Cybersecurity Brief – 2025-06-03

Tue, 03 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Cartier disclosed a data breach after its systems were compromised, exposing customers’ personal information.
The North Face warned customers of a credential stuffing attack in April that resulted in theft of personal information from its website.
SentinelOne experienced a seven-hour outage due to a software flaw.
A significant phishing campaign is targeting users in France, using leaked personal data to craft convincing emails.
The “Russian Market” cybercrime marketplace has become a major platform for trading credentials stolen by information stealer malware.

Google released an emergency out-of-band patch for Chrome to address three security issues, including a high-severity zero-day vulnerability under active exploitation.
Qualcomm issued security updates for three zero-day vulnerabilities in its Adreno GPU driver, which have been exploited in targeted attacks.
Three vulnerabilities in preinstalled Android apps on Ulefone and Krüger&Matz smartphones could allow any installed app to reset devices or steal PINs.
New details have emerged about a critical Cisco IOS XE vulnerability, increasing the risk of exploitation by attackers.
Unpatched vulnerabilities in Consilium Safety’s CS5000 Fire Panel could allow takeover of the OT/ICS platform, creating serious safety risks.

Researchers identified a cryptojacking campaign targeting publicly accessible DevOps web servers (including Docker, Gitea, and HashiCorp Consul), using off-the-shelf tools from GitHub.
An anonymous whistleblower leaked substantial data connected to the alleged operator behind Trickbot and Conti ransomware operations.
Ongoing APT intrusions, AI-powered malware, and zero-click exploits were highlighted in recent threat activity recaps.

Threat actors are increasingly leveraging leaked personal data to enhance the effectiveness of phishing campaigns.
Living-off-the-land techniques and the use of easily accessible tools continue to feature in sophisticated cyber attacks.
The value of all data types is being emphasised in the context of data breaches, not just financial or credential data.
There is a notable trend towards credential theft and resale, as evidenced by the rise of platforms like Russian Market.
Organizations are being encouraged to move from perimeter-based security to data-centric protection strategies.

Google Chrome will distrust root CA certificates from Chunghwa Telecom and Netlock in August 2025 due to compliance failures.
Australia has introduced new ransomware payment disclosure rules, requiring certain organizations to report ransomware payments and related communications within 72 hours or face civil penalties.
Microsoft and CrowdStrike have partnered to align hacking group aliases, improving clarity while not standardizing nomenclature.
The Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC) has shut down, impacting information sharing for the emergency services sector.

Sat, 31 May 2025 00:00:00 +0000

ConnectWise experienced a breach attributed to a “sophisticated nation state actor,” with subsequent targeting of ScreenConnect customers. Details remain limited.
Law enforcement took down AVCheck, an online service used by cybercriminals to test malware against commercial antivirus solutions prior to deployment.

Two critical vulnerabilities were identified in vBulletin forum software, with one confirmed as being actively exploited in the wild.
The Q1 2025 vulnerability and exploit report highlights ongoing high rates of published exploits, with notable vulnerabilities in SAP NetWeaver and Microsoft SQL Server among those actively targeted.
A PNG image was discovered containing concatenated payloads, demonstrating the continued use of file format manipulation for payload delivery.

A China-linked threat actor has been exploiting critical flaws in SAP NetWeaver and Microsoft SQL Server in attacks across Asia and Brazil. The group, also referred to as “Earth Lamia,” is actively targeting exposed servers in sensitive sectors to steal data.
The German Federal Criminal Police Office (BKA) publicly identified “Stern,” the alleged leader of the Trickbot and Conti ransomware groups, as Vitaly Nikolaevich Kovalev, a 36-year-old Russian national.
A new malware campaign is distributing EDDIESTEALER, a Rust-based information stealer that bypasses Chrome’s app-bound encryption to exfiltrate browser data. The campaign leverages fake CAPTCHA verification pages (ClickFix) for social engineering.
The U.S. Department of Treasury and FBI sanctioned Funnull Technology Inc., a Philippines-based company, for orchestrating $200 million in romance and cryptocurrency fraud scams, reportedly costing Americans billions annually.

Threat actors continue to exploit known vulnerabilities in widely used enterprise software (e.g., SAP, SQL Server, vBulletin) soon after disclosure.
Social engineering tactics, such as fake CAPTCHA pages, remain prominent in malware delivery campaigns.
Cybercriminals leverage online AV scanning services like AVCheck to refine malware evasion techniques.
There is increasing use of Rust for new malware families, as seen with EDDIESTEALER.
Pentera’s 2025 State of Pentesting report indicates attackers are focusing on specific high-value assets, with security teams facing challenges in prioritising remediation.
AI coding agents and tools are being rapidly adopted despite 96% of IT professionals acknowledging associated security risks, raising concerns about their potential to introduce vulnerabilities into software development and open source projects.

The U.S. Treasury’s OFAC sanctions against Funnull Technology Inc. represent a continued policy focus on disrupting large-scale cyber-enabled financial fraud operations.
Law enforcement’s takedown of AVCheck demonstrates increased international collaboration targeting cybercrime-enabling infrastructure.