CVE-2025-10035 on DanSec Daily

Cybersecurity Brief – 2025-10-12

Sun, 12 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall SSL VPN devices: Huntress reported a widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into over 100 customer environments to access internal systems.
Gladinet CentreStack and TrioFox: Active exploitation of a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox products has been observed, allowing unauthenticated local file access and potential escalation to remote code execution. The flaw remains unpatched.
BreachForums Takedown: The FBI seized all domains of the BreachForums hacking forum operated by the ShinyHunters group, which was used for leaking data from ransomware and extortion attacks, including recent Salesforce-related incidents.
AI Companion Apps Data Leak: Two AI “girlfriend” apps exposed millions of private chat logs belonging to over 400,000 users.
Oracle EBS Zero-Day Attacks: Sophisticated malware was deployed in attacks exploiting a zero-day in Oracle E-Business Suite (EBS), affecting dozens of organizations since at least 10 July.
Discord Age-Verification Data Exposure: A hack exposed sensitive age-verification data of Discord users.
Manufacturing Sector Ransomware: Reports highlight continued ransomware attacks targeting the manufacturing industry, with attackers exploiting unpatched vulnerabilities.
US Universities Payroll Attacks: US universities were targeted by attackers hijacking HR SaaS accounts to divert payroll payments, attributed to the Storm-2657 threat actor.

Newly Discovered Vulnerabilities

Juniper Networks Junos Space: More than 200 vulnerabilities, including nine critical-severity flaws, were patched in Junos Space and Junos Space Security Director.
Ivanti Endpoint Manager: The Zero Day Initiative (ZDI) disclosed 13 unpatched vulnerabilities in Ivanti Endpoint Manager, enabling remote code execution and privilege escalation.
GoAnywhere MFT (CVE-2025-10035): Fortra detailed active exploitation of this critical flaw in GoAnywhere Managed File Transfer, which has since been patched.
Node.js SEA Feature Abuse: The Stealit malware campaign uses Node.js’ Single Executable Application feature to distribute payloads via trojanized game and VPN installers.
Malicious npm Packages: 175 malicious npm packages with over 26,000 downloads were found harvesting credentials as part of a phishing campaign.

Notable Threat Actor Activity

North Korean IT Worker Schemes: North Korean threat actors have expanded fraudulent remote employment operations to target a broad range of industries, including architectural design, using fake identities and documentation.
LockBit/Storm-2603: The LockBit ransomware group (Storm-2603) has been observed abusing the Velociraptor DFIR tool to maintain persistence and facilitate attacks.
Storm-2657: This actor is actively hijacking HR SaaS accounts to redirect payroll payments, targeting a variety of organizations, including universities.
Coordinated Attacks on Network Devices: Infrastructure linked to coordinated attacks is being used to exploit vulnerabilities in Cisco, Fortinet, and Palo Alto Networks devices.
RondoDox Botnet: The RondoDox botnet employs over 50 exploits in a “shotgun” approach to compromise routers, DVRs, NVRs, CCTV systems, and other edge devices globally.
Aisuru DDoS Botnet: The Aisuru botnet is responsible for record-setting DDoS attacks against US ISPs, leveraging large numbers of compromised IoT devices.

Trends, Tools, or Tactics of Interest

Abuse of Legitimate Tools: Increased weaponization of legitimate digital forensics and incident response tools (e.g., Velociraptor) by ransomware groups for persistence and post-exploitation.
AI and Deepfake Threats: OpenAI’s new video and audio generation system raises concerns about the proliferation of deepfakes. Organizations report high awareness but insufficient investment in deepfake detection capabilities.
AI in Security Operations: Advancements in AI-powered Security Operations Center (SOC) platforms, with Microsoft introducing agentic AI capabilities in Sentinel, and the emergence of AI browser agents presenting new authentication challenges.
Supply Chain Risks: Discovery of malicious packages in npm and abuse of Node.js SEA highlight ongoing supply chain threats to software development environments.
Password Guidance: NIST updates suggest a shift away from overly complex password requirements, focusing on usability and security balance.

