CVE-2025-5777 on DanSec Daily

Cybersecurity Brief – 2026-07-03

Fri, 03 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Google, in coordination with the FBI and industry partners, disrupted the NetNut residential proxy network, which relied on millions of compromised home devices to anonymize cybercriminal and nation-state activity. Hundreds of domains associated with NetNut were seized, significantly degrading the network’s operations ^[4]^[25]^[26].
A dual US-Estonian citizen alleged to be a member of the Scattered Spider hacking collective was extradited to the United States to face charges ^[18].
European Parliament members investigating Pegasus spyware were themselves targeted, with Citizen Lab confirming Pegasus infection on one investigator’s phone ^[24].

Newly Discovered Vulnerabilities

A critical vulnerability in the Cursor AI code editor (DuneSlide) allows zero-click prompt injection attacks that escape the editor’s sandbox and can execute arbitrary code at the operating system level ^[27].
A new WinRAR security flaw has been patched that could allow attackers to take control of a user’s computer. The lack of automatic updates in WinRAR increases the risk of unpatched systems ^[37].
A vulnerability in Apple’s Hide My Email feature, first reported a year ago, remains unpatched and exposes user email addresses ^[35].

Notable Threat Actor Activity

Ransomware groups, including those associated with Anubis, are exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability for initial access and are also leveraging bring-your-own-vulnerable-driver (BYOVD) and supply chain credential theft tactics ^[5]^[28].
The threat actor ToddyCat is deploying new Umbrij malware that abuses OAuth to access Gmail accounts via the Google API, enabling covert email access ^[7].
Attackers linked to the FortiBleed campaign have harvested credentials from hundreds of thousands of FortiGate firewalls and are collaborating with the INC and Lynx ransomware gangs, also exploiting a Nextcloud zero-day vulnerability ^[21]^[30].
Ransomware operators are running campaigns that impersonate Interpol, targeting small businesses globally using basic social engineering techniques ^[22].
KnowBe4 ThreatLabs tracked phishing campaigns targeting the FIFA World Cup 2026, with cybercriminals leveraging the event for credential theft and malware distribution ^[3].
ClickFix and ConsentFix attacks are hijacking Microsoft 365 accounts in seconds by exploiting OAuth flows and fake prompts to bypass MFA protections ^[13]^[36].
Fake Google and Cloudflare verification pages are distributing multiple malware families, including infostealers and a new malware loader, through ClickFix-style social engineering ^[36].

Trends, Tools, or Tactics of Interest

Immediate exploitation of newly disclosed vulnerabilities, such as CitrixBleed, is increasing, with attackers using public proof-of-concept code to target NetScaler appliances ^[28].
The first fully autonomous ransomware attack orchestrated by an AI agent (JADEPUFFER) was observed, exploiting a Langflow RCE vulnerability to automate a database ransomware campaign from start to finish ^[9].
ConsentFix and ClickFix attacks demonstrate a trend of using rapid OAuth token theft and social engineering to bypass MFA and compromise cloud accounts ^[13]^[36].
Opera has introduced a Paste Protect feature to mitigate ClickFix-style attacks by blocking malicious command execution via social engineering ^[17].
Context manipulation attacks, such as BioShocking, can trick agentic browsers into exfiltrating sensitive credentials by bypassing their safety guardrails ^[33].
Compromise assessment projects highlight persistent threats, missed incidents, and gaps in incident response across organizations, emphasizing the need for improved detection and response practices ^[1].
Identity lifecycle management models are being challenged by the proliferation of AI agents, which lack traditional employment records and departure dates, complicating access governance ^[8].
IBM and Red Hat have launched Project Lightwell, assigning 20,000 engineers to address open-source software supply chain risks identified by Anthropic’s Mythos AI bug-finding technology ^[23].
There is a shift in cybercrime pressure toward small and medium-sized businesses in Australia as larger institutions improve safeguards and regulatory compliance ^[19].

Regulatory or Policy Developments Affecting the Security Industry

The Court of Justice of the European Union dismissed Google’s final appeal against a €4.1 billion antitrust fine related to Android’s promotion of Chrome and search, upholding significant regulatory action against the company ^[12].
The Trump administration lifted restrictions on Anthropic’s Claude AI models following cybersecurity concerns, making Claude Fable 5 widely available again ^[31].
Apple has revised its long-standing patch policy to accelerate patch cycles in response to attackers leveraging AI to reduce time to exploit, indicating a move toward more rapid security updates ^[20].

