https://blog.dansec.red/vendors/bouygues/Recent content in Bouygues on DanSec DailyHugoen-gbSat, 09 Aug 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-08-09-cybersecurity-news/Sat, 09 Aug 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-08-09-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Columbia University suffered a significant data breach impacting nearly 870,000 individuals, including students, applicants, and employees. Stolen data includes personal, financial, and health information.</li> <li>French telecom provider Bouygues disclosed a breach affecting 6.4 million customers, with personal information compromised.</li> <li>Allianz Life reported a cybersecurity incident exposing personal information of hundreds of thousands of individuals.</li> <li>The U.S. Federal Judiciary confirmed a cyberattack on its electronic case management systems, impacting confidential court documents.</li> <li>Royal and BlackSuit ransomware operations breached over 450 U.S. companies before their infrastructure was dismantled, according to the U.S. Department of Homeland Security.</li> <li>FTC reported that Americans aged 60 and older lost a record $700 million to online scams in 2024, indicating a sharp increase in fraud targeting seniors.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Over a dozen vulnerabilities were identified in enterprise secure vaults from CyberArk and HashiCorp, enabling potential remote takeover without credentials if exploited.</li> <li>A WinRAR vulnerability (CVE-2025-8088) was exploited as a zero-day in phishing attacks to install RomCom malware.</li> <li>Security researchers found two techniques to crack at least eight brands of electronic safes using Securam Prologic locks, allowing unauthorized access within seconds.</li> <li>A misconfiguration in corporate livestreaming platforms’ APIs was discovered, potentially exposing internal company meetings.</li> <li>A feature in stream-oriented UNIX domain sockets (MSG_OOB) was leveraged to escalate privileges from Chrome renderer code execution to Linux kernel code execution.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The Efimer Trojan is being mass-mailed via email and hacked WordPress sites to steal cryptocurrency by substituting clipboard wallet addresses, with over 5,000 victims reported.</li> <li>A campaign dubbed GreedyBear used over 150 malicious Firefox extensions impersonating popular crypto wallets to steal more than $1 million in cryptocurrency.</li> <li>60 new malicious packages were found on RubyGems, targeting credential and crypto theft. Similar activity was reported on PyPI, leading to changes in security practices for these software repositories.</li> <li>AI-powered website builders (DeepSite AI, BlackBox AI) are being leveraged in Brazilian phishing scams to create convincing malicious sites.</li> <li>Data from an APT actor, believed to be affiliated with China or North Korea, was leaked, revealing details on recent campaigns, attacker tools, compromised credentials, and command files.</li> <li>Scattered Spider threat actor has been targeting help desks and identity systems, exploiting social engineering to bypass traditional security perimeters.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Leaked credentials incidents increased by 160%, with attackers using them for a range of malicious activities beyond immediate compromise.</li> <li>Attackers are increasingly targeting the foundations of cryptocurrency, including smart contracts, through both scams and exploitation of vulnerabilities.</li> <li>Red teams demonstrated that GPT-5’s prompt-level filters can be easily bypassed using multi-turn “storytelling” attacks, raising concerns about the model’s enterprise security.</li> <li>Shadow AI and rogue AI models are being identified as new risks, with tools like BigID’s Shadow AI Discovery launched to uncover such instances.</li> <li>There is a notable drop in ransomware attacks in Q2, with reported incidents falling by nearly half.</li> <li>Security flaws in IoT devices, such as school bathroom vape detectors, can enable covert audio surveillance due to embedded microphones and insecure configurations.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>Microsoft 365 apps for Windows will block file access via the insecure FPRPC legacy authentication protocol by default from late August.</li> <li>Microsoft will retire the Lens PDF scanner app for iOS and Android as of September 15, 2025.</li> <li>The U.S. Judiciary is implementing enhanced cybersecurity measures following the breach of its electronic case management systems.</li> <li>Software repositories RubyGems and PyPI are enforcing new security measures in response to the discovery of malicious packages.</li> <li>Ex-NSA chief Paul Nakasone indicated at Defcon that major policy changes for the tech community may be forthcoming.