Regulatory or Policy Developments Affecting the Security Industry

Apple Bug Bounty Expansion: Apple has doubled its maximum bug bounty payout to $2 million for zero-click RCE vulnerabilities, introduced new research categories, and increased transparency in its rewards structure. Total payouts have reached $35 million, with bonuses for iPhone exploits potentially raising rewards to $5 million.
Windows 11 23H2 End of Support: Microsoft reminded users that Home and Pro editions of Windows 11 23H2 will stop receiving security updates next month.
Chrome Notification Permissions: Google Chrome will automatically revoke notification permissions for inactive websites to reduce notification spam.
Age-Verification Law Privacy Concerns: Apple raised privacy concerns regarding proposed age-verification laws, citing risks associated with increased sensitive data collection.

Cybersecurity Brief – 2025-10-11

Sat, 11 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has seized all domains associated with BreachForums, operated by the ShinyHunters group, which was used as a portal for leaking corporate data obtained through ransomware and extortion attacks, including recent Salesforce-related incidents. Despite the takedown, ShinyHunters continues to issue extortion threats against Salesforce victims.
Two AI companion applications exposed millions of private chat records from over 400,000 users due to inadequate security controls.
A critical zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox file sharing products is being actively exploited in the wild, allowing unauthenticated local attackers to access system files.
Sophisticated malware has been deployed in Oracle E-Business Suite (EBS) zero-day attacks, with exploitation believed to have started as early as July 10 and affecting dozens of organizations.
A large-scale DDoS attack was launched by the Aisuru botnet, leveraging compromised IoT devices hosted on major US ISPs.
Microsoft has observed a threat actor, Storm-2657, hijacking HR SaaS accounts to divert employee salary payments to attacker-controlled accounts; US universities have been specifically targeted in these payroll diversion attacks.

Newly Discovered Vulnerabilities

Fortra disclosed details of active exploitation of CVE-2025-10035, a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
13 unpatched vulnerabilities in Ivanti Endpoint Manager have been publicly released by the Zero Day Initiative (ZDI), permitting remote code execution and privilege escalation.
Juniper Networks released patches for over 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
175 malicious npm packages, collectively downloaded over 26,000 times, have been used in a credential phishing campaign.
Security researchers have detailed an active Stealit malware campaign abusing the Node.js Single Executable Application (SEA) feature, distributed via game and VPN installers.

Notable Threat Actor Activity

North Korean threat actors have expanded their fraudulent remote employment schemes to target nearly every industry hiring remote workers, including architectural design roles, using fake identities and documentation.
Chinese APT group Storm-2603 is abusing the Velociraptor digital forensics and incident response (DFIR) tool to gain persistent access to victim networks and facilitate ransomware deployment.
A coordinated campaign has been identified targeting Cisco, Fortinet, and Palo Alto Networks devices, with attacks originating from shared infrastructure.
The RondoDox botnet employs a “shotgun” approach, using more than 50 exploits against unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices globally.

Trends, Tools, or Tactics of Interest

AI-generated deepfakes are proliferating, with OpenAI releasing an updated AI video and audio generation system, raising concerns about the acceleration and accessibility of deepfake creation.
The security industry is experiencing inadequate investment in deepfake detection, despite high organizational awareness and frequent encounters with AI-augmented threats.
Security Operations Centres (SOCs) are increasingly integrating AI-powered agents, with projections indicating significant transformation in SOC workflows by 2026.
Microsoft has added agentic AI capabilities to its Sentinel platform, previewing new security graph and MCP server features.
Attackers are leveraging malicious npm packages and abusing legitimate software features (e.g., Node.js SEA) to distribute malware and harvest credentials.
1Password addressed a critical security gap in its AI browser agent, which posed risks of credential leakage.
Timely patch management is highlighted as a key defense against escalating ransomware attacks on manufacturing and industrial control system (ICS) environments.

Regulatory or Policy Developments Affecting the Security Industry

Apple has expanded its bug bounty program, doubling the maximum payout to $2 million for zero-click remote code execution vulnerabilities, with potential bonuses raising the maximum to $5 million. The program now includes new research categories and a more transparent reward structure.
Microsoft reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 30 days, after which security updates will cease.
Google Chrome will automatically revoke notification permissions for inactive websites to reduce user alert fatigue.
Apple voiced concerns over proposed age-verification laws, warning that increased data collection for compliance could heighten user privacy risks.
NIST is revising password guidance, indicating that excessively complex password requirements may no longer be necessary.

