Lazarus Group (North Korea) linked to the $290 million KelpDAO crypto theft.
Scattered Spider leader pleaded guilty to multiple cybercrimes, including corporate intrusions and cryptocurrency theft.
Pro-Iran hacker group claimed responsibility for the DDoS attack on Bluesky.
The Gentlemen ransomware group was observed using the SystemBC proxy malware botnet (over 1,570 hosts) for bot-powered attacks, facilitating lateral movement and defense evasion.
Threat actors are abusing QEMU, a machine emulator, in campaigns to evade defenses and distribute ransomware and remote access tools.
Microsoft reported increased abuse of Microsoft Teams by threat actors for helpdesk impersonation and lateral movement using legitimate tools.
Reports indicate use of .wav files as a vector for malware delivery.

Trends, Tools, or Tactics of Interest

Third-party tools and compromised OAuth tokens are increasingly leveraged as initial access vectors in breaches, as seen in the Vercel incident.
There is a rise in threat actors exploiting trusted download paths and legitimate collaboration platforms (e.g., Microsoft Teams) for initial access and lateral movement.
The SystemBC proxy is being used by ransomware operators to automate attacks and maintain persistence within victim networks.
QEMU is being leveraged for defense evasion in recent ransomware and RAT campaigns.
Increase in phishing and malicious app distribution on official platforms, such as the Apple App Store, specifically targeting cryptocurrency assets.
Serial-to-IP converters in OT and healthcare environments remain a weak link due to numerous unpatched vulnerabilities.
AI supply chain risks are highlighted by critical vulnerabilities in AI model protocols and concerns about the misuse of powerful AI tools (e.g., Anthropic’s Mythos tool not publicly released over security fears).
Survey data from LevelBlue indicates ongoing concern among security leaders about the human element in cybersecurity, with workforce education seen as insufficient.

Regulatory or Policy Developments

The US Senate extended surveillance powers under a controversial program until 30 April 2026, following legislative delays.
CISA set federal deadlines in April–May 2026 for remediation of newly catalogued exploited vulnerabilities.

Cybersecurity Brief – 2026-02-06

Fri, 06 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Spain’s Ministry of Science has partially shut down IT systems following breach claims, disrupting several citizen- and company-facing services.
Rome’s La Sapienza University suffered a cyberattack causing widespread operational disruptions.
Romanian oil pipeline operator Conpet disclosed a cyberattack that disrupted business systems and took down its website; the Qilin ransomware group is reportedly involved.
Newsletter platform Substack notified users of a data breach after attackers stole email addresses and phone numbers (approx. 700,000 records) in October 2025.
Fintech firm Betterment reported a breach exposing email addresses and personal information of 1.4 million accounts in January.
Zendesk users experienced a renewed spam wave, with inboxes flooded by “Activate account” emails due to abuse of unsecured support systems.
SystemBC malware remains active post law enforcement takedown, infecting over 10,000 devices and continuing to deliver ransomware and proxy traffic.
VS Code configuration files in GitHub Codespaces were found to automatically execute when opening repositories or pull requests, exposing users to potential attacks.

Newly Discovered Vulnerabilities

Anthropic’s Claude Opus 4.6 LLM identified over 500 previously unknown high-severity security flaws across major open-source libraries.
A critical sandbox escape vulnerability in the n8n workflow automation tool could enable arbitrary command execution and credential theft.
Researchers highlighted that VS Code-integrated configuration files can be abused in GitHub Codespaces to achieve remote code execution.
The EnCase forensic tool driver, signed with an expired digital certificate, is being weaponised for EDR evasion due to Windows security gaps.

Notable Threat Actor Activity

The Stan Ghouls campaign is targeting organisations in Russia and Uzbekistan using Java-based loaders and NetSupport RAT, with indications of IoT interest.
Infy (aka Prince of Persia), an Iranian threat group, resumed operations with new C2 infrastructure after the end of the Iran internet blackout and has evolved its operational security tactics.
A previously identified cyberspy group, likely China-linked, has compromised governments and critical infrastructure in 37 countries.
Italy reportedly thwarted Russian-linked cyberattacks against Winter Olympics websites and foreign ministry offices.
The DEAD#VAX campaign is distributing AsyncRAT by disguising malicious virtual hard disks as PDF attachments.
Ransomware operators are abusing ISPsystem virtual machines to host and deliver payloads at scale.
The AISURU/Kimwolf botnet launched a record-setting 31.4 Tbps DDoS attack lasting 35 seconds.

