CVE-2025-43300 on DanSec Daily

Cybersecurity Brief – 2025-09-17

Wed, 17 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover has extended its production shutdown for another week following a significant cyberattack that impacted systems at the end of August.
The US Department of Homeland Security exposed sensitive national security intelligence, including surveillance data on Americans, to thousands of unauthorized users due to a misconfigured data hub.
The RaccoonO365 phishing network, responsible for large-scale phishing campaigns, was dismantled following a joint operation by Microsoft and Cloudflare, resulting in the takedown of 338 malicious domains.
Google has removed 224 Android applications involved in the “SlopAds” ad fraud operation, which generated 2.3 billion ad requests daily and affected 38 million downloads globally.
At least 187 npm packages were compromised in a self-propagating supply chain attack, dubbed ‘Shai-Hulud’, which stole developer credentials and spread malware through infected packages.
The BreachForums hacking forum administrator, Conor Brian Fitzpatrick, was resentenced to three years in prison for cybercrime charges, including the operation of the forum and possession of CSAM.

Newly Discovered Vulnerabilities

Apple released security updates for iOS, macOS, and older iPhone/iPad models, addressing over 50 vulnerabilities, including CVE-2025-43300, an out-of-bounds flaw actively exploited in sophisticated spyware attacks.
Multiple critical vulnerabilities were disclosed in Chaos Mesh, a chaos engineering platform for Kubernetes, allowing for remote code execution and potential full cluster takeover.
A new Rowhammer attack, named Phoenix, was demonstrated against DDR5 memory, achieving root access on systems in under two minutes.
ChatGPT’s new calendar integration was shown to be exploitable for email exfiltration via crafted calendar invites.

Notable Threat Actor Activity

RevengeHotels, an established cybercrime group, has launched a new campaign in Latin America leveraging large language models (LLMs) to generate malicious scripts and using VenomRAT in targeted phishing attacks.
The North Korean group Kimsuky used ChatGPT to create deepfake military ID documents in attempts to compromise South Korean targets.
A new FileFix variant is delivering the StealC infostealer malware through multilingual phishing sites, using code obfuscation and steganography, and impersonating Meta account suspension warnings.
The Yurei ransomware group, believed to operate from Morocco, has claimed its first victims using a modified Prince-Ransomware binary.
The SlopAds fraud ring exploited commercial adtech infrastructure, including links to PropellerAds, to orchestrate its global ad fraud operation.
Security industry experts remain skeptical of claims by Scattered Spider and ShinyHunters that they are retiring, suggesting continued threat activity is likely.

Trends, Tools, or Tactics of Interest

Shadow AI threats are increasing, with reports highlighting the use of generative AI and autonomous agents in both attacks and enterprise workflows.
Phishing-as-a-service operations, such as RaccoonO365, continue to leverage large-scale domain infrastructure for credential theft.
Supply chain attacks targeting open-source repositories (npm) are increasingly employing self-replicating, worm-like malware to propagate and exfiltrate credentials.
AI chatbots, including ChatGPT and Grok, are being used to generate phishing emails and malicious code, with a noted focus on targeting vulnerable populations such as senior citizens.
Children and teenagers are increasingly involved in hacking school systems, often underestimating the consequences.
The FileFix campaign demonstrates advanced social engineering, using multilingual phishing, steganography, and code obfuscation.
The removal of WMIC (Windows Management Instrumentation Command-line) tool is planned for Windows 11 25H2 and later, impacting system administration and automation practices.
The emergence of new security solutions focused on AI agent management (Astrix), browser security (Neon Cyber), and real-time, AI-driven data protection (Ray Security) reflects a shift toward addressing AI-native and browser-based threats.

Regulatory or Policy Developments Affecting the Security Industry

CrowdStrike announced the acquisition of Pangea to launch AI Detection and Response (AIDR), expanding protection for enterprise AI models and applications.
Check Point is acquiring AI security firm Lakera, underlining growing industry demand for AI-native security solutions amid increased generative AI adoption.
Apple’s backporting of zero-day patches to older devices addresses ongoing exploitation concerns and highlights regulatory and customer pressure for extended device support.

