Balancer on DanSec Daily

Cybersecurity Brief – 2025-11-07

Fri, 07 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The U.S. Congressional Budget Office (CBO) confirmed a cybersecurity incident attributed to a suspected foreign threat actor. Sensitive data may have been exposed.
SonicWall disclosed that a nation-state actor breached its cloud backup service, stealing firewall configuration files of all customers using the service. This incident is not connected to recent Akira ransomware activity.
Hyundai AutoEver America reported a data breach from February, with attackers stealing Social Security Numbers and other personal information.
The State of Nevada completed recovery from a ransomware attack that began as early as May 2025 and was discovered in August. The attack impacted 60 state agencies and disrupted critical health and public safety services.
The DeFi protocol Balancer began recovering funds after hackers exploited a vulnerability to steal $128 million in cryptocurrency.
New data revealed that UK water systems have been targeted by hackers five times since 2024, highlighting increased risks to critical infrastructure.

Newly Discovered Vulnerabilities

Cisco released patches for critical vulnerabilities in its Unified Contact Center Express (UCCX) software and Contact Center Appliance. The flaws (including CVE-2025-20333 and CVE-2025-20362) allow remote code execution and privilege escalation to root.
Multiple security vulnerabilities were identified in ChatGPT, including issues with memory and web search features. These bugs could allow data exfiltration, prompt injection, bypassing safety mechanisms, and other malicious actions.

Notable Threat Actor Activity

Russian state-backed group Sandworm deployed multiple data-wiping malware families in attacks targeting Ukraine’s education, government, and grain sectors.
A previously unknown threat cluster impersonated ESET in phishing campaigns against Ukrainian entities, distributing trojanized installers that deploy the Kalambur backdoor.
State-sponsored actors were responsible for the SonicWall cloud backup breach.
Phishing campaigns are actively targeting LastPass users with fake death notifications to gain account access, and Microsoft Help Desk-themed phishing emails continue to circulate.

Trends, Tools, or Tactics of Interest

A malicious Visual Studio Code (VS Code) extension with ransomware capabilities was discovered on the official marketplace. The extension, apparently created with AI assistance, can encrypt files on a victim’s system.
ClickFix malware attacks have evolved to include multi-OS support, video tutorials to guide victims through self-infection, countdown timers to pressure users, and automatic OS detection.
Android malware leveraging NFC technology is being used to steal card details and PINs for instant ATM withdrawals.
Deepfake and synthetic video technologies are increasingly being abused for fraud, requiring enhanced verification protocols.
Cybercrime is increasingly funding organized crime, with online scams supporting real-world criminal activities and violence-as-a-service models.
Continuous purple teaming and breach and attack simulation (BAS) are being promoted as effective ways to validate security controls and close detection gaps in enterprise environments.
Agentic AI tools are being integrated into attack chains, requiring stronger oversight, least privilege, and red-teaming to mitigate risks.

Regulatory or Policy Developments Affecting the Security Industry

Financial services are now subject to prescriptive regulatory requirements for cyber-resilience, moving beyond best practices to operational mandates.
New initiatives are being launched to increase transparency in social media advertising, aiming to address the proliferation of scam ads.
Increased focus on privacy controls, as evidenced by updates to consumer security products, reflects evolving regulatory and user expectations.

Cybersecurity Brief – 2025-11-06

Thu, 06 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall confirmed that state-sponsored threat actors were responsible for the September 2025 breach, which resulted in the exposure of customers’ firewall configuration backup files.
Hyundai AutoEver America reported a data breach in which attackers accessed sensitive personal information, including Social Security numbers and driver’s license details.
The University of Pennsylvania disclosed that a cyberattack led to the compromise and theft of data from internal systems related to development and alumni activities.
Nikkei, a major Japanese media company, suffered a breach via compromised Slack credentials, impacting approximately 17,000 employees and business partners.
International law enforcement dismantled three large credit card fraud and money laundering networks, linked to losses exceeding €300 million and affecting over 4.3 million cardholders.
Check Point Research detailed an incident where an attacker exploited a rounding error in Balancer V2’s ComposableStablePool, resulting in the theft of $128 million in cryptocurrency.

Newly Discovered Vulnerabilities

A critical remote command execution vulnerability in CentOS Web Panel (CWP) is being actively exploited, according to CISA.
A critical vulnerability in the Post SMTP WordPress plugin is under active attack, allowing full compromise of affected sites and unauthorized reading of emails, including password reset messages. Approximately 400,000 WordPress sites are affected.
Researchers disclosed new vulnerabilities in OpenAI’s ChatGPT that could enable attackers to steal personal information and confidential data.
Apple released patches addressing nearly 50 security flaws across iPhones, Macs, Safari, and other products, some of which could be used to compromise user data.
A zero-day vulnerability (CVE-2025-61932) in a popular endpoint manager was exploited by the APT group Bronze Butler to backdoor Japanese organizations.

