Saturday 19 April 2025

Major Incidents and Breaches

• SonicWall SMA VPN Devices Under Active Attack

  • A remote code execution vulnerability in SonicWall Secure Mobile Access (SMA) appliances has been actively exploited since at least January 2025. Organisations using these devices are at heightened risk and should prioritise patching and mitigation.

• Apple Zero-Day Exploits

  • Two zero-day vulnerabilities in Apple iOS devices have been used in sophisticated attacks targeting specific individuals, indicating likely involvement of spyware or nation-state actors. Details remain limited.

• Smishing Surge Tied to Chinese Threat Actors

  • A China-based cybercriminal group, “Smishing Triad,” is conducting widespread toll-themed SMS phishing attacks across the US and UK, aiming for financial theft. A custom Chinese smishing kit is enabling these campaigns.

• FBI Impersonation Scam

  • Scammers are posing as FBI IC3 employees, contacting previous fraud victims and offering assistance in recovering lost funds as a means to further defraud them.

• Payment Card Scam with Malware Component

  • A new scam involves phone calls and malware disguised as security or verification tools to capture payment card details and access funds.

• Alleged SmokeLoader Operator Charged

  • US authorities have charged an individual accused of operating the SmokeLoader malware, responsible for stealing personal data of over 65,000 individuals.

Newly Discovered Vulnerabilities

• ASUS Router Authentication Bypass

  • ASUS has disclosed a critical authentication bypass vulnerability affecting routers with AiCloud enabled, potentially allowing remote attackers to execute unauthorized functions.

• Cisco Webex Remote Code Execution

  • Cisco released updates for a high-severity Webex vulnerability that allows unauthenticated attackers to achieve client-side remote code execution via malicious meeting invite links.

Notable Threat Actor Activity

• Chinese APTs and Cybercriminals

  • “IronHusky” (Chinese-speaking) has targeted Russian and Mongolian government entities with upgraded MysterySnail RAT malware.
  • Mustang Panda, a Chinese APT, has introduced four new tools: two keyloggers, a lateral movement utility, and an EDR evasion driver, enhancing their capabilities.
  • XorDDoS, a DDoS malware family, continues to expand, now targeting Docker, Linux, and IoT environments with new controller infrastructure.

• Interlock Ransomware Gang

  • The group is deploying ransomware via ClickFix attacks, impersonating IT tools to gain access to corporate networks and encrypt files.

• Multi-Stage Malware Campaigns

  • Recent attacks employ .JSE scripts and PowerShell to deliver Agent Tesla, Remcos RAT, and XLoader, reflecting increased use of complex, multi-stage delivery mechanisms to evade detection.

Trends, Tools, and Tactics of Interest

• AI in Fraud and Defence

  • Both attackers and defenders are leveraging AI in identity fraud. Sectors such as identity verification, insurance, and financial services report increased AI-driven fraud, with organisations responding by deploying AI-based countermeasures.

• Credential-Based Attacks

  • Credential-based intrusions now account for nearly half of all breaches, highlighting the need for robust password and identity management.

• Low Remediation Rates for Vulnerabilities

  • Organisations are addressing less than half of all exploitable vulnerabilities, with only 21% of GenAI application flaws being resolved, indicating significant gaps in vulnerability management.

• Phishing and Social Engineering

  • Advanced phishing campaigns, including convincing Google-themed email scams, are ongoing, underscoring the persistent threat of social engineering.

Regulatory and Policy Developments

• Operational Technology (OT) Security Regulation

  • Governments are introducing stricter OT security regulations with explicit corporate accountability for breaches, particularly where boards fail to act.

• Collaborative Cybersecurity Legislation for Critical Infrastructure

  • The American Water Works Association (AWWA) has endorsed new collaborative cybersecurity legislation aimed at enhancing protection for critical infrastructure sectors such as energy and water.

• CISA Guidance on Oracle Cloud Breach

  • CISA has issued recommendations following reports of an alleged Oracle Cloud breach, advising organisations to implement preventive measures against data misuse, though Oracle has not yet provided customer-specific guidance.

Sector-Specific Notes

• Energy Sector Supply Chain Security
  • The energy sector remains a high-value target due to its interconnected supply chain, necessitating enhanced third-party risk management and supply chain security practices.