UNC5174 on DanSec Daily

Cybersecurity Brief – 2025-10-01

Wed, 01 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

UK law enforcement seized £5.5 billion (~$7.39 billion) in Bitcoin from a Chinese national convicted for involvement in a fraudulent cryptocurrency scheme, marking the world’s largest crypto asset seizure to date.
Canadian airline WestJet confirmed that a recent cyberattack compromised sensitive customer information, including passports and ID documents.
Beer producer Asahi suffered a cyberattack that disrupted production, order processing, shipments, and call centre operations in Japan.
Imgur has blocked UK users from accessing its platform after the UK data protection authority signalled a possible monetary penalty for non-compliance.
Interpol arrested 260 individuals involved in romance scams and sextortion, identifying 1,463 victims and $2.8 million in losses.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2025-32463) in the Linux sudo package is being actively exploited, allowing attackers to execute commands with root privileges.
Western Digital patched a critical remote command injection vulnerability in multiple My Cloud NAS models.
Apple released updates for iOS and macOS to address a critical font processing vulnerability (CVE-2025-43400) that could enable denial-of-service or memory corruption.
Nearly 50,000 Cisco ASA and FTD firewalls exposed on the public internet remain vulnerable to two actively exploited flaws.
Broadcom released security updates for high-severity vulnerabilities in VMware Aria Operations, NSX, and vCenter, including privilege escalation and username enumeration flaws.
Academics disclosed the “Battering RAM” vulnerability affecting Intel and AMD cloud processors, capable of bypassing the latest hardware security defences.
Security researchers disclosed and Google patched three vulnerabilities in Google Gemini AI, including prompt injection and cloud exploitation methods.
Researchers highlighted multiple security issues in Life360’s Tile trackers, primarily due to lack of encryption.

Notable Threat Actor Activity

A previously undocumented China-linked APT group, “Phantom Taurus,” targeted government and telecommunications entities across Africa, the Middle East, and Asia using stealthy, fileless malware such as IIServerCore.
The China-linked threat actor UNC5174 exploited a VMware zero-day (privilege escalation in VMware Tools and Aria Operations) since October 2024 in active attacks.
A new Android banking trojan, “Datzbro,” is using AI-generated Facebook travel events to target elderly users, enabling device takeover and fraudulent transactions.
The “Klopatra” banking trojan has infected thousands of victims in Italy and Spain, capable of conducting automated bank transfers while users are inactive.

Trends, Tools, or Tactics of Interest

Attackers are leveraging the new MatrixPDF toolkit to weaponise PDF files for phishing and malware campaigns, enabling interactive lures that bypass email security and facilitate credential theft.
The proliferation of “shadow AI” risks is increasing as organisations adopt agentic AI and embedded LLMs, with associated security challenges highlighted in both enterprise and SaaS environments.
Dark web exploit markets continue to thrive, with evolving pricing models, access methods, and a growing arsenal for sale to threat actors.
Security operations centres (SOCs) are challenged by alert fatigue and the need for contextual incident response, with legacy systems contributing to inefficiency.
Weak default passwords in IoT and web applications remain a common entry point for attackers, as highlighted in recent honeypot and password research.

Regulatory or Policy Developments Affecting the Security Industry

China introduced a regulation mandating that major cyber incidents must be reported within one hour, signalling an increased focus on internal cybersecurity posture.
California enacted the Transparency in Frontier Artificial Intelligence Act (TFAIA), requiring AI companies to implement and publicly disclose safety protocols for advanced models.
New international guidance urges operators of operational technology (OT) environments to maintain continually updated system inventories for improved security and resilience.
The UK data watchdog’s enforcement against Imgur demonstrates increasing regulatory scrutiny and penalties for non-compliance with data protection requirements.
The US Federal Trade Commission (FTC) filed suit against Sendit for illegally collecting data from underage users and deceptive subscription practices.

Cybersecurity Brief – 2025-06-10

Tue, 10 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Sensata Technologies confirmed a data breach following an April ransomware attack, with personal data of current and former employees compromised.
United Natural Foods (UNFI), North America’s largest publicly traded grocery wholesaler, experienced a cyberattack that forced the shutdown of some systems.
Data stolen from Ticketmaster during the 2024 Snowflake data theft attacks was briefly relisted for sale by the Arkana Security extortion group, but no new breach is indicated.
SentinelOne disclosed new details about an attempted supply chain attack by Chinese hackers, targeting the company through an IT services and logistics provider.

Newly Discovered Vulnerabilities

Over 84,000 instances of Roundcube webmail remain vulnerable to CVE-2025-49113, a critical remote code execution vulnerability with a public exploit, which is being actively exploited.
CISA added critical vulnerabilities in Erlang/Open Telecom Platform (OTP) SSH and Roundcube to its Known Exploited Vulnerabilities Catalog.
A now-patched critical flaw in Wazuh Server has been exploited in the wild by threat actors deploying two different Mirai botnet variants for DDoS attacks.
A Google account vulnerability allowed brute-forcing of recovery phone numbers using only a profile name and partial number; the issue has been patched.

