Askul on DanSec Daily

Cybersecurity Brief – 2025-12-17

Wed, 17 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Petróleos de Venezuela (PDVSA), Venezuela’s state-owned oil company, suffered a cyberattack that disrupted export operations over the weekend.
SoundCloud disclosed a data breach affecting approximately 20% of its users, with attackers accessing user data.
Askul, an e-commerce and logistics company, was targeted by the RansomHouse ransomware group in October, resulting in the compromise of 700,000 records.
A new report highlights that most “parked” domains-largely expired or unused domains-now serve malicious content, increasing risks from direct navigation.
Urban VPN Proxy, a popular Chrome extension with 8 million users, was found to be harvesting data from AI chatbot conversations, including ChatGPT, Claude, Gemini, and Copilot.
A security flaw at a photo booth operator’s website exposed hundreds of private customer photos online.

Newly Discovered Vulnerabilities

Two critical authentication bypass vulnerabilities in Fortinet FortiGate devices are under active exploitation, enabling unauthorised access to admin accounts and theft of configuration files.
The React2Shell vulnerability is being actively exploited to deploy Linux backdoors such as KSwapDoor and ZnDoor.
A vulnerability in JumpCloud Remote Assist allows attackers to write arbitrary data or delete files to gain System privileges.
Kaspersky researchers detailed a vulnerability in a vehicle’s head unit modem, which allowed full system access.
A malicious NuGet package, typosquatting the legitimate Tracer.Fody .NET library, was discovered stealing cryptocurrency wallet data.

Notable Threat Actor Activity

Amazon’s threat intelligence team reported a years-long Russian GRU campaign targeting Western critical infrastructure, particularly in the energy and cloud sectors, from 2021 to 2025. The campaign has shifted from exploiting vulnerabilities to leveraging misconfigured edge devices.
The Ink Dragon espionage group (also known as CL-STA-0049, Earth Alux) was profiled for its sustained and sophisticated offensive operations, including the use of relay networks.
An ongoing campaign is targeting AWS customers with compromised IAM credentials to conduct large-scale cryptocurrency mining.
The ‘GhostPoster’ campaign is distributing malicious Firefox extensions that hide JavaScript in addon logos to monitor activity and deploy backdoors, with over 50,000 downloads.
Cellik, a new Android malware-as-a-service (MaaS), is being marketed on underground forums with capabilities to embed in any app and build malicious versions from Google Play apps.
A phishing campaign targeting executives is using phony award offers to harvest credentials.
European law enforcement dismantled a Ukrainian call center fraud ring responsible for over €10 million in losses across Europe.

Trends, Tools, or Tactics of Interest

Ransomware groups are increasingly targeting hypervisors to encrypt multiple virtual machines simultaneously.
There is a surge in Android mobile adware and malware, particularly Triada and MobiDash, in late 2025.
Threat actors are increasingly exploiting third-party risks introduced by rapid adoption of open source and AI-powered coding assistants.
The majority of parked domains now serve malicious content, making direct navigation to such domains riskier.
Fortinet FortiGate vulnerabilities are being exploited within a week of public disclosure, indicating rapid weaponisation of new flaws.
AI-assisted coding platforms are accelerating software development, increasing the attack surface and third-party risks.
KnowBe4 released deepfake training modules to help organisations combat AI-driven threats.
Microsoft announced it will block Exchange Online access for mobile devices running outdated email software.
Amazon observed Russian state actors shifting tactics from exploiting vulnerabilities to abusing misconfigured infrastructure in critical sectors.

Regulatory or Policy Developments Affecting the Security Industry

The Texas Attorney General filed lawsuits against five major TV manufacturers, alleging illegal collection and sale of user viewing data without consent via Automated Content Recognition.
Afripol is intensifying regional cooperation to address cybercrime challenges amid rapid digitisation and increased cybercriminal activity in Africa.
Google announced it will discontinue its dark web monitoring report in early 2026.