Notable Threat Actor Activity

Google identified a previously unknown threat actor deploying VB Script malware dubbed PROMPTFLUX, which uses Gemini AI to rewrite its code every hour to evade detection.
Google’s Threat Intelligence Group reported a major shift toward adversaries leveraging artificial intelligence to create and deploy new malware families with large language model (LLM) integration, including malware that mutates during execution.
The Gootloader malware loader operation has resumed after a 7-month hiatus, again using SEO poisoning to distribute malicious payloads.
A new threat cluster, codenamed UNK_SmudgedSerpent, has targeted US academics and foreign policy experts amid Iran–Israel tensions, with attribution to Iranian threat actors suspected but unconfirmed.
The Aisuru botnet was observed dominating Cloudflare’s top requested domains list, indicating significant botnet activity.
The US Treasury Department imposed sanctions on two North Korean financial institutions and eight individuals, targeting entities involved in laundering stolen cryptocurrency and conducting fraudulent IT worker schemes.

Trends, Tools, or Tactics of Interest

Multiple sources, including Malwarebytes and Google, highlight a rapid increase in AI-driven extortion, phishing, and malware campaigns, with AI being used for code mutation, data collection, and evasion.
Verizon’s Mobile Security Index and other studies reaffirm that human error remains a leading factor in successful cyberattacks, particularly in mobile security incidents.
Gootloader’s return signals ongoing use of SEO poisoning as an effective method for malware distribution.
Attackers are increasingly targeting supply chain vulnerabilities, with concerns raised about a popular software update tool presenting risks comparable to the SolarWinds incident.
There is continued exploitation of operational technology (OT) environments in manufacturing, with inherent security risks persisting despite increased awareness.

Regulatory or Policy Developments Affecting the Security Industry

UK mobile carriers, in partnership with the government, have committed to network upgrades designed to block spoofed phone numbers, aiming to reduce scam and fraud incidents.
The US Treasury Department’s new sanctions against North Korean entities underscore ongoing international efforts to disrupt cyber-enabled financial crime and fraud.

Cybersecurity Brief – 2025-11-04

Tue, 04 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers stole over $120 million from the Balancer DeFi crypto protocol by targeting its v2 pools.
A major breach at the Kansas City, Kansas, Police Department exposed a list of alleged officer misconduct, including dishonesty, sexual harassment, excessive force, and false arrests.
Everest ransomware group claimed responsibility for recent attacks, according to Check Point’s latest threat intelligence report.

Newly Discovered Vulnerabilities

XWiki (CVE-2025-24893): Exploit attempts have been observed against XWiki’s SolrSearch component, which allows arbitrary remote code execution. A patch was released in February.
Google Chrome: Two high-severity vulnerabilities in the V8 JavaScript engine (type confusion and inappropriate implementation) were disclosed, with Google awarding $100,000 in bug bounties.
Microsoft WSUS: An out-of-band update to patch an actively exploited Windows Server Update Service vulnerability has disabled hotpatching on some Windows Server 2025 systems.

Notable Threat Actor Activity

Lazarus Group targeted Web3 entities, using advanced tools and rapid exploitation of new vulnerabilities.
North Korea-linked Kimsuky group deployed a new backdoor, HttpTroy, disguised as a VPN invoice in a likely spear-phishing attack in South Korea.
Chinese APTs used new ‘Airstalk’ malware (PowerShell and .NET variants) in supply chain attacks, abusing AirWatch’s MDM API for C2 communication.
Cybercriminals are increasingly targeting logistics and freight networks by deploying remote monitoring and management (RMM) tools to hijack cargo and steal physical shipments.
Three former US cybersecurity professionals were indicted for conducting BlackCat (ALPHV) ransomware attacks against five US companies.
Ukrainian national Yuriy Igorevich Rybtsov (aka MrICQ) was extradited to the US to face charges related to the Jabber Zeus cybercrime operation.

Trends, Tools, or Tactics of Interest

AI Poisoning: New research indicates attackers can more easily poison AI models by introducing malicious data, increasing the risk of models producing harmful outputs.
Abuse of AI APIs: Microsoft identified the ‘SesameOp’ backdoor, which uses the OpenAI Assistants API as a covert C2 channel. Additionally, Claude AI APIs can be abused for data exfiltration via prompt injection.
Malicious VSCode Extensions: The ‘SleepyDuck’ remote access trojan was found in a fake Solidity extension on the Open VSX registry, using an Ethereum smart contract for C2.
Android Malware: BankBot-YNRK and DeliveryRAT trojans are actively stealing financial data from Android users, with BankBot-YNRK reportedly muting device alerts and draining cryptocurrency wallets, primarily targeting Indonesia.
TruffleNet Attack: Attackers use frameworks based on TruffleHog to leverage stolen credentials for AWS account compromise, leading to reconnaissance and business email compromise (BEC).
Device Code Phishing: Attackers are exploiting OAuth device flows, with significant differences in attack surfaces between Azure and Google.
Fake AI Apps: There is an increase in fake ChatGPT and AI-related apps in app stores, some containing adware or spyware.
SOC Operations: Security Operations Centers are increasingly overwhelmed by alert volumes, leading to a shift toward continuous exposure management and automation.
Generative AI in Malware Analysis: Generative AI is being used to accelerate reverse engineering of malware such as XLoader.

Regulatory or Policy Developments

OpenAI Safety Panel: A panel led by Zico Kolter at OpenAI now has the authority to halt the release of new AI systems if deemed unsafe.
Electrical Grid Security: Regulators and industry experts are advocating for the convergence of cyber and physical security strategies for the power grid, reflecting increased attack activity on critical infrastructure.