CVE-2025-20337 on DanSec Daily

Cybersecurity Brief – 2025-11-14

Fri, 14 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

DoorDash disclosed a data breach in October affecting user information across the US, Canada, Australia, and New Zealand.
The Washington Post is notifying nearly 10,000 employees and contractors of personal and financial data exposure following the Oracle data theft attack.
Synnovis confirmed patient information was stolen in a ransomware attack that disrupted pathology services at several London hospitals.
The NHS is investigating claims of an Oracle E-Business Suite (EBS) hack after hackers named over 40 alleged victims, with the National Cyber Security Centre involved.

Newly Discovered Vulnerabilities

Fortinet FortiWeb is affected by a path traversal vulnerability that allows unauthenticated attackers to create administrative users. The flaw is being actively exploited and a public proof-of-concept (PoC) is available.
ImunifyAV, a malware scanner for Linux servers used by tens of millions of websites, has a remote code execution vulnerability that could compromise hosting environments.
WatchGuard Firebox firewalls are impacted by CVE-2025-9242, a critical (CVSS 9.3) unauthenticated remote code execution vulnerability, which is being actively exploited.
Cisco Adaptive Security Appliances (ASA) and Firepower devices are subject to two actively exploited vulnerabilities, prompting urgent patching advisories from CISA.
Cisco Identity Services Engine (ISE) and Citrix products are affected by CVE-2025-20337 and CVE-2025-5777, both of which have been exploited as zero-days.
Uhale Android-based digital picture frames contain multiple critical vulnerabilities, including the ability to download and execute malware at boot time.
A vulnerability in ChatGPT’s custom GPTs allowed exploitation via server-side request forgery (SSRF) to obtain Azure access tokens.

Notable Threat Actor Activity

Russian-speaking threat actors have registered over 4,300 fake travel domains in a mass phishing campaign targeting hotel guests’ payment data.
A malicious Chrome extension, “Safery,” steals Ethereum wallet seed phrases and exfiltrates them using the Sui blockchain.
Indonesian threat actors are likely behind the ‘IndonesianFoods’ worm, which has spammed npm with over 100,000 self-replicating malicious packages.
The Coyote and Maverick banking trojans are active in Brazil, with Maverick terminating itself if run outside the country.
Google has taken legal action against the China-based Lighthouse phishing kit, disrupting a platform responsible for SMS phishing and toll-fee scams affecting over a million victims and 17,500 fake sites.

Trends, Tools, or Tactics of Interest

The Tycoon 2FA phishing kit has evolved, enabling unskilled actors to launch sophisticated social engineering attacks bypassing two-factor authentication.
Ransomware operators are increasingly targeting virtual environments: Akira ransomware is encrypting Nutanix AHV VMs; Kraken ransomware benchmarks systems to optimise encryption without overloading them.
Kerberoasting attacks remain a significant threat for Active Directory environments, with attackers stealing service account passwords to escalate privileges.
Formbook malware is being delivered through multiple scripting techniques to evade detection.
A surge in exploit weaponisation speed: 50–61% of new vulnerabilities in 2025 had exploit code available within 48 hours of disclosure.
Organisations are moving toward single sign-on (SSO) and passkeys to address persistent weak password usage among employees.
Microsoft Teams is rolling out screen capture prevention for Premium customers, blocking screenshots and recordings during meetings.
Attackers continue to leverage phishing-as-a-service platforms, with new kits and services supporting rapid deployment of phishing campaigns.

Law Enforcement and Regulatory Developments

Operation Endgame, coordinated by Europol and Eurojust, disrupted the Rhadamanthys, Venom RAT, and Elysium botnet operations, taking down over 1,025 servers and arresting at least one individual.
CISA, FBI, and partners have released updated guidance for defending against Akira ransomware, and have reiterated patching requirements for actively exploited Cisco and WatchGuard vulnerabilities.
Google’s legal actions have resulted in the disruption of the Lighthouse phishing kit infrastructure.
The UK’s National Cyber Security Centre is assisting the NHS following claims of an Oracle EBS breach.
New York State is investigating the use of algorithmic surveillance pricing in consumer markets, highlighting regulatory scrutiny over data-driven practices.

Cybersecurity Brief – 2025-11-13

Thu, 13 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Synnovis, a UK pathology services provider, has notified healthcare providers of a data breach resulting from a ransomware attack in June 2024, which led to the theft of patient data.
Over 67,000 fake npm packages have been published in a large-scale, worm-like spam attack, likely financially motivated, flooding the npm registry since early 2024.
DanaBot malware has resumed activity, infecting Windows systems after a six-month hiatus following law enforcement disruption in May 2024.
A campaign targeting Microsoft 365 users is leveraging Quantum Route Redirection to bypass email security and steal credentials, impacting victims in over 90 countries.
Phishing emails disguised as spam filter alerts are being used to steal user credentials.

Newly Discovered Vulnerabilities

Amazon’s threat intelligence team disclosed that an advanced threat actor exploited two zero-day vulnerabilities: “Citrix Bleed 2” (CVE-2025-5777) in Citrix NetScaler ADC/Gateway and CVE-2025-20337 in Cisco Identity Service Engine (ISE).
Microsoft released fixes for 63 security vulnerabilities, including a Windows kernel zero-day flaw currently under active exploitation.
Google Chrome (version 142) and Mozilla Firefox (version 145) have patched multiple high-severity vulnerabilities in their latest releases.
Ivanti and Zoom have patched high-severity vulnerabilities that could enable arbitrary file writes, privilege escalation, code execution, and information disclosure.
Intel, AMD, and Nvidia have published advisories addressing over 60 vulnerabilities in their products as part of their regular security updates.
Siemens, Rockwell, Aveva, and Schneider Electric have addressed vulnerabilities affecting industrial control systems.

