Cybersecurity Brief – 2025-06-01

Sun, 01 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The U.S. Department of Justice, in coordination with international law enforcement, seized four domains that provided crypting services to cybercriminals. These services enabled threat actors to obfuscate malware and evade detection by security tools.

Two information disclosure vulnerabilities have been identified in the core dump handlers apport and systemd-coredump, impacting Ubuntu, Red Hat Enterprise Linux, and Fedora. The flaws could allow attackers to extract password hashes from core dumps.
Exploit details have been published for a maximum-severity vulnerability (CVE-2025-20188) in Cisco IOS XE Wireless LAN Controller (WLC) software. The flaw allows arbitrary file upload, increasing the risk of exploitation.

The dismantled crypting service domains were used by cybercrime syndicates to facilitate malware distribution and evasion, supporting a range of threat actor operations globally.

The public release of exploit details for the Cisco IOS XE vulnerability may accelerate weaponisation and exploitation in the wild.
Law enforcement continues to target cybercrime infrastructure, specifically services that enable malware obfuscation and distribution.

Thu, 08 May 2025 00:00:00 +0000

LockBit Ransomware Gang Breach: The LockBit ransomware group suffered a significant breach, with its dark web affiliate panels defaced and victim negotiation data exposed via a leaked MySQL database. This incident may disrupt ongoing operations and expose sensitive data related to victims and affiliates.
PowerSchool Extortion Escalates: Following a December cyberattack, the PowerSchool hacker is now directly extorting individual school districts, threatening to release stolen student and teacher data if ransoms are not paid.
Masimo Cyberattack: Medical device manufacturer Masimo reported a cyberattack that has disrupted production and caused delays in fulfilling customer orders.
South African Airways Disruption: A cyberattack temporarily disrupted operational systems at South African Airways. The company is investigating potential data theft.