CVE-2025-29824 on DanSec Daily

Cybersecurity Brief – 2025-08-20

Wed, 20 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Allianz Life (US): Hackers stole personal information of 1.1 million individuals in a Salesforce data theft attack. Exposed data includes physical addresses, dates of birth, phone numbers, and other sensitive information for life insurance customers.
Business Council of New York State (US): Data breach in February led to theft of personal, financial, and health information of over 47,000 individuals.
Inotiv (US): Ransomware attack resulted in encryption of systems and data, impacting business operations.
Bragg Gaming Group (Global): Hackers accessed internal systems, though operations reportedly unaffected.
TPG Telecom/iiNet (Australia): Unauthorised access detected in iiNet order management system; investigation ongoing.
Highly Sensitive Medical Cannabis Data (US): Nearly one million records, including SSNs, government IDs, and health data, exposed due to an unsecured database.
Polish Power Plant (Poland): Russian hacktivists launched a cyberattack causing operational disruption at a power plant.
RapperBot DDoS Botnet: US authorities charged a 22-year-old Oregon man for operating the RapperBot botnet, which powered over 370,000 distributed denial-of-service attacks.

Newly Discovered Vulnerabilities

Apache ActiveMQ: Threat actors are exploiting a nearly two-year-old security flaw to gain persistent access to cloud Linux systems, deploying the DripDropper malware. Attackers have been observed patching the exploited vulnerability post-compromise to maintain exclusive access.
SAP NetWeaver: A public exploit chaining two critical, now-patched vulnerabilities has been released, exposing unpatched systems to remote code execution and data theft.
Windows CLFS (CVE-2025-29824): Previously zero-day flaw exploited in the wild as part of Play ransomware attack chains, enabling attackers to gain system-level privileges.
Windows Recovery/Reset: August 2025 security updates introduced an issue breaking reset and recovery operations on Windows 10 and some Windows 11 versions. Microsoft has released emergency out-of-band updates to address the problem.

Notable Threat Actor Activity

GodRAT: Financial institutions, especially trading and brokerage firms, are being targeted by a new remote access trojan dubbed GodRAT. The malware uses steganography and is based on Gh0st RAT code, likely as a successor to AwesomePuppet and attributed to the Winnti group.
ScarCruft (North Korea): The group has added ransomware to its toolset, distributing it via phishing emails.
PipeMagic Backdoor: Attackers are using the modular PipeMagic malware, which masquerades as a ChatGPT application, in conjunction with exploitation of Windows CLFS vulnerabilities as part of Play ransomware campaigns.
Russian Hacktivists: Conducted a disruptive cyberattack against a Polish power plant.
Yemen Cyber Army: UK courts sentenced Al-Tahery Al-Mashriky to 20 months in prison for hacktivist campaigns involving website defacement.

Trends, Tools, or Tactics of Interest

DripDropper Malware: Attackers exploiting Apache ActiveMQ are patching the same vulnerability after deploying their malware, a tactic to prevent other actors from leveraging the same entry point.
Linux Evasion: RingReaper, a sophisticated post-compromise tool, abuses the Linux kernel’s io_uring interface to evade endpoint detection and response (EDR) systems.
Darknet Communications: Criminal actors are increasingly migrating from traditional IRC forums to Telegram networks for operational security and resilience.
AI and Security: Increased discussion on the dual-use nature of AI helpers, with risks of AI-powered tools being leveraged for malicious purposes, including zero-click exploits against AI agents.
Supply Chain Attacks: Ongoing concern over GitHub risk vectors and supply chain compromise, with new research highlighting overlooked attack surfaces.
Increased Reconnaissance: Rise in scans targeting Elasticsearch instances, seeking misconfigurations or exposed data.
Vendor Security Requirements: Asian organizations, including a Japanese chipmaker and the Singaporean government, are mandating cybersecurity checks for suppliers in response to breach upticks.

Regulatory or Policy Developments

UK Encryption Policy: The UK government has dropped its demand for Apple to implement encryption backdoors following pressure from US civil liberties groups.
PyPI Security: The Python Package Index has implemented protections against domain resurrection attacks, reducing the risk of account hijacking through expired domain-based password resets.
Okta/Threat Detection: Okta has open-sourced a catalog of Sigma-based Auth0 detection rules to help customers identify account takeovers, misconfigurations, and suspicious behaviors in event logs.

Cybersecurity Brief – 2025-08-19

Tue, 19 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Workday disclosed a data breach after attackers accessed a third-party CRM platform via social engineering, likely linked to the broader Salesforce attacks attributed to the ShinyHunters group. Exposed data was limited to “commonly available” business contact information, with no customer data compromised.
The Canadian House of Commons experienced a data breach, as noted in recent threat intelligence reporting.
Over 800 N-able N-central servers remain unpatched against two critical vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that have been actively exploited. More than 870 instances are affected globally.
Multiple web hosting firms in Taiwan were targeted by Chinese APT group UAT-7237, aiming for long-term access to high-value targets.
The US Department of Justice seized $2.8 million in cryptocurrency from a Zeppelin ransomware operator, following an indictment.

Newly Discovered Vulnerabilities

A critical Microsoft Windows vulnerability (CVE-2025-29824) was exploited to deploy the PipeMagic backdoor in RansomExx ransomware attacks, with observed activity in Brazil and Saudi Arabia.
Researchers disclosed a major internet-wide vulnerability enabling large-scale DDoS attacks, affecting a significant portion of websites since 2023.
A novel 5G attack, Sni5Gect, allows attackers to sniff traffic and disrupt networks without requiring a malicious base station.