Notable Threat Actor Activity

Google has filed a lawsuit in the US District Court against China-based threat actors operating the “Lighthouse” Phishing-as-a-Service (PhaaS) platform, attributed to the group “Smishing Triad.” The platform facilitated large-scale SMS phishing campaigns, including US toll scam texts, using over 194,000 malicious domains.
Advanced persistent threat actors exploited Citrix NetScaler and Cisco ISE zero-day vulnerabilities in coordinated attacks, demonstrating increased targeting of identity and access management systems.
The SmartApeSG campaign is using ClickFix social engineering techniques, including fake Cloudflare verification pages, to push NetSupport RAT malware.
Ongoing cyber threats have been identified against Cisco ASA and Firepower devices, as reported by CISA.

Trends, Tools, or Tactics of Interest

ClickFix attacks are becoming more sophisticated, with recent campaigns mimicking Cloudflare verification checks to trick users into executing malicious commands.
The Quantum Route Redirection technique in phishing campaigns simplifies attack steps and is being used to bypass traditional email security controls.
There is increased adversary interest in targeting identity and access management infrastructure, as evidenced by recent zero-day exploitation of Citrix and Cisco products.
Passkey management on Windows 11 now supports third-party applications, with 1Password and Bitwarden as initial partners, improving passwordless authentication options.
The return of DanaBot and the scale of npm spam attacks highlight persistent threats to software supply chains and end-user systems.
Google introduced “Private AI Compute,” a privacy-enhancing technology for secure AI processing in the cloud.
Token Security outlined methods to extend Zero Trust principles to autonomous AI agents, emphasizing scoped access and continuous verification.
Behavioral (TTP-based) detection is being promoted as more effective than traditional IoC-based hunting for identifying privilege escalation, credential theft, and lateral movement.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced new legislation to strengthen cybersecurity requirements for critical infrastructure, including hospitals, energy, water, and transport sectors.
Kenya has launched the “Code Nation” initiative to train one million workers in technology skills, with a focus on cybersecurity, software engineering, and data science.

Cybersecurity Brief – 2025-07-18

Fri, 18 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Cryptocurrency exchange BigONE suffered a security breach resulting in the theft of digital assets valued at $27 million.
An adoption agency leaked over 1.1 million records, including names and sensitive information of children, birth parents, and adoptive parents.
Chinese state-sponsored group Salt Typhoon breached a U.S. Army National Guard network for nine months in 2024, exfiltrating network configuration files and credentials.
Security researchers revealed that poor password practices at Paradox.ai led to the exposure of personal information belonging to millions of job applicants.
A vulnerability in Meta AI (now fixed) could have allowed unauthorized access to private chatbot conversations.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical pre-authentication vulnerability (CVE-2025-20337, CVSS 10) in Identity Services Engine (ISE) and ISE-PIC, allowing unauthenticated remote code execution and file storage.
Citrix NetScaler vulnerability “CitrixBleed 2” (CVE-2025-5777) was actively exploited weeks before public proof-of-concept exploits were released.
Oracle’s July 2025 Critical Patch Update addressed approximately 200 unique CVEs, with 309 security patches issued.
Google released a Chrome update patching six vulnerabilities, including one zero-day.
VMware patched four zero-day vulnerabilities in ESXi, Workstation, Fusion, and Tools, which were exploited at Pwn2Own Berlin 2025.
A known Apache HTTP Server vulnerability is being exploited to deploy the Linuxsys cryptocurrency miner.

Notable Threat Actor Activity

Kaspersky identified “GhostContainer,” a new backdoor targeting Microsoft Exchange servers of high-value organizations in Asia, based on open-source tools.
Three previously undocumented Chinese state-sponsored threat actors, as well as a fourth group, targeted Taiwan’s semiconductor sector with spear-phishing, Cobalt Strike, and custom backdoors.
Threat actors are distributing Amadey malware and data stealers via malicious payloads hosted on public GitHub repositories to bypass security filters.
The Matanbuchus malware loader is being delivered through social engineering over Microsoft Teams voice calls, with attackers impersonating IT helpdesk staff.
LameHug malware uses large language models (LLMs) to generate Windows data-theft commands in real time.
Europol coordinated an international operation disrupting the infrastructure of the pro-Russian hacktivist group NoName057(16), known for DDoS attacks against Ukraine.
Research highlights increased use of DNS records to hide malicious code and conduct prompt injection attacks against chatbots.

Trends, Tools, or Tactics of Interest

PsMapExec, a new PowerShell-based tool, has been released for enumeration and lateral movement, supporting WinRM and SMB operations.
Security gaps in printer firmware and endpoint vetting are being increasingly targeted by attackers.
There is a rise in browser-based AI agent attacks, with security vendors emphasizing AI-first protection strategies.
AI-driven malware, such as LameHug, and the exploitation of AI tools for malicious purposes are emerging trends.
Cloud attack surface management and continuous threat exposure management (CTEM) are being discussed as alternatives to traditional vulnerability management.
Massistant, a mobile forensics tool used by Chinese law enforcement, is capable of collecting user information, files, and location data from confiscated devices.

Regulatory or Policy Developments Affecting the Security Industry

Google has filed a lawsuit against operators of the BadBox 2.0 Android malware botnet, which infected 10 million devices and ran a global ad fraud scheme.
A settlement was reached in the class action lawsuit against Meta over the Cambridge Analytica incident; details remain undisclosed.
WeTransfer has retracted a clause that would have allowed the company to train AI models on user-uploaded files, following user backlash.
An Armenian national was extradited to the US and faces charges related to the Ryuk ransomware operation.