Trends, Tools, or Tactics of Interest

Proof-of-concept attacks demonstrate that large language models (LLMs) can be used to generate phishing pages and malicious JavaScript in real time.
Phishing-as-a-service (PhaaS) platforms are increasingly central to the cybercriminal economy, enabling actors of all skill levels to conduct advanced phishing campaigns.
AI-powered scams are industrialising website cloning, with one network creating over 150 cloned law firm websites and using Cloudflare and IP rotation for evasion.
Attackers are leveraging malicious scripts, such as Chrome injectors, to steal browser data.
BYOVD (Bring Your Own Vulnerable Driver) techniques persist, with threat actors weaponising legitimate drivers for EDR bypass.
Cloud log limitations are creating monitoring blind spots; network-level telemetry is highlighted as a more reliable visibility source.
Abuse of unsecured customer support systems (e.g., Zendesk) continues to facilitate spam and phishing campaigns.
AI-generated web platforms (e.g., Moltbook) have been found exposing sensitive data via insecure APIs.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced the deprecation of Exchange Web Services (EWS) API for Exchange Online, effective April 2027.
Concerns have been raised regarding CISA’s silent updates to the Known Exploited Vulnerabilities (KEV) catalog, particularly relating to ransomware-exploited vulnerabilities.
Flock Safety’s ALPR cameras were found to have shared license plate data with hundreds of agencies without permission, prompting a California city to shut down its system.
Zscaler has acquired browser security firm SquareX, aiming to embed lightweight security extensions across browsers.

Cybersecurity Brief – 2025-09-20

Sat, 20 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-linked cyber espionage group, successfully infiltrated 34 devices across 11 European telecommunications organisations using LinkedIn job lures and the MINIBIKE malware.
Russian threat groups Gamaredon and Turla collaborated in a campaign targeting Ukrainian entities, with Turla malware deployed on systems previously compromised by Gamaredon.
Over 600,000 individuals were impacted by recent healthcare sector breaches; ShinyHunters was identified as responsible for major attacks.
The FBI issued a warning about cybercriminals creating fake FBI Internet Crime Complaint Center (IC3) portals for malicious activity.
The REM Proxy botnet, powered by SystemBC malware, currently controls approximately 1,500 VPS victims daily via 80 C2 servers.
A surge in phishing-as-a-service (PhaaS) operations, notably Lighthouse and Lucid, has resulted in over 17,500 phishing domains targeting 316 brands in 74 countries.

Newly Discovered Vulnerabilities

Fortra disclosed and patched a critical vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT), allowing remote command injection via the License Servlet.
A zero-click vulnerability in OpenAI ChatGPT’s Deep Research agent enabled attackers to exfiltrate Gmail inbox data through a crafted email. OpenAI has since patched the issue.
Novakon Human-Machine Interfaces (HMIs) were found to have unpatched remote code execution and information exposure vulnerabilities.
A critical flaw in Microsoft Azure Entra ID was disclosed and fixed; it could have enabled catastrophic identity and access management attacks.
CISA released an analysis of malware kits used in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, where attackers chained two flaws to collect system information, dump credentials, and execute malware.

Notable Threat Actor Activity

Iranian APT group UNC1549 targeted European telecom and satellite companies with highly bespoke attacks, leveraging LinkedIn lures and custom malware.
Russian APTs Gamaredon and Turla collaborated to compromise Ukrainian organisations, with evidence of sequential deployment of their respective malware.
Scattered Spider group members were arrested in the UK and charged in the US for attacks on critical infrastructure organisations.

