CVE-2025-32433 on DanSec Daily

Cybersecurity Brief – 2025-08-13

Wed, 13 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers leaked data stolen from Allianz Life in ongoing Salesforce data theft campaigns, exposing 2.8 million records containing sensitive information on business partners and customers.
Over 275 million patient records were breached in the healthcare sector in 2024, primarily due to weak or stolen passwords.
Researchers identified Docker images on Docker Hub still containing the XZ Utils backdoor, more than a year after its public disclosure. At least 35 Linux images remain affected, posing ongoing supply chain risks.
The U.S. Department of Justice seized approximately $1 million in cryptocurrency from the BlackSuit ransomware gang.
Over 3,300 Citrix NetScaler devices remain unpatched against the actively exploited “CitrixBleed 2” vulnerability, leaving organisations at risk of authentication bypass attacks.

Newly Discovered Vulnerabilities

Microsoft’s August 2025 Patch Tuesday addressed 107–111 vulnerabilities, including 13–17 rated as critical. One publicly disclosed zero-day vulnerability in Windows Kerberos was patched, alongside several elevation-of-privilege flaws.
Adobe released security updates fixing over 60 vulnerabilities across 13 products, including Commerce, Substance, InDesign, FrameMaker, and Dimension.
SAP patched a critical vulnerability in S/4HANA as part of its August 2025 security notes.
Major industrial control system (ICS) vendors (Siemens, Schneider, Aveva, Honeywell, ABB, Phoenix Contact) issued advisories for code execution vulnerabilities.
Citrix NetScaler ADC products are being actively exploited via CVE-2025-6543, a critical security flaw confirmed by the Dutch National Cyber Security Centre (NCSC-NL).
A vulnerability in Erlang/OTP (CVE-2025-32433) has been widely exploited in operational technology (OT) networks since early May.
A now-patched WinRAR vulnerability has been exploited by at least two separate threat groups.

Notable Threat Actor Activity

The Charon ransomware family, employing APT-level evasion tactics, has been deployed in targeted attacks against public sector and aviation organisations in the Middle East. The campaign may be linked to China’s state-sponsored Earth Baxia group.
Cybercrime groups ShinyHunters and Scattered Spider have joined forces in data extortion campaigns, initially targeting Salesforce customers, with indications of expansion towards financial services and technology providers. ShinyHunters’ tactics now mirror those of Scattered Spider.
The newly identified Curly COMrades APT group has targeted government entities in Georgia and Moldova using custom backdoor malware and NGEN COM hijacking for persistent access.
Fortinet SSL VPN devices experienced a significant spike in brute-force attacks globally, with attackers later shifting focus to FortiManager.
Researchers report ongoing exploitation of Microsoft Teams in social engineering attacks to facilitate credential theft and malware delivery.

Trends, Tools, or Tactics of Interest

Supply chain risks persist as malicious Docker images with the XZ Utils backdoor remain available on Docker Hub.
Threat actors continue to abuse business logic flaws and leverage dark web marketplaces to sell enterprise network access, streamlining cybercrime operations.
Social engineering remains a prominent attack vector, with attackers exploiting communication platforms (e.g., Microsoft Teams) and using tactics such as tax office or Amazon recall impersonation scams.
APT actors are leveraging advanced persistence techniques, such as NGEN COM hijacking and scheduled tasks, to maintain long-term access in targeted environments.
The debate between enterprise browsers and secure browser extensions is highlighted as a key consideration for mitigating browser-based risks.
Elevation-of-privilege vulnerabilities dominated Microsoft’s August 2025 Patch Tuesday, reflecting ongoing attacker interest in privilege escalation.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced end-of-support for Windows 11 23H2 Home and Pro editions in November 2025.
Android’s protected Kernel-based Virtual Machine (pKVM) achieved SESIP Level 5 security certification, the highest level for IoT and mobile platforms.
The Dutch NCSC issued an alert regarding active exploitation of Citrix NetScaler CVE-2025-6543 in critical sectors.
Chinese authorities have publicly questioned the security of AI chips from Nvidia and AMD, citing concerns about potential backdoors.

Cybersecurity Brief – 2025-04-20

Sun, 20 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

APT29 Targeting European Diplomats
- Russian state-sponsored group APT29 has launched a phishing campaign against European diplomatic entities.
- The campaign uses wine-tasting themed lures and deploys a new variant of WINELOADER, named GRAPELOADER, to gain initial access and maintain persistence.
Malicious npm Packages Planting SSH Backdoors
- Three rogue npm packages, mimicking a popular Telegram bot API library, were discovered to contain SSH backdoors and data exfiltration capabilities.
- These packages target Linux systems and could facilitate broader supply chain attacks.
Microsoft Entra ID Account Lockouts
- A new “leaked credentials” detection feature in Microsoft Entra ID has caused widespread account lockouts across multiple organizations due to false positives.
- The incident has impacted Windows administrators and disrupted user access.

