UNC6395 on DanSec Daily

Cybersecurity Brief – 2025-09-16

Tue, 16 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Over 40 npm packages were compromised in a software supply chain attack, with attackers leveraging a malicious bundle.js file to steal credentials from affected developers and users.
FinWise Bank disclosed an insider breach impacting 689,000 American First Finance customers. A former employee accessed sensitive files after termination, exposing customer information.
KillSec ransomware group breached a major Brazilian healthcare software provider, stealing sensitive patient data and affecting a critical element of the healthcare technology supply chain.
Google confirmed that hackers created a fraudulent account in its Law Enforcement Request System (LERS), potentially enabling unauthorised access to sensitive law enforcement data requests.
The FBI’s IC3 issued a warning regarding threat actors UNC6040 and UNC6395 targeting Salesforce customers. These groups have conducted data theft and extortion campaigns against organisations using Salesforce, with the FBI sharing indicators of compromise (IoCs).
Panama’s Ministry of Economy and Finance (MEF) was affected by a cyber incident, as reported in recent threat intelligence bulletins.
Fairmont Federal Credit Union in West Virginia is notifying 187,000 people of a 2023 data breach that compromised personal, financial, and medical information.

Newly Discovered Vulnerabilities

Samsung patched a zero-day vulnerability affecting Android devices, which allowed remote code execution and was reportedly exploited by a spyware vendor. The flaw was reported by Meta and WhatsApp.
Academic researchers disclosed a new “Phoenix” Rowhammer attack variant that bypasses current DDR5 memory protection mechanisms from SK Hynix, allowing bit-flipping attacks despite existing mitigations.
Apple released iOS/iPadOS/macOS/watchOS/tvOS 26, addressing multiple security issues across its ecosystem.
Microsoft confirmed that the September 2025 Windows updates are causing connection issues to SMBv1 shares.
Microsoft has removed a safeguard hold for Windows 11 24H2 upgrades after resolving compatibility issues causing Bluetooth audio device malfunctions.

Notable Threat Actor Activity

Mustang Panda, a China-aligned threat group, was observed deploying an updated TONESHELL backdoor and a previously undocumented USB worm named SnakeDisk. The worm targets Thailand-based IPs and is used to deliver the Yokai backdoor.
Threat actors UNC6040 and UNC6395 continue to target Salesforce customers, conducting data theft and extortion campaigns.
Researchers demonstrated a “Lies-in-the-Loop” attack against Anthropic’s AI coding agent, tricking it into unsafe behaviour and enabling a potential supply chain attack.

Trends, Tools, or Tactics of Interest

Supply chain attacks continue to target open-source software repositories, as evidenced by the npm package compromise.
Increased focus on browser-based attacks, with reports highlighting a significant rise in attacks targeting users via web browsers.
AI integration protocols, specifically the Model Context Protocol (MCP), are being scrutinised for potential abuse in supply chain attacks, with proof-of-concept attacks demonstrating risks associated with insufficient validation of AI agent interactions.
Zero Trust security adoption remains inconsistent, with uneven implementation leaving organisations exposed despite its status as a security standard.
The use of USB worms for lateral movement and payload delivery, as seen with Mustang Panda’s SnakeDisk, indicates ongoing innovation in threat actor tactics.
“AI-powered” attacks and the security of AI agents are emerging as key areas of concern, including the manipulation of AI coding assistants.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft Exchange Server 2016 and 2019 will reach end of extended support next month, with Microsoft providing guidance for decommissioning outdated servers.
Microsoft will begin automatically installing the Microsoft 365 Copilot app on Windows devices outside of the EEA region for users with Microsoft 365 desktop client apps, starting in October.
Google reportedly conducted a behind-the-scenes campaign against new California privacy legislation, though the legislation ultimately passed, potentially impacting privacy compliance requirements for tech companies operating in California.
CISA’s “Secure by Design” initiative is emphasising the need for resilient IT infrastructure and secure system design practices.

Cybersecurity Brief – 2025-09-15

Mon, 15 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has issued a FLASH alert regarding UNC6040 and UNC6395, two threat actor clusters actively compromising Salesforce environments. These actors are stealing sensitive data and engaging in extortion of affected organisations.

