CVE-2025-8875 on DanSec Daily

Cybersecurity Brief – 2025-08-19

Tue, 19 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Workday disclosed a data breach after attackers accessed a third-party CRM platform via social engineering, likely linked to the broader Salesforce attacks attributed to the ShinyHunters group. Exposed data was limited to “commonly available” business contact information, with no customer data compromised.
The Canadian House of Commons experienced a data breach, as noted in recent threat intelligence reporting.
Over 800 N-able N-central servers remain unpatched against two critical vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that have been actively exploited. More than 870 instances are affected globally.
Multiple web hosting firms in Taiwan were targeted by Chinese APT group UAT-7237, aiming for long-term access to high-value targets.
The US Department of Justice seized $2.8 million in cryptocurrency from a Zeppelin ransomware operator, following an indictment.

Newly Discovered Vulnerabilities

A critical Microsoft Windows vulnerability (CVE-2025-29824) was exploited to deploy the PipeMagic backdoor in RansomExx ransomware attacks, with observed activity in Brazil and Saudi Arabia.
Researchers disclosed a major internet-wide vulnerability enabling large-scale DDoS attacks, affecting a significant portion of websites since 2023.
A novel 5G attack, Sni5Gect, allows attackers to sniff traffic and disrupt networks without requiring a malicious base station.

Notable Threat Actor Activity

The Noodlophile malware campaign expanded its global reach, targeting enterprises with spear-phishing emails using copyright complaint lures to deliver information-stealing malware.
The source code for ERMAC v3 Android banking trojan was leaked online, exposing details of its malware-as-a-service infrastructure.
Chinese APT group UAT-7237 targeted Taiwanese web infrastructure for persistent access to high-value entities.
MFA-bombing attacks continue to be reported, with attackers sending repeated multi-factor authentication prompts to coerce user approval.

Trends, Tools, or Tactics of Interest

Malicious packages were discovered in both PyPI and npm repositories, leveraging dependencies for supply chain attacks and establishing persistence.
The evolution of the PipeMagic backdoor demonstrates ongoing adaptation of TTPs by its operators, with recent exploitation linked to a patched Microsoft Windows vulnerability.
Increasing sophistication of RATs (Remote Access Trojans) is prompting calls for more unified, behavior-aware detection approaches.
Attackers are leveraging weaknesses in multi-cloud environments due to inconsistent security monitoring and controls.
Ongoing phishing campaigns are using fake Gmail security alerts to trick users into account compromise.

Regulatory or Policy Developments Affecting the Security Industry

The European Union has made cybersecurity funding available for SMEs, with guidance published on how to access these resources.
Mozilla has raised concerns that a recent German Federal Supreme Court ruling could lead to browser-based ad blockers being declared illegal in Germany, potentially impacting privacy and security tools.
Wazuh has been highlighted as a tool for regulatory compliance, supporting organizations in meeting data protection and privacy obligations.
In the UK, a hacker responsible for compromising 3,000 websites was sentenced to 20 months in prison.

Cybersecurity Brief – 2025-08-18

Mon, 18 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Workday disclosed a data breach resulting from attackers gaining access to a third-party CRM platform, reportedly linked to a wider wave of Salesforce-related attacks targeting multiple organizations.
The Canadian House of Commons suffered a data breach, as reported in the latest threat intelligence bulletin.
A UK individual was sentenced to 20 months in prison for hacking approximately 3,000 websites.
Over 800 N-able N-central servers remain unpatched and exposed to two critical vulnerabilities (CVE-2025-8875 and CVE-2025-8876) that have been actively exploited.
US authorities seized $2.8 million in cryptocurrency from a Zeppelin ransomware operator following an indictment.

Newly Discovered Vulnerabilities

A new vulnerability (CVE-2025-29824) has been linked to the evolution of the PipeMagic backdoor, with exploitation observed in attacks in Brazil and Saudi Arabia.
An internet-wide vulnerability affecting a significant proportion of websites has enabled large-scale DDoS attacks, considered the most significant since 2023.
Researchers disclosed a novel 5G attack technique (“Sni5Gect”) that allows attackers to sniff traffic and disrupt services without requiring a malicious base station.

Notable Threat Actor Activity

Chinese APT group UAT-7237 has been targeting web hosting firms in Taiwan to gain long-term access to high-value targets.
Zeppelin ransomware operator Ianis Antropenko has been indicted in the US, with cryptocurrency assets seized.
Malicious packages were discovered in the PyPI and npm repositories, introducing supply chain risks via dependencies that enable persistent access.