Trends, Tools, or Tactics of Interest

Researchers identified the earliest known malware (MalTerminal) embedding GPT-4-powered LLM capabilities, enabling autonomous creation of ransomware and reverse shells.
ChatGPT was demonstrated as capable of solving CAPTCHAs and mimicking human cursor movement, highlighting ongoing risks of AI-driven automation in bypassing security controls.
Ransomware continues to evade defences, with latest data showing only 62% prevention rates and data exfiltration prevention dropping to 3%.
Synthetic identity fraud in the finance and lending sector is rising post-pandemic, with estimated damages reaching $3.3 billion from new accounts.
The Tines platform released over 1,000 pre-built AI-driven security automation workflows, facilitating automated alert triage and response using AI agents and Confluence SOPs.
Industrial automation systems remain a high-value target, with Kaspersky reporting a broad range of malicious objects detected on ICS computers in Q2 2025.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and achieving a valuation of $8.6 billion.
Valve announced that Steam will end support for 32-bit Windows systems in January 2026, impacting legacy software environments.

Cybersecurity Brief – 2025-09-19

Fri, 19 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall suffered a breach of its MySonicWall cloud backup service, exposing firewall configuration backup files for fewer than 5% of customers. Impacted customers have been instructed to reset their passwords and import new configuration files.
Tiffany & Co. disclosed a data breach affecting thousands of customers in the US and Canada, with attackers accessing information related to gift cards.
Medical Associates of Brevard reported a data breach impacting nearly 250,000 individuals, attributed to the BianLian ransomware group.
ChatGPT was targeted in a server-side data theft attack using a zero-click method called ShadowLeak, which has since been fixed by OpenAI.
The Python Package Index (PyPI) invalidated all tokens stolen in the GhostAction supply chain attack and confirmed that threat actors did not use the stolen tokens to publish malicious packages.

Newly Discovered Vulnerabilities

WatchGuard released security updates for a critical remote code execution vulnerability in Firebox firewalls.
Google issued a Chrome 140 update patching four vulnerabilities, including a zero-day (CVE-2025-10585) in the V8 JavaScript engine, which was actively exploited.
Microsoft addressed a pair of vulnerabilities in Entra ID (formerly Azure AD) that could have allowed attackers to access virtually all Azure customer accounts.
CISA published details of two malware strains exploiting Ivanti EPMM vulnerabilities (CVE-2025-4427 and CVE-2025-4428) in a recent incident.

Notable Threat Actor Activity

Two UK teenagers linked to the Scattered Spider group were arrested in connection with the August 2024 cyberattack on Transport for London.
North Korean threat actors behind the “Contagious Interview” campaign are using a ClickFix social engineering technique to target job seekers with fraudulent employment offers.
Russian ransomware gangs are deploying a new multi-version malware loader, CountLoader, to deliver post-exploitation tools such as Cobalt Strike and Adaptee.
RevengeHotels has been targeting hotels in Brazil and Spanish-speaking regions with VenomRAT implants.
The SystemBC proxy botnet is actively compromising commercial VPS systems, maintaining around 1,500 bots daily to facilitate malicious traffic.
Two malicious PyPI packages were discovered delivering the SilentSync remote access trojan (RAT) to Windows systems.
Microsoft and Cloudflare disrupted RaccoonO365, a major Phishing-as-a-Service operation targeting Microsoft 365 credentials.
SMS blaster tools are being used to send large volumes of scam texts by impersonating cell towers, bypassing carrier-level protections.

Trends, Tools, or Tactics of Interest

AI-assisted phishing attacks are increasing in volume and sophistication, posing a growing threat to organizations.
Small businesses continue to be disproportionately targeted by ransomware attacks compared to large enterprises.
Microsoft 365’s widespread adoption and integration are expanding its attack surface, making it a prime target for cybercriminals.
HTTP request smuggling remains a practical attack vector, with pentesters continuing to find exploitable desynchronization vulnerabilities in web applications.
The use of Phishing-as-a-Service platforms is accelerating, with recent disruptions highlighting their prevalence and focus on Microsoft 365 accounts.
Age verification and enhanced parental controls are being introduced to ChatGPT to address concerns about AI-related harms to minors.

