CVE-2025-61882 on DanSec Daily

Cybersecurity Brief – 2025-11-18

Tue, 18 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Eurofiber France disclosed a data breach after hackers exploited a vulnerability in its ticket management system, resulting in exfiltration of customer information. The breach was discovered after the attacker attempted to sell the data.
Princeton University reported a data breach on 10 November 2025, exposing personal information of alumni, donors, faculty, and students.
DoorDash confirmed a data breach involving compromise of names, addresses, email addresses, and phone numbers after an employee was targeted in a social engineering attack.
The Pennsylvania Attorney General’s office confirmed a data breach following an August 2025 ransomware attack by the INC Ransom group, with personal and medical information stolen.
Logitech confirmed a data breach after being listed by the Cl0p ransomware group. The incident is linked to the Oracle E-Business Suite exploitation.
Dutch police seized approximately 250 servers used by a bulletproof hosting service that provided infrastructure for cybercriminals.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two vulnerabilities, including CVE-2025-xxxx, a V8 zero-day flaw under active exploitation, reportedly by a commercial spyware vendor.
A critical remote code execution vulnerability in Fortinet FortiWeb WAF is being actively exploited in the wild, allowing unauthenticated attackers to execute administrative commands.
The RondoDox botnet is exploiting CVE-2025-24893, a critical RCE vulnerability in XWiki Platform. Widespread exploitation has been observed, including by botnets, crypto miners, and custom tools.
Seven malicious npm packages are abusing the Adspect cloud-based service to redirect researchers while leading victims to malicious payloads.
A vulnerability in DoorDash’s email systems allowed attackers to send spoofed, official-looking emails from DoorDash servers, creating a significant phishing risk. DoorDash has since patched the issue.
Researchers identified a security weakness in the AI-powered coding tool Cursor, enabling credential-stealing attacks via a malicious MCP server hijacking the internal browser.

Notable Threat Actor Activity

The Dragon Breath threat actor is using a multi-stage loader (RONINGLOADER) to disable security tools and deploy a modified Gh0st RAT in recent campaigns.
Iranian state-sponsored APTs are targeting defense and government officials, including their family members, in ongoing campaigns to increase pressure on primary targets.
The Aisuru botnet launched a 15.72 Tbps DDoS attack against Microsoft Azure, leveraging over 500,000 IP addresses.
The EVALUSION ClickFix campaign is deploying Amatera Stealer and NetSupport RAT via social engineering techniques.
Cl0p ransomware group continues to exploit Oracle E-Business Suite (CVE-2025-61882), with associated data breaches including Logitech.
Scammers are sending fake copyright violation messages to steal X (formerly Twitter) logins.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly shifting to non-email channels, with LinkedIn and other platforms now accounting for 1 in 3 phishing incidents.
ClickFix social engineering tactics are being widely adopted in malware distribution campaigns.
Malicious packages in open-source repositories such as npm are using cloud-based redirectors to evade detection and target victims.
Bulletproof hosting services remain a critical enabler for cybercriminal infrastructure, as evidenced by recent law enforcement action in the Netherlands.
Attackers are leveraging vulnerabilities in widely used platforms (e.g., XWiki, FortiWeb, Oracle E-Business Suite) for large-scale exploitation.
DDoS attacks are increasing in scale and sophistication, as demonstrated by the recent record-setting attack on Microsoft Azure.

Regulatory or Policy Developments Affecting the Security Industry

In the US, five individuals pleaded guilty to assisting North Korean IT workers in obtaining employment at US companies by providing false identities and remote access to company laptops, highlighting ongoing law enforcement efforts against supply chain and insider threats.
Microsoft released an out-of-band Windows 10 update (KB5072653) to address issues with installing Extended Security Updates, ensuring continued compliance for organizations relying on legacy systems.

Cybersecurity Brief – 2025-10-29

Wed, 29 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Dentsu Data Breach: Japanese advertising giant Dentsu disclosed a cybersecurity incident at its U.S. subsidiary Merkle, resulting in the exposure of staff and client data.
Oracle EBS Attacks: Numerous organizations, including Schneider Electric and Emerson, have been identified as victims of attacks exploiting Oracle E-Business Suite zero-day CVE-2025-61882. Data stolen from these companies has been made available on the Cl0p ransomware leak site.
Swedish Power Grid Incident: Hackers targeted a Swedish power grid operator, stealing information from a file transfer solution. The country’s power supply was not affected.
183 Million Credentials Traded: Cybercriminals are trading 183 million stolen credentials on Telegram and dark web forums, with 16.4 million email addresses not previously seen in data breaches.

