UNC1549 on DanSec Daily

Cybersecurity Brief – 2025-11-19

Wed, 19 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The Pennsylvania Attorney General’s office confirmed a data breach following a ransomware attack by the Inc Ransom group, which claims to have stolen several terabytes of data.
Princeton University disclosed a data breach affecting alumni, donors, faculty, students, and parents, with hackers accessing a database containing personal information.
Eurofiber France suffered a breach where a threat actor exploited a vulnerability, exfiltrated data, and attempted extortion.
French social security agency Pajemploi reported a data breach potentially exposing the personal information of 1.2 million individuals.
DoorDash disclosed a data breach involving theft of customer names and addresses.
A simple flaw in WhatsApp’s contact discovery tool exposed up to 3.5 billion phone numbers, along with profile photos and other data, by allowing mass enumeration.
Cloudflare experienced a global outage affecting multiple major online services, though it was confirmed not to be caused by a cyberattack.

Newly Discovered Vulnerabilities

Fortinet released patches for a new FortiWeb zero-day vulnerability (CVE-2025-58034, CVSS 6.7) that is being actively exploited in the wild.
Google released an emergency update to address a new Chrome zero-day vulnerability under active exploitation, marking the seventh Chrome zero-day exploited this year.
Researchers identified that exposed Ray clusters are being hijacked via an old code execution flaw in a campaign dubbed ShadowRay 2.0, converting them into a cryptomining botnet.
IoT devices remain susceptible to takeover via gaps in cloud management interfaces for firewalls and routers, even if protected by security software or not directly online.

Notable Threat Actor Activity

Iranian-linked threat actors, including UNC1549, have been observed targeting aerospace and defense sectors in the US, Israel, UAE, Qatar, Spain, and Saudi Arabia, deploying backdoors such as TWOSTROKE and DEEPROOT.
The Inc Ransom group claimed responsibility for the ransomware attack and data breach at the Pennsylvania Attorney General’s office.
A new phishing kit is impersonating the Italian IT provider Aruba, targeting Italian entities to steal credentials.
MI5 warned UK lawmakers that Chinese intelligence operatives are using LinkedIn for large-scale outreach and espionage efforts.
Seven malicious npm packages were discovered using Adspect cloaking to differentiate between security researchers and real victims, redirecting the latter to cryptocurrency scam pages.

Trends, Tools, or Tactics of Interest

Phishing-as-a-Service (PhaaS) kit Sneaky 2FA has added Browser-in-the-Browser (BitB) pop-up functionality to better mimic legitimate login processes and bypass 2FA.
The Tycoon 2FA phishing platform has enabled real-time MFA relays, supporting over 64,000 attacks this year, highlighting the ongoing collapse of legacy MFA when targeted by advanced phishing kits.
Tuoni C2, a nascent command-and-control and red teaming framework, was used in a recent attempted cyber intrusion targeting a major US real-estate company.
Microsoft mitigated a record-breaking 15.72 Tbps DDoS attack against an endpoint in Australia, attributed to the AISURU botnet.
Enterprises are increasingly leveraging dark web search engines for credential leak monitoring, impersonation detection, and supply chain exposure analysis using APIs and IOC hunting.
Bug bounty programs continue to rise as a key strategic security solution, with Meta alone paying out $4 million in 2025 and launching new tools to support security research on WhatsApp.
Microsoft announced native integration of Sysmon into Windows 11 and Server 2025, eliminating the need for standalone deployment.
New Windows 11 features, Cloud Rebuild and Point-in-Time Restore, aim to streamline system recovery and reduce downtime.
Microsoft Teams will soon allow users to report messages incorrectly flagged as threats, refining threat detection accuracy.
Thunderbird 145 now supports native connectivity to Microsoft Exchange via EWS protocol.

Regulatory or Policy Developments Affecting the Security Industry

MI5 issued a formal warning to UK lawmakers regarding ongoing Chinese espionage campaigns leveraging professional networking platforms.

Cybersecurity Brief – 2025-09-21

Sun, 21 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-nexus cyber espionage group, compromised 34 devices across 11 European telecommunications firms using LinkedIn job lures and the MINIBIKE malware.
Over 600,000 individuals were impacted by healthcare data breaches in the past day, with additional major intrusions attributed to the ShinyHunters group.
The Royal Canadian Mounted Police dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million linked to criminal activity.
FBI issued an alert regarding cybercriminals impersonating the FBI’s Internet Crime Complaint Center (IC3) via fake reporting portals for malicious purposes.

Newly Discovered Vulnerabilities

Fortra released a critical patch for a command injection vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT) software, specifically in its License Servlet. Exploitation enables arbitrary command execution.
OpenAI’s ChatGPT Deep Research agent was found vulnerable to a zero-click flaw, allowing attackers to exfiltrate Gmail inbox data via a single crafted email. The vulnerability has since been patched.
Novakon HMIs were reported to have unpatched remote code execution and information exposure vulnerabilities, exposing industrial control systems to remote attacks.
A critical vulnerability was disclosed and fixed in Microsoft Azure Entra ID that could have enabled catastrophic identity and access management attacks if exploited.