Sources

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices - thehackernews.com
FBI Seizes NetNut Proxy Platform, Popa Botnet - krebsonsecurity.com
Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices - securityweek.com
Alleged Scattered Spider hacker extradited to the United States - bleepingcomputer.com
EU Politicians Investigated Pegasus Spyware. Then It Ended Up on One of Their Phones - wired.com
Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution - securityweek.com
WinRAR flaw could allow attackers to take control of your computer - malwarebytes.com
Apple’s Hide My Email doesn’t hide it very well - malwarebytes.com
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials - thehackernews.com
New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure - securityweek.com
ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API - thehackernews.com
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs - darkreading.com
FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks - securityweek.com
Ransomware Thugs Masquerade as Interpol to Entice Small Biz - darkreading.com
Cybercriminals Are Targeting the FIFA World Cup 2026 - blog.knowbe4.com
ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds - bleepingcomputer.com
Fake Google and Cloudflare verification pages spread multiple malware families - malwarebytes.com
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack - thehackernews.com
Opera rolls out Paste Protect feature to fight ClickFix attacks - bleepingcomputer.com
‘BioShocking’ Attack Tricks AI Browsers Into Stealing Credentials - securityweek.com
Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects - securelist.com
Identity Lifecycle Management Wasn't Built for AI Agents - thehackernews.com
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them. - darkreading.com
Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs - darkreading.com
Google loses final appeal to overturn €4.1 billion EU fine - bleepingcomputer.com
Trump Administration Lifts Restrictions on Anthropic’s Claude Models After Cybersecurity Alarm - securityweek.com
Apple Reverses Age-Old Patch Policy to Keep Up With AI - darkreading.com

Cybersecurity Brief – 2025-11-14

Fri, 14 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

DoorDash disclosed a data breach in October affecting user information across the US, Canada, Australia, and New Zealand.
The Washington Post is notifying nearly 10,000 employees and contractors of personal and financial data exposure following the Oracle data theft attack.
Synnovis confirmed patient information was stolen in a ransomware attack that disrupted pathology services at several London hospitals.
The NHS is investigating claims of an Oracle E-Business Suite (EBS) hack after hackers named over 40 alleged victims, with the National Cyber Security Centre involved.

Newly Discovered Vulnerabilities

Fortinet FortiWeb is affected by a path traversal vulnerability that allows unauthenticated attackers to create administrative users. The flaw is being actively exploited and a public proof-of-concept (PoC) is available.
ImunifyAV, a malware scanner for Linux servers used by tens of millions of websites, has a remote code execution vulnerability that could compromise hosting environments.
WatchGuard Firebox firewalls are impacted by CVE-2025-9242, a critical (CVSS 9.3) unauthenticated remote code execution vulnerability, which is being actively exploited.
Cisco Adaptive Security Appliances (ASA) and Firepower devices are subject to two actively exploited vulnerabilities, prompting urgent patching advisories from CISA.
Cisco Identity Services Engine (ISE) and Citrix products are affected by CVE-2025-20337 and CVE-2025-5777, both of which have been exploited as zero-days.
Uhale Android-based digital picture frames contain multiple critical vulnerabilities, including the ability to download and execute malware at boot time.
A vulnerability in ChatGPT’s custom GPTs allowed exploitation via server-side request forgery (SSRF) to obtain Azure access tokens.

Notable Threat Actor Activity

Russian-speaking threat actors have registered over 4,300 fake travel domains in a mass phishing campaign targeting hotel guests’ payment data.
A malicious Chrome extension, “Safery,” steals Ethereum wallet seed phrases and exfiltrates them using the Sui blockchain.
Indonesian threat actors are likely behind the ‘IndonesianFoods’ worm, which has spammed npm with over 100,000 self-replicating malicious packages.
The Coyote and Maverick banking trojans are active in Brazil, with Maverick terminating itself if run outside the country.
Google has taken legal action against the China-based Lighthouse phishing kit, disrupting a platform responsible for SMS phishing and toll-fee scams affecting over a million victims and 17,500 fake sites.

