CVE-2025-4632 on DanSec Daily

Cybersecurity Brief – 2025-05-16

Fri, 16 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach: Coinbase disclosed a breach affecting approximately 1% of its users. Cybercriminals bribed customer support agents to steal customer data, including government-issued IDs. Attackers attempted to extort $20 million, but the attempt failed.
Nova Scotia Power Data Breach: Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data.
Steel Manufacturer Cyber Incident: Nucor, a major steelmaker, halted operations due to a cyber incident. Details on the nature and scope of the breach remain undisclosed.
Breachforums Settlement: The former administrator of Breachforums agreed to pay nearly $700,000 to settle a civil lawsuit related to a healthcare data breach.

Newly Discovered Vulnerabilities

Google Chrome Zero-Day: Google patched a high-severity Chrome vulnerability (with a public exploit in the wild) that enables cross-origin data leaks via Loader Referrer Policy. Emergency updates have been released.
Samsung MagicInfo Server (CVE-2025-4632): Threat actors are actively exploiting a patch bypass for a previously disclosed vulnerability in Samsung MagicInfo 9 Server.
SAP NetWeaver (CVE-2025-31324): Ongoing exploitation of a critical SAP NetWeaver vulnerability is being observed. Administrators are urged to patch immediately.
Windows 10 KB5058379 Update Issue: The latest Windows 10 update is triggering unexpected BitLocker recovery prompts on some devices after installation.

Notable Threat Actor Activity

APT28 Cyber Espionage: Russia-linked APT28 exploited a zero-day in MDaemon and other webmail servers (Roundcube, Horde, Zimbra) via XSS vulnerabilities in a global campaign (“RoundPress”) targeting government organizations.
Malicious npm Package: Researchers identified a malicious npm package (“os-info-checker-es6”) using Unicode steganography to hide its payload and Google Calendar links as command-and-control infrastructure.

Trends, Tools, or Tactics of Interest

Industrial Automation Threats: Kaspersky ICS CERT reported a continued high threat landscape for industrial automation systems in Q1 2025, with increased targeting of critical infrastructure and persistent OT security gaps.
Ransomware Evolution: Ransomware actors are leveraging legitimate IT tools and increasingly sophisticated tactics to evade detection and disrupt business continuity.
AI-Driven Voice Deepfakes: The FBI warned of ongoing voice phishing attacks against US officials using AI-generated audio deepfakes since April.
Anonymity Tools: Tor released Oniux, a command-line tool enabling any Linux application to route network traffic through the Tor network for enhanced anonymity.
Penetration Testing Practices: Industry discussion highlights the inadequacy of compliance-only penetration testing, emphasizing the need for continuous and adaptive security assessments.
Pwn2Own Berlin 2025: Security researchers demonstrated successful zero-day exploits against Windows 11, Red Hat Linux, Docker Desktop, and Oracle VirtualBox on the first day, earning $260,000 in rewards.

Regulatory or Policy Developments

Meta AI Data Use Controversy: Meta plans to use E.U. user data for AI training without explicit consent from May 27. The Austrian privacy group noyb has issued a cease-and-desist letter and is threatening a class action lawsuit if Meta proceeds.
Critical Infrastructure Security Warnings: Federal agencies continue to warn that OT security in critical infrastructure remains inadequate amid persistent and sophisticated cyber threats.

Artificial Intelligence Developments

OpenAI ChatGPT Integrations: Leaks confirm upcoming integration of Model Context Protocol (MCP), enabling ChatGPT to connect with third-party services. Additionally, a new feature will allow ChatGPT to record, transcribe, and summarize meetings, potentially increasing exposure of sensitive business communications.

Cybersecurity Brief – 2025-05-15

Thu, 15 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach and Extortion Attempt
- Coinbase disclosed a data breach affecting approximately 1% of its users after cybercriminals bribed customer support agents. Attackers accessed sensitive customer information, including government IDs, and attempted to extort $20 million. The extortion attempt failed, but the incident highlights ongoing risks to cryptocurrency platforms from both insider and external threats.
Nova Scotia Power Data Breach
- Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data. The breach was discovered last month and underscores the persistent targeting of critical infrastructure and utility providers.

