Major Incidents or Breaches

  • Meta disclosed that over 20,000 Instagram accounts were compromised after attackers exploited Meta’s AI-powered support system to reset passwords and hijack accounts. Authorities have been notified regarding the incident [3][12].
  • Law firms and professional services organizations in the United States have been targeted by the Silent Ransom Group, which uses fake IT support calls in social engineering attacks that lead to rapid data theft [6].
  • Researchers revealed details of a financially motivated extortion campaign by threat actor UNC3753, which has targeted dozens of organizations across professional, legal, and financial services sectors using vishing and physical intrusions [1].

Newly Discovered Vulnerabilities

  • SolarWinds patched a vulnerability in Serv-U that is being actively exploited in the wild. The flaw allows unauthenticated attackers to crash the Serv-U service via specially crafted POST requests [11].
  • A new variant of the Gafgyt botnet, C0XMO, is exploiting a flaw in DD-WRT router firmware to propagate. The botnet can also target multiple device types with various CPU architectures and is designed to remove rival malware from infected devices [5].

Notable Threat Actor Activity

  • UNC3753 has been identified as responsible for a data theft extortion campaign involving vishing and physical intrusions targeting organizations in the professional, legal, and financial sectors [1].
  • Silent Ransom Group is actively conducting social engineering attacks against U.S. law firms and professional services organizations, using fake IT support calls to facilitate data theft [6].

Trends, Tools, or Tactics of Interest

  • Microsoft announced that Visual Studio Code will implement a two-hour delay before extensions are automatically updated, aiming to reduce the risk of supply chain attacks via malicious or compromised extensions [2].
  • OpenAI is rolling out expanded account security controls for ChatGPT users, including Active Sessions and Lockdown Mode features [10].
  • The C0XMO botnet demonstrates the continued trend of malware targeting IoT and router firmware vulnerabilities, with added functionality to eliminate competing malware on infected devices [5].
  • Emphere has raised $2.1 million to develop AI-powered vulnerability remediation solutions for software companies, indicating increased investment in AI-driven security automation [13].

Sources#

  1. Over 20,000 Instagram accounts stolen in Meta AI support hack - bleepingcomputer.com
  2. Meta Says 20,000 Instagram Accounts Hacked via AI Tool Abuse - securityweek.com
  3. Silent Ransom Group targets law firms with fake IT support calls - bleepingcomputer.com
  4. UNC3753 Used Vishing and Physical Intrusions in U.S. Data Theft Extortion Campaign - thehackernews.com
  5. SolarWinds Serv-U Vulnerability Exploited in the Wild - securityweek.com
  6. C0XMO botnet spreads via DD-WRT router flaw, kills rival malware - bleepingcomputer.com
  7. VS Code Adds 2-Hour Extension Auto-Update Delay to Limit Supply Chain Attacks - thehackernews.com
  8. OpenAI Rolling Out ChatGPT Account Security Controls - securityweek.com
  9. Emphere Raises $2.1 Million for AI-Powered Vulnerability Remediation - securityweek.com