Regulatory or Policy Developments Affecting the Security Industry

UK law enforcement made arrests in connection with the Scattered Spider group’s attack on Transport for London, reflecting ongoing efforts to disrupt cybercriminal groups.
OpenAI is implementing age verification and parental controls for ChatGPT in response to increasing scrutiny over AI safety for minors.

Cybersecurity Brief – 2025-07-23

Wed, 23 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

AMEOS Group, a large Central European healthcare network, disclosed a security breach potentially exposing customer, employee, and partner information.
Dior confirmed a cyberattack from January 2025 that resulted in the theft of personal information. Payment information was not compromised.
Dell reported a breach of its Customer Solution Center demo environment by the World Leaks group. The company stated the leaked data was synthetic and not from real customers or partners.
A tech startup was found to be selling personal data stolen by infostealer malware and sourced from the dark web.

Newly Discovered Vulnerabilities

Microsoft SharePoint: Two critical vulnerabilities (CVE-2025-49704, CVE-2025-49706) are under active exploitation, with CISA adding them to its Known Exploited Vulnerabilities (KEV) catalog. The flaws have been exploited since at least July 7, 2025.
Cisco Identity Services Engine (ISE): Three recently patched critical remote code execution vulnerabilities are being actively exploited, allowing unauthenticated root access.
Helmholz REX 100 Industrial Routers: Eight vulnerabilities, including those enabling full device control, were discovered and patched.
Microsoft Windows Server: KB5062557 update is causing cluster service and virtual machine restart issues.
Coyote Banking Trojan: A new variant is abusing Microsoft’s UI Automation framework to identify and target banking and cryptocurrency exchange sites.

Notable Threat Actor Activity

Chinese APTs (Linen Typhoon, Violet Typhoon, Storm-2603): Attributed to the exploitation of SharePoint zero-day vulnerabilities (ToolShell chain) targeting internet-facing SharePoint servers, with activity traced back to early July 2025.
China-backed APT41: Conducted a sophisticated cyber-espionage attack on an African IT company, marking the group’s expansion into new geographic regions.
Russian APTs: Three groups and 18 individuals sanctioned by the UK government for involvement in cyber operations against Ukraine, NATO, and the EU.
Interlock Ransomware: CISA and the FBI reported escalating double extortion attacks targeting businesses and critical infrastructure.
AllaKore RAT, SystemBC, PureRAT, and Hijack Loader: Continued use in credential theft and remote access campaigns, particularly targeting Mexican organizations.
Lumma Infostealer: Resumed operations after law enforcement disruption in May 2025, with the infrastructure gradually coming back online.

Trends, Tools, or Tactics of Interest

Ransomware: Increased double extortion tactics and a notable rise in attacks on critical infrastructure and public sector organizations.
AI-Driven Threats: AI is being used to create convincing fake travel destinations and to clone voices for social engineering scams, as demonstrated in a recent AI voice scam extorting money from a victim.
Fake E-commerce Platforms: Surge in AI-powered scam sites used as attack vectors for data theft and fraud.
Infostealer Malware: The ecosystem for trading stolen personal data is expanding, with startups commercializing access to data harvested by malware.
Windows Accessibility Abuse: Malware such as Coyote is exploiting accessibility frameworks for more targeted credential theft.
Windows 11 Resilience: Microsoft introduced new recovery and resilience features, including a Black Screen of Death and automated recovery tools, in the KB5062660 update.

Regulatory or Policy Developments Affecting the Security Industry

UK Ransomware Payment Ban: The UK government is planning to prohibit public sector and critical infrastructure organizations from paying ransoms following ransomware attacks.
UK Sanctions: The UK imposed sanctions on Russian APT groups and individuals associated with high-profile cyber operations.
US Coast Guard Cybersecurity Rule: New cybersecurity requirements for maritime transport safety were issued, with phased implementation over two years to secure shipping ports.
China National Cyber ID: China launched a voluntary national Internet identity system aimed at protecting online identities, raising privacy and surveillance concerns.
Darktrace Acquisition: UK-based Darktrace acquired Mira Security to enhance network visibility and encrypted traffic decryption capabilities.