Notable Threat Actor Activity

Chinese-speaking users are being targeted by a malware campaign leveraging SEO poisoning. The campaign uses fake software distribution sites, hosted via GitHub Pages, to deliver HiddenGh0st, Winos, and kkRAT malware families.
A new phishing-as-a-service (PhaaS) platform named VoidProxy has been identified. VoidProxy is designed to target Microsoft 365 and Google accounts, including those protected by third-party single sign-on (SSO) services.

Trends, Tools, or Tactics of Interest

Attackers are manipulating search engine rankings (SEO poisoning) to lure users to malicious sites, particularly for distributing malware to Chinese-speaking audiences.
There is an observed increase in web searches for ZIP file archives (e.g., backup.zip, web.zip) as noted by web honeypots, indicating potential reconnaissance or exploitation attempts targeting archived data.
The use of legitimate platforms like GitHub Pages for malware hosting continues to be a tactic, complicating detection and takedown efforts.
VoidProxy’s service highlights the ongoing professionalisation and accessibility of phishing operations, specifically targeting enterprise cloud accounts and SSO-protected environments.

Cybersecurity Brief – 2025-09-14

Sun, 14 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Apple has issued a fourth round of spyware attack notifications to users in France in 2025, confirmed by CERT-FR. These alerts relate to targeted campaigns using sophisticated spyware, with at least four notification waves sent this year.
The U.S. FBI has issued a flash alert regarding cybercriminal groups UNC6040 and UNC6395, which have conducted data theft attacks targeting Salesforce platforms. Indicators of compromise have been released to assist in detection and response.
A critical remote code execution vulnerability (CVE-2025-5086) in Dassault Systèmes DELMIA Apriso Manufacturing Operations Management software is being actively exploited. The vulnerability arises from deserialization of untrusted data, allowing attackers to achieve RCE. CISA has issued a warning regarding ongoing exploitation.
A payment system vendor, KioSoft, took over a year to patch a serious NFC card vulnerability that allowed infinite card top-ups, despite being notified in 2023. The patch has only recently been released.

Newly Discovered Vulnerabilities

Samsung has patched a critical zero-day vulnerability (CVE-2025-21043) affecting its Android devices, which was being actively exploited in the wild. The flaw enabled remote code execution and was initially reported via WhatsApp.
Researchers have identified a new ransomware strain, HybridPetya, which mimics Petya/NotPetya and exploits CVE-2024-7344 to bypass UEFI Secure Boot protections. The malware installs a malicious application on the EFI System Partition.
Academics have disclosed VMScape, a new variant of the Spectre attack that breaks cloud isolation by exploiting incomplete mitigations in the branch predictor state, enabling leakage of arbitrary memory between virtual machines.

Notable Threat Actor Activity

The ransomware group Yurei, first observed on 5 September 2025, has been identified as a new actor leveraging open-source ransomware. The group has begun listing victims on its leak site.
AI-powered phishing and social engineering attacks are being leveraged by threat actors to increase the success rate of ransomware campaigns, as highlighted in a report from Resilience.

Trends, Tools, or Tactics of Interest

AI-driven phishing campaigns are demonstrating higher success rates than traditional methods, fueling increased ransomware losses.
HybridPetya represents an evolution in ransomware tactics by targeting UEFI Secure Boot, indicating a shift toward lower-level system attacks.
Cloud-native security is increasingly focused on runtime visibility due to the widespread adoption of containers, Kubernetes, and serverless technologies.
Security researchers are combining tools like Burp Suite Professional with bug bounty platforms such as HackerOne to efficiently identify and report high-impact vulnerabilities.
The emergence of agentic and AI browsers is being discussed, with attention to their safety and implications for the future of web browsing.

Regulatory or Policy Developments Affecting the Security Industry

CISA has announced that the CVE Program will focus on enhancing the quality, trust, and responsiveness of vulnerability data.
Microsoft has reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 60 days, after which they will no longer receive security updates.
F5 has announced the acquisition of CalypsoAI for $180 million, aiming to integrate adaptive AI inference security solutions into its Application Delivery and Security Platform.