Newly Discovered Vulnerabilities

SAP NetWeaver (CVE-2025-31324)
- A critical vulnerability in SAP NetWeaver is being actively exploited by multiple threat actors, including ransomware groups BianLian and RansomExx. The flaw allows remote code execution and has led to a surge in attacks against unpatched systems. Immediate patching is strongly advised.
Samsung MagicINFO 9 Server (CVE-2025-4632)
- Samsung patched a critical vulnerability (CVSS 9.8) in MagicINFO 9 Server that was actively exploited to deploy Mirai botnet variants. Organizations using this software should update immediately.
Google Chrome High-Severity Flaw
- Google released emergency updates addressing a high-severity Chrome vulnerability that has a public exploit and is being used in the wild for cross-origin data leaks via the Loader Referrer Policy. All users are advised to update promptly.
Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Flaws
- Ivanti confirmed exploitation in the wild of zero-day vulnerabilities in EPMM, affecting a limited number of customers. The flaws stem from open source library issues and are being used in chained attacks.

Cybersecurity Brief – 2025-05-14

Wed, 14 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer confirmed customer data was stolen in a recent cyberattack. While no account passwords were compromised, customers are being required to reset passwords as a precaution.
Dior disclosed a cybersecurity incident resulting in the exposure of customer information.
Nucor Corporation, a major steel producer, experienced network disruptions due to a cyberattack, forcing parts of its systems offline for containment.
The Australian Human Rights Commission suffered a data breach in which private documents were leaked online and indexed by search engines.
Xinbi Guarantee, a Chinese-language Telegram marketplace, has been linked to $8.4 billion in illicit transactions, including crypto crime, romance scams, and North Korean money laundering.
North Korean IT worker scams are being exposed at scale, with researchers publishing 1,000 email addresses and photos linked to infiltration of Western companies.
Kosovo extradited the admin of BlackDB, an online cybercrime marketplace, to the US to face charges.

Newly Discovered Vulnerabilities and Exploits

Microsoft Patch Tuesday (May 2025): Microsoft released fixes for 78 vulnerabilities, including five zero-days under active exploitation. Notably, a CVSS 10 vulnerability impacts Azure DevOps Server.
Samsung patched CVE-2025-4632 in MagicINFO 9 Server, a critical flaw (CVSS 9.8) exploited to deploy Mirai botnet malware.
Fortinet addressed CVE-2025-32756, a zero-day RCE flaw in FortiVoice enterprise phone systems, confirmed as exploited in the wild.
Ivanti released updates for two vulnerabilities in Endpoint Manager Mobile (EPMM) that have been chained for remote code execution in limited attacks.
SAP NetWeaver vulnerability is being actively exploited by multiple ransomware groups, including BianLian and RansomExx, to deploy malware such as PipeMagic Trojan.
Google Chrome is rolling out a security change to prevent browser launches with admin privileges on Windows, reducing attack surface.
Open redirect vulnerabilities in trusted domains (e.g., google.com) continue to be abused in phishing campaigns.
Focused phishing attacks are leveraging trusted domains, real CAPTCHAs, and server-side validation for more targeted credential theft.

Notable Threat Actor Activity

Earth Ammit, a cyber espionage group, was linked to supply chain breaches in the drone sector via ERP systems in the VENOM and TIDRONE campaigns targeting Taiwan and South Korea.
Scattered Spider (aka UNC3944) tactics, previously used against UK retail chains, are now being deployed against US retailers.
Ransomware gangs are increasingly exploiting SAP NetWeaver vulnerabilities for initial access and malware deployment.
Meta Mirage, a global phishing campaign, is targeting Meta Business Suite users to hijack high-value business accounts.
Horabot malware is being distributed through invoice-themed phishing emails, targeting Windows users across six Latin American countries.

Trends, Tools, and Tactics of Interest

Phishing campaigns are becoming more sophisticated, with increased use of trusted domains, CAPTCHAs, and real-time validation to evade detection and improve targeting.
Telegram-based black markets remain a significant vector for cybercrime, with recent enforcement actions leading to shutdowns and exposure of major illicit marketplaces.
Shadow SaaS and AI usage is an emerging risk, with new tools (e.g., LastPass SaaS monitoring) being developed to detect unauthorised employee use of unsanctioned cloud and AI services.
Supply chain attacks via ERP systems and targeting of high-value sectors (e.g., drones, retail) remain prevalent.
AI agent security: Research indicates that AI agents can be manipulated by implanting fake “memories,” raising concerns about the integrity of autonomous systems.
Device hygiene: Daily phone reboots are recommended as a practical defense against persistent zero-click mobile exploits.

Regulatory and Policy Developments

Consumer Financial Protection Bureau (CFPB) in the US has canceled plans for tighter regulation of data brokers, potentially impacting privacy and data protection standards.
Telegram enforcement: Following media inquiries, Telegram banned thousands of accounts tied to crypto scam money laundering, disrupting several major illicit marketplaces.