Cybersecurity Brief – 2025-08-24

Sun, 24 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

DaVita, a kidney dialysis provider, confirmed that a ransomware gang breached its network and exfiltrated personal and health information of nearly 2.7 million individuals.
CPAP Medical Supplies and Services disclosed a data breach impacting 90,000 individuals, stemming from an intrusion in December 2024.
Hundreds of organisations were targeted in a new Atomic macOS Stealer campaign via malvertising between June and August 2025.
A clickjacking attack was reported that can steal credentials from browser-integrated password managers.
Grok AI chats, intended to be shared privately, were indexed by Google and became publicly searchable.

Newly Discovered Vulnerabilities

Apple patched a zero-day vulnerability (CVE-2025-43300) exploited in sophisticated attacks against targeted individuals.
A flaw in the ReVault control board in commonly used Dell laptops allowed attackers to gain malicious access down to the device firmware.
AWS addressed a vulnerability that allowed attackers to trick Trusted Advisor into displaying unprotected S3 buckets as secure.
Microsoft confirmed that August 2025 Windows security updates are causing severe issues with NDI streaming software on Windows 10 and 11.
MITRE released an updated list of the most important hardware weaknesses, reflecting current hardware security challenges.

Notable Threat Actor Activity

The Chinese state-sponsored group Murky Panda (Silk Typhoon) escalated cloud and telecom espionage, exploiting trusted relationships in cloud environments to access downstream customer networks and data, particularly targeting North American organisations. The group leveraged both n-day and zero-day vulnerabilities for initial access.
Pakistani APT36 is abusing Linux .desktop files to install malware in new campaigns against Indian government and defence entities.
Campaigns exploiting known vulnerabilities in GeoServer, Redis, and other platforms have been observed, with attackers leveraging these for botnet expansion and malicious activities.
A new infostealer malware, Shamos, is targeting Mac devices through fake troubleshooting guides and fixes in ClickFix attacks.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly abusing generative AI tools to produce convincing phishing websites rapidly, as observed by Palo Alto Networks’ Unit 42.
Survey scam phishing emails are evolving in sophistication, using technical measures to evade detection and steal financial data.
Linux malware campaigns are employing malicious RAR filenames in phishing emails to deliver the open-source VShell backdoor, evading antivirus detection.
Automation is increasingly redefining penetration testing delivery, with a shift towards more scalable and efficient reporting.
The proliferation of AI agents, chatbots, and machine credentials is creating new security management challenges, as these non-human identities now outnumber human users.
Insurers are considering limiting payouts for breaches involving unpatched critical vulnerabilities, with resistance from most organisations.
AI-assisted code and security reviews (e.g., Anthropic’s Claude) are being explored to enhance application security.
Apple Intelligence was found to be collecting more user data than previously understood, including music preferences, location, and potentially encrypted messages.
Modern vehicle cybersecurity trends highlight growing threats and the need for new security approaches in automotive systems.

Regulatory or Policy Developments

INTERPOL’s Operation Serengeti 2.0 resulted in the arrest of over 1,200 cybercriminals across 18 African nations, dismantling criminal infrastructure and recovering nearly $100 million.
CISA released a draft Software Bill of Materials (SBOM) guide for public comment.
Ongoing concerns about personal liability for CISOs remain, with increased risk of both legal and criminal targeting.
Microsoft has limited China’s access to the Microsoft Active Protections Program (MAPP).

Cybersecurity Brief – 2025-08-23

Sat, 23 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

DaVita, a kidney dialysis provider, confirmed a ransomware attack resulted in the theft of personal and health information for nearly 2.7 million individuals.
CPAP Medical Supplies and Services disclosed a data breach stemming from a December 2024 intrusion, impacting approximately 90,000 people.
Over 300 entities were targeted between June and August in a new campaign using the Atomic macOS Stealer, delivered via malvertising.
A clickjacking attack capable of stealing credentials from browser-integrated password managers was disclosed.
Grok AI chat logs intended to be private were indexed by Google Search, exposing user conversations to the public web.

