Major Incidents or Breaches

  • Crunchbase has confirmed a data breach following hacking claims. The incident is linked to the ShinyHunters group, which also targeted SoundCloud and Betterment.
  • A failed cyberattack on the Polish power grid has been attributed to the Russian APT group Sandworm. The attack involved the deployment of data-wiping malware but did not result in significant disruption.
  • Nearly 800,000 Telnet servers have been found exposed to remote attacks due to a critical authentication bypass vulnerability in GNU InetUtils, with ongoing exploitation attempts observed.
  • Cloudflare experienced a 25-minute BGP route leak affecting IPv6 traffic due to internal misconfiguration, causing congestion, packet loss, and approximately 12 Gbps of traffic disruption.

Newly Discovered Vulnerabilities

  • Microsoft has patched an actively exploited Office zero-day vulnerability rated as high severity.
  • Over 20 vulnerabilities were identified and patched in Dormakaba physical access control systems, which could have allowed attackers to unlock doors at major European firms.
  • CISA has reported active exploitation of a critical VMware vCenter Server remote code execution vulnerability, mandating U.S. federal agencies to secure their servers within three weeks.
  • The npm package manager’s Shai-Hulud supply-chain defenses can be bypassed via Git dependencies, exposing users to potential malicious package installations.

Notable Threat Actor Activity

  • The North Korean Konni group has been observed targeting blockchain developers and engineering teams with a new AI-generated PowerShell backdoor, aiming to compromise development environments and cryptocurrency assets.
  • A campaign targeting Indian users with tax-themed phishing emails is delivering the Blackmoon malware as part of a suspected cyber espionage operation.
  • The Russian Sandworm APT group is confirmed to have attempted a wiper attack on Poland’s power grid.
  • The ShinyHunters group has claimed responsibility for the Crunchbase data breach.
  • The Kimwolf botnet operators reportedly compromised the control panel of the Badbox 2.0 botnet, which has infected over 2 million devices.

Trends, Tools, or Tactics of Interest

  • Two malicious Visual Studio Code extensions, posing as AI-powered coding assistants, were discovered stealing developer source code. The extensions had over 1.5 million installs.
  • The ‘Stanley’ malware-as-a-service toolkit is being marketed on cybercrime forums for $2,000–$6,000, offering phishing Chrome extensions that can bypass Google’s review and be published on the Chrome Web Store.
  • New attacks are leveraging the ClickFix method combined with fake CAPTCHA prompts and signed Microsoft App-V scripts to deliver the Amatera infostealer malware.
  • Offensive AI techniques are increasingly used by threat actors, including AI-generated malware and backdoors, complicating detection and response efforts.
  • Deepfake ‘nudify’ technology is becoming more advanced and accessible, increasing the risk and impact of sexual image abuse.
  • Threat actors are exploiting misconfigurations in Okta deployments, with security researchers highlighting six commonly overlooked settings that weaken identity security.

Regulatory or Policy Developments

  • The European Commission has launched an investigation into X (formerly Twitter) to determine if the company properly assessed risks before deploying its Grok AI tool, following incidents involving the generation of sexually explicit images.
  • TikTok has finalized a deal to create a new American entity, averting a potential ban in the United States.