Trends, Tools, or Tactics of Interest

The PipeMagic backdoor has evolved in its tactics, techniques, and procedures (TTPs) since the RansomExx incident, now leveraging new vulnerabilities for access.
Evolving remote access trojans (RATs) are increasingly redefining enterprise security threats, with a focus on unified and behavior-aware detection approaches.
A surge in MFA-bombing attacks has been noted, where attackers repeatedly send MFA prompts to users in an attempt to cause confusion and gain unauthorized access.
The dual-use tool “LostMyPassword” has been highlighted for its capability to recover account passwords and serve as a rapid credential dumping utility during post-exploitation.
Organizations are struggling with security across multi-cloud environments, creating openings for attackers due to inconsistent monitoring and controls.
Security researchers have observed NFC-based fraud and Docker backdoors as part of emerging attack vectors.

Regulatory or Policy Developments Affecting the Security Industry

A recent ruling by Germany’s Federal Supreme Court has revived the legal debate over browser-based ad blockers, raising concerns that ad blockers could be declared illegal in Germany.
The European Union has ongoing cybersecurity funding initiatives aimed at supporting small- and medium-sized enterprises (SMEs) to address evolving threats and compliance requirements.

Cybersecurity Brief – 2025-08-15

Fri, 15 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

The House of Commons of Canada is investigating a data breach after a cyberattack resulted in the theft of employee information.
Pro-Russian hackers have been blamed for taking control of critical operation systems at a Norwegian water dam and opening outflow valves, according to the Norwegian Police Security Service.
Over $300 million in cryptocurrency linked to cybercrime and fraud schemes has been seized through two joint law enforcement and private sector operations.
The US Courts records system suffered a breach, with details about the exposure and responsible party still unclear.
Cybercriminals are auctioning live police and government email credentials on the dark web, offering access to sensitive systems and confidential intelligence.
Four individuals from Ghana have been charged with stealing over $100 million via romance scams and business email compromise (BEC) schemes.

Newly Discovered Vulnerabilities

The “MadeYouReset” vulnerability in multiple HTTP/2 implementations enables large-scale denial-of-service (DoS) attacks by exploiting how HTTP/2 handles stream resets. This vulnerability is comparable to the Rapid Reset attack vector.
Two vulnerabilities (CVE-2025-8875 and CVE-2025-8876) in N-able N-central remote monitoring and management (RMM) platform are being actively exploited as zero-days. These allow local code execution and command injection after authentication.
Xerox FreeFlow Core print orchestration software contained path traversal and XML external entity (XXE) injection flaws enabling unauthenticated remote code execution. Patches have been released.
Researchers demonstrated that passkey (FIDO/WebAuthn) authentication can be bypassed via manipulation of the WebAuthn process, allowing attackers to impersonate users.
A downgrade attack technique has been shown to allow phishing kits to bypass FIDO authentication, enabling credential theft even with strong authentication mechanisms.

Notable Threat Actor Activity

The Crypto24 ransomware group is targeting large organisations using custom utilities for endpoint detection and response (EDR) evasion, data exfiltration, and file encryption.
Threat actors are using the CrossC2 command-and-control framework to expand Cobalt Strike Beacon capabilities to Linux and macOS environments, as observed by JPCERT/CC.
A new Android banking trojan, PhantomCard, is abusing NFC relay attacks, call hijacking, and root exploits to conduct fraudulent transactions.
A phishing campaign is distributing malware by leveraging a Japanese hiragana character (“ん”) in URLs to impersonate Booking.com, making malicious links appear legitimate.
Scammers are targeting jobseekers with fake Netflix job offers to steal Facebook login credentials.

Trends, Tools, or Tactics of Interest

The Picus Blue Report 2025 notes that only 3% of data exfiltration attempts are stopped, indicating a trend toward stealthy ransomware and infostealer operations focused on data theft rather than encryption.
MailSniper, a PowerShell tool for Exchange, is being used in red team operations to search mailboxes for credentials, network intelligence, and usernames.
SNI5GECT research demonstrates the ability to sniff and inject traffic in 5G networks without rogue base stations, highlighting risks to 5G infrastructure.
Budget constraints are impacting cybersecurity teams, particularly in healthcare, professional services, retail, and hospitality, while financial services, insurance, and tech sectors see budget growth above 5%.
Google Chrome Enterprise is enhancing browser security for enterprise environments, with a focus on extending protections from browser to operating system.

Regulatory or Policy Developments

State and local leaders in the US are lobbying Congress for increased cybersecurity resources following federal funding cuts to the Multi-State Information Sharing and Analysis Center (MS-ISAC), potentially affecting over 18,000 organisations’ access to basic cybersecurity services.