Newly Discovered Vulnerabilities

Apple released a patch for a zero-day vulnerability (CVE-2025-43300) exploited in targeted attacks, likely linked to spyware or nation-state actors.
A vulnerability in Dell laptops’ ReVault control board allowed attackers to gain access down to the device firmware.
AWS addressed a flaw in Trusted Advisor that allowed unprotected S3 buckets to be incorrectly reported as secure.
Microsoft confirmed that August 2025 Windows updates are causing severe lag and stuttering issues with NDI streaming software on Windows 10 and 11.
MITRE updated its list of Most Important Hardware Weaknesses to reflect current hardware security risks.

Notable Threat Actor Activity

Chinese APT group Murky Panda (Silk Typhoon) exploited trusted relationships in cloud environments to gain access to downstream customer networks and data, targeting North American organisations and leveraging both n-day and zero-day vulnerabilities for initial access.
Pakistani APT36 group was observed using malicious Linux .desktop files to install malware in attacks against Indian government and defence entities.
New Linux malware infection chain employing phishing emails to deliver the open-source VShell backdoor was documented, using malicious RAR filenames to evade antivirus detection.
Mac users were targeted by the new ‘Shamos’ infostealer, distributed via fake troubleshooting guides and fixes (ClickFix attacks).
Cybercriminals are increasingly leveraging generative AI tools to automate the creation of convincing phishing websites.
Survey scam phishing campaigns have become more technically sophisticated, evading detection and stealing financial data through fake offers of free gifts.

Trends, Tools, or Tactics of Interest

Automation is transforming penetration testing delivery, with increased focus on efficient result reporting and remediation tracking.
The proliferation of AI agents, chatbots, and machine identities is introducing complex security management challenges, as these non-human entities now outnumber human users in many environments.
ChromeAlone, a new red team tool, turns the Chromium browser into a stealthy command-and-control implant with credential capture and persistence capabilities.
Modern vehicle cybersecurity is facing evolving threats, including increased attack surfaces in electric and connected vehicles, with a focus on supply chain, telematics, and over-the-air update security.
AI-assisted website generators are being abused by threat actors to rapidly create phishing sites.
Clickjacking remains a viable attack vector for compromising browser-based password managers.

Regulatory or Policy Developments

CISA issued a draft Software Bill of Materials (SBOM) guide for public comment, aiming to standardise SBOM practices across industries.
Some cyber insurers are moving to limit payouts for breaches where organisations have failed to remediate serious vulnerabilities in a timely manner.
Ongoing concerns over personal liability for CISOs persist, with increased scrutiny over liability protections and targeting by threat actors due to their privileged access.

Cybersecurity Brief – 2025-08-22

Fri, 22 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Colt Technology Services Ransomware Attack
- UK-based Colt Technology Services confirmed a data breach involving customer documentation theft. The Warlock ransomware gang is auctioning the stolen files. The company is working to restore disrupted systems.
Orange Belgium Data Breach
- Orange Belgium disclosed that attackers accessed data of approximately 850,000 customers during a July cyberattack. The breach affected customer accounts but no further technical details were provided.
Ex-Developer Sentenced for Sabotage
- A former developer was sentenced to four years in prison for deploying custom malware and a kill switch on his ex-employer’s network, locking out employees after his account was disabled.
Scattered Spider Member Sentenced
- Noah Michael Urban, a member of the Scattered Spider cybercrime group, was sentenced to 10 years in prison for wire fraud and conspiracy related to high-profile attacks.