Cybersecurity Brief – 2025-04-18

Fri, 18 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Ahold Delhaize Data Breach: Food retail giant Ahold Delhaize confirmed data theft from its U.S. business systems during a November 2024 cyberattack, attributed to the INC ransomware group. The breach impacted operations at several of its 2,000 U.S. stores.
Legends International Breach: Entertainment venue management firm Legends International disclosed a data breach from November 2024 affecting both employees and venue visitors.
Airport Retailer Ransomware Settlement: An airport retailer agreed to a $6.9 million settlement after a ransomware attack exfiltrated personal data (including names and Social Security numbers) of approximately 76,000 current and former employees.
Surge in SMS Phishing Scams: CTM360 reported a global spike in SMS-based reward and toll scams, notably PointyPhish and TollShark, operating via the Darcula Phishing-as-a-Service (PhaaS) platform. Over 5,000 domains are implicated in payment information theft.
Real Cash Scam in the U.S.: A widespread scam is tricking individuals into withdrawing and transferring large sums of cash to fraudsters, resulting in significant financial losses.

Newly Discovered Vulnerabilities

CVE-2025-32433 (Erlang/OTP SSH): A critical pre-auth remote code execution vulnerability in Erlang/OTP SSH was disclosed. The flaw is easily exploitable and requires immediate patching.
CVE-2025-24054 (Microsoft Windows): Actively exploited vulnerability allows NTLM credential theft via file downloads (notably .library-ms files). The flaw is being leveraged in phishing campaigns targeting government and private sector entities.
Chrome Extensions with Hidden Tracking: 57 Chrome extensions (6 million installs) were found to contain hidden tracking code, with capabilities to monitor browsing, access cookies, and potentially execute remote code.

Notable Threat Actor Activity

Mustang Panda: The China-linked Mustang Panda group targeted a Myanmar organization using new tooling, including StarProxy, EDR bypass techniques, and updated TONESHELL malware, demonstrating ongoing innovation.
XorDDoS Malware Expansion: Researchers identified a new XorDDoS controller and expanded infrastructure. The malware now targets Docker, Linux, and IoT environments, with 71% of attacks observed between Nov 2023–Feb 2024.
State-Sponsored ClickFix Campaigns: State-backed actors from Iran, North Korea, and Russia are actively using the ClickFix social engineering technique in targeted malware campaigns over the past three months.
Android Pre-Downloaded Malware: Threat actors are pre-installing malware on Android devices to steal cryptocurrency by covertly swapping wallet addresses.

Trends, Tools, and Tactics

Abuse of Legitimate Platforms: There is a continued increase in the abuse of legitimate domains (e.g., Google Drive, QuickBooks, Microsoft) for phishing attacks, with predictions that this trend will escalate in 2025.
AI in SaaS and Data Exposure: Employees are increasingly using AI-enabled tools (e.g., ChatGPT, SaaS integrations), inadvertently risking sensitive data exposure.
Security Awareness as a Top Challenge: A CyberEdge Group survey found that lack of security awareness among employees remains the primary obstacle to effective cyber defense.
Phishing-as-a-Service (PhaaS): Platforms like Darcula are enabling large-scale, sophisticated SMS phishing operations globally.

Regulatory and Policy Developments

CVE Program Funding Uncertainty: CISA extended MITRE’s CVE program contract by 11 months after initial cuts threatened continuity. The program’s long-term future remains uncertain, raising sector-wide concerns.
Cybersecurity Information Sharing Act Renewal: U.S. senators proposed a 10-year extension of the Cybersecurity Information Sharing Act of 2015 to facilitate continued information sharing between businesses and federal agencies.
Microsoft Office 2016/2019 End-of-Support: Microsoft reminded customers that Office 2016 and 2019 will reach end of extended support on October 14, 2025, impacting security update availability.
Discord Facing Legal and Regulatory Scrutiny: New Jersey filed suit against Discord for alleged failures in protecting children online. Discord is also piloting age verification via facial scans to enhance age-gating.
Leadership Change at SentinelOne: Chris Krebs resigned from SentinelOne after his security clearance was revoked by the Trump administration, reflecting ongoing political tensions impacting cybersecurity leadership.

AI Security

PromptArmor Platform Launch: PromptArmor, a new AI security startup, launched to help organizations assess and monitor third-party AI risks, following notable AI-related vulnerability discoveries.

Other Notable Developments

Security Usability Concerns: Reports highlight that complex security tools lead users to seek workarounds, undermining cyber defense efforts.