Cybersecurity Brief – 2025-12-16

Tue, 16 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

SoundCloud confirmed a security breach resulting in the theft of a user database containing member data and subsequent disruption of VPN access for users.
Askul Corporation, a Japanese e-commerce company, disclosed that RansomHouse hackers stole approximately 740,000 customer records in an October ransomware attack.
PornHub is being extorted by the ShinyHunters gang following the theft of Premium member search and watch history data, reportedly accessed via a Mixpanel data breach.
700Credit, a U.S.-based financial services provider, reported a data breach impacting 5.8 million individuals, with stolen data including names, addresses, dates of birth, and Social Security numbers.

Newly Discovered Vulnerabilities

FreePBX patched multiple critical vulnerabilities, including an authentication bypass, SQL injection, and file upload flaws, all of which could enable remote code execution.
Atlassian released updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira to address a critical Apache Tika vulnerability.
Apple patched two actively exploited WebKit zero-days in macOS and iOS, which are linked to a previously patched Chrome flaw. The vulnerabilities were used in sophisticated attacks.
React2Shell (CVE-2025-55182) remote code execution vulnerability continues to be actively exploited, with new exploits surfacing.
Microsoft confirmed that December 2025 security updates are causing failures in Message Queuing (MSMQ) and breaking VPN networking for Windows Subsystem for Linux (WSL) users.

Notable Threat Actor Activity

Five additional Chinese threat groups have been linked by Google to ongoing exploitation of the React2Shell vulnerability for malware delivery. Iranian threat actors have also been observed leveraging the same flaw.
The ShadyPanda threat group was identified as responsible for a large-scale campaign hijacking popular Chrome and Edge browser extensions.
Phantom Stealer is being distributed via phishing emails with malicious ISO attachments, targeting various sectors in Russia.
The pro-Russia CyberVolk ransomware group’s VolkLocker variant was found to contain a flaw that allows victims to decrypt their files without paying ransom.
SantaStealer, a new information stealer malware offered as malware-as-a-service, is being promoted on Telegram and hacker forums, featuring in-memory operation to evade file-based detection.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly abusing free Cloudflare Pages to host phishing portals, aiding in evasion of security scanners.
Phishing trends in 2025 show a shift beyond email, with increased use of social platforms, search ads, and browser-based techniques to bypass multi-factor authentication and steal session tokens.
Deepfake attacks are becoming more realistic and compelling, raising concerns about their use in social engineering and disinformation.
Militant and extremist groups are experimenting with AI technologies, including propaganda and deepfakes, to expand their influence.
A Chrome browser extension with a “Featured” badge and six million users was discovered intercepting and collecting user prompts from AI chatbots.
PayPal closed a loophole that allowed scammers to send legitimate-looking emails from service@paypal.com, which were used to push tech support scams.
Pig butchering scams are being highlighted as a growing global crisis, involving large-scale, long-term social engineering fraud.

Regulatory or Policy Developments Affecting the Security Industry

Google announced the discontinuation of its dark web monitoring/report tool in early 2026, impacting users’ ability to monitor exposure of personal information on the dark web.
The French Ministry of the Interior confirmed a cyberattack that compromised its email servers.
Cyber insurance managing general agents (MGAs) are increasingly shaping policies to better reflect real-world cyber risk, with a focus on sector-specific expertise.
A third individual pleaded guilty in the U.S. for involvement in a credential stuffing attack against DraftKings, underlining ongoing law enforcement activity against cybercrime.

