UAT-7237 on DanSec Daily

Cybersecurity Brief – 2025-08-19

Tue, 19 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Workday disclosed a data breach after attackers accessed a third-party CRM platform via social engineering, likely linked to the broader Salesforce attacks attributed to the ShinyHunters group. Exposed data was limited to “commonly available” business contact information, with no customer data compromised.
The Canadian House of Commons experienced a data breach, as noted in recent threat intelligence reporting.
Over 800 N-able N-central servers remain unpatched against two critical vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that have been actively exploited. More than 870 instances are affected globally.
Multiple web hosting firms in Taiwan were targeted by Chinese APT group UAT-7237, aiming for long-term access to high-value targets.
The US Department of Justice seized $2.8 million in cryptocurrency from a Zeppelin ransomware operator, following an indictment.

Newly Discovered Vulnerabilities

A critical Microsoft Windows vulnerability (CVE-2025-29824) was exploited to deploy the PipeMagic backdoor in RansomExx ransomware attacks, with observed activity in Brazil and Saudi Arabia.
Researchers disclosed a major internet-wide vulnerability enabling large-scale DDoS attacks, affecting a significant portion of websites since 2023.
A novel 5G attack, Sni5Gect, allows attackers to sniff traffic and disrupt networks without requiring a malicious base station.

Notable Threat Actor Activity

The Noodlophile malware campaign expanded its global reach, targeting enterprises with spear-phishing emails using copyright complaint lures to deliver information-stealing malware.
The source code for ERMAC v3 Android banking trojan was leaked online, exposing details of its malware-as-a-service infrastructure.
Chinese APT group UAT-7237 targeted Taiwanese web infrastructure for persistent access to high-value entities.
MFA-bombing attacks continue to be reported, with attackers sending repeated multi-factor authentication prompts to coerce user approval.

Trends, Tools, or Tactics of Interest

Malicious packages were discovered in both PyPI and npm repositories, leveraging dependencies for supply chain attacks and establishing persistence.
The evolution of the PipeMagic backdoor demonstrates ongoing adaptation of TTPs by its operators, with recent exploitation linked to a patched Microsoft Windows vulnerability.
Increasing sophistication of RATs (Remote Access Trojans) is prompting calls for more unified, behavior-aware detection approaches.
Attackers are leveraging weaknesses in multi-cloud environments due to inconsistent security monitoring and controls.
Ongoing phishing campaigns are using fake Gmail security alerts to trick users into account compromise.

Regulatory or Policy Developments Affecting the Security Industry

The European Union has made cybersecurity funding available for SMEs, with guidance published on how to access these resources.
Mozilla has raised concerns that a recent German Federal Supreme Court ruling could lead to browser-based ad blockers being declared illegal in Germany, potentially impacting privacy and security tools.
Wazuh has been highlighted as a tool for regulatory compliance, supporting organizations in meeting data protection and privacy obligations.
In the UK, a hacker responsible for compromising 3,000 websites was sentenced to 20 months in prison.

Cybersecurity Brief – 2025-08-18

Mon, 18 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Workday disclosed a data breach resulting from attackers gaining access to a third-party CRM platform, reportedly linked to a wider wave of Salesforce-related attacks targeting multiple organizations.
The Canadian House of Commons suffered a data breach, as reported in the latest threat intelligence bulletin.
A UK individual was sentenced to 20 months in prison for hacking approximately 3,000 websites.
Over 800 N-able N-central servers remain unpatched and exposed to two critical vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that have been actively exploited.
US authorities seized $2.8 million in cryptocurrency from a Zeppelin ransomware operator following an indictment.

Newly Discovered Vulnerabilities

A new vulnerability (CVE-2025-29824) has been linked to the evolution of the PipeMagic backdoor, with exploitation observed in attacks in Brazil and Saudi Arabia.
An internet-wide vulnerability affecting a significant proportion of websites has enabled large-scale DDoS attacks, considered the most significant since 2023.
Researchers disclosed a novel 5G attack technique (“Sni5Gect”) that allows attackers to sniff traffic and disrupt services without requiring a malicious base station.

Notable Threat Actor Activity

Chinese APT group UAT-7237 has been targeting web hosting firms in Taiwan to gain long-term access to high-value targets.
Zeppelin ransomware operator Ianis Antropenko has been indicted in the US, with cryptocurrency assets seized.
Malicious packages were discovered in the PyPI and npm repositories, introducing supply chain risks via dependencies that enable persistent access.

Trends, Tools, or Tactics of Interest

The PipeMagic backdoor has evolved in its tactics, techniques, and procedures (TTPs) since the RansomExx incident, now leveraging new vulnerabilities for access.
Evolving remote access trojans (RATs) are increasingly redefining enterprise security threats, with a focus on unified and behavior-aware detection approaches.
A surge in MFA-bombing attacks has been noted, where attackers repeatedly send MFA prompts to users in an attempt to cause confusion and gain unauthorized access.
The dual-use tool “LostMyPassword” has been highlighted for its capability to recover account passwords and serve as a rapid credential dumping utility during post-exploitation.
Organizations are struggling with security across multi-cloud environments, creating openings for attackers due to inconsistent monitoring and controls.
Security researchers have observed NFC-based fraud and Docker backdoors as part of emerging attack vectors.

Regulatory or Policy Developments Affecting the Security Industry

A recent ruling by Germany’s Federal Supreme Court has revived the legal debate over browser-based ad blockers, raising concerns that ad blockers could be declared illegal in Germany.
The European Union has ongoing cybersecurity funding initiatives aimed at supporting small- and medium-sized enterprises (SMEs) to address evolving threats and compliance requirements.

Cybersecurity Brief – 2025-08-16

Sat, 16 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Colt Technology Services, a UK-based telecommunications provider, experienced a cyberattack attributed to the WarLock ransomware group. The incident resulted in a multi-day outage affecting hosting and porting services, with stolen data now being offered for sale.
Italian hotels suffered a breach in which tens of thousands of scanned guest IDs were stolen and subsequently listed for sale on underground forums, according to CERT-AGID.
Web infrastructure entities in Taiwan were compromised by the Chinese-speaking APT group UAT-7237. The attackers used customized open-source tools to establish persistent access.
National Public Data, a service previously involved in a significant Social Security Number leak, has resumed operations under new ownership, raising concerns about the continued exposure and handling of leaked personal data.
The Canadian House of Commons was reportedly hacked, and the Pennsylvania Attorney General was targeted in a cyberattack. Russia was identified as being behind a separate attack on a court system.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical remote code execution vulnerability in the RADIUS subsystem of its Secure Firewall Management Center (FMC) software. The flaw is rated maximum severity.
Plex issued an urgent advisory for users to patch a recently discovered security vulnerability affecting its media servers.
Rockwell Automation released advisories for critical and high-severity vulnerabilities in its FactoryTalk, Micro800, and ControlLogix products.
A critical vulnerability was identified and patched in Zoom, details of which are referenced in industry news roundups.

Notable Threat Actor Activity

The Russian threat group EncryptHub continues to exploit a now-patched Microsoft Windows vulnerability (MSC EvilTwin) to deliver the Fickle Stealer malware.
WarLock ransomware claimed responsibility for the attack on Colt Technology Services and is selling exfiltrated data.
UAT-7237, a Chinese-speaking APT, targeted Taiwanese web servers with customized open-source hacking tools for long-term persistence.
Cybercriminals are leveraging sophisticated phishing kits to target brokerage account holders in a “ramp and dump” cashout scheme, converting stolen card data into mobile wallets.

Trends, Tools, or Tactics of Interest

Tech support scammers are targeting high-profile employees and influencers with fake podcast invitations as part of a new social engineering tactic, as reported by the Better Business Bureau.
There is an observed resurgence in traditional postal mail-based scams, with criminals exploiting physical mail systems to steal money.
Organizations are increasingly adopting AI-driven cybersecurity solutions to address staffing shortages and budget constraints.
Cybercriminals are shifting tactics to target brokerage accounts using mobile phishing and advanced cashout schemes.
The use of customized open-source tools by APT actors, such as UAT-7237, highlights a trend toward tailored toolsets for persistent access.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) renewed sanctions against the Russian cryptocurrency exchange Garantex and imposed new sanctions on Grinex, its successor, for facilitating ransomware-linked illicit crypto transactions exceeding $100 million.
Microsoft reiterated that Windows 10 support will end in October 2025, affecting all editions of version 22H2.
Google announced that Android pKVM has achieved SESIP Level 5 certification, denoting resistance to highly skilled and well-funded attackers.