CVE-2025-14847 on DanSec Daily

Cybersecurity Brief – 2025-12-30

Tue, 30 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, South Korea’s largest retailer, will compensate 33.7 million customers with $1.17 billion following a data breach that exposed customer information.
Aflac suffered a data breach affecting 22 million individuals, with hackers stealing names, addresses, Social Security numbers, ID numbers, and medical/health insurance information.
Sax, a major US accounting firm, disclosed a 2024 data breach impacting 220,000 individuals; the investigation took over a year.
Korean Air experienced a data breach affecting thousands of employees after its in-flight catering supplier, KC&D, was hacked.
Trust Wallet reported that attackers compromised its browser extension, draining approximately $7 million from 2,596 cryptocurrency wallets.
Romanian energy provider Oltenia Energy Complex was hit by a Gentlemen ransomware attack, disrupting its IT infrastructure.
A hacker claimed theft of 40 million Condé Nast records following a Wired data leak, with 2.3 million Wired subscriber records made public.
The EmEditor website was compromised in a supply chain attack, serving a malicious installer that delivered infostealer malware.
Over 90% of parked domains now lead users to scams or malware, a significant increase from less than 5% a decade ago.
A Lithuanian national was arrested for distributing clipboard-stealing malware disguised as KMSAuto, infecting 2.8 million systems.
A former Coinbase support agent was arrested in India for assisting hackers in stealing sensitive customer information from a company database.

Newly Discovered Vulnerabilities

MongoDB vulnerability CVE-2025-14847 (“MongoBleed”) is under active exploitation, allowing unauthenticated, remote attackers to leak sensitive data. Over 87,000 potentially vulnerable instances are exposed worldwide.
Fortinet warned that the five-year-old critical FortiOS vulnerability (CVE-2020-12812), which allows 2FA bypass, is still being actively exploited in attacks against unpatched devices.

Notable Threat Actor Activity

The HoneyMyte APT (also known as Mustang Panda or Bronze President), linked to Chinese state actors, has evolved its tactics to use a kernel-mode rootkit for delivering and protecting the ToneShell backdoor in attacks against government organisations.
Researchers disclosed a spear-phishing campaign that published over two dozen malicious npm packages, used as phishing infrastructure to steal login credentials.
Chinese state-affiliated hackers are using a kernel-mode loader to hide ToneShell malware activity during cyberespionage campaigns targeting government entities.

Trends, Tools, or Tactics of Interest

Malware in 2025 increasingly targeted platforms beyond Windows, including Android, macOS, and cross-platform environments.
OWASP’s Agentic AI Top 10 highlights real-world attacks on autonomous AI systems, including goal hijacking and malicious MCP servers.
Supply chain attacks remain prominent, as evidenced by the EmEditor installer compromise and malicious npm package campaigns.
There is a significant rise in malicious use of parked domains, now serving as a major vector for scams and malware distribution.
2025 saw a shift from singular large incidents to widespread smaller breaches and attacks, with trusted tools being abused and old vulnerabilities resurfacing.

Regulatory or Policy Developments Affecting the Security Industry

Debate continues over the utility of Software Bill of Materials (SBOMs), with industry experts expressing mixed views on their practical effectiveness as regulatory and compliance requirements evolve.

Cybersecurity Brief – 2025-12-29

Mon, 29 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

A hacker claims to have breached Condé Nast and leaked an alleged WIRED database containing more than 2.3 million subscriber records. The attacker also stated intentions to release up to 40 million additional records.
Ubisoft’s Rainbow Six Siege experienced a breach where attackers abused internal systems to ban and unban players, manipulate in-game moderation feeds, and grant players large amounts of in-game currency.

Newly Discovered Vulnerabilities

A high-severity vulnerability in MongoDB, tracked as CVE-2025-14847 (“MongoBleed”, CVSS 8.7), allows unauthenticated attackers to read uninitialized heap memory. The flaw affects multiple MongoDB versions.
The MongoBleed vulnerability is being actively exploited in the wild, with reports indicating over 87,000 potentially vulnerable MongoDB servers are exposed to the internet. Attackers can leverage the flaw to leak sensitive database secrets.

Notable Threat Actor Activity

Threat actors are actively exploiting the MongoBleed (CVE-2025-14847) vulnerability to access sensitive information from unpatched MongoDB instances. The scale of exposed servers suggests widespread scanning and exploitation activity.

Cybersecurity Brief – 2025-12-28

Sun, 28 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Ubisoft’s Rainbow Six Siege experienced a significant breach in which attackers exploited internal systems to ban and unban players, manipulate in-game moderation feeds, and grant players billions of in-game credits. The incident exposed weaknesses in the game’s backend infrastructure and moderation controls.

Newly Discovered Vulnerabilities

A high-severity vulnerability in MongoDB (CVE-2025-14847, CVSS 8.7) was disclosed, allowing unauthenticated attackers to read uninitialized heap memory. This flaw could potentially expose sensitive data processed by the database.

Notable Threat Actor Activity

Attackers targeting Rainbow Six Siege demonstrated the capability to access and manipulate internal moderation tools, indicating a high level of access and understanding of Ubisoft’s internal systems. The breach resulted in large-scale abuse of in-game economies and moderation functionality.