CVE-2025-31324 on DanSec Daily

Cybersecurity Brief – 2025-07-30

Wed, 30 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The City of Saint Paul, Minnesota, suffered a significant cyberattack, prompting the activation of the National Guard in response to disruptions.
French telecommunications giant Orange disclosed a cyberattack after detecting a breached system on its network.
Russian airline Aeroflot experienced a cyberattack resulting in the cancellation of over 60 flights and severe delays.
Allianz Life reported a data breach impacting the majority of its 1.4 million US customers, exposing sensitive personal information.
The Tea Dating Advice app suffered two security incidents, resulting in the leak of approximately 72,000 images and 59,000 additional images from posts, comments, and direct messages, including unauthorized access to private messages.
A U.S.-based chemicals company was targeted by attackers exploiting a SAP NetWeaver vulnerability (CVE-2025-31324) to deploy the Linux Auto-Color malware.
The FBI seized $2.4 million in Bitcoin from a member of the newly emerged Chaos ransomware operation, linked to cyberattacks and extortion payments in Texas.

Newly Discovered Vulnerabilities

A critical access bypass flaw was discovered and patched in the Base44 AI-powered coding platform, which could have allowed unauthorized access to private applications.
Lenovo firmware vulnerabilities were identified that enable privilege escalation, code execution, and security bypass, facilitating persistent implant deployment.
Apple released updates for iOS, iPadOS, macOS, watchOS, tvOS, and visionOS, addressing a total of 89 vulnerabilities, including significant security issues.
A macOS vulnerability was disclosed that could allow bypass of Transparency, Consent, and Control (TCC) protections, exposing cached information such as geolocation and biometric data.
Ongoing exploitation of a two-year-old PaperCut vulnerability is enabling remote code execution by threat actors.
Researchers continue to observe supply chain attacks leveraging backdoors, poisoned code, and malicious commits in widely used tools including GitHub Actions, Gravity Forms, and npm.

Notable Threat Actor Activity

The Chaos ransomware-as-a-service (RaaS) group has emerged, believed to comprise former BlackSuit members following law enforcement takedown of BlackSuit infrastructure. Chaos has demanded $300,000 from U.S. victims and is linked to recent extortion and crypto seizures.
The ‘Gunra’ ransomware group has developed a Linux variant, expanding from initial Windows targeting and employing multithreaded encryption.
Ongoing phishing campaigns are targeting Python Package Index (PyPI) users with fake verification emails and lookalike domains, aiming to redirect victims to fraudulent PyPI sites.
Attackers are exploiting SAP NetWeaver (CVE-2025-31324) to deploy Linux malware in targeted attacks.
Cybercriminals are conducting large-scale mobile malware campaigns across Asia, distributing fake apps (dating, social, cloud storage, car service) to steal data and blackmail users.
Node.JS is being leveraged by threat actors to launch the JSCeal malware, targeting cryptocurrency applications.

Trends, Tools, or Tactics of Interest

Ransomware activity is increasing in sophistication, with 2025 trends highlighting smarter evasion and extortion tactics.
Attackers are bypassing “phishing-resistant” authentication methods using downgrade attacks, device-code phishing, and OAuth manipulation.
JavaScript injection attacks remain prevalent despite modern frameworks like React, with attackers exploiting prototype pollution and new injection techniques.
Browsers are increasingly becoming primary cyberattack vectors, with attackers exploiting both software vulnerabilities and user behavior.
Supply chain attacks remain a significant risk, with recent incidents involving poisoned code and malicious commits in popular development tools.
Security solutions and investments are focusing on AI-driven SOC analysts, securing LLMs/generative AI, and human risk management platforms.
The integration of SecurityCoach with Microsoft Edge for Business aims to bridge security gaps between technical controls and user behavior.

Regulatory or Policy Developments Affecting the Security Industry

UK age verification laws for adult content have led to a surge in VPN usage, raising concerns over privacy and the future of open internet access.
Google Project Zero reaffirmed its “90+30” vulnerability disclosure policy, emphasizing transparency and timely patching.