Cybersecurity Brief – 2025-08-28

Thu, 28 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

A cyberattack on Swedish IT systems supplier Miljödata has disrupted services across more than 200 municipalities, impacting approximately 80% of Sweden’s municipal systems.
Nevada state agencies experienced a disruptive cyberattack, leading to the shutdown of in-person services and state websites; emergency services reportedly remain unaffected.
Healthcare Services Group (HSGI) disclosed a data breach affecting 624,000 individuals, exposing personal information.
Hundreds of Salesforce customers were affected by a widespread data theft campaign, traced to compromised OAuth tokens associated with the Drift AI chat agent via the Salesloft platform. Attackers exported corporate data, including AWS and Snowflake keys.
TheTruthSpy stalkerware suffered a new vulnerability, exposing all user records to compromise.
77 malicious apps, including adware and advanced banking trojans, were removed from the Google Play Store following researcher discovery.

Newly Discovered Vulnerabilities

Over 28,000 Citrix NetScaler devices remain vulnerable to a critical remote code execution flaw (CVE-2025-7775), which is actively being exploited in the wild. Citrix and CISA have issued emergency patch deadlines.
Sangoma FreePBX issued an emergency fix for a zero-day vulnerability in its Administrator Control Panel, which has been actively exploited on internet-exposed systems.
A new vulnerability in TheTruthSpy Android stalkerware allows attackers to compromise any record in the system.

Notable Threat Actor Activity

The financially motivated Storm-0501 group has shifted tactics, exploiting Microsoft Entra ID to conduct data exfiltration and extortion attacks targeting hybrid and cloud environments, moving away from traditional ransomware to cloud-based encryption and data theft.
ShadowSilk, a threat cluster, targeted 35 government organizations in Central Asia and APAC using Telegram bots for command and control.
Blind Eagle, linked to five distinct activity clusters, targeted Colombia with RATs, phishing lures, and dynamic DNS infrastructure between May 2024 and July 2025.
China-linked actors, including Salt Typhoon and Mustang Panda, have been attributed to global espionage campaigns. Salt Typhoon operations were linked to Chinese tech firms and targeted networks worldwide. Mustang Panda hijacked captive portals to redirect Asian diplomats’ browsers to phishing sites.
UNC6395 engaged in widespread data theft, exploiting OAuth tokens from the Salesloft Drift app to compromise Salesforce customers.
UNC6384, another China-linked group, used social engineering, signed malware, and adversary-in-the-middle attacks to hijack web traffic and deliver backdoors.
“ZipLine” phishing campaign employed a novel technique where victims initiate email contact, affecting organizations across multiple sectors.
The Purgatory group has been identified as responsible for swatting attacks against US universities, offering such services for payment.

Trends, Tools, or Tactics of Interest

AI-powered ransomware has emerged with the discovery of PromptLock, a cross-platform strain using OpenAI’s gpt-oss:20b model and Lua scripts to encrypt and steal data on Windows, macOS, and Linux. PromptLock dynamically generates attack scripts in real time.
Anthropic disrupted an operation in which its Claude AI chatbot was weaponized for large-scale theft and extortion, automating reconnaissance, credential harvesting, and intrusions across critical sectors.
AI-generated phishing campaigns are increasingly sophisticated, with attackers crafting emails to deploy tools such as ConnectWise ScreenConnect for remote access.
Malware-as-a-service competition has led to more refined and accessible infostealers, driving modern cybercrime.
The Q2 2025 vulnerabilities and exploits report noted a significant number of published vulnerabilities and increased use of command-and-control frameworks.
Zero trust is highlighted as an ongoing, adaptive process in response to evolving threats, including supply chain attacks and policy drift.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. NSA, UK NCSC, and international partners issued a joint advisory attributing global hacking campaigns to Chinese state-sponsored actors, specifically Salt Typhoon, and provided guidance on countering such threats.
CISA and partners are providing real-time incident response support for the Nevada state cyberattack.
Google announced new developer verification requirements aimed at reducing harmful apps on Android, enhancing platform security.