https://blog.dansec.red/cves/cve-2025-24893/Recent content in CVE-2025-24893 on DanSec DailyHugoen-gbTue, 18 Nov 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-11-18-cybersecurity-news/Tue, 18 Nov 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-11-18-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Eurofiber France disclosed a data breach after hackers exploited a vulnerability in its ticket management system, resulting in exfiltration of customer information. The breach was discovered after the attacker attempted to sell the data.</li> <li>Princeton University reported a data breach on 10 November 2025, exposing personal information of alumni, donors, faculty, and students.</li> <li>DoorDash confirmed a data breach involving compromise of names, addresses, email addresses, and phone numbers after an employee was targeted in a social engineering attack.</li> <li>The Pennsylvania Attorney General’s office confirmed a data breach following an August 2025 ransomware attack by the INC Ransom group, with personal and medical information stolen.</li> <li>Logitech confirmed a data breach after being listed by the Cl0p ransomware group. The incident is linked to the Oracle E-Business Suite exploitation.</li> <li>Dutch police seized approximately 250 servers used by a bulletproof hosting service that provided infrastructure for cybercriminals.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Google released security updates for Chrome to address two vulnerabilities, including CVE-2025-xxxx, a V8 zero-day flaw under active exploitation, reportedly by a commercial spyware vendor.</li> <li>A critical remote code execution vulnerability in Fortinet FortiWeb WAF is being actively exploited in the wild, allowing unauthenticated attackers to execute administrative commands.</li> <li>The RondoDox botnet is exploiting CVE-2025-24893, a critical RCE vulnerability in XWiki Platform. Widespread exploitation has been observed, including by botnets, crypto miners, and custom tools.</li> <li>Seven malicious npm packages are abusing the Adspect cloud-based service to redirect researchers while leading victims to malicious payloads.</li> <li>A vulnerability in DoorDash’s email systems allowed attackers to send spoofed, official-looking emails from DoorDash servers, creating a significant phishing risk. DoorDash has since patched the issue.</li> <li>Researchers identified a security weakness in the AI-powered coding tool Cursor, enabling credential-stealing attacks via a malicious MCP server hijacking the internal browser.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The Dragon Breath threat actor is using a multi-stage loader (RONINGLOADER) to disable security tools and deploy a modified Gh0st RAT in recent campaigns.</li> <li>Iranian state-sponsored APTs are targeting defense and government officials, including their family members, in ongoing campaigns to increase pressure on primary targets.</li> <li>The Aisuru botnet launched a 15.72 Tbps DDoS attack against Microsoft Azure, leveraging over 500,000 IP addresses.</li> <li>The EVALUSION ClickFix campaign is deploying Amatera Stealer and NetSupport RAT via social engineering techniques.</li> <li>Cl0p ransomware group continues to exploit Oracle E-Business Suite (CVE-2025-61882), with associated data breaches including Logitech.</li> <li>Scammers are sending fake copyright violation messages to steal X (formerly Twitter) logins.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Phishing attacks are increasingly shifting to non-email channels, with LinkedIn and other platforms now accounting for 1 in 3 phishing incidents.</li> <li>ClickFix social engineering tactics are being widely adopted in malware distribution campaigns.</li> <li>Malicious packages in open-source repositories such as npm are using cloud-based redirectors to evade detection and target victims.</li> <li>Bulletproof hosting services remain a critical enabler for cybercriminal infrastructure, as evidenced by recent law enforcement action in the Netherlands.</li> <li>Attackers are leveraging vulnerabilities in widely used platforms (e.g., XWiki, FortiWeb, Oracle E-Business Suite) for large-scale exploitation.</li> <li>DDoS attacks are increasing in scale and sophistication, as demonstrated by the recent record-setting attack on Microsoft Azure.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>In the US, five individuals pleaded guilty to assisting North Korean IT workers in obtaining employment at US companies by providing false identities and remote access to company laptops, highlighting ongoing law enforcement efforts against supply chain and insider threats.