Cybersecurity Brief – 2025-05-16

Fri, 16 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach: Coinbase disclosed a breach affecting approximately 1% of its users. Cybercriminals bribed customer support agents to steal customer data, including government-issued IDs. Attackers attempted to extort $20 million, but the attempt failed.
Nova Scotia Power Data Breach: Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data.
Steel Manufacturer Cyber Incident: Nucor, a major steelmaker, halted operations due to a cyber incident. Details on the nature and scope of the breach remain undisclosed.
Breachforums Settlement: The former administrator of Breachforums agreed to pay nearly $700,000 to settle a civil lawsuit related to a healthcare data breach.

Newly Discovered Vulnerabilities

Google Chrome Zero-Day: Google patched a high-severity Chrome vulnerability (with a public exploit in the wild) that enables cross-origin data leaks via Loader Referrer Policy. Emergency updates have been released.
Samsung MagicInfo Server (CVE-2025-4632): Threat actors are actively exploiting a patch bypass for a previously disclosed vulnerability in Samsung MagicInfo 9 Server.
SAP NetWeaver (CVE-2025-31324): Ongoing exploitation of a critical SAP NetWeaver vulnerability is being observed. Administrators are urged to patch immediately.
Windows 10 KB5058379 Update Issue: The latest Windows 10 update is triggering unexpected BitLocker recovery prompts on some devices after installation.

Notable Threat Actor Activity

APT28 Cyber Espionage: Russia-linked APT28 exploited a zero-day in MDaemon and other webmail servers (Roundcube, Horde, Zimbra) via XSS vulnerabilities in a global campaign (“RoundPress”) targeting government organizations.
Malicious npm Package: Researchers identified a malicious npm package (“os-info-checker-es6”) using Unicode steganography to hide its payload and Google Calendar links as command-and-control infrastructure.

Trends, Tools, or Tactics of Interest

Industrial Automation Threats: Kaspersky ICS CERT reported a continued high threat landscape for industrial automation systems in Q1 2025, with increased targeting of critical infrastructure and persistent OT security gaps.
Ransomware Evolution: Ransomware actors are leveraging legitimate IT tools and increasingly sophisticated tactics to evade detection and disrupt business continuity.
AI-Driven Voice Deepfakes: The FBI warned of ongoing voice phishing attacks against US officials using AI-generated audio deepfakes since April.
Anonymity Tools: Tor released Oniux, a command-line tool enabling any Linux application to route network traffic through the Tor network for enhanced anonymity.
Penetration Testing Practices: Industry discussion highlights the inadequacy of compliance-only penetration testing, emphasizing the need for continuous and adaptive security assessments.
Pwn2Own Berlin 2025: Security researchers demonstrated successful zero-day exploits against Windows 11, Red Hat Linux, Docker Desktop, and Oracle VirtualBox on the first day, earning $260,000 in rewards.

Regulatory or Policy Developments

Meta AI Data Use Controversy: Meta plans to use E.U. user data for AI training without explicit consent from May 27. The Austrian privacy group noyb has issued a cease-and-desist letter and is threatening a class action lawsuit if Meta proceeds.
Critical Infrastructure Security Warnings: Federal agencies continue to warn that OT security in critical infrastructure remains inadequate amid persistent and sophisticated cyber threats.

Artificial Intelligence Developments

OpenAI ChatGPT Integrations: Leaks confirm upcoming integration of Model Context Protocol (MCP), enabling ChatGPT to connect with third-party services. Additionally, a new feature will allow ChatGPT to record, transcribe, and summarize meetings, potentially increasing exposure of sensitive business communications.

Cybersecurity Brief – 2025-05-15

Thu, 15 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach and Extortion Attempt
- Coinbase disclosed a data breach affecting approximately 1% of its users after cybercriminals bribed customer support agents. Attackers accessed sensitive customer information, including government IDs, and attempted to extort $20 million. The extortion attempt failed, but the incident highlights ongoing risks to cryptocurrency platforms from both insider and external threats.
Nova Scotia Power Data Breach
- Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data. The breach was discovered last month and underscores the persistent targeting of critical infrastructure and utility providers.