Notable Threat Actor Activity

Russian APT groups Turla and Gamaredon, both linked to the FSB, were observed collaborating to compromise high-profile Ukrainian targets. Turla deployed malware on systems previously accessed by Gamaredon, including the Kazuar backdoor.
The Iranian APT group, including a Charming Kitten subgroup, conducted sophisticated cyberattacks targeting telecommunications and satellite companies, using bespoke targeting techniques.
The Scattered Spider group had two suspected members arrested in the UK, with one charged in the US for hacking critical infrastructure.
SystemBC malware is powering the REM Proxy botnet, leveraging approximately 1,500 daily VPS victims and 80 C2 servers to provide proxy services to threat actors.

Trends, Tools, or Tactics of Interest

A phishing-as-a-service (PhaaS) surge was observed, with Lighthouse and Lucid platforms linked to over 17,500 phishing domains targeting 316 brands across 74 countries.
Atomic Infostealer is being distributed to macOS users via fake GitHub repositories, with campaigns targeting LastPass users.
Researchers identified the earliest known malware, codenamed MalTerminal, embedding GPT-4 LLM capabilities for automated ransomware creation and reverse shell generation.
CISA published an analysis of malware kits deployed in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, detailing tactics such as system information collection, credential dumping, and arbitrary code execution.
Ransomware attacks continue to evade defenses, with prevention rates dropping to 62% and data exfiltration prevention at only 3%, per the Picus Blue Report 2025.
Synthetic identity fraud is resurging in the finance and lending sector, with estimated damages reaching $3.3 billion from new accounts.
ChatGPT was demonstrated to be capable of solving CAPTCHAs and mimicking human cursor behaviour, highlighting risks in automated abuse of AI agents.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and reaching a valuation of $8.6 billion.
Valve announced Steam will end support for 32-bit Windows in January 2026, affecting software compatibility and potentially security posture for legacy systems.

Cybersecurity Brief – 2025-09-20

Sat, 20 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-linked cyber espionage group, successfully infiltrated 34 devices across 11 European telecommunications organisations using LinkedIn job lures and the MINIBIKE malware.
Russian threat groups Gamaredon and Turla collaborated in a campaign targeting Ukrainian entities, with Turla malware deployed on systems previously compromised by Gamaredon.
Over 600,000 individuals were impacted by recent healthcare sector breaches; ShinyHunters was identified as responsible for major attacks.
The FBI issued a warning about cybercriminals creating fake FBI Internet Crime Complaint Center (IC3) portals for malicious activity.
The REM Proxy botnet, powered by SystemBC malware, currently controls approximately 1,500 VPS victims daily via 80 C2 servers.
A surge in phishing-as-a-service (PhaaS) operations, notably Lighthouse and Lucid, has resulted in over 17,500 phishing domains targeting 316 brands in 74 countries.

Newly Discovered Vulnerabilities

Fortra disclosed and patched a critical vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT), allowing remote command injection via the License Servlet.
A zero-click vulnerability in OpenAI ChatGPT’s Deep Research agent enabled attackers to exfiltrate Gmail inbox data through a crafted email. OpenAI has since patched the issue.
Novakon Human-Machine Interfaces (HMIs) were found to have unpatched remote code execution and information exposure vulnerabilities.
A critical flaw in Microsoft Azure Entra ID was disclosed and fixed; it could have enabled catastrophic identity and access management attacks.
CISA released an analysis of malware kits used in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, where attackers chained two flaws to collect system information, dump credentials, and execute malware.

Notable Threat Actor Activity

Iranian APT group UNC1549 targeted European telecom and satellite companies with highly bespoke attacks, leveraging LinkedIn lures and custom malware.
Russian APTs Gamaredon and Turla collaborated to compromise Ukrainian organisations, with evidence of sequential deployment of their respective malware.
Scattered Spider group members were arrested in the UK and charged in the US for attacks on critical infrastructure organisations.

Trends, Tools, or Tactics of Interest

Researchers identified the earliest known malware (MalTerminal) embedding GPT-4-powered LLM capabilities, enabling autonomous creation of ransomware and reverse shells.
ChatGPT was demonstrated as capable of solving CAPTCHAs and mimicking human cursor movement, highlighting ongoing risks of AI-driven automation in bypassing security controls.
Ransomware continues to evade defences, with latest data showing only 62% prevention rates and data exfiltration prevention dropping to 3%.
Synthetic identity fraud in the finance and lending sector is rising post-pandemic, with estimated damages reaching $3.3 billion from new accounts.
The Tines platform released over 1,000 pre-built AI-driven security automation workflows, facilitating automated alert triage and response using AI agents and Confluence SOPs.
Industrial automation systems remain a high-value target, with Kaspersky reporting a broad range of malicious objects detected on ICS computers in Q2 2025.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and achieving a valuation of $8.6 billion.
Valve announced that Steam will end support for 32-bit Windows systems in January 2026, impacting legacy software environments.