Newly Discovered Vulnerabilities

TEE.Fail Side-Channel Attack: Academic researchers disclosed TEE.Fail, a side-channel attack enabling extraction of secrets from trusted execution environments in Intel, AMD, and NVIDIA CPUs, undermining confidential computing.
QNAP NetBak PC Agent Vulnerability: The software is affected by a recent critical ASP.NET Core flaw that allows HTTP request smuggling, data access, server file modification, or denial-of-service.
Dassault Systèmes DELMIA Apriso: CISA warned of two actively exploited vulnerabilities in this manufacturing operations management platform.
Chrome Zero-Day: A now-patched Chrome zero-day was exploited to deliver Memento Labs’ LeetAgent spyware.
BiDi Swap Phishing Technique: Attackers are abusing bidirectional text to craft fake URLs that appear legitimate, reviving a browser flaw for phishing.
Atroposia Malware: A new malware-as-a-service platform, Atroposia, includes a built-in local vulnerability scanner for post-compromise exploitation.

Notable Threat Actor Activity

BlueNoroff (North Korea): The BlueNoroff APT group is running twin campaigns (GhostCall and GhostHire) targeting Web3 and blockchain sectors with cross-platform malware, using fake business collaboration and job recruitment lures.
Qilin Ransomware: The Qilin operation is abusing Windows Subsystem for Linux (WSL) to run Linux encryptors on Windows systems, evading traditional security tools.
Herodotus Android Trojan: A new banking trojan, Herodotus, is targeting Italy and Brazil, using random delay injection to mimic human typing and bypass anti-fraud and security detection mechanisms.
Aisuru Botnet: The Aisuru botnet, previously responsible for massive Mirai-class DDoS attacks exceeding 20 Tbps, has shifted to operating as a residential proxy network for more sustainable monetization.
YouTube Ghost Network: This malware operation leverages compromised YouTube accounts and botnets to distribute infostealers, with activity tripling in 2025.

Trends, Tools, or Tactics of Interest

AI-Powered Attacks in Africa: Cybersecurity firms report a surge in AI-driven phishing, deepfakes, and impersonation attacks across Africa, with adversaries testing new techniques on government and enterprise targets.
Deepfake-as-a-Service: The emergence of voice cloning and synthetic media fraud services is impacting enterprise security, with documented cases of business compromise and evolving detection tactics.
Invisible Characters in Phishing: Attackers are using invisible characters in email subject lines to bypass detection and trick recipients.
Grok Abuse for Phishing: Attackers are exploiting the Grok platform to distribute phishing links.
Surge in Credential Theft: Large-scale credential theft and trading continues unabated, with significant numbers of newly compromised emails.
Chrome HTTP Warnings: Google Chrome will begin warning users before connecting to insecure HTTP sites starting with version 154 in October 2026.

Regulatory or Policy Developments

UN Cybercrime Convention: Around 70 countries have signed a new UN cybercrime convention, though concerns have been raised about expanded surveillance and potential criminalization of security research.
Python Software Foundation Grant Rejection: The PSF withdrew a $1.5 million U.S. National Science Foundation grant proposal due to terms that conflicted with its diversity and inclusion commitments.
Microsoft Copilot Lawsuit: The Australian Competition and Consumer Commission (ACCC) has filed suit against Microsoft, alleging the company misled 2.7 million Australians into subscribing to Copilot M365.
Windows 11 Security Update: Microsoft released the KB5067036 preview update, introducing the Administrator Protection cybersecurity feature for Windows 11 24H2 and 25H2.

Cybersecurity Brief – 2025-10-07

Tue, 07 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Red Hat suffered a data breach, with the ShinyHunters extortion group leaking samples of stolen customer engagement reports (CERs) and threatening further exposure.
Discord disclosed that user information, including names, usernames, email addresses, contact details, IP addresses, and billing information, was compromised via a third-party data breach.
Doctors Imaging Group notified approximately 171,000 individuals of a cybersecurity incident that occurred nearly a year ago.
Beer giant Asahi reported a ransomware attack resulting in data theft and disruption to operations at its Japanese subsidiaries, forcing a shift to manual order processing and shipment.
Salesforce faced extortion attempts after data from dozens of customers was stolen; Salesforce stated these relate to past or unsubstantiated incidents, not new intrusions.

Newly Discovered Vulnerabilities

Oracle E-Business Suite: A critical remote code execution vulnerability (CVE-2025-61882) has been exploited in the wild by the Cl0p ransomware group. Oracle has released an emergency patch.
GoAnywhere MFT: Microsoft reported that Storm-1175 has been exploiting a maximum severity vulnerability in GoAnywhere MFT for Medusa ransomware attacks for nearly a month.
Redis: The Redis security team released patches for a maximum-severity vulnerability that could allow remote code execution on thousands of exposed instances.
Unity Game Engine: A code execution vulnerability in the Unity engine could enable attackers to gain code execution on Android and privilege escalation on Windows. Microsoft and Steam have issued warnings and are taking action.
Zimbra: Attackers exploited a zero-day vulnerability in Zimbra via ICS files, targeting Brazilian military entities.
BitLocker Bypass and VMScape vulnerabilities were also highlighted in recent security roundups.

