Cybersecurity Brief – 2025-08-01

Fri, 01 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

A Florida correctional institution inadvertently leaked the names, email addresses, and telephone numbers of all facility visitors to every inmate.
North Korea-linked threat actor UNC4899 targeted two organizations to steal millions in cryptocurrency by luring employees via LinkedIn and Telegram, leveraging cloud account access and malware.
Financially motivated threat actor UNC2891 breached ATM networks using a 4G-equipped Raspberry Pi device and attempted to deploy the CAKETAP rootkit for fraudulent activity.

Newly Discovered Vulnerabilities

Multiple critical and high-severity vulnerabilities were patched in Honeywell Experion PKS, an industrial process control and automation product, which could have allowed manipulation of industrial processes.
Malicious connectors in Microsoft 365 were highlighted as a serious and growing email threat vector, potentially impacting hundreds of millions of users.

Notable Threat Actor Activity

The Russian state-affiliated group Secret Blizzard (also known as Turla) was observed using adversary-in-the-middle (AitM) attacks at the ISP level to deploy malware against foreign embassies in Moscow, leveraging local ISP access to intercept and manipulate web traffic.
Scattered Spider, a threat actor known for social engineering, continues to use techniques that mimic legitimate IT support to gain access to target networks, as noted in a recent CISA advisory update.
SentinelLabs reported links between Chinese state-sponsored hackers and Chinese companies developing intrusion tools used in offensive operations.

Trends, Tools, or Tactics of Interest

Researchers identified a multi-layer redirect phishing tactic targeting Microsoft 365 users, which abuses link wrapping services from Proofpoint and Intermedia to bypass security defenses and steal login credentials.
ClickFix and FileFix were profiled as social engineering attacks that start in the browser and use clipboard or File Explorer hijacking to deliver malware.
Analysis revealed that in approximately 80% of cases, spikes in malicious activity such as network reconnaissance and targeted scanning precede the public disclosure of new security vulnerabilities (CVEs).
LayerX demonstrated that browser extensions can be exploited to compromise generative AI tools via a technique dubbed ‘man-in-the-prompt’, posing a significant risk to sensitive data.
BrainDamage, a new payload generator and encrypted shell stager toolkit, was released for red team operations, focusing on stealth and remote command delivery.
Kali Linux is now supported in Apple containers on macOS Sequoia, expanding virtualization options for security professionals.
CISA released Thorium, an open-source platform for malware and forensic analysis, aimed at supporting containment and eviction during incident response.
The Gartner 2025 Magic Quadrant highlights increasing adoption of AI-driven solutions in endpoint security to address complex and growing threats.
Security Operations Centers are experiencing alert fatigue and data overload, with traditional SIEMs struggling to keep pace with increasing log volumes and complexity.
Proton launched a free, standalone, cross-platform two-factor authentication app, Proton Authenticator.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced that, between October 2025 and July 2026, it will disable external workbook links to blocked file types by default in Excel.
Microsoft expanded its .NET and ASP.NET Core bug bounty program, offering rewards of up to $40,000 for eligible vulnerabilities.
Meta is sponsoring the Pwn2Own Ireland 2025 hacking competition, offering up to $1 million for a successful WhatsApp exploit.
The Trump Administration, in collaboration with 60 companies, is developing a plan for Americans to voluntarily upload their healthcare and medical data.
Significant funding rounds were announced: Noma Security raised $100 million for AI agent security solutions, Wallarm raised $55 million for API security, and Reach Security received $10 million for AI-driven exposure management solutions.

