https://blog.dansec.red/vendors/airwatch/Recent content in AirWatch on DanSec DailyHugoen-gbTue, 04 Nov 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-11-04-cybersecurity-news/Tue, 04 Nov 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-11-04-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Hackers stole over $120 million from the Balancer DeFi crypto protocol by targeting its v2 pools.</li> <li>A major breach at the Kansas City, Kansas, Police Department exposed a list of alleged officer misconduct, including dishonesty, sexual harassment, excessive force, and false arrests.</li> <li>Everest ransomware group claimed responsibility for recent attacks, according to Check Point’s latest threat intelligence report.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>XWiki (CVE-2025-24893): Exploit attempts have been observed against XWiki’s SolrSearch component, which allows arbitrary remote code execution. A patch was released in February.</li> <li>Google Chrome: Two high-severity vulnerabilities in the V8 JavaScript engine (type confusion and inappropriate implementation) were disclosed, with Google awarding $100,000 in bug bounties.</li> <li>Microsoft WSUS: An out-of-band update to patch an actively exploited Windows Server Update Service vulnerability has disabled hotpatching on some Windows Server 2025 systems.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Lazarus Group targeted Web3 entities, using advanced tools and rapid exploitation of new vulnerabilities.</li> <li>North Korea-linked Kimsuky group deployed a new backdoor, HttpTroy, disguised as a VPN invoice in a likely spear-phishing attack in South Korea.</li> <li>Chinese APTs used new ‘Airstalk’ malware (PowerShell and .NET variants) in supply chain attacks, abusing AirWatch’s MDM API for C2 communication.</li> <li>Cybercriminals are increasingly targeting logistics and freight networks by deploying remote monitoring and management (RMM) tools to hijack cargo and steal physical shipments.</li> <li>Three former US cybersecurity professionals were indicted for conducting BlackCat (ALPHV) ransomware attacks against five US companies.</li> <li>Ukrainian national Yuriy Igorevich Rybtsov (aka MrICQ) was extradited to the US to face charges related to the Jabber Zeus cybercrime operation.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>AI Poisoning: New research indicates attackers can more easily poison AI models by introducing malicious data, increasing the risk of models producing harmful outputs.</li> <li>Abuse of AI APIs: Microsoft identified the ‘SesameOp’ backdoor, which uses the OpenAI Assistants API as a covert C2 channel. Additionally, Claude AI APIs can be abused for data exfiltration via prompt injection.</li> <li>Malicious VSCode Extensions: The ‘SleepyDuck’ remote access trojan was found in a fake Solidity extension on the Open VSX registry, using an Ethereum smart contract for C2.</li> <li>Android Malware: BankBot-YNRK and DeliveryRAT trojans are actively stealing financial data from Android users, with BankBot-YNRK reportedly muting device alerts and draining cryptocurrency wallets, primarily targeting Indonesia.</li> <li>TruffleNet Attack: Attackers use frameworks based on TruffleHog to leverage stolen credentials for AWS account compromise, leading to reconnaissance and business email compromise (BEC).</li> <li>Device Code Phishing: Attackers are exploiting OAuth device flows, with significant differences in attack surfaces between Azure and Google.</li> <li>Fake AI Apps: There is an increase in fake ChatGPT and AI-related apps in app stores, some containing adware or spyware.</li> <li>SOC Operations: Security Operations Centers are increasingly overwhelmed by alert volumes, leading to a shift toward continuous exposure management and automation.</li> <li>Generative AI in Malware Analysis: Generative AI is being used to accelerate reverse engineering of malware such as XLoader.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>OpenAI Safety Panel: A panel led by Zico Kolter at OpenAI now has the authority to halt the release of new AI systems if deemed unsafe.</li> <li>Electrical Grid Security: Regulators and industry experts are advocating for the convergence of cyber and physical security strategies for the power grid, reflecting increased attack activity on critical infrastructure.</li> </ul>