Major Incidents or Breaches

• Four individuals were arrested in the UK for cyberattacks targeting major retailers Marks & Spencer, Co-op, and Harrods. The suspects are believed to be connected to the Scattered Spider group, which has also targeted airlines and other sectors.
• Qantas confirmed a data breach affecting 5.7 million customers. Exposed information includes names, addresses, email addresses, phone numbers, and other personal data.
• Nippon Steel’s NS Solutions subsidiary suffered a breach exposing customer and employee data. There is currently no evidence of the data being leaked on dark web sites.
• Ingram Micro experienced a ransomware attack that disrupted online ordering for customers. The company has since restored operations.
• McDonald’s suffered a data exposure incident involving its AI-powered job application bot, which allowed access to applicant data using a weak default password.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Qantas confirmed a data breach affecting 5.7 million customers, with threat actors exfiltrating customer data.
• Bitcoin Depot reported a data breach impacting nearly 27,000 cryptocurrency users, exposing sensitive customer information.
• Ingram Micro is restoring operations after a ransomware attack by the SafePay group, which disrupted systems and business services.
• McDonald’s AI hiring platform, operated by Paradox.ai, exposed the personal information of tens of millions of job applicants due to basic security flaws, including the use of the password ‘123456’.
• Nippon Steel Solutions disclosed a data breach following exploitation of a zero-day vulnerability in network equipment.
• Nova Scotia Power, a Canadian electric utility, reported disruption of power meters and a data breach affecting individuals in both Canada and the United States.
• Researchers identified millions of users being spied on via malicious browser extensions available in the Chrome and Edge web stores.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• M&S confirmed a significant ransomware attack by DragonForce, initiated via a sophisticated social engineering/impersonation attack.
• Qantas experienced a data breach resulting in an extortion demand after customer data was stolen from a contact centre.
• South Korean telecommunications provider SK Telecom suffered a breach exposing 27 million records; the government imposed a monetary penalty and new regulatory requirements.
• Over 17,000 fake news websites were uncovered globally as part of a large-scale investment fraud campaign (“BaitTrap”).
• More than 1.7 million installations of malicious Chrome extensions were identified, capable of tracking users, stealing browser activity, and redirecting to unsafe sites.
• The Anatsa Android banking trojan was distributed via a fake PDF viewer app on Google Play, impacting over 90,000 users, primarily targeting US banks.
• Russian organisations were targeted by a new Windows spyware dubbed Batavia, used in ongoing espionage campaigns.
• A supply chain attack compromised the Ethcode Visual Studio Code extension, exposing over 6,000 developers to malicious pull requests.
• The RondoDox botnet exploited vulnerabilities in TBK DVRs and Four-Faith routers to conscript devices for DDoS attacks.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Ingram Micro, a major IT distributor, experienced a ransomware attack causing widespread outages and disruption to customer ordering and services. The company is working to restore systems; details on data theft remain undisclosed.
• Qantas confirmed it is being extorted by threat actors following a cyberattack that potentially exposed the data of 6 million customers.
• Hackers stole nearly $140 million from six Brazilian banks by using credentials purchased from a C&M employee for $920.
• The International Criminal Court (ICC) disclosed a sophisticated cyberattack in its latest threat intelligence report.
• The PC version of Call of Duty: WWII was taken offline after reports of gamers being hacked.
• Several Russian industrial enterprises were targeted in a phishing campaign delivering the newly discovered Batavia spyware, which exfiltrates sensitive data from corporate devices.

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

• TAG-140, a threat group linked to Pakistan, has been observed targeting Indian government, defence, and rail sectors using a modified version of the DRAT remote access trojan (DRAT V2). The campaign involves spear-phishing and the deployment of the new RAT variant for persistent access and data exfiltration.