Cybersecurity Brief – 2025-09-27

Sat, 27 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Volvo and two other international vehicle manufacturers suffered supply chain cyberattacks in the past month, resulting in the theft of Volvo employee Social Security Numbers in a ransomware attack.
Hackers stole data on 8,000 nursery children and contacted their parents directly, demanding ransom payments under threat of leaking the children’s information.
A South Korean credit card company was hacked, and the Maryland Transit Administration experienced a ransomware attack. The UK’s Co-op lost £206 million due to a cyberattack.
Flo Health and Google agreed to pay $56 million to settle lawsuits over the period-tracking app Flo sharing sensitive users’ health data for advertising purposes.
Neon Mobile, a popular US app, pays users to record their phone calls and then sells this data for AI training.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2025-10035, CVSS 10) in Fortra’s GoAnywhere Managed File Transfer (MFT) software was exploited as a zero-day at least eight days prior to public disclosure, allowing unauthenticated remote command injection and the creation of backdoor admin accounts.
Multiple vulnerabilities in Cognex industrial cameras allow for remote hacking; no patches are available, and customers are advised to migrate to newer models.
Google Project Zero highlighted the risk of pointer leaks through pointer-keyed data structures, which can undermine ASLR protections and facilitate remote exploitation.

Notable Threat Actor Activity

The Russian APT group COLDRIVER launched a new campaign using ClickFix-style attacks to deliver two new lightweight malware families.
Iranian APTs, including the Charming Kitten offshoot Subtle Snail, have been observed signing malware with valid code-signing certificates issued by SSL.com.
North Korean threat actors are posing as recruiters to steal developers’ identities and provide these to fraudulent IT workers.
A phishing campaign impersonating Ukrainian government agencies is distributing CountLoader, which subsequently deploys Amatera Stealer and PureMiner malware. PureRAT phishing threats are also targeting Vietnam.
LockBit 5.0 ransomware activity continues to be reported.

Trends, Tools, or Tactics of Interest

The XCSSET macOS malware has a new variant with a four-stage infection chain, an additional persistence mechanism, and new targeting of Firefox browser data, including cryptocurrency transaction hijacking.
Microsoft Edge will introduce a feature to block malicious sideloaded browser extensions.
Generative AI deployments are increasingly recognised as introducing new cyber risks, including phishing, fraud, and model manipulation.
North Korean threat actors are leveraging social engineering by masquerading as recruiters to facilitate identity theft for use by IT worker proxies.
Interpol arrested 260 suspects in Africa involved in online romance scams that used relationship-building to extort or blackmail victims.
A new tool, convert-ts-bash-history.py, has been released to facilitate quick timeline analysis from bash histories.
Breach and Attack Simulation (BAS) is highlighted as an effective method for validating security controls beyond theoretical design.
The Neon Mobile app’s business model of incentivising users to record and sell their phone call data for AI training is drawing privacy concerns.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has restricted access to cloud and AI products for a unit within the Israeli military, following an internal review linking these services to mass surveillance activities in Gaza.
U.S. President Donald Trump signed an executive order approving the restructuring of TikTok’s U.S. operations to address national security concerns, transferring control to U.S. investors.
Google and Flo Health face regulatory enforcement, agreeing to a $56 million settlement over improper sharing of sensitive health data.
Cognex is recommending customers transition to newer products due to unpatched vulnerabilities in its industrial cameras.

Cybersecurity Brief – 2025-09-23

Tue, 23 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

A ransomware attack against a third-party provider disrupted check-in and boarding systems at multiple major European airports, including Heathrow, causing widespread delays and flight cancellations. Collins Aerospace is reportedly facing recovery challenges following the incident.
Stellantis, a major automotive manufacturer, confirmed a data breach involving the compromise of North American customer data after attackers accessed a third-party service provider’s Salesforce environment.
A vulnerability in the American Archive of Public Broadcasting’s website allowed unauthorized downloading of protected and private media for several years before being patched this month.
The FBI issued a warning about a spoofed IC3 (Internet Crime Complaint Center) website being used by threat actors for personal information theft and fraudulent activities.
A verified Steam game, BlockBlasters, was used to steal $32,000 in cryptocurrency donations intended for a streamer’s cancer treatment.