Notable Threat Actor Activity

The Noodlophile malware campaign expanded its global reach, targeting enterprises with spear-phishing emails using copyright complaint lures to deliver information-stealing malware.
The source code for ERMAC v3 Android banking trojan was leaked online, exposing details of its malware-as-a-service infrastructure.
Chinese APT group UAT-7237 targeted Taiwanese web infrastructure for persistent access to high-value entities.
MFA-bombing attacks continue to be reported, with attackers sending repeated multi-factor authentication prompts to coerce user approval.

Trends, Tools, or Tactics of Interest

Malicious packages were discovered in both PyPI and npm repositories, leveraging dependencies for supply chain attacks and establishing persistence.
The evolution of the PipeMagic backdoor demonstrates ongoing adaptation of TTPs by its operators, with recent exploitation linked to a patched Microsoft Windows vulnerability.
Increasing sophistication of RATs (Remote Access Trojans) is prompting calls for more unified, behavior-aware detection approaches.
Attackers are leveraging weaknesses in multi-cloud environments due to inconsistent security monitoring and controls.
Ongoing phishing campaigns are using fake Gmail security alerts to trick users into account compromise.

Regulatory or Policy Developments Affecting the Security Industry

The European Union has made cybersecurity funding available for SMEs, with guidance published on how to access these resources.
Mozilla has raised concerns that a recent German Federal Supreme Court ruling could lead to browser-based ad blockers being declared illegal in Germany, potentially impacting privacy and security tools.
Wazuh has been highlighted as a tool for regulatory compliance, supporting organizations in meeting data protection and privacy obligations.
In the UK, a hacker responsible for compromising 3,000 websites was sentenced to 20 months in prison.

Cybersecurity Brief – 2025-08-18

Mon, 18 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Workday disclosed a data breach resulting from attackers gaining access to a third-party CRM platform, reportedly linked to a wider wave of Salesforce-related attacks targeting multiple organizations.
The Canadian House of Commons suffered a data breach, as reported in the latest threat intelligence bulletin.
A UK individual was sentenced to 20 months in prison for hacking approximately 3,000 websites.
Over 800 N-able N-central servers remain unpatched and exposed to two critical vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that have been actively exploited.
US authorities seized $2.8 million in cryptocurrency from a Zeppelin ransomware operator following an indictment.

Newly Discovered Vulnerabilities

A new vulnerability (CVE-2025-29824) has been linked to the evolution of the PipeMagic backdoor, with exploitation observed in attacks in Brazil and Saudi Arabia.
An internet-wide vulnerability affecting a significant proportion of websites has enabled large-scale DDoS attacks, considered the most significant since 2023.
Researchers disclosed a novel 5G attack technique (“Sni5Gect”) that allows attackers to sniff traffic and disrupt services without requiring a malicious base station.

Notable Threat Actor Activity

Chinese APT group UAT-7237 has been targeting web hosting firms in Taiwan to gain long-term access to high-value targets.
Zeppelin ransomware operator Ianis Antropenko has been indicted in the US, with cryptocurrency assets seized.
Malicious packages were discovered in the PyPI and npm repositories, introducing supply chain risks via dependencies that enable persistent access.

Trends, Tools, or Tactics of Interest

The PipeMagic backdoor has evolved in its tactics, techniques, and procedures (TTPs) since the RansomExx incident, now leveraging new vulnerabilities for access.
Evolving remote access trojans (RATs) are increasingly redefining enterprise security threats, with a focus on unified and behavior-aware detection approaches.
A surge in MFA-bombing attacks has been noted, where attackers repeatedly send MFA prompts to users in an attempt to cause confusion and gain unauthorized access.
The dual-use tool “LostMyPassword” has been highlighted for its capability to recover account passwords and serve as a rapid credential dumping utility during post-exploitation.
Organizations are struggling with security across multi-cloud environments, creating openings for attackers due to inconsistent monitoring and controls.
Security researchers have observed NFC-based fraud and Docker backdoors as part of emerging attack vectors.

Regulatory or Policy Developments Affecting the Security Industry

A recent ruling by Germany’s Federal Supreme Court has revived the legal debate over browser-based ad blockers, raising concerns that ad blockers could be declared illegal in Germany.
The European Union has ongoing cybersecurity funding initiatives aimed at supporting small- and medium-sized enterprises (SMEs) to address evolving threats and compliance requirements.

Cybersecurity Brief – 2025-05-08

Thu, 08 May 2025 00:00:00 +0000

Major Incidents and Breaches

LockBit Ransomware Gang Breach: The LockBit ransomware group suffered a significant breach, with its dark web affiliate panels defaced and victim negotiation data exposed via a leaked MySQL database. This incident may disrupt ongoing operations and expose sensitive data related to victims and affiliates.
PowerSchool Extortion Escalates: Following a December cyberattack, the PowerSchool hacker is now directly extorting individual school districts, threatening to release stolen student and teacher data if ransoms are not paid.
Masimo Cyberattack: Medical device manufacturer Masimo reported a cyberattack that has disrupted production and caused delays in fulfilling customer orders.
South African Airways Disruption: A cyberattack temporarily disrupted operational systems at South African Airways. The company is investigating potential data theft.