UNC6384 on DanSec Daily

Cybersecurity Brief – 2025-11-01

Sat, 01 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Ribbon Communications, a US telecom company, disclosed a breach attributed to suspected nation-state actors, with initial access dating back to December of the previous year. The company has not confirmed whether sensitive data was accessed.
The University of Pennsylvania experienced a cybersecurity incident in which students and alumni received offensive emails from compromised university addresses, with threats to leak data.
Open VSX (Eclipse Foundation) revoked a small number of leaked tokens after discovery by Wiz. The incident was contained, and the foundation downplayed the impact, stating it was not a self-replicating worm.
Australian authorities issued warnings regarding ongoing attacks on unpatched Cisco IOS XE devices, with routers being compromised via the BadCandy webshell.

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Motex Lanscope Endpoint Manager (CVE-2025-xxxx) is being actively exploited by the China-linked Tick group for cyber espionage and system hijacking.
An unpatched Windows shortcut vulnerability is being exploited by China-affiliated threat actors, including UNC6384 and Mustang Panda, to target European diplomatic and government entities. Attacks use spear-phishing with European Commission and NATO-themed lures to deliver malware, including PlugX.
CISA confirmed active exploitation of a high-severity Linux kernel privilege escalation flaw by ransomware groups.
Broadcom updated its advisory to confirm in-the-wild exploitation of a VMware vulnerability (CVE-2025-41244), now added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Google released a Chrome update addressing 20 security issues, including seven serious flaws that could allow remote code execution via malicious web pages.

Notable Threat Actor Activity

Nation-state threat actors are distributing new malware named Airstalk as part of a suspected supply chain attack, according to Palo Alto Networks Unit 42.
China-linked UNC6384 and Mustang Panda are conducting targeted attacks against European diplomatic entities, exploiting unpatched Windows vulnerabilities.
The China-linked Tick group is exploiting a Lanscope zero-day for corporate system compromise.
Russian authorities arrested three individuals believed to be administrators of the Meduza Stealer malware operation after attacks on Russian organizations.
A Ukrainian national was extradited from Ireland to the US on charges related to participation in the Conti ransomware group.

Trends, Tools, or Tactics of Interest

OpenAI announced Aardvark, an agentic security researcher powered by GPT-5, designed to autonomously identify and remediate code flaws.
Microsoft Edge introduced a new scareware sensor to enhance scam detection capabilities and improve Defender SmartScreen response times.
Ongoing exploitation of unpatched networking devices (notably Cisco IOS XE) continues to be leveraged for webshell deployment and persistent access.
The use of spear-phishing with themed lures (European Commission, NATO) remains prevalent in targeted attacks on diplomatic sectors.
MSPs are facing increased client expectations for cybersecurity and compliance, amid evolving threats and regulatory demands.

Regulatory or Policy Developments

The United Nations adopted a new Convention Against Cybercrime, establishing an international framework for cross-border cybercrime cooperation.
CISA and NSA, in coordination with Australian and Canadian partners, issued urgent guidance to secure on-premises WSUS and Microsoft Exchange servers.
Japan released comprehensive OT security guidance for semiconductor factories, available in both Japanese and English.
CISA added exploited XWiki and VMware vulnerabilities to the Known Exploited Vulnerabilities catalog.

Cybersecurity Brief – 2025-08-28

Thu, 28 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

A cyberattack on Swedish IT systems supplier Miljödata has disrupted services across more than 200 municipalities, impacting approximately 80% of Sweden’s municipal systems.
Nevada state agencies experienced a disruptive cyberattack, leading to the shutdown of in-person services and state websites; emergency services reportedly remain unaffected.
Healthcare Services Group (HSGI) disclosed a data breach affecting 624,000 individuals, exposing personal information.
Hundreds of Salesforce customers were affected by a widespread data theft campaign, traced to compromised OAuth tokens associated with the Drift AI chat agent via the Salesloft platform. Attackers exported corporate data, including AWS and Snowflake keys.
TheTruthSpy stalkerware suffered a new vulnerability, exposing all user records to compromise.
77 malicious apps, including adware and advanced banking trojans, were removed from the Google Play Store following researcher discovery.

Newly Discovered Vulnerabilities

Over 28,000 Citrix NetScaler devices remain vulnerable to a critical remote code execution flaw (CVE-2025-7775), which is actively being exploited in the wild. Citrix and CISA have issued emergency patch deadlines.
Sangoma FreePBX issued an emergency fix for a zero-day vulnerability in its Administrator Control Panel, which has been actively exploited on internet-exposed systems.
A new vulnerability in TheTruthSpy Android stalkerware allows attackers to compromise any record in the system.

Notable Threat Actor Activity

The financially motivated Storm-0501 group has shifted tactics, exploiting Microsoft Entra ID to conduct data exfiltration and extortion attacks targeting hybrid and cloud environments, moving away from traditional ransomware to cloud-based encryption and data theft.
ShadowSilk, a threat cluster, targeted 35 government organizations in Central Asia and APAC using Telegram bots for command and control.
Blind Eagle, linked to five distinct activity clusters, targeted Colombia with RATs, phishing lures, and dynamic DNS infrastructure between May 2024 and July 2025.
China-linked actors, including Salt Typhoon and Mustang Panda, have been attributed to global espionage campaigns. Salt Typhoon operations were linked to Chinese tech firms and targeted networks worldwide. Mustang Panda hijacked captive portals to redirect Asian diplomats’ browsers to phishing sites.
UNC6395 engaged in widespread data theft, exploiting OAuth tokens from the Salesloft Drift app to compromise Salesforce customers.
UNC6384, another China-linked group, used social engineering, signed malware, and adversary-in-the-middle attacks to hijack web traffic and deliver backdoors.
“ZipLine” phishing campaign employed a novel technique where victims initiate email contact, affecting organizations across multiple sectors.
The Purgatory group has been identified as responsible for swatting attacks against US universities, offering such services for payment.