Newly Discovered Vulnerabilities

SAP NetWeaver (CVE-2025-31324)
- A critical vulnerability in SAP NetWeaver is being actively exploited by multiple threat actors, including ransomware groups BianLian and RansomExx. The flaw allows remote code execution and has led to a surge in attacks against unpatched systems. Immediate patching is strongly advised.
Samsung MagicINFO 9 Server (CVE-2025-4632)
- Samsung patched a critical vulnerability (CVSS 9.8) in MagicINFO 9 Server that was actively exploited to deploy Mirai botnet variants. Organizations using this software should update immediately.
Google Chrome High-Severity Flaw
- Google released emergency updates addressing a high-severity Chrome vulnerability that has a public exploit and is being used in the wild for cross-origin data leaks via the Loader Referrer Policy. All users are advised to update promptly.
Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Flaws
- Ivanti confirmed exploitation in the wild of zero-day vulnerabilities in EPMM, affecting a limited number of customers. The flaws stem from open source library issues and are being used in chained attacks.

Cybersecurity Brief – 2025-05-09

Fri, 09 May 2025 00:00:00 +0000

Major Incidents or Breaches

Pearson Data Breach: Education giant Pearson suffered a cyberattack resulting in the theft of corporate and customer data.
Insight Partners Breach: Venture capital firm Insight Partners confirmed sensitive employee and investor data was stolen in a January 2025 cyberattack.
Toronto School District Ransomware: Toronto’s school district paid a ransom believing stolen data would be deleted; however, the data was not removed as promised.
Supply Chain Attacks on Open Source Packages:
- The npm package ‘rand-user-agent’ (45,000 weekly downloads) was compromised to deliver a remote access trojan (RAT).
- A malicious PyPI package targeting Discord developers was found to be distributing RAT malware since 2022.
Kickidler Software Abused: Ransomware operators are leveraging legitimate Kickidler employee monitoring software for post-compromise reconnaissance and credential harvesting.

Newly Discovered Vulnerabilities

SonicWall SMA 100 Flaws: Three vulnerabilities (including one actively exploited) in SonicWall SMA 100 appliances allow remote code execution as root. Patches have been released, and urgent remediation is advised.
Cisco IOS XE Critical Flaw: Cisco patched a maximum severity vulnerability in IOS XE Software for Wireless LAN Controllers, which allowed unauthenticated remote takeover via a hard-coded JWT.
SAP NetWeaver RCE (CVE-2025-31324): Chinese threat actors (Chaya_004) are actively exploiting this recent SAP NetWeaver remote code execution flaw.
End-of-Life Routers Compromised: The FBI warned that threat actors are compromising end-of-life routers to build proxy networks for cybercrime.

Notable Threat Actor Activity

Qilin Ransomware Surge: Qilin ransomware was the most prolific in April 2025, responsible for 72 data leak disclosures. Operators are using SmokeLoader and a new .NET loader (NETXLOADER).
Chinese APT (Chaya_004): Actively exploiting SAP NetWeaver RCE to deploy Golang-based SuperShell malware.
Russian State-Linked ColdRiver Group: Deploying new LostKeys data theft malware in espionage campaigns targeting Western governments, journalists, and think tanks.
MirrorFace Espionage: The MirrorFace group is targeting Japanese and Taiwanese government/public sector organisations with upgraded ANEL and new ROAMINGMOUSE malware.
Phishing Operations:
- Industrial-scale crypto phishing operation using over 38,000 FreeDrain subdomains to steal wallet seed phrases.
- CoGUI phishing kit targeting Japanese organisations with sophisticated detection-evasion capabilities.

Trends, Tools, or Tactics of Interest

Phishing Kits Bypassing MFA: Ongoing evolution of phishing kits with features designed to bypass multi-factor authentication, increasing risk to organisations relying on MFA alone.
Abuse of Legitimate Tools: Ransomware actors are increasingly using legitimate employee monitoring software (e.g., Kickidler) for internal reconnaissance and credential theft post-breach.
Open Source Supply Chain Risk: Continued targeting of popular npm and PyPI packages to deliver malware, highlighting persistent risks in software supply chains.
Email-Based Attacks Dominate Claims: Business email compromise and funds transfer fraud accounted for 60% of 2024 cyber-insurance claims, underscoring the prevalence and impact of email-based attacks.
Proxy Networks via EoL Routers: Threat actors are exploiting outdated routers to create large-scale proxy networks used in cybercrime infrastructure.
DDoS-for-Hire Disruption: International law enforcement (Operation PowerOFF) took down nine DDoS-for-hire domains, reflecting ongoing efforts to disrupt cybercrime services.

