Cybersecurity Brief – 2025-09-25

Thu, 25 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Boyd Gaming reported a data breach affecting employees and other individuals, as disclosed to the SEC.
A US Federal Civilian Executive Branch (FCEB) agency was breached via exploitation of a critical GeoServer vulnerability (CVE-2024-36401); attackers deployed China Chopper and remote access scripts and remained undetected for three weeks.
European airports experienced widespread disruptions due to a ransomware attack linked to the RTX group; the UK National Crime Agency arrested a suspect in connection with the incident. The attack on Collins Aerospace is believed to have involved HardBit ransomware.
Interpol-led law enforcement seized over $439 million in cash and cryptocurrency from cybercrime rings worldwide during a five-month joint operation.
A record-breaking DDoS attack peaked at 22 Tbps and 10 billion packets per second (Bpps), targeting a European network infrastructure company and linked to the Aisuru botnet.
The Python Package Index (PyPI) urged users to reset credentials following a new wave of phishing attacks using a fake PyPI website.
GitHub users were targeted in a large-scale phishing campaign impersonating Y Combinator via GitHub notifications, delivering cryptocurrency drainers.
KNP Logistics Group, a 158-year-old business, collapsed following a cyber incident attributed to poor password security.

Newly Discovered Vulnerabilities

Cisco disclosed a high-severity, actively exploited SNMP vulnerability in IOS and IOS XE Software allowing remote code execution or denial-of-service; patches have been released.
Two critical vulnerabilities were identified in Wondershare RepairIt, exposing private user data and enabling potential tampering with AI models.
Supermicro hardware was found to have two firmware vulnerabilities in its Baseboard Management Controller (BMC), which could allow attackers to create persistent backdoors by updating systems with malicious images.
A flaw in multiple OnePlus OxygenOS versions allows installed apps to access SMS data and metadata without permissions or user interaction; the issue remains unpatched.
Ongoing exploit attempts have been observed against an older Hikvision camera vulnerability.
SonicWall SMA devices were targeted with the ‘OVERSTEP’ backdoor; SonicWall released updates for SMA 100 appliances to remove the malware and improve file checks.

Notable Threat Actor Activity

Suspected Chinese threat actors (RedNovember) have been targeting global government and private sector organizations using Pantegana and Cobalt Strike.
UNC5221, believed to be China-nexus, used the BRICKSTORM backdoor to infiltrate US legal, SaaS, BPO, and technology sectors; Google reports the malware has been used for over a year for data theft and persistent espionage.
UNC6148 deployed the OVERSTEP backdoor in ongoing attacks against SonicWall SMA devices