Cybersecurity Brief – 2025-07-31

Thu, 31 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group has been linked to data breaches at Qantas, Allianz Life, LVMH, and Adidas, using voice phishing attacks to steal data from Salesforce environments.
SafePay ransomware group claims to have stolen 3.5TB of data from Ingram Micro and is threatening to leak the data.
Telecom provider Orange suffered a cyberattack resulting in service disruptions for both corporate and individual customers.
The UNC2891 (LightBasin) threat group attempted a physical intrusion by planting a 4G-equipped Raspberry Pi on a bank’s network during a failed ATM heist.
The City of Saint Paul, Minnesota, called in the National Guard to respond to a cyberattack.
The National Treasury of South Africa and several other organisations were compromised in mass exploits of on-premises Microsoft SharePoint servers.
A U.S.-based chemicals company was breached via exploitation of a SAP NetWeaver vulnerability, leading to deployment of the Auto-Color backdoor.
The Python Software Foundation warned that attackers are using a fake PyPI website to phish for developer credentials.
Over 250 fake mobile apps targeting Koreans have been used to deploy spyware and conduct blackmail campaigns.
Discord and other social platforms are being flooded with fraudulent online gaming and wagering sites, which lure users and steal funds.

Newly Discovered Vulnerabilities

Apple released security updates for iOS, iPadOS, and Safari, patching 29 vulnerabilities, including a WebKit flaw that was exploited as a zero-day in Google Chrome.
Lenovo issued UEFI firmware updates to address high-severity BIOS flaws enabling Secure Boot bypass in certain desktop models.
Critical, now-patched vulnerabilities in Dahua smart camera firmware could allow remote hijacking via ONVIF and file upload exploits.
Researchers disclosed a critical authentication bypass in the Vibe coding platform Base44, which exposed private enterprise applications; Wix patched the issue.
A critical unauthenticated arbitrary file upload vulnerability in the WordPress ‘Alone’ theme is being actively exploited for remote code execution and full site takeovers.

Notable Threat Actor Activity

Cobalt Strike Beacon is being delivered via social media, Microsoft Learn Challenge, Quora, and GitHub in a campaign targeting Russian entities.
Hackers are distributing JSCEAL malware through Facebook ads promoting fake cryptocurrency trading apps, using compiled V8 JavaScript to capture sensitive data.
Chinese state-sponsored group Silk Typhoon (Hafnium) is linked to over 15 technology patents for cyber espionage tools, highlighting PRC-backed contractor involvement.
Scattered Spider’s activity has decreased following recent arrests, but their social engineering and backup targeting tactics are being adopted by other financially motivated actors.

Trends, Tools, or Tactics of Interest

Device Bound Session Credentials (DBSC) launched in open beta in Google Chrome to protect against session cookie theft.
A new attack vector allows threat actors to use malicious browser extensions to inject prompts into popular generative AI tools, including ChatGPT and Gemini (“Man in the Prompt” attack).
AI adoption in vCISO services is rapidly increasing, with a reported 68% reduction in workload and tripling of adoption rates among MSPs and MSSPs.
VPN usage in the UK is rising sharply in response to age verification controls mandated by the Online Safety Act.
Security awareness training and tools, such as KnowBe4’s Phish Alert Button, can significantly increase employee phishing reporting rates, as evidenced by a 50-fold increase in a large retail organisation.
Fraudsters are exploiting Discord and social media to promote sophisticated scam gaming sites.
Mass exploitation of on-premises Microsoft SharePoint servers continues to impact organisations, particularly in Africa.
Threat actors are using phishing with fake PyPI sites to target software developers and steal credentials.

Regulatory or Policy Developments

The US Senate Committee has advanced the nomination of Sean Plankey to lead the Cybersecurity and Infrastructure Security Agency (CISA).
The UK’s Online Safety Act, which mandates age verification on adult sites, is directly influencing a surge in VPN adoption across the region.

Industry Developments

Palo Alto Networks announced the acquisition of CyberArk for $25 billion, marking a significant move into the identity security market.
BlinkOps raised $50 million for its agentic security automation platform, bringing total funding to $90 million.
Legion emerged from stealth with $38 million in funding for its browser-native AI Security Operations Center (SOC) platform.
Cyata, an Israeli startup focused on AI agent monitoring and control, raised $8.5 million in funding.
The average cost of a data breach in the US has risen to $10.22 million, while the global average has decreased slightly to $4.44 million, according to IBM.

UNC2891 on DanSec Daily

Cybersecurity Brief – 2025-08-01

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-07-31

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Industry Developments