Trends, Tools, or Tactics of Interest

The Tycoon 2FA phishing kit has evolved, enabling unskilled actors to launch sophisticated social engineering attacks bypassing two-factor authentication.
Ransomware operators are increasingly targeting virtual environments: Akira ransomware is encrypting Nutanix AHV VMs; Kraken ransomware benchmarks systems to optimise encryption without overloading them.
Kerberoasting attacks remain a significant threat for Active Directory environments, with attackers stealing service account passwords to escalate privileges.
Formbook malware is being delivered through multiple scripting techniques to evade detection.
A surge in exploit weaponisation speed: 50–61% of new vulnerabilities in 2025 had exploit code available within 48 hours of disclosure.
Organisations are moving toward single sign-on (SSO) and passkeys to address persistent weak password usage among employees.
Microsoft Teams is rolling out screen capture prevention for Premium customers, blocking screenshots and recordings during meetings.
Attackers continue to leverage phishing-as-a-service platforms, with new kits and services supporting rapid deployment of phishing campaigns.

Law Enforcement and Regulatory Developments

Operation Endgame, coordinated by Europol and Eurojust, disrupted the Rhadamanthys, Venom RAT, and Elysium botnet operations, taking down over 1,025 servers and arresting at least one individual.
CISA, FBI, and partners have released updated guidance for defending against Akira ransomware, and have reiterated patching requirements for actively exploited Cisco and WatchGuard vulnerabilities.
Google’s legal actions have resulted in the disruption of the Lighthouse phishing kit infrastructure.
The UK’s National Cyber Security Centre is assisting the NHS following claims of an Oracle EBS breach.
New York State is investigating the use of algorithmic surveillance pricing in consumer markets, highlighting regulatory scrutiny over data-driven practices.

Cybersecurity Brief – 2025-11-13

Thu, 13 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Synnovis, a UK pathology services provider, has notified healthcare providers of a data breach resulting from a ransomware attack in June 2024, which led to the theft of patient data.
Over 67,000 fake npm packages have been published in a large-scale, worm-like spam attack, likely financially motivated, flooding the npm registry since early 2024.
DanaBot malware has resumed activity, infecting Windows systems after a six-month hiatus following law enforcement disruption in May 2024.
A campaign targeting Microsoft 365 users is leveraging Quantum Route Redirection to bypass email security and steal credentials, impacting victims in over 90 countries.
Phishing emails disguised as spam filter alerts are being used to steal user credentials.

Newly Discovered Vulnerabilities

Amazon’s threat intelligence team disclosed that an advanced threat actor exploited two zero-day vulnerabilities: “Citrix Bleed 2” (CVE-2025-5777) in Citrix NetScaler ADC/Gateway and CVE-2025-20337 in Cisco Identity Service Engine (ISE).
Microsoft released fixes for 63 security vulnerabilities, including a Windows kernel zero-day flaw currently under active exploitation.
Google Chrome (version 142) and Mozilla Firefox (version 145) have patched multiple high-severity vulnerabilities in their latest releases.
Ivanti and Zoom have patched high-severity vulnerabilities that could enable arbitrary file writes, privilege escalation, code execution, and information disclosure.
Intel, AMD, and Nvidia have published advisories addressing over 60 vulnerabilities in their products as part of their regular security updates.
Siemens, Rockwell, Aveva, and Schneider Electric have addressed vulnerabilities affecting industrial control systems.

Notable Threat Actor Activity

Google has filed a lawsuit in the US District Court against China-based threat actors operating the “Lighthouse” Phishing-as-a-Service (PhaaS) platform, attributed to the group “Smishing Triad.” The platform facilitated large-scale SMS phishing campaigns, including US toll scam texts, using over 194,000 malicious domains.
Advanced persistent threat actors exploited Citrix NetScaler and Cisco ISE zero-day vulnerabilities in coordinated attacks, demonstrating increased targeting of identity and access management systems.
The SmartApeSG campaign is using ClickFix social engineering techniques, including fake Cloudflare verification pages, to push NetSupport RAT malware.
Ongoing cyber threats have been identified against Cisco ASA and Firepower devices, as reported by CISA.