Regulatory or Policy Developments

CVE Database Concerns: Industry discussion is intensifying around the future and timeliness of the CVE vulnerability database, with calls for reform to address delays and improve vulnerability coordination.
Leadership Change at FBI Cyber Division: The head of the FBI’s Cyber Division, Bryan Vorndran, is expected to retire, potentially impacting US cyber policy and enforcement priorities.

Cybersecurity Brief – 2025-04-29

Tue, 29 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Ransomware Attack
- Marks & Spencer experienced significant operational disruption, including outages and warehouse worker furloughs, due to a ransomware attack attributed to the “Scattered Spider” group.
Hitachi Vantara Ransomware Incident
- Hitachi Vantara took servers offline to contain an Akira ransomware attack, impacting business operations.
VeriSource Data Breach
- Employee benefits firm VeriSource confirmed that a February breach exposed personal information of 4 million individuals.
Urban One Data Breach
- Urban One, a major media company, disclosed a data breach following claims by a ransomware group.
World Uyghur Congress Targeted by Malware
- Senior members of the World Uyghur Congress were targeted in a sophisticated malware campaign via a trojanized UyghurEdit++ tool, indicating ongoing cyber-espionage efforts against exiled Uyghur groups.

Newly Discovered and Actively Exploited Vulnerabilities

SAP NetWeaver Visual Composer (CVE-2025-31324)
- Over 1,200 internet-facing SAP NetWeaver servers remain vulnerable to an actively exploited unauthenticated file upload flaw, allowing server hijacking. Attacks began before SAP released a patch.
Craft CMS Zero-Day Flaws
- Two newly disclosed critical vulnerabilities in Craft CMS are being exploited in the wild, with hundreds of servers likely compromised.
Broadcom Brocade Fabric OS and Commvault Web Server
- CISA added high-severity vulnerabilities in Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) database, indicating active exploitation.
Pymatgen 2024.1 Remote Code Execution
- A high-risk remote code execution vulnerability has been disclosed in Pymatgen 2024.1.
WooCommerce Phishing Campaign
- Attackers are distributing fake security patches to WooCommerce users, installing backdoors under the guise of critical updates.

Notable Threat Actor Activity

Earth Kurma APT
- Newly identified APT group “Earth Kurma” has targeted government and telecom sectors in Southeast Asia since June 2023, using rootkits and cloud-based data theft tools.
Scattered Spider
- Linked to the ransomware attack on Marks & Spencer, demonstrating continued targeting of UK-based large enterprises.
AI-Powered Phishing and Commodity Tools
- Increased use of AI-powered phishing kits and automated attack tools is lowering the barrier to entry for less skilled threat actors.

Trends, Tools, and Tactics

AI and Automation in Threat Landscape
- Attackers are leveraging AI, automation, and dark web resources to accelerate attack sophistication and frequency.
Record DDoS Attack Volumes
- Cloudflare reported a 358% year-over-year increase in DDoS attacks, highlighting a surge in volumetric and application-layer attacks.
Supply Chain and Update Risks
- Kali Linux users were warned of update failures due to a lost repository signing key, underscoring the importance of secure software supply chains.
Surveillance Risks in Connected Vehicles
- Law enforcement agencies are increasingly exploiting data from internet-connected vehicle features for surveillance purposes.

Regulatory and Policy Developments

CISA KEV Updates
- The U.S. CISA’s addition of new vulnerabilities to its KEV database may prompt UK organisations to review their own exposure and patch management processes.
US DoJ Data Security Program
- New compliance rules from the US Department of Justice will require organisations to reassess data sharing practices, with potential implications for multinational firms operating in or with the US.
Windscribe Legal Precedent
- Windscribe VPN was acquitted on charges regarding user data collection, reinforcing the legal standing of privacy-first service providers.

Other Notable Developments

Operational Disruptions
- Ukrainian state and banking services were temporarily disrupted due to a data centre power outage, affecting government and corporate customers.
Security Tooling
- Malwarebytes highlighted as a tool for combating online scams, reflecting ongoing emphasis on endpoint protection and anti-fraud solutions.

Summary of Key Risks

Ransomware remains a significant threat to large enterprises, with notable UK impact.
Actively exploited vulnerabilities in widely used enterprise software (SAP, Craft CMS, Broadcom, Commvault) require urgent attention.
AI-driven attack automation and phishing are reshaping the threat landscape, enabling more actors to launch sophisticated campaigns.
Regulatory changes and legal rulings are influencing data security and privacy practices globally.