Cybersecurity Brief – 2025-08-29

Fri, 29 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion suffered a data breach impacting over 4.4 million individuals in the US, exposing personal information but not credit reports or core credit data.
MathWorks (MATLAB developer) disclosed a ransomware attack that resulted in the theft of data belonging to over 10,000 individuals.
Google confirmed that the Salesloft breach is larger than previously reported, with attackers using stolen OAuth tokens to access both Google Workspace email accounts and Salesforce data.
The maintainers of the Nx build system reported a supply chain attack involving malicious npm packages and plugins, resulting in the leakage of over 2,300 GitHub, cloud, and AI credentials. This incident marks the first known use of AI-powered stealers in a supply chain attack.
Law enforcement agencies (FBI and Dutch Police) seized servers and domains associated with the VerifTools fake ID marketplace.
TransUnion and MathWorks incidents highlight continued targeting of large data repositories by threat actors, with significant personal data exposure.

Newly Discovered Vulnerabilities

A high-severity authentication bypass vulnerability was disclosed in Passwordstate, an enterprise password manager. Customers have been urged to patch immediately.
A flaw in the Visual Studio Code Marketplace allows attackers to republish previously deleted extensions under the same names, posing a risk to the software supply chain.
Researchers highlighted hidden vulnerabilities in popular project management tools (e.g., Trello, Asana), with risks including data exposure and insufficient backup protections.

Notable Threat Actor Activity

The China-linked APT group Salt Typhoon has exploited vulnerabilities in Cisco, Ivanti, and Palo Alto devices to breach over 600 organizations globally, including critical infrastructure in telecom, government, and military sectors. The group maintains persistent access for espionage purposes.
Cybercriminals are actively recruiting social engineering talent with fluent English skills, according to a new report on the cybercriminal recruitment ecosystem.
A new phishing-as-a-service (PhaaS) platform named “Salty 2FA” is being used to bypass MFA and steal Microsoft 365 credentials, targeting organizations across North America and Europe.
The TamperedChef malware campaign uses malvertising and fake PDF editor sites to deliver an information stealer that exfiltrates credentials and cookies.
North Korean IT worker schemes were targeted by new US Treasury sanctions, exposing $600K in crypto transfers and over $1M in profits for DPRK-linked threat actors.
Threat actors have abused Anthropic’s Claude AI to develop ransomware and automate data extortion campaigns.
Akira and Cl0p remain among the most active ransomware-as-a-service groups, with reports noting increased use of AI by both established and emerging gangs.

Trends, Tools, or Tactics of Interest

First documented AI-weaponized supply chain attack occurred via the Nx build system, where AI-powered stealers were used to rapidly exfiltrate developer secrets.
There is a notable rise in requests for ZIP files in web honeypot logs, indicating a possible trend in attackers seeking to exploit ZIP-based delivery or exfiltration methods.
Shadow IT continues to expand organizational attack surfaces, with researchers finding widespread exposed backups, open Git repositories, and accessible admin panels containing sensitive data.
RedExt, a browser extension-based C2 framework, has been released for red team operations, enabling data collection and command-and-control via Chromium-based browsers.
Meta reported shutting down millions of WhatsApp accounts linked to scam centers, reflecting ongoing large-scale anti-fraud operations.
Increasing use of malvertising and fake software download sites to deliver malware, as seen in the TamperedChef campaign.
Affiliates are flocking to scam gambling sites that lure victims with free credits and steal cryptocurrency deposits.
Microsoft Word for Windows will soon autosave and default to cloud storage for new documents.
CISA, FBI, and NSA issued a global advisory on the widespread espionage activities of Chinese nation-state actors targeting network devices.

Regulatory or Policy Developments

The US Treasury’s Office of Foreign Assets Control (OFAC) imposed new sanctions on individuals and entities associated with North Korean IT worker schemes.
The FCC disconnected over a thousand voice operators from the public telephone network for failing to combat robocalling.
CISA released updated Software Bill of Materials (SBOM) guidelines, receiving mixed industry reviews regarding their effectiveness and practical utility.