Trends, Tools, or Tactics of Interest

ClickFix attacks are becoming more sophisticated, with recent campaigns mimicking Cloudflare verification checks to trick users into executing malicious commands.
The Quantum Route Redirection technique in phishing campaigns simplifies attack steps and is being used to bypass traditional email security controls.
There is increased adversary interest in targeting identity and access management infrastructure, as evidenced by recent zero-day exploitation of Citrix and Cisco products.
Passkey management on Windows 11 now supports third-party applications, with 1Password and Bitwarden as initial partners, improving passwordless authentication options.
The return of DanaBot and the scale of npm spam attacks highlight persistent threats to software supply chains and end-user systems.
Google introduced “Private AI Compute,” a privacy-enhancing technology for secure AI processing in the cloud.
Token Security outlined methods to extend Zero Trust principles to autonomous AI agents, emphasizing scoped access and continuous verification.
Behavioral (TTP-based) detection is being promoted as more effective than traditional IoC-based hunting for identifying privilege escalation, credential theft, and lateral movement.

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced new legislation to strengthen cybersecurity requirements for critical infrastructure, including hospitals, energy, water, and transport sectors.
Kenya has launched the “Code Nation” initiative to train one million workers in technology skills, with a focus on cybersecurity, software engineering, and data science.

Cybersecurity Brief – 2025-07-18

Fri, 18 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Cryptocurrency exchange BigONE suffered a security breach resulting in the theft of digital assets valued at $27 million.
An adoption agency leaked over 1.1 million records, including names and sensitive information of children, birth parents, and adoptive parents.
Chinese state-sponsored group Salt Typhoon breached a U.S. Army National Guard network for nine months in 2024, exfiltrating network configuration files and credentials.
Security researchers revealed that poor password practices at Paradox.ai led to the exposure of personal information belonging to millions of job applicants.
A vulnerability in Meta AI (now fixed) could have allowed unauthorized access to private chatbot conversations.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical pre-authentication vulnerability (CVE-2025-20337, CVSS 10) in Identity Services Engine (ISE) and ISE-PIC, allowing unauthenticated remote code execution and file storage.
Citrix NetScaler vulnerability “CitrixBleed 2” (CVE-2025-5777) was actively exploited weeks before public proof-of-concept exploits were released.
Oracle’s July 2025 Critical Patch Update addressed approximately 200 unique CVEs, with 309 security patches issued.
Google released a Chrome update patching six vulnerabilities, including one zero-day.
VMware patched four zero-day vulnerabilities in ESXi, Workstation, Fusion, and Tools, which were exploited at Pwn2Own Berlin 2025.
A known Apache HTTP Server vulnerability is being exploited to deploy the Linuxsys cryptocurrency miner.

Notable Threat Actor Activity

Kaspersky identified “GhostContainer,” a new backdoor targeting Microsoft Exchange servers of high-value organizations in Asia, based on open-source tools.
Three previously undocumented Chinese state-sponsored threat actors, as well as a fourth group, targeted Taiwan’s semiconductor sector with spear-phishing, Cobalt Strike, and custom backdoors.
Threat actors are distributing Amadey malware and data stealers via malicious payloads hosted on public GitHub repositories to bypass security filters.
The Matanbuchus malware loader is being delivered through social engineering over Microsoft Teams voice calls, with attackers impersonating IT helpdesk staff.
LameHug malware uses large language models (LLMs) to generate Windows data-theft commands in real time.
Europol coordinated an international operation disrupting the infrastructure of the pro-Russian hacktivist group NoName057(16), known for DDoS attacks against Ukraine.
Research highlights increased use of DNS records to hide malicious code and conduct prompt injection attacks against chatbots.

Trends, Tools, or Tactics of Interest

PsMapExec, a new PowerShell-based tool, has been released for enumeration and lateral movement, supporting WinRM and SMB operations.
Security gaps in printer firmware and endpoint vetting are being increasingly targeted by attackers.
There is a rise in browser-based AI agent attacks, with security vendors emphasizing AI-first protection strategies.
AI-driven malware, such as LameHug, and the exploitation of AI tools for malicious purposes are emerging trends.
Cloud attack surface management and continuous threat exposure management (CTEM) are being discussed as alternatives to traditional vulnerability management.
Massistant, a mobile forensics tool used by Chinese law enforcement, is capable of collecting user information, files, and location data from confiscated devices.

Regulatory or Policy Developments Affecting the Security Industry

Google has filed a lawsuit against operators of the BadBox 2.0 Android malware botnet, which infected 10 million devices and ran a global ad fraud scheme.
A settlement was reached in the class action lawsuit against Meta over the Cambridge Analytica incident; details remain undisclosed.
WeTransfer has retracted a clause that would have allowed the company to train AI models on user-uploaded files, following user backlash.
An Armenian national was extradited to the US and faces charges related to the Ryuk ransomware operation.

Cybersecurity Brief – 2025-07-12

Sat, 12 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

A vulnerability in McHire, McDonald’s chatbot job application platform, exposed chat histories and personal data of over 64 million job applicants in the United States due to weak authentication (“123456” password) and insecure API design.
The developer account for the WordPress Gravity Forms plugin was compromised, leading to backdoored plugin installers being distributed via the official website in a supply-chain attack.
A critical vulnerability (CVE-2025-47812) in Wing FTP Server is being actively exploited in the wild, allowing attackers to execute arbitrary commands with root or system privileges.

Newly Discovered Vulnerabilities

Fortinet patched a critical SQL injection vulnerability (CVE-2025-25257) in FortiWeb that allows unauthenticated attackers to execute arbitrary database commands. Proof-of-concept exploits for this vulnerability have been publicly released.
Security researchers disclosed four vulnerabilities in OpenSynergy’s BlueSDK Bluetooth stack (“PerfektBlue”), which could allow remote code execution on millions of vehicles (including Mercedes, Skoda, and Volkswagen) and over a billion industrial, medical, mobile, and consumer devices.
The U.S. CISA confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway, mandating federal agencies to patch within 24 hours.
A zero-day vulnerability in OpenVSX, a popular extension marketplace, was discovered and patched. The flaw could have enabled attackers to compromise millions of developer machines via a supply chain attack.
Microsoft disclosed new attack techniques targeting AMD CPUs.
NVIDIA issued guidance recommending activation of System Level Error-Correcting Code (ECC) to mitigate Rowhammer attacks on GPUs with GDDR6 memory. Researchers demonstrated Rowhammer-based “GPUHammer” attacks that can degrade machine learning model accuracy.

Notable Threat Actor Activity

The Iranian-backed Pay2Key ransomware-as-a-service operation has resurfaced, offering affiliates an increased profit share (80%) for attacks targeting Western organisations, particularly in the US and Israel. This follows recent geopolitical tensions involving Iran, Israel, and the US.
The Indian APT group DoNot is actively targeting government entities.

Trends, Tools, or Tactics of Interest

Researchers at Netcraft highlighted that AI-generated search engine summaries are inadvertently directing users to phishing sites when queried for legitimate login pages, posing a new phishing risk vector.
SentinelOne reported evolution in the ZuRu macOS malware family.
The 2025 Data Risk Report notes heightened data loss risks from AI-powered tools, with calls for unified, AI-driven data security strategies.
Cyber-insurance premiums are declining from previous highs, though comprehensive coverage remains vital for risk management.
There is increased emphasis on integrating cybersecurity into financial sector digital transformation strategies.
Discussion of passwordless authentication mechanisms-specifically passkeys using public key cryptography-to address the inherent risks of shared secrets in traditional password systems.

Regulatory or Policy Developments

The European Union unveiled a voluntary AI Code of Practice to help businesses comply with the phased rollout of the EU AI Act.
The Irish Data Privacy Commission opened a new investigation into TikTok regarding the transfer of user data to China under EU privacy regulations.
Google did not release a scheduled July 2025 Android security patch, breaking a ten-year streak of monthly updates.

Cybersecurity Brief – 2025-07-11

Fri, 11 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Four individuals were arrested in the UK for cyberattacks targeting major retailers Marks & Spencer, Co-op, and Harrods. The suspects are believed to be connected to the Scattered Spider group, which has also targeted airlines and other sectors.
Qantas confirmed a data breach affecting 5.7 million customers. Exposed information includes names, addresses, email addresses, phone numbers, and other personal data.
Nippon Steel’s NS Solutions subsidiary suffered a breach exposing customer and employee data. There is currently no evidence of the data being leaked on dark web sites.
Ingram Micro experienced a ransomware attack that disrupted online ordering for customers. The company has since restored operations.
McDonald’s suffered a data exposure incident involving its AI-powered job application bot, which allowed access to applicant data using a weak default password.

Newly Discovered Vulnerabilities

CISA added CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
A critical remote code execution vulnerability was discovered in the open-source mcp-remote project, affecting over 437,000 downloads.
Multiple critical vulnerabilities, dubbed “PerfektBlue,” were identified in the BlueSDK Bluetooth stack used by Mercedes, Volkswagen, and Skoda vehicles. These flaws could allow remote code execution and potential access to critical vehicle systems.
A high-severity flaw, CVE-2025-3648, was disclosed in the ServiceNow platform. Exploitation could lead to data exposure via misconfigured access control lists (ACLs).
AMD disclosed a new class of vulnerabilities called Transient Scheduler Attacks, impacting a wide range of its CPUs and potentially allowing information disclosure.
A 6-year-old Oracle vulnerability affecting eSIM technology was disclosed, enabling potential spying and device takeover across millions of phones.
The Model Context Protocol (MCP) ecosystem, widely adopted for integrating AI models with external data, was found to have critical security vulnerabilities opening new attack vectors.

Notable Threat Actor Activity

Scattered Spider, a data theft and extortion group, has shifted its targeting to the aviation and transportation sectors, according to warnings from the FBI and cybersecurity experts.
Kaspersky identified malicious open-source packages for Cursor AI that deploy the Quasar backdoor and a cryptocurrency stealer.
Ongoing social engineering campaigns are using fake gaming and AI startup firms on Telegram and Discord to distribute malware targeting cryptocurrency users.
A new ZuRu malware variant is propagating via trojanized versions of the Termius macOS app, targeting developers.
Deepfake attacks are being used to impersonate high-profile political figures, such as Marco Rubio, to attempt to extract government secrets.
A Russian professional basketball player was arrested in France at the request of the US for allegedly acting as a negotiator for a ransomware gang.

Trends, Tools, or Tactics of Interest

AI-driven attacks are becoming more sophisticated, faster, and pervasive, with increased use of generative AI in offensive operations.
SSH tunneling, specifically direct-tcp requests, is highlighted as an active technique.
Force Push Scanner is a new tool for red teams to identify leaked secrets in ephemeral GitHub commits.
Anubis, an open-source self-hosted firewall, is being used to block AI bots from scraping website content.
SIM swap fraud is reportedly increasing, highlighting ongoing risks to mobile-based authentication.
Microsoft replaced the default JScript engine with JScript9Legacy in Windows 11 version 24H2 and later, aiming to improve scripting security.

Regulatory or Policy Developments

The FBI issued guidance on CJIS (Criminal Justice Information Services) compliance, emphasizing password hygiene, multi-factor authentication, and access control for law enforcement data handlers.
The U.S. Department of Homeland Security is advising law enforcement to treat certain protest activities as violent tactics, including livestreaming and skateboarding, potentially affecting policing and surveillance practices.
CISA’s update to the KEV catalog with Citrix NetScaler CVE-2025-5777 signals heightened regulatory attention to actively exploited enterprise vulnerabilities.

Cybersecurity Brief – 2025-07-09

Wed, 09 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

M&S confirmed a significant ransomware attack by DragonForce, initiated via a sophisticated social engineering/impersonation attack.
Qantas experienced a data breach resulting in an extortion demand after customer data was stolen from a contact centre.
South Korean telecommunications provider SK Telecom suffered a breach exposing 27 million records; the government imposed a monetary penalty and new regulatory requirements.
Over 17,000 fake news websites were uncovered globally as part of a large-scale investment fraud campaign (“BaitTrap”).
More than 1.7 million installations of malicious Chrome extensions were identified, capable of tracking users, stealing browser activity, and redirecting to unsafe sites.
The Anatsa Android banking trojan was distributed via a fake PDF viewer app on Google Play, impacting over 90,000 users, primarily targeting US banks.
Russian organisations were targeted by a new Windows spyware dubbed Batavia, used in ongoing espionage campaigns.
A supply chain attack compromised the Ethcode Visual Studio Code extension, exposing over 6,000 developers to malicious pull requests.
The RondoDox botnet exploited vulnerabilities in TBK DVRs and Four-Faith routers to conscript devices for DDoS attacks.

Newly Discovered Vulnerabilities

Microsoft’s July 2025 Patch Tuesday addressed 130–137 vulnerabilities, including a publicly disclosed zero-day in SQL Server. Seventeen bugs are considered high risk, including multiple remote code execution vulnerabilities in Office and SharePoint.
Adobe released patches for critical code execution vulnerabilities affecting several products, including After Effects, Audition, Illustrator, and others.
SAP patched critical insecure deserialization vulnerabilities in NetWeaver, which could allow remote code execution and full system takeover.
Technical details and exploit code for CitrixBleed2 (CVE-2025-5777) in Citrix NetScaler have been released, increasing the risk of exploitation.
A new Android “TapTrap” attack was disclosed, using invisible UI tricks to bypass permission systems and trick users into granting sensitive access.

Notable Threat Actor Activity

Threat actors repurposed the legitimate Shellter red teaming tool to distribute Lumma Stealer, SectopRAT, Arechclient2, and Rhadamanthys malware, leveraging its AV/EDR evasion features.
A suspected Chinese state-sponsored hacker linked to Silk Typhoon (Hafnium) was arrested in Milan, facing charges including wire fraud and unauthorized computer access.
Russian organisations faced an ongoing campaign involving the newly identified Batavia Windows spyware.
A large-scale operation using Baiting News Sites (BNS) was uncovered, leveraging fake news for investment fraud.
RondoDox botnet activity increased, exploiting IoT device vulnerabilities for DDoS.

Trends, Tools, or Tactics of Interest

Malicious open source packages increased by 188% year-over-year, with data exfiltration as the most common malware function.
Threat actors continue to exploit legitimate security and pen-testing tools (e.g., Shellter) for malware delivery and AV/EDR evasion.
Supply chain attacks targeting development environments (e.g., VS Code extensions) remain a significant threat vector.
Identity-based attacks in the retail sector are exploiting overprivileged admin roles and neglected vendor tokens.
Agentic AI is emerging as a growing attack surface, with increased risk from invisible threats and novel vectors.
Human risk management and measurement in security awareness programs remain a focus area for evaluating organisational resilience.

Regulatory or Policy Developments Affecting the Security Industry

South Korea imposed regulatory requirements on SK Telecom following a major data breach, in addition to a monetary penalty.
SSL/TLS certificate lifespan reduction to 47 days by 2029 is prompting organisations to prepare for operational changes in certificate management.
Samsung announced major security and privacy enhancements for its upcoming One UI 8 release on Galaxy smartphones.
Microsoft clarified options for extended Windows 10 security updates through October 2026, including free alternatives with certain conditions.

Cybersecurity Brief – 2025-07-08

Tue, 08 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro, a major IT distributor, experienced a ransomware attack causing widespread outages and disruption to customer ordering and services. The company is working to restore systems; details on data theft remain undisclosed.
Qantas confirmed it is being extorted by threat actors following a cyberattack that potentially exposed the data of 6 million customers.
Hackers stole nearly $140 million from six Brazilian banks by using credentials purchased from a C&M employee for $920.
The International Criminal Court (ICC) disclosed a sophisticated cyberattack in its latest threat intelligence report.
The PC version of Call of Duty: WWII was taken offline after reports of gamers being hacked.
Several Russian industrial enterprises were targeted in a phishing campaign delivering the newly discovered Batavia spyware, which exfiltrates sensitive data from corporate devices.

Newly Discovered Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Researchers released proof-of-concept exploits for CVE-2025-5777 (“CitrixBleed2”), a critical Citrix NetScaler vulnerability that is easily exploitable and now publicly available.
Grafana patched multiple Chromium bugs, including CVE-2025-6554, a zero-day vulnerability exploited in the wild that could allow remote code execution and memory corruption.