Trends, Tools, or Tactics of Interest

• The Caracal rootkit, written in Rust and leveraging eBPF, has been released for stealthy post-exploitation. Caracal enables the hiding of BPF programs, maps, and processes on compromised systems, enhancing evasion capabilities for attackers and red teamers.
• Analysis of SSH and Telnet honeypot data has revealed attackers experimenting with new and varied usernames in brute-force attempts, indicating ongoing evolution in credential-stuffing tactics.
• The Flipper Zero device continues to demonstrate a wide range of offensive security capabilities, including RFID/NFC cloning, signal replay attacks, and wireless protocol analysis, maintaining its popularity among both security professionals and hobbyists.

Major Incidents or Breaches

• Ingram Micro, a major IT distributor, is experiencing an ongoing outage attributed to a SafePay ransomware attack. Internal systems have been shut down as a result of the incident.

Newly Discovered Vulnerabilities

• Exposed Java Debug Wire Protocol (JDWP) interfaces are being actively exploited by threat actors to gain remote code execution and deploy cryptocurrency miners on compromised systems.

Notable Threat Actor Activity

• Attackers are leveraging exposed JDWP interfaces for illicit crypto mining operations.
• Hpingbot malware is targeting SSH services to facilitate Distributed Denial of Service (DDoS) attacks.
• Iran-linked hackers have threatened to release emails related to the Trump campaign.
• Chinese state-linked threat actors reportedly maintain persistent access within US telecommunications networks.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Ingram Micro has suffered a global outage affecting its websites and internal systems. Customers have expressed concern that this may be the result of a cyberattack, although the company has not issued an official statement regarding the cause.
• A hacker has claimed to have stolen and leaked 106GB of data from Spanish telecommunications provider Telefónica. The company has not confirmed the breach.

Newly Discovered Vulnerabilities

• Two critical vulnerabilities have been disclosed in the Sudo command-line utility for Linux and Unix-like operating systems. These flaws allow local attackers to escalate privileges to root. The vulnerabilities impact major Linux distributions.

Notable Threat Actor Activity

Major Incidents or Breaches

• Spanish police dismantled an investment fraud ring responsible for over €10 million in losses, targeting victims through fraudulent investment schemes.
• IdeaLab confirmed data was stolen during a ransomware attack in October 2024, with notifications being sent to affected individuals.
• Microsoft is investigating ongoing intermittent access issues affecting SharePoint Online users.
• Over 40 malicious Firefox browser extensions targeting cryptocurrency wallets have been discovered, designed to steal wallet secrets and user assets.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Qantas Airlines suffered a data breach impacting 6 million customers. Personal information was accessed via a third-party call center platform; passport and credit card data were not included.
• Spanish authorities arrested two individuals in Las Palmas for cybercriminal activity, including data theft from government entities, politicians, and journalists.

Newly Discovered Vulnerabilities

• Cisco disclosed and patched a critical vulnerability in Unified Communications Manager (Unified CM) and Session Management Edition, involving hardcoded root SSH credentials that allowed remote root access. The backdoor account has now been removed.
• The Forminator WordPress plugin is vulnerable to an unauthenticated arbitrary file deletion flaw, enabling potential full site takeover attacks.
• Google Chrome was updated to address a serious security flaw that has been exploited in the wild.
• Citrix issued a warning that patching recent authentication bypass vulnerabilities in NetScaler ADC and Gateway may cause login page failures.
• Multiple fake cryptocurrency wallet extensions were discovered in the Firefox add-ons store, designed to steal wallet credentials and sensitive data.

Notable Threat Actor Activity

Major Incidents or Breaches

• Qantas disclosed a cyberattack involving unauthorised access to a third-party platform containing customer data.
• Kelly Benefits reported a 2024 data breach impacting 550,000 customers’ personal information.
• Esse Health notified over 263,000 patients of a breach in April that compromised personal and health information.
• Johnson Controls began notifying individuals affected by a 2023 ransomware attack that impacted global operations.
• The International Criminal Court is investigating a new “sophisticated” cyberattack on its systems.

Newly Discovered Vulnerabilities