</li> </ul>https://blog.dansec.red/posts/2025-08-08-cybersecurity-news/Fri, 08 Aug 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-08-08-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Bouygues Telecom confirmed a data breach affecting 6.4 million customers, exposing personal information.</li> <li>Air France and KLM disclosed a breach via a third-party customer service platform, compromising customer names, email addresses, phone numbers, and other non-financial data.</li> <li>Chanel notified clients of a third-party breach impacting customer data, joining other luxury brands affected by similar incidents.</li> <li>Google, Adidas, and other organisations suffered breaches after employees were tricked via phone calls into granting access to Salesforce data, attributed to ShinyHunters.</li> <li>Mozilla’s Firefox add-on store was targeted by the “GreedyBear” campaign, which uploaded 150 malicious extensions that drained cryptocurrency wallets, stealing an estimated $1 million.</li> <li>TeaOnHer, a dating advice app, was found leaking user personal data.</li> <li>Recent ransomware attacks against SonicWall Gen 7 firewalls with SSL VPN enabled were linked to exploitation of an older, patched vulnerability, not a zero-day.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Microsoft disclosed CVE-2025-53786, a high-severity privilege escalation flaw in on-premise Exchange Server hybrid deployments, allowing attackers to gain elevated privileges in Exchange Online. Both Microsoft and CISA have issued advisories; CISA mandated emergency patching for US federal agencies.</li> <li>Security flaws were reported in Axis Communications video surveillance products, exposing over 6,500 servers to potential remote takeover.</li> <li>Researchers discovered a privilege escalation issue in Amazon ECS, allowing IAM hijacking and cross-resource access via an undocumented protocol.</li> <li>New HTTP request smuggling/desync attacks exploiting HTTP/1.1 vulnerabilities impacted major CDNs and millions of websites.</li> <li>Two malicious npm packages masquerading as WhatsApp developer tools were discovered, containing destructive data-wiping code targeting developer systems.</li> <li>Researchers found that encryption algorithms used in law enforcement and military radios may be easily cracked, potentially allowing eavesdropping.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>SocGholish malware operators are utilising Traffic Distribution Systems (Parrot TDS, Keitaro TDS) to redirect users to malicious content, delivering access to ransomware groups including LockBit and Evil Corp.</li> <li>ShinyHunters resurfaced, conducting low-tech social engineering attacks to breach Salesforce data at major corporations.</li> <li>The Silver Fox APT group demonstrated operations blending espionage and cybercrime, attributed to Chinese threat actors.</li> <li>North Korean IT scammers’ operational details were leaked, revealing structured targeting and internal surveillance.</li> <li>Eight ransomware groups, including RansomHub, have adopted a new EDR killer tool, an evolution of EDRKillShifter, to disable endpoint detection and response solutions during attacks.</li> <li>Akira ransomware attacks targeting SonicWall firewalls exploited a known vulnerability, not a zero-day.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>The FBI warned of attackers sending physical packages containing malicious QR codes (“quishing”) to initiate phishing campaigns via postal mail.</li> <li>Surge in vishing scams, where attackers impersonate service providers offering discounts in exchange for upfront fees.</li> <li>Rise in Python and Go supply chain attacks, with malicious packages discovered that deliver cross-platform malware and trigger remote data wipes.</li> <li>Increased use of AI in both offensive and defensive cloud security operations, with AI now central to evolving attack and defence strategies.</li> <li>150+ malicious Firefox extensions highlight the ongoing risk in browser extension ecosystems.</li> <li>Clickjacking campaigns on adult sites are being used to manipulate Facebook user engagement.</li> <li>EDR killer tools are being actively distributed across multiple ransomware operations for disabling security controls.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>CISA issued an emergency directive requiring all US Federal Civilian Executive Branch agencies to patch Microsoft Exchange Server CVE-2025-53786 by Monday.</li> <li>The founders of Samourai Wallet pleaded guilty to laundering over $200 million for cybercriminals and agreed to forfeit the proceeds.</li> <li>A court found Meta accessed sensitive health data from the Flo app without user consent.</li> <li>The Alliance for Creativity and Entertainment (ACE) took offline Rare Breed TV, a major illegal IPTV service, following a financial settlement.</li> </ul>