Notable Threat Actor Activity

The Librarian Ghouls APT continues targeting Russian entities, using RAR archives and BAT scripts to steal data and deploy cryptominers, often leveraging legitimate tools and executing attacks at night to evade detection.
Chinese state-linked threat groups APT15 and UNC5174 (also referenced as “PurpleHaze”) targeted SentinelOne and more than 70 other organizations across multiple sectors between July 2024 and March 2025, focusing on cyber-espionage and supply chain attacks.
The criminal group UNC6040 is conducting vishing (voice phishing) campaigns to compromise Salesforce instances, according to Google Threat Intelligence Group.
A global spear-phishing campaign is targeting CFOs with fraudulent employment offers, aiming at financial executives worldwide.
OpenAI has banned ChatGPT accounts linked to nation-state threat actors, citing use for malicious activities including social engineering, employment fraud, and cyber espionage.

Trends, Tools, or Tactics of Interest

Multiple botnets are exploiting the Wazuh Server vulnerability to deploy Mirai-based DDoS attacks, demonstrating ongoing interest in IoT botnet infrastructure.
Security researchers highlight that SIEMs are missing coverage for many MITRE ATT&CK techniques, with a significant proportion of detection rules non-functional.
Shadow IT risks persist despite IdP or CASB controls, with free trials, third-party AI tools, and personal accounts presenting ongoing exposure.
AI coding tools are increasing enterprise risk by enabling insecure code generation, as developers adopt new workflows with insufficient security oversight.
The Linux Foundation has launched the FAIR Package Manager, a decentralized and independent distribution system for trusted WordPress plugins.

Regulatory or Policy Developments

A new Trump administration cybersecurity order has reversed certain Biden and Obama-era priorities, including limits on cyber sanctions, termination of the digital ID program, and a refocus on enabling AI, deploying post-quantum cryptography, and promoting secure software development.

Cybersecurity Brief – 2025-04-16

Wed, 16 Apr 2025 00:00:00 +0000

Phishing Remains Top Cyberattack in the UK:
- Phishing was identified as the most common and disruptive cyberattack faced by UK organizations in the past year.
North Korea Expands Fraudulent IT Worker Operations:
- North Korea has expanded its fraudulent IT worker operations, posing a new threat.
MITRE’s CVE Funding Expires:
- The U.S. government’s funding for MITRE to operate and maintain the CVE program ends, raising concerns in the cybersecurity community.
Chinese Hackers Target Linux Systems:
- A China-linked threat actor known as UNC5174 is using SNOWLIGHT malware and the VShell tool to target Linux systems.
Critical Apache Roller Vulnerability Discovered:
- A critical vulnerability in Apache Roller blogging server software allows unauthorized session persistence.
Browser Extensions Pose Security Risks:
- Majority of browser extensions can access sensitive enterprise data, posing a risk to organizations.
Malicious PyPI Package Targets MEXC Trading API:
- A malicious package on PyPI targets MEXC trading API to steal credentials and redirect orders.
Python Malware Targets Crypto Developers:
- Python malware disguised as coding challenges targets crypto developers to deliver new stealer malware.
Midnight Blizzard Targets Diplomatic Entities:
- Russian state-sponsored group Midnight Blizzard deploys new GrapeLoader malware in embassy phishing attacks.
Landmark Admin Data Breach Impact Grows:
- Landmark Admin data breach now affects 1.6 million individuals.
Infamous 4chan Forum Taken Down in Hack:
- 4chan was taken offline following a major hack affecting the notorious online forum.
Microsoft Disabling ActiveX Controls:
- Microsoft will disable ActiveX controls in Microsoft 365 and Office 2024 applications.
Google Implements Auto-Reboot for Android Security:
- Google introduces auto-reboot feature on Android to enhance security.
Max Severity Bug in Apache Roller Allows Persistent Access:
- Adversaries could retain access to Apache Roller due to a remediated flaw.
Bad Bots Increasingly Difficult to Detect:
- Bad bots are evolving to mimic human behaviors, making them harder to detect.
AI-Powered Tool Used in Phishing Attacks:
- Threat actors leverage the legitimate presentation tool named “Gamma” in phishing attacks.
Hertz Falls Victim to Cleo Zero-Day Attacks:
- Cleo zero-day attacks lead to the theft of customer data from Hertz.
Wave of Wine-Inspired Phishing Attacks Target EU Diplomats:
- A phishing campaign targeting EU diplomats uses wine-tasting events as a lure.
Funding Expires for Key Cyber Vulnerability Database:
- A critical cybersecurity resource’s funding is at risk of expiring, impacting vulnerability identification and mitigation efforts.