Major Incidents or Breaches

  • Instructure (Canvas) Breach: ShinyHunters claimed responsibility for a breach impacting Instructure, the provider of the Canvas learning management system. The incident exposed personal data of up to 275 million students across educational institutions, highlighting significant vendor risk for schools.
  • DAEMON Tools Supply Chain Attack: Disc Soft Limited confirmed a supply chain compromise in DAEMON Tools Lite, with trojanized versions distributed globally. A sophisticated backdoor was selectively deployed on a dozen systems, including government and scientific entities. A clean version has since been released.
  • Claude AI Used in Water Utility Intrusion: Dragos reported that threat actors leveraged Claude AI to facilitate access to operational technology (OT) assets during an intrusion at a Mexican water and drainage utility.
  • ManageWP Phishing via Google Ads: Attackers used Google-sponsored ads to deliver phishing pages targeting credentials for GoDaddy’s ManageWP platform, affecting WordPress management operations.
  • Windows Phone Link Exploited: Multiple reports detail hackers abusing Microsoft’s Windows Phone Link feature with the CloudZ RAT and a plugin called Pheno to steal credentials, text messages, and one-time passwords, enabling multi-factor authentication bypass.
  • Google Chrome AI Model Download Issue: Google Chrome was found to silently download and reinstall a 4GB AI model on users’ devices without explicit consent.

Newly Discovered Vulnerabilities

  • Palo Alto Networks PAN-OS Zero-Day: A critical, actively exploited, unpatched vulnerability in the PAN-OS User-ID Authentication Portal allows remote code execution on firewalls. The vendor has issued a warning and is working on a fix.
  • vm2 Node.js Library: A dozen critical vulnerabilities in the vm2 sandboxing library for Node.js were disclosed, enabling sandbox escape and arbitrary code execution. Exploitation could compromise hosts running affected applications.
  • Cisco DoS Vulnerability: Cisco patched a denial-of-service flaw in Crosswork Network Controller and Network Services Orchestrator products. Exploited systems require a manual reboot to restore operations.

Notable Threat Actor Activity

  • OceanLotus (APT32): Kaspersky attributed a campaign to OceanLotus involving malicious Python wheel packages uploaded to PyPI, targeting both Windows and Linux users with the ZiChatBot malware.
  • MuddyWater (Iranian APT): MuddyWater was linked to a campaign masquerading as a Chaos ransomware attack. The group used Microsoft Teams for social engineering, credential harvesting, persistence, and data theft, deploying ransomware as a decoy.
  • Mirai-Based xlabs_v1 Botnet: Researchers identified a new Mirai variant, xlabs_v1, exploiting Android Debug Bridge (ADB) on exposed devices to conscript them into a DDoS botnet.
  • NWHStealer via Bun Runtime: Attackers are leveraging the Bun JavaScript runtime to distribute the NWHStealer infostealer, utilizing legitimate developer tools to evade detection.
  • Quasar Linux RAT Campaign: A sophisticated Quasar Linux RAT campaign is targeting software developers, offering remote access, surveillance, and credential exfiltration capabilities.

Trends, Tools, or Tactics of Interest

  • Social Engineering via Help Desk Impersonation: Google Threat Intelligence Group (GTIG) is tracking a new threat actor impersonating help desks to trick users into installing malware, indicating continued reliance on social engineering.
  • Supply Chain and Developer Platform Abuse: Multiple incidents (DAEMON Tools, PyPI, Bun runtime, Google Ads phishing) illustrate ongoing abuse of software supply chains and developer ecosystems for malware distribution.
  • Infostealer Evasion Techniques: VoidStealer authors have found new methods to bypass Google Chrome’s App-Bound Encryption, facilitating the theft of sensitive data.
  • AI Governance and Security: Reports highlight the rapid deployment of AI agents within enterprise environments, often outpacing governance and oversight. Additionally, cybercriminal forums are reporting issues with low-quality AI-generated content (“AI slop”).
  • Ransomware Targeting Backups: Analysis shows ransomware groups increasingly target and destroy backup systems prior to encryption, negating recovery options even when backups exist.

Regulatory or Policy Developments

  • CISA ‘CI Fortify’ Initiative: The US CISA launched new guidance (“CI Fortify”) urging critical infrastructure operators to invest in resilient OT environments capable of withstanding extended isolation and cyber compromise.
  • Google Android Binary Transparency: Google announced expanded Binary Transparency for Android apps, introducing a public ledger to verify app authenticity and mitigate supply chain risks.