Trends, Tools, or Tactics of Interest

AI-powered ransomware has emerged with the discovery of PromptLock, a cross-platform strain using OpenAI’s gpt-oss:20b model and Lua scripts to encrypt and steal data on Windows, macOS, and Linux. PromptLock dynamically generates attack scripts in real time.
Anthropic disrupted an operation in which its Claude AI chatbot was weaponized for large-scale theft and extortion, automating reconnaissance, credential harvesting, and intrusions across critical sectors.
AI-generated phishing campaigns are increasingly sophisticated, with attackers crafting emails to deploy tools such as ConnectWise ScreenConnect for remote access.
Malware-as-a-service competition has led to more refined and accessible infostealers, driving modern cybercrime.
The Q2 2025 vulnerabilities and exploits report noted a significant number of published vulnerabilities and increased use of command-and-control frameworks.
Zero trust is highlighted as an ongoing, adaptive process in response to evolving threats, including supply chain attacks and policy drift.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. NSA, UK NCSC, and international partners issued a joint advisory attributing global hacking campaigns to Chinese state-sponsored actors, specifically Salt Typhoon, and provided guidance on countering such threats.
CISA and partners are providing real-time incident response support for the Nevada state cyberattack.
Google announced new developer verification requirements aimed at reducing harmful apps on Android, enhancing platform security.

Cybersecurity Brief – 2025-08-26

Tue, 26 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Farmers Insurance disclosed a data breach affecting 1.1 million individuals, with the compromise traced to broader attacks on Salesforce environments.
French retailer Auchan reported a cyberattack that exposed sensitive loyalty account data of several hundred thousand customers.
Aspire Rural Health System confirmed a data breach impacting nearly 140,000 individuals, attributed to the BianLian ransomware group.
Data I/O, a chip programming firm, experienced a ransomware attack disrupting communications, shipping, and production operations.
Arch Linux Project has been subject to a week-long DDoS attack, affecting its website, repository, and forums.
US pharmaceutical company Inotiv suffered a cyberattack, as reported in threat intelligence bulletins.
Lab-Dookhtegen claimed responsibility for attacks disabling communications on more than 60 Iranian cargo ships and oil tankers.

Newly Discovered Vulnerabilities

Docker released patches for CVE-2025-9074, a critical container escape vulnerability (CVSS 9.3) in Docker Desktop for Windows and macOS, which allowed attackers to compromise host systems even with Enhanced Container Isolation enabled.
CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, impacting Citrix Session Recording and Git.
Researchers described the “OneFlip” attack, a Rowhammer-based technique that flips a single bit in neural network weights, enabling stealthy backdoors in AI systems.
Multiple password manager flaws and an Apple 0-day were highlighted as being exploited in the wild.
Researchers detailed a new AI attack method that hides data-theft prompts in downscaled images processed by large language models.
The “ClickFix” attack was described, where AI-generated content summaries are abused to push malware.
Prompt injection vulnerabilities in AI browsers were reported, with potential for significant financial risk to users.

Notable Threat Actor Activity

The China-nexus threat actor UNC6384 was attributed to attacks against diplomats in Southeast Asia and globally, deploying PlugX malware via captive portal hijacks and valid certificates.
Transparent Tribe (APT36), a Pakistani state-sponsored group, targeted Indian government entities and Linux systems with malicious desktop shortcut files as part of a phishing campaign.
The Anatsa Android banking trojan expanded operations, now targeting 830 financial and cryptocurrency applications across additional countries.
A new phishing campaign was identified using fake voicemail and purchase order emails to deliver the UpCrypter malware loader, which installs remote access trojans (RATs) for persistent access.
Surge in coordinated scanning activity detected against Microsoft Remote Desktop Web Access and RDP authentication servers, involving nearly 2,000 IP addresses.
BianLian ransomware group was confirmed as responsible for the Aspire Rural Health System breach.

Trends, Tools, or Tactics of Interest

Seventy-seven malicious Android apps, totalling over 19 million installs, were removed from Google Play after being found to contain various types of malware.
Fast-spreading, complex phishing campaigns are increasingly delivering RATs, enabling both credential theft and long-term network persistence.
Attackers are leveraging malware persistence techniques such as scheduled tasks and startup scripts, with detection and blocking methods highlighted for platforms like Wazuh.
SIEM rule effectiveness was analysed using 160 million attack simulations, revealing common detection failures and the need for improved tuning.
Ongoing DDoS attacks continue to target open-source and infrastructure projects, as seen with the Arch Linux Project.

Regulatory or Policy Developments Affecting the Security Industry

Google announced forthcoming requirements to verify the identity of all Android app developers in four countries, extending to those distributing apps outside the Play Store.
CISA published updated guidance on the Minimum Elements for a Software Bill of Materials (SBOM) and requested public feedback.
The US Federal Trade Commission (FTC) chair issued letters to major tech companies, urging them not to weaken encryption in response to foreign government demands.