Cybersecurity Brief – 2025-10-21

Tue, 21 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

F5 disclosed a cyber attack, reportedly carried out by threat actors who maintained long-term, undetected access to internal systems.
Retailer Muji suspended online sales after a ransomware attack on its delivery partner, Askul, caused a logistics outage.
Envoy Air, an American Airlines subsidiary, confirmed a breach resulting in the theft of business information following an Oracle-related hack.
A European telecommunications organization was breached using Snappybee malware and a Citrix vulnerability, attributed to the China-linked Salt Typhoon group.
AWS suffered a significant outage, disrupting Amazon.com, Prime Video, Fortnite, Perplexity AI, Canva, and other major services for approximately two hours.
A phishing campaign impersonating Home Depot used fake giveaways and tracking pixels to lure victims and compromise data.
Over 75,000 WatchGuard Firebox security appliances remain exposed online and vulnerable to a critical remote code execution flaw (CVE-2025-9242).
131 malicious Chrome extensions, cloned from a WhatsApp Web automation tool, were used to hijack WhatsApp Web sessions and conduct large-scale spam campaigns, primarily targeting Brazilian users.
A self-propagating malware named GlassWorm targeted the OpenVSX and Visual Studio Code extension registries, infecting an estimated 36,000 developer systems and acting as a criminal proxy network.

Newly Discovered Vulnerabilities

U.S. CISA added five new exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, including flaws in Oracle and Microsoft products.
A high-severity Windows SMB privilege escalation vulnerability is now being actively exploited in the wild, allowing attackers to gain SYSTEM privileges on unpatched systems.
A critical flaw (CVE-2025-9242) in WatchGuard Firebox appliances remains unpatched in tens of thousands of devices, enabling remote code execution.
ConnectWise patched a critical vulnerability in its Automate RMM tool that could allow attackers to intercept and tamper with communications in certain configurations.
A vulnerability in Dolby Decoder on Android allows for zero-click attacks via out-of-bounds writes during media file processing.
Microsoft released fixes for Windows Server Active Directory sync issues and addressed smart card authentication problems caused by recent security updates.
October Windows security updates introduced issues with USB input devices (mice and keyboards) in the Windows Recovery Environment (WinRE).
Oracle E-Business Suite customers were exposed to risk due to conflicting vendor guidance on deploying a recent zero-day patch.

Notable Threat Actor Activity

The Russia-linked COLDRIVER (a.k.a. ColdRiver) group developed and deployed three new malware families, demonstrating increased operational tempo and rapid adaptation.
The China-linked Salt Typhoon group used Snappybee malware and a Citrix flaw to conduct cyber espionage against a European telecom operator.
The Lumma Stealer group saw a significant drop in activity after the core members’ identities were exposed in an underground doxxing campaign.
Chinese cybercriminal gangs utilized US SIM farms and money mules to run large-scale text message scams targeting Americans, generating over $1 billion in illicit proceeds.
Law enforcement dismantled a major SIM box criminal network in Europe, arresting seven individuals and disrupting a cybercrime-as-a-service platform responsible for €5 million in losses.

Trends, Tools, or Tactics of Interest

Long-term, stealthy breaches are increasingly common, as evidenced by the F5 incident and recent rootkit discoveries in Linux environments.
ClickFix and similar browser-based copy/paste attacks are a growing cause of security breaches, exploiting user interaction with malicious scripts.
Malicious OAuth applications are being used to infiltrate Microsoft 365 tenants; tools like Cazadora are being deployed to detect hidden rogue apps.
The GlassWorm malware campaign highlights the ongoing risk of supply-chain attacks against developer ecosystems, with self-spreading malware targeting code extension marketplaces.
SIM farms and SIM box infrastructure continue to enable cybercrime-as-a-service offerings, facilitating large-scale fraud and spam operations.
New microchip technology (“FD-SOI”) is being developed to protect vehicles from laser-based hardware attacks, with implications for regulatory compliance in the automotive sector.
BYOD risks are expanding to include vehicles, with researchers demonstrating that attacks on connected cars can potentially bridge to corporate networks via employee devices.

Regulatory or Policy Developments

The DNS0.EU non-profit public DNS service for European users announced an immediate shutdown due to sustainability issues, impacting privacy-focused DNS options in the region.
A U.S. judge ordered NSO Group to cease hacking WhatsApp but reduced damages from $167 million to $4 million.
South Korea is intensifying efforts to prosecute online scam suspects repatriated from Cambodia, responding to public pressure over overseas cybercrime.
Anthropic, in partnership with the U.S. government, introduced a filter to prevent its Claude AI from providing information relevant to nuclear weapon construction, reflecting ongoing policy attention to AI misuse.