Major Incidents or Breaches

  • The French national postal service experienced a cyberattack that disrupted online services, including digital banking and postal operations, affecting millions of users.
  • Baker University disclosed a data breach affecting over 53,000 individuals, with attackers accessing personal, health, and financial information after compromising the network a year prior.
  • Nissan confirmed exposure of personal information for 21,000 customers due to a compromise of Red Hat’s GitLab instances.
  • The U.S. Department of Justice seized a domain and database used in a $14.6 million bank account takeover scheme, which involved phishing and credential theft.
  • Hacktivists claimed to have scraped nearly all content from Spotify, raising concerns about data exposure.
  • INTERPOL coordinated an operation across 19 African countries, resulting in 574 arrests and the recovery of $3 million, dismantling business email compromise (BEC), ransomware, and cyber-fraud networks.

Newly Discovered Vulnerabilities

  • Two malicious Chrome extensions, both named “Phantom Shuttle,” were discovered in the Chrome Web Store. These extensions intercepted user traffic, stole credentials from over 170 sites, and posed as proxy service plugins.
  • A malicious npm package with over 56,000 downloads was found to steal WhatsApp credentials and data, while also providing legitimate functionality to evade detection and deploying a backdoor.

Notable Threat Actor Activity

  • The Evasive Panda APT group was analyzed for using poisoned DNS requests to deliver the MgBot implant. The infection chain includes shellcode encrypted using DPAPI and RC5.
  • The WebRAT malware is being spread via fake vulnerability exploit repositories on GitHub, specifically targeting cybersecurity researchers by masquerading as proof-of-concept code.
  • State-sponsored North Korean operatives attempted to infiltrate Amazon through fraudulent IT job applications, with Amazon reportedly fending off approximately 1,800 such attempts.
  • Chinese cybercriminals are leveraging Telegram to run large-scale cryptocurrency scams, contributing to the growth of darknet markets.

Trends, Tools, or Tactics of Interest

  • Phishing campaigns are abusing free Cloudflare Pages services to host malicious content and conduct credential theft.
  • Brushing scams are on the rise, where individuals receive unsolicited packages as a method for fraudsters to validate stolen data and boost seller ratings.
  • Microsoft Teams will enable messaging safety features by default in January to better protect against malicious content.
  • The Google Workspace Password Manager (“Passwd”) was detailed, highlighting its business-focused design for secure credential management.
  • ServiceNow announced the acquisition of Armis for $7.75 billion, aiming to enhance autonomous cybersecurity capabilities and build a proactive AI-driven security stack.

Regulatory or Policy Developments

  • Italy’s antitrust authority fined Apple €98.6 million ($116 million) for using its App Tracking Transparency (ATT) framework to restrict competition in the App Store. Apple has announced plans to appeal the decision.
  • The healthcare industry continues to oppose proposed changes to the US HIPAA Security Rule, arguing that the new rules are insufficient given the rise in healthcare-targeted cyberattacks.