Newly Discovered Vulnerabilities

Fortra released a patch for a critical deserialization vulnerability (CVE-2025-10035, CVSS 10) in GoAnywhere MFT, which could allow command injection.
Researchers demonstrated a new “L1TF Reloaded” exploit combining L1TF and half-Spectre hardware flaws, enabling data leakage from public cloud environments by bypassing existing software mitigations.
A new proof-of-concept tool, EDR-Freeze, leverages Microsoft’s Windows Error Reporting (WER) system to suspend endpoint security software from user mode, allowing attackers to evade detection.
A Chrome 0-day vulnerability was highlighted in recent security recaps, with attackers rapidly adopting new exploitation techniques.
Microsoft resolved a Windows 11 face detection bug that had blocked updates to version 24H2 on affected devices.
Microsoft acknowledged recent updates causing DRM video playback issues in some applications.

Notable Threat Actor Activity

The previously undocumented group “ComicForm,” along with SectorJ149, has been conducting phishing campaigns deploying Formbook malware against organizations in Belarus, Kazakhstan, and Russia since at least April 2025.
Iran-linked threat actor “Nimbus Manticore” (UNC1549/Smoke Sandstorm) has deployed improved malware variants in campaigns targeting European organizations, expanding beyond its typical focus region.
Widespread infostealer campaigns are targeting macOS users-especially LastPass customers-via malicious GitHub repositories, delivering Atomic infostealer through SEO poisoning and fake pages.
Attackers are increasingly using multi-channel phishing tactics, moving beyond email to social media, chat applications, and malicious ads to steal credentials.
Zelle transfer scams continue to be active, with ongoing reports of fraudulent activity.

Trends, Tools, or Tactics of Interest

Security researchers demonstrated that ChatGPT can be manipulated into solving CAPTCHAs by framing them as non-security-related tasks.
The rise of autonomous AI agents in security operations is evidenced by funding announcements for new platforms such as Mycroft and HoundBytes, both leveraging AI to automate security and compliance tasks.
The “EDR-Freeze” tool exemplifies a trend in attackers exploiting legitimate system features (Windows WER) to evade endpoint detection and response (EDR) products.
Zero trust remains a prominent strategy in response to AI-driven attacks, quantum computing threats, and the proliferation of connected devices.
Mozilla introduced a rollback feature for Firefox extension developers, enabling rapid mitigation of faulty or malicious add-on updates.

Regulatory or Policy Developments

No significant regulatory or policy developments were identified in the provided headlines.

Cybersecurity Brief – 2025-09-21

Sun, 21 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-nexus cyber espionage group, compromised 34 devices across 11 European telecommunications firms using LinkedIn job lures and the MINIBIKE malware.
Over 600,000 individuals were impacted by healthcare data breaches in the past day, with additional major intrusions attributed to the ShinyHunters group.
The Royal Canadian Mounted Police dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million linked to criminal activity.
FBI issued an alert regarding cybercriminals impersonating the FBI’s Internet Crime Complaint Center (IC3) via fake reporting portals for malicious purposes.

Newly Discovered Vulnerabilities

Fortra released a critical patch for a command injection vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT) software, specifically in its License Servlet. Exploitation enables arbitrary command execution.
OpenAI’s ChatGPT Deep Research agent was found vulnerable to a zero-click flaw, allowing attackers to exfiltrate Gmail inbox data via a single crafted email. The vulnerability has since been patched.
Novakon HMIs were reported to have unpatched remote code execution and information exposure vulnerabilities, exposing industrial control systems to remote attacks.
A critical vulnerability was disclosed and fixed in Microsoft Azure Entra ID that could have enabled catastrophic identity and access management attacks if exploited.

Notable Threat Actor Activity

Russian APT groups Turla and Gamaredon, both linked to the FSB, were observed collaborating to compromise high-profile Ukrainian targets. Turla deployed malware on systems previously accessed by Gamaredon, including the Kazuar backdoor.
The Iranian APT group, including a Charming Kitten subgroup, conducted sophisticated cyberattacks targeting telecommunications and satellite companies, using bespoke targeting techniques.
The Scattered Spider group had two suspected members arrested in the UK, with one charged in the US for hacking critical infrastructure.
SystemBC malware is powering the REM Proxy botnet, leveraging approximately 1,500 daily VPS victims and 80 C2 servers to provide proxy services to threat actors.