Cybersecurity Brief – 2025-08-21

Thu, 21 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a pharmaceutical company, confirmed a ransomware attack that resulted in the compromise and encryption of internal systems, with business operations impacted.
Vulnerabilities in a Workhorse Software application used by hundreds of municipalities exposed sensitive data; CERT/CC disclosed details following the release of patches.
Vulnerable internal services at Intel exposed information of 270,000 employees, as reported by a security researcher.
Microsoft is investigating an outage affecting Copilot and Office.com, impacting user access across North America.
Six major password managers are currently vulnerable to unpatched clickjacking flaws, potentially exposing user credentials, two-factor authentication codes, and credit card information.
McDonald’s staff and partner portals were found to have exposed APIs, sensitive data, and corporate documents due to security flaws.
Hackers are using legitimate ADFS redirects via office.com links to steal Microsoft 365 login credentials through phishing attacks.
The RapperBot DDoS-for-hire botnet was disrupted, and the alleged developer and administrator has been charged by the US Department of Justice.
A member of the “Scattered Spider” cybercrime group was sentenced to 10 years in prison and ordered to pay $13 million in restitution for SIM-swapping and related cyber offences.
Europol has clarified that a purported $50,000 reward for Qilin ransomware group members is a scam.

Newly Discovered Vulnerabilities

Apple released emergency security updates for iOS, iPadOS, and macOS, patching CVE-2025-43300, an out-of-bounds write zero-day vulnerability actively exploited in targeted attacks.
Google and Mozilla issued patches for multiple high-severity vulnerabilities in Chrome and Firefox browsers.
DOM-based clickjacking vulnerabilities affecting major password manager browser extensions could allow attackers to steal credentials and sensitive data.
A vulnerability in GPT-5’s routing mechanism can redirect user queries to older, less secure models, risking exposure to jailbreaks and unsafe outputs.
Researchers identified prompt injection vulnerabilities in AI browsers, such as Perplexity’s Comet, allowing malicious prompts to trigger unintended actions, including fraudulent purchases.
Vulnerabilities in McDonald’s internal portals exposed sensitive APIs and corporate documents.
CERT/CC disclosed information exposure vulnerabilities in Workhorse Software, used by local governments, after patch release.

Notable Threat Actor Activity

The Russian state-sponsored group “Static Tundra” (aka Energetic Bear) is exploiting a seven-year-old flaw in Cisco IOS/IOS XE software, targeting unpatched, end-of-life devices for cyber espionage against enterprises and critical infrastructure.
North Korean threat actors have conducted a coordinated cyber espionage campaign against diplomatic missions in South Korea, leveraging GitHub for command and control and deploying spear-phishing tactics.
Detailed spear-phishing attacks targeting European government entities in Seoul have been attributed to North Korea, China, or both.
Cybercriminals are increasingly abusing the AI-powered Lovable website builder to generate phishing pages, malware delivery sites, and fraudulent portals.
Low-skill attackers are leveraging LLM-generated scripts and services like Lovable to rapidly create convincing malicious websites.
Increased scanning activity targeting Airtell routers and web servers has been observed via honeypots.

Trends, Tools, or Tactics of Interest

HR-themed phishing attacks have surged by 120% in Q1 2025, with attackers impersonating internal HR communications to increase success rates.
The use of legitimate infrastructure (e.g., office.com, ADFS) in phishing campaigns is on the rise, enabling more convincing credential theft schemes.
AI browsers and agentic tools are being actively researched for vulnerabilities, with prompt injection and clickjacking emerging as significant risks.
The “Warlock” ransomware group is specifically targeting vulnerable on-premises SharePoint servers using sophisticated attack methods.
There is a notable increase in the abuse of AI-driven website builders (e.g., Lovable, Vibe) to lower barriers for cybercriminals, enabling rapid deployment of malicious sites.
The disruption of the RapperBot botnet and law enforcement action against its administrator highlight ongoing efforts to combat DDoS-for-hire operations.
Increased focus on shadow AI agents within enterprises, with concerns that unmonitored deployments could introduce significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced its Quantum-Safe Program, aiming to ensure all products and services are secured against quantum-based attacks by 2033.
Incode has acquired AuthenticID to enhance AI-driven identity verification, combining AI models with large-scale, regulated identity programme experience.
Europol issued a warning about fraudulent reward offers targeting ransomware group members, clarifying that a recently publicised Qilin reward is a scam.