Cybersecurity Brief – 2025-07-08

Tue, 08 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro, a major IT distributor, experienced a ransomware attack causing widespread outages and disruption to customer ordering and services. The company is working to restore systems; details on data theft remain undisclosed.
Qantas confirmed it is being extorted by threat actors following a cyberattack that potentially exposed the data of 6 million customers.
Hackers stole nearly $140 million from six Brazilian banks by using credentials purchased from a C&M employee for $920.
The International Criminal Court (ICC) disclosed a sophisticated cyberattack in its latest threat intelligence report.
The PC version of Call of Duty: WWII was taken offline after reports of gamers being hacked.
Several Russian industrial enterprises were targeted in a phishing campaign delivering the newly discovered Batavia spyware, which exfiltrates sensitive data from corporate devices.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Researchers released proof-of-concept exploits for CVE-2025-5777 (“CitrixBleed2”), a critical Citrix NetScaler vulnerability that is easily exploitable and now publicly available.
Grafana patched multiple Chromium bugs, including CVE-2025-6554, a zero-day vulnerability exploited in the wild that could allow remote code execution and memory corruption.

A Chinese national allegedly linked to the Silk Typhoon (APT41) group was arrested in Milan for cyberespionage activities targeting American organizations.
North Korean threat actors were observed targeting cryptocurrency and Web3 platforms on Telegram using malicious Zoom meeting requests to deliver the NimDoor macOS malware.
TAG-140 targeted Indian government entities using “ClickFix-style” lures, leading to BroaderAspect .NET loader execution.
Iranian hackers breached a U.S. water facility, gaining control over a pressure station serving 7,000 people.
Batavia spyware campaigns used contract-themed phishing emails to compromise Russian industrial organizations.
Over 8,500 SMB users were targeted in an SEO poisoning campaign delivering the Oyster malware loader disguised as AI tools.
Hackers exploited a leaked copy of the Shellter Elite red team tool to deploy infostealers in live attacks.

The Atomic macOS infostealer (AMOS) has added a backdoor for persistent access to compromised systems.
The new “Bert” ransomware strain targets both Linux and Windows systems, featuring aggressive multithreading and cross-platform capabilities.
A Chrome browser extension with over 100,000 downloads was found to contain sophisticated spyware, hijacking sessions and redirecting users to malicious sites.
Modern malware increasingly incorporates anti-debugging and anti-analysis features to evade detection.
Hunters International, a Ransomware-as-a-Service (RaaS) group and successor to Hive, announced its shutdown and transition to “World Leaks,” focusing on data theft and extortion. Free decryptors were offered to previous victims.
PayPal has implemented an AI-powered scam alert system that may intercept suspicious transactions to combat increasingly sophisticated fraud attempts.
Let’s Encrypt began issuing free certificates for IP addresses, which, while enhancing security, also presents new opportunities for cybercriminal abuse.

CISA’s addition of four new actively exploited vulnerabilities to its KEV catalog may prompt accelerated patching and mitigation efforts across affected organizations.
Let’s Encrypt’s rollout of certificates for IP addresses introduces new considerations for certificate management and threat actor abuse.

Wed, 02 Jul 2025 00:00:00 +0000

Qantas disclosed a cyberattack involving unauthorised access to a third-party platform containing customer data.
Kelly Benefits reported a 2024 data breach impacting 550,000 customers’ personal information.
Esse Health notified over 263,000 patients of a breach in April that compromised personal and health information.
Johnson Controls began notifying individuals affected by a 2023 ransomware attack that impacted global operations.
The International Criminal Court is investigating a new “sophisticated” cyberattack on its systems.

Google patched a Chrome zero-day vulnerability (CVE-2025-6554) that is being actively exploited in the wild, the fourth such Chrome zero-day addressed in 2025.
Researchers identified a critical vulnerability in Anthropic’s Model Context Protocol (MCP) Inspector project, exposing developer machines to remote exploits.
A new flaw in IDEs such as Visual Studio Code, Visual Studio, IntelliJ IDEA, and Cursor allows malicious extensions to bypass verified status, undermining extension security controls.
A new FileFix attack has been observed that executes malicious JScript while bypassing Windows Mark of the Web (MoTW) protections by exploiting browser handling of saved HTML webpages.

Unknown threat actors are weaponizing Vercel’s v0 generative AI tool to rapidly create fake login pages for phishing at scale.
Tactical overlaps have been observed between TA829 (linked to RomCom RAT) and the UNK_GreenSec cluster, including shared infrastructure and the use of a loader dubbed TransferLoader.
The Silver Fox group is suspected of targeting Taiwanese entities using sideloading techniques to deliver Gh0stRAT variants, leveraging lures related to DeepSeek’s LLM.
North Korean IT workers have infiltrated technology, manufacturing, and transportation sectors globally to steal funds and data, with the U.S. DoJ arresting a facilitator, seizing 29 domains, and disrupting 21 “laptop farms” across 16 states.
The U.S. Treasury sanctioned Russian hosting provider Aeza Group and four operators for providing bulletproof hosting to ransomware and infostealer operators.

Attackers are exploiting AI and generative tools (e.g., Vercel’s v0) to automate and scale phishing campaigns.
Threat actors are increasingly targeting browsers through zero-day vulnerabilities and malicious extensions, highlighting browser security as an enterprise risk.
FileFix attacks demonstrate continued evolution in bypassing Windows security features, specifically MoTW.
Sideloading remains a prevalent technique for malware delivery, as seen in Silver Fox’s campaign.
Concerns are raised over the potential manipulation of large language models (LLMs) for phishing, similar to previous SEO poisoning tactics.
Cyber insurers have shifted assessment practices in response to the uptick in ransomware incidents, focusing on previously overlooked security weaknesses.

The U.S. Department of Justice and Treasury have taken coordinated action against North Korean cyber-enabled financial operations and Russian cybercrime infrastructure.
The U.S. Senate has removed a ban on state-level AI regulations from a tax bill, allowing states to enact their own AI legislation in the absence of a federal framework.
AT&T launched a “Wireless Lock” feature to help protect customers from SIM swapping attacks by restricting changes to account information and phone number porting.