https://blog.dansec.red/actors/vanilla-tempest/Recent content in Vanilla Tempest on DanSec DailyHugoen-gbFri, 17 Oct 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-10-17-cybersecurity-news/Fri, 17 Oct 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-10-17-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Sotheby’s disclosed a data breach in which threat actors accessed sensitive information, including financial details of individuals.</li> <li>Financial services company Prosper suffered a breach impacting over 17.6 million accounts, with personal information stolen.</li> <li>F5 confirmed a long-term breach of its systems, with attribution linked to Chinese threat actors. The attack exploited BIG-IP vulnerabilities, prompting patch releases and government alerts.</li> <li>Video call app Huddle01 exposed over 600,000 user logs due to a misconfigured Kafka broker.</li> <li>Fashion retailer Mango reported a data breach at a third-party marketing provider, exposing limited contact details.</li> <li>LastPass and other top password managers are being targeted by phishing campaigns aiming to exploit user trust in password vaults.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Cisco IOS and IOS XE Software: CVE-2025-20352, a remote code execution vulnerability, is being actively exploited to deploy Linux rootkits on older networking devices.</li> <li>Gladinet CentreStack: A local file inclusion vulnerability (CVE-2025-11371) has been exploited as a zero-day since late September; security updates have been released.</li> <li>Adobe Experience Manager: A maximum-severity vulnerability in AEM Forms is being actively exploited to execute code on unpatched systems.</li> <li>Fuji Electric HMI Configurator: Multiple vulnerabilities have been disclosed and patched, with advisories issued to industrial organizations.</li> <li>Windows Kernel (Rust-based GDI component): A security vulnerability identified by Check Point Research in January 2025.</li> <li>Microsoft Windows 11: Recent updates have broken HTTP/2 connections to localhost (127.0.0.1), impacting applications relying on this functionality.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>North Korean-affiliated actors are leveraging the EtherHiding technique to distribute malware and steal cryptocurrency, using blockchain smart contracts for resilience and stealth.</li> <li>Financially motivated threat actor UNC5142 is abusing blockchain smart contracts to distribute information stealers such as Atomic (AMOS), Lumma, and RedLine via infected WordPress sites.</li> <li>Chinese threat actors have been linked to the F5 breach and are reportedly testing AI-optimized attack chains in Taiwan.</li> <li>Vanilla Tempest (aka Vice Spider/Vice Society) used over 200 fraudulent certificates to sign malicious binaries in Rhysida ransomware campaigns, targeting Microsoft Teams users. Microsoft has revoked these certificates to disrupt ongoing attacks.</li> <li>Attackers are exploiting a Cisco SNMP flaw to deploy Linux rootkits (including the newly discovered LinkPro rootkit, which uses eBPF for stealth and activates via magic TCP packets) on AWS-hosted and on-premises infrastructure.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Increased abuse of blockchain technologies (smart contracts) for malware distribution and command-and-control, notably by both state-aligned and financially motivated actors.</li> <li>Emergence of new Linux rootkits (e.g., LinkPro) employing advanced stealth techniques such as eBPF and covert activation mechanisms.</li> <li>Phishing campaigns specifically targeting users of password managers, exploiting trust in these platforms.</li> <li>Security risks in the software supply chain highlighted by the discovery of over 550 unique secrets exposed in Microsoft Visual Studio Code marketplaces.</li> <li>AI-driven security tools are gaining traction, with new products emerging to automate vulnerability remediation and enterprise data protection.</li> <li>Security Operations Centers (SOCs) are under pressure to adopt AI-based platforms for scaling detection and response capabilities.</li> <li>Ongoing concerns regarding secure coding practices in AI-generated code, with emphasis on the need for improved training and oversight.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>Microsoft Office 2016 and Office 2019 have reached end of extended support as of October 14, 2025, with implications for continued security updates and compliance.</li> <li>Regulatory scrutiny on data handling practices, as evidenced by allegations against Roku for collecting and selling children&rsquo;s data in violation of privacy laws.</li> <li>Financial institutions are facing increasing challenges in data governance and regulatory risk management amid evolving compliance requirements.</li> </ul>