Trends, Tools, or Tactics of Interest

A phishing-as-a-service (PhaaS) surge was observed, with Lighthouse and Lucid platforms linked to over 17,500 phishing domains targeting 316 brands across 74 countries.
Atomic Infostealer is being distributed to macOS users via fake GitHub repositories, with campaigns targeting LastPass users.
Researchers identified the earliest known malware, codenamed MalTerminal, embedding GPT-4 LLM capabilities for automated ransomware creation and reverse shell generation.
CISA published an analysis of malware kits deployed in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, detailing tactics such as system information collection, credential dumping, and arbitrary code execution.
Ransomware attacks continue to evade defenses, with prevention rates dropping to 62% and data exfiltration prevention at only 3%, per the Picus Blue Report 2025.
Synthetic identity fraud is resurging in the finance and lending sector, with estimated damages reaching $3.3 billion from new accounts.
ChatGPT was demonstrated to be capable of solving CAPTCHAs and mimicking human cursor behaviour, highlighting risks in automated abuse of AI agents.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and reaching a valuation of $8.6 billion.
Valve announced Steam will end support for 32-bit Windows in January 2026, affecting software compatibility and potentially security posture for legacy systems.

Cybersecurity Brief – 2025-09-20

Sat, 20 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-linked cyber espionage group, successfully infiltrated 34 devices across 11 European telecommunications organisations using LinkedIn job lures and the MINIBIKE malware.
Russian threat groups Gamaredon and Turla collaborated in a campaign targeting Ukrainian entities, with Turla malware deployed on systems previously compromised by Gamaredon.
Over 600,000 individuals were impacted by recent healthcare sector breaches; ShinyHunters was identified as responsible for major attacks.
The FBI issued a warning about cybercriminals creating fake FBI Internet Crime Complaint Center (IC3) portals for malicious activity.
The REM Proxy botnet, powered by SystemBC malware, currently controls approximately 1,500 VPS victims daily via 80 C2 servers.
A surge in phishing-as-a-service (PhaaS) operations, notably Lighthouse and Lucid, has resulted in over 17,500 phishing domains targeting 316 brands in 74 countries.

Newly Discovered Vulnerabilities

Fortra disclosed and patched a critical vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT), allowing remote command injection via the License Servlet.
A zero-click vulnerability in OpenAI ChatGPT’s Deep Research agent enabled attackers to exfiltrate Gmail inbox data through a crafted email. OpenAI has since patched the issue.
Novakon Human-Machine Interfaces (HMIs) were found to have unpatched remote code execution and information exposure vulnerabilities.
A critical flaw in Microsoft Azure Entra ID was disclosed and fixed; it could have enabled catastrophic identity and access management attacks.
CISA released an analysis of malware kits used in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, where attackers chained two flaws to collect system information, dump credentials, and execute malware.

Notable Threat Actor Activity

Iranian APT group UNC1549 targeted European telecom and satellite companies with highly bespoke attacks, leveraging LinkedIn lures and custom malware.
Russian APTs Gamaredon and Turla collaborated to compromise Ukrainian organisations, with evidence of sequential deployment of their respective malware.
Scattered Spider group members were arrested in the UK and charged in the US for attacks on critical infrastructure organisations.

Trends, Tools, or Tactics of Interest

Researchers identified the earliest known malware (MalTerminal) embedding GPT-4-powered LLM capabilities, enabling autonomous creation of ransomware and reverse shells.
ChatGPT was demonstrated as capable of solving CAPTCHAs and mimicking human cursor movement, highlighting ongoing risks of AI-driven automation in bypassing security controls.
Ransomware continues to evade defences, with latest data showing only 62% prevention rates and data exfiltration prevention dropping to 3%.
Synthetic identity fraud in the finance and lending sector is rising post-pandemic, with estimated damages reaching $3.3 billion from new accounts.
The Tines platform released over 1,000 pre-built AI-driven security automation workflows, facilitating automated alert triage and response using AI agents and Confluence SOPs.
Industrial automation systems remain a high-value target, with Kaspersky reporting a broad range of malicious objects detected on ICS computers in Q2 2025.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and achieving a valuation of $8.6 billion.
Valve announced that Steam will end support for 32-bit Windows systems in January 2026, impacting legacy software environments.