Notable Threat Actor Activity

Cl0p ransomware group exploited Oracle E-Business Suite zero-day (CVE-2025-61882) for data theft and extortion attacks.
ShinyHunters is actively extorting Red Hat following their data breach.
Storm-1175 exploited GoAnywhere MFT vulnerabilities in Medusa ransomware campaigns.
Chinese-speaking cybercrime group UAT-8099 is running a global SEO fraud operation using compromised IIS servers, stealing high-value credentials.
XWorm malware resurfaced with a ransomware module and over 35 plugins, distributed via phishing campaigns.
Water Saci campaign deployed self-propagating malware (Sorvepotel) via WhatsApp in Brazil, targeting financial institutions.
Phishing campaigns are targeting 1Password users with convincing fake breach alert emails.
A threat actor impersonating the Libyan Navy’s Office of Protocol targeted Brazil’s military using Zimbra zero-day exploits.

Trends, Tools, or Tactics of Interest

AI-driven phishing and social engineering attacks are cited as a top concern by nearly 40% of surveyed security leaders.
Machine learning models for detecting DLL hijacking have been developed and integrated into Kaspersky SIEM, enabling early incident detection.
Increased use of AI in cybersecurity, including open-source XDR/SIEM platforms like Waziuh and the risk of insecure AI-generated code (“vibe coding”).
XWorm’s modular architecture and plugin system highlight evolving malware sophistication.
High-profile phishing and social engineering attacks continue to leverage realistic lures and automation.
Self-propagating malware targeting messaging platforms (e.g., WhatsApp) is being used for credential theft and financial fraud.
The launch of the Zeroday.Cloud hacking competition offers $4.5 million in bounties for exploits targeting open-source cloud and AI tools.

Notable Threat Actor Attribution

CrowdStrike attributes recent Oracle EBS exploitation to Graceful Spider (aka Cl0p).
Chinese research firms BIETA and CIII have been linked to the Ministry of State Security (MSS) and assessed as fronts for PRC cyber operations.
Reports highlight Chinese government fronts collaborating with Western organisations to acquire cyber technologies for state intelligence purposes.

Regulatory or Policy Developments Affecting the Security Industry

LinkedIn has filed a lawsuit against ProAPIs Inc. and its founder for scraping user data via over one million fake accounts, addressing large-scale data harvesting.
Compliance training updates and frameworks (e.g., KnowBe4’s Compliance Plus and the DEEP Matrix for unified defence) are being promoted to address evolving human risk management and regulatory requirements.

Cybersecurity Brief – 2025-10-06

Mon, 06 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Oracle E-Business Suite (EBS) has been compromised via a critical zero-day vulnerability (CVE-2025-61882), enabling unauthenticated remote code execution. The Cl0p ransomware group actively exploited this flaw in recent data theft attacks, prompting Oracle to issue an emergency patch.
ParkMobile concluded a class action lawsuit related to its 2021 data breach affecting 22 million users. Victims are receiving a $1 compensation each as part of the settlement.

Newly Discovered Vulnerabilities

CVE-2025-61882: A critical remote code execution vulnerability in Oracle E-Business Suite, actively exploited in the wild by threat actors including Cl0p. Oracle has released an emergency patch to address this issue.
CVE-2025-27915: A Zimbra Collaboration Suite vulnerability (CVSS 5.4) was exploited as a zero-day earlier in the year, targeting the Brazilian military. The attack leveraged malicious .ICS (iCalendar) files to deliver the exploit. The vulnerability has since been patched.

Notable Threat Actor Activity

Cl0p ransomware group exploited the Oracle EBS zero-day (CVE-2025-61882) in a recent campaign focused on data theft.

Trends, Tools, or Tactics of Interest

Use of malicious .ICS calendar attachments to exploit Zimbra Collaboration Suite (CVE-2025-27915) demonstrates ongoing interest in abusing productivity and collaboration tools for initial access.
The publication of an exploit script and rapid weaponisation of the Oracle EBS vulnerability (CVE-2025-61882) highlight threat actors’ ability to quickly operationalise newly discovered flaws for attacks.

Regulatory or Policy Developments Affecting the Security Industry

ParkMobile’s class action settlement following a major data breach sets a precedent for low-value compensation in large-scale breaches, with each affected user receiving $1.