</li> <li>Microsoft released an out-of-band Windows 10 update (KB5072653) to address issues with installing Extended Security Updates, ensuring continued compliance for organizations relying on legacy systems.</li> </ul>https://blog.dansec.red/posts/2025-11-04-cybersecurity-news/Tue, 04 Nov 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-11-04-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Hackers stole over $120 million from the Balancer DeFi crypto protocol by targeting its v2 pools.</li> <li>A major breach at the Kansas City, Kansas, Police Department exposed a list of alleged officer misconduct, including dishonesty, sexual harassment, excessive force, and false arrests.</li> <li>Everest ransomware group claimed responsibility for recent attacks, according to Check Point’s latest threat intelligence report.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>XWiki (CVE-2025-24893): Exploit attempts have been observed against XWiki’s SolrSearch component, which allows arbitrary remote code execution. A patch was released in February.</li> <li>Google Chrome: Two high-severity vulnerabilities in the V8 JavaScript engine (type confusion and inappropriate implementation) were disclosed, with Google awarding $100,000 in bug bounties.</li> <li>Microsoft WSUS: An out-of-band update to patch an actively exploited Windows Server Update Service vulnerability has disabled hotpatching on some Windows Server 2025 systems.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Lazarus Group targeted Web3 entities, using advanced tools and rapid exploitation of new vulnerabilities.</li> <li>North Korea-linked Kimsuky group deployed a new backdoor, HttpTroy, disguised as a VPN invoice in a likely spear-phishing attack in South Korea.</li> <li>Chinese APTs used new ‘Airstalk’ malware (PowerShell and .NET variants) in supply chain attacks, abusing AirWatch’s MDM API for C2 communication.</li> <li>Cybercriminals are increasingly targeting logistics and freight networks by deploying remote monitoring and management (RMM) tools to hijack cargo and steal physical shipments.</li> <li>Three former US cybersecurity professionals were indicted for conducting BlackCat (ALPHV) ransomware attacks against five US companies.</li> <li>Ukrainian national Yuriy Igorevich Rybtsov (aka MrICQ) was extradited to the US to face charges related to the Jabber Zeus cybercrime operation.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>AI Poisoning: New research indicates attackers can more easily poison AI models by introducing malicious data, increasing the risk of models producing harmful outputs.</li> <li>Abuse of AI APIs: Microsoft identified the ‘SesameOp’ backdoor, which uses the OpenAI Assistants API as a covert C2 channel. Additionally, Claude AI APIs can be abused for data exfiltration via prompt injection.</li> <li>Malicious VSCode Extensions: The ‘SleepyDuck’ remote access trojan was found in a fake Solidity extension on the Open VSX registry, using an Ethereum smart contract for C2.</li> <li>Android Malware: BankBot-YNRK and DeliveryRAT trojans are actively stealing financial data from Android users, with BankBot-YNRK reportedly muting device alerts and draining cryptocurrency wallets, primarily targeting Indonesia.</li> <li>TruffleNet Attack: Attackers use frameworks based on TruffleHog to leverage stolen credentials for AWS account compromise, leading to reconnaissance and business email compromise (BEC).</li> <li>Device Code Phishing: Attackers are exploiting OAuth device flows, with significant differences in attack surfaces between Azure and Google.</li> <li>Fake AI Apps: There is an increase in fake ChatGPT and AI-related apps in app stores, some containing adware or spyware.</li> <li>SOC Operations: Security Operations Centers are increasingly overwhelmed by alert volumes, leading to a shift toward continuous exposure management and automation.</li> <li>Generative AI in Malware Analysis: Generative AI is being used to accelerate reverse engineering of malware such as XLoader.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>OpenAI Safety Panel: A panel led by Zico Kolter at OpenAI now has the authority to halt the release of new AI systems if deemed unsafe.</li> <li>Electrical Grid Security: Regulators and industry experts are advocating for the convergence of cyber and physical security strategies for the power grid, reflecting increased attack activity on critical infrastructure.</li> </ul>