Notable Threat Actor Activity

A Chinese national allegedly linked to the Silk Typhoon (APT41) group was arrested in Milan for cyberespionage activities targeting American organizations.
North Korean threat actors were observed targeting cryptocurrency and Web3 platforms on Telegram using malicious Zoom meeting requests to deliver the NimDoor macOS malware.
TAG-140 targeted Indian government entities using “ClickFix-style” lures, leading to BroaderAspect .NET loader execution.
Iranian hackers breached a U.S. water facility, gaining control over a pressure station serving 7,000 people.
Batavia spyware campaigns used contract-themed phishing emails to compromise Russian industrial organizations.
Over 8,500 SMB users were targeted in an SEO poisoning campaign delivering the Oyster malware loader disguised as AI tools.
Hackers exploited a leaked copy of the Shellter Elite red team tool to deploy infostealers in live attacks.

Trends, Tools, or Tactics of Interest

The Atomic macOS infostealer (AMOS) has added a backdoor for persistent access to compromised systems.
The new “Bert” ransomware strain targets both Linux and Windows systems, featuring aggressive multithreading and cross-platform capabilities.
A Chrome browser extension with over 100,000 downloads was found to contain sophisticated spyware, hijacking sessions and redirecting users to malicious sites.
Modern malware increasingly incorporates anti-debugging and anti-analysis features to evade detection.
Hunters International, a Ransomware-as-a-Service (RaaS) group and successor to Hive, announced its shutdown and transition to “World Leaks,” focusing on data theft and extortion. Free decryptors were offered to previous victims.
PayPal has implemented an AI-powered scam alert system that may intercept suspicious transactions to combat increasingly sophisticated fraud attempts.
Let’s Encrypt began issuing free certificates for IP addresses, which, while enhancing security, also presents new opportunities for cybercriminal abuse.

Regulatory or Policy Developments Affecting the Security Industry

CISA’s addition of four new actively exploited vulnerabilities to its KEV catalog may prompt accelerated patching and mitigation efforts across affected organizations.
Let’s Encrypt’s rollout of certificates for IP addresses introduces new considerations for certificate management and threat actor abuse.

Cybersecurity Brief – 2025-06-28

Sat, 28 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Ahold Delhaize, a global food retail chain, disclosed that a ransomware attack in November resulted in a data breach affecting 2.2 million individuals, compromising personal, financial, and health information.
Cloudflare successfully mitigated the largest recorded DDoS attack to date.
Russian ISPs began throttling access to websites and services protected by Cloudflare as of 9 June 2025, causing widespread inaccessibility.

Newly Discovered Vulnerabilities

A critical vulnerability in NetScaler ADC and Gateway, dubbed “Citrix Bleed 2” (CVE-2025-5777), is now believed to be actively exploited. This flaw allows attackers to maintain undetected access for extended periods.
Researchers identified security weaknesses in aftermarket smart tractor steering systems, allowing potential full takeover and surveillance of connected tractors.

Notable Threat Actor Activity

Over 1,000 SOHO devices have been compromised in China-linked “LapDogs” cyber espionage operations.
Mustang Panda, a China-based threat actor, conducted a targeted cyber espionage campaign against the Tibetan community using spear-phishing and custom malware (PUBLOAD and Pubshell).
The Chinese group “Silver Fox” has been observed using fake websites mimicking popular software to distribute Sainbox RAT and the Hidden rootkit, targeting users in China and Japan.
Scattered Spider hackers have shifted their targeting to aviation and transportation sectors after previously attacking insurance and retail. In a recent incident, they accessed CyberArk vaults, extracted over 1,400 secrets, and compromised Azure, VMware, and Snowflake environments.
Increased scanning activity targeting Progress MOVEit Transfer systems has been detected since 27 May 2025, indicating preparation for further exploitation of known CVEs.

Trends, Tools, or Tactics of Interest

64% of US C-suite executives in cybersecurity or data center roles cite data breaches and ransomware as the top threats for the next decade.
Threat actors are increasingly leveraging fake websites and spear-phishing with regionally relevant topics to deliver custom malware in espionage campaigns.
Security operations centers are under pressure due to increasingly complex threats and stagnant budgets, prompting interest in agentic AI SOC analysts.
There is a noted increase in the scale and sophistication of DDoS attacks.
The US is reported to be lagging behind China in exploit production capabilities.
Researchers allege that VPN apps from Apple and Google app stores may be enabling surveillance by Chinese authorities.

Regulatory or Policy Developments Affecting the Security Industry

The US Supreme Court upheld the constitutionality of Texas’ age verification law for explicit websites, setting a precedent for similar regulatory measures.