Cybersecurity Brief – 2025-06-19

Thu, 19 Jun 2025 00:00:00 +0000

Major Incidents and Breaches

Episource, a healthcare SaaS provider, disclosed a data breach affecting 5.4 million patients in the United States, with health information stolen during a January cyberattack.
Asana reported a flaw in its Model Context Protocol (MCP) AI feature, which exposed customer data from some instances to other organisations.
Over 1,500 Minecraft players were infected by a multi-stage Java-based malware campaign, distributed via malicious game mods and cheats on GitHub, aiming to steal credentials and authentication tokens.
Pro-Israel hacking group Predatory Sparrow claimed responsibility for stealing and destroying over $90 million in cryptocurrency from Iran’s Nobitex exchange in a politically motivated attack.
Water Curse, a newly identified threat actor, was found to have hijacked 76 GitHub accounts to deliver multi-stage malware with data exfiltration and remote control capabilities.

Newly Discovered Vulnerabilities

Two local privilege escalation (LPE) vulnerabilities were discovered in major Linux distributions, affecting the PAM and Udisks components, allowing attackers to gain root privileges. Exploitation in the wild has been reported, and CISA has issued an alert regarding the OverlayFS subsystem flaw.
BeyondTrust released patches for a high-severity pre-authentication remote code execution vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) solutions, which could allow unauthenticated attackers to execute code remotely.

Notable Threat Actor Activity

North Korean APT BlueNoroff (Sapphire Sleet/TA444) used deepfake company executives in Zoom calls to trick employees into installing custom Mac malware.
Ryuk ransomware’s initial access specialist was extradited to the United States, highlighting ongoing law enforcement action against ransomware operators.
The Stargazers Ghost Network operated a distribution-as-a-service (DaaS) campaign targeting Minecraft users with infostealers via fake mods on GitHub.
An unidentified threat actor used Cloudflare Tunnel subdomains to host and deliver remote access trojans (RATs) through phishing emails in a campaign dubbed Serpentine#Cloud, leveraging .lnk shortcut files, in-memory code execution, and living-off-the-land tactics.
ChainLink phishing campaigns exploited trusted domains such as Google Drive and Dropbox to bypass security filters and conduct credential theft.

Trends, Tools, or Tactics of Interest

AI-generated voice deepfakes are improving in quality and present an increasing threat to organisations, with researchers noting their use in social engineering attacks.
Phishing campaigns are leveraging legitimate platforms (e.g., EUSurvey, Google Drive, Dropbox) to increase credibility and evade detection, as observed in recent sophisticated credential harvesting attacks.
The GodFather Android banking trojan has adopted virtualization tactics to take over banking and crypto apps by running them in isolated environments on compromised devices.
Varonis released the Jitter-Trap tool to detect beacons used by attackers for command-and-control communications, addressing evolving evasion techniques.
SMS-based two-factor authentication (2FA) remains vulnerable, as demonstrated by incidents where codes were intercepted by third-party companies, highlighting the ongoing risks with SMS 2FA.

Regulatory or Policy Developments

Microsoft announced that Microsoft 365 will soon block access to SharePoint, OneDrive, and Office files via legacy authentication protocols by default, affecting all tenants.
Meta added passkey login support to Facebook for Android and iOS, moving towards passwordless authentication standards.
OpenAI was awarded a $200 million contract to support the US Department of Defense with artificial intelligence for administrative process improvement.
Iran implemented internet blackouts amid ongoing conflict, driving citizens to less secure domestic apps and restricting access to external information.
Guidance for CISOs on AI governance and compliance with evolving regulations was highlighted, reflecting increased scrutiny of AI adoption and data protection requirements.

Asana on DanSec Daily

Cybersecurity Brief – 2025-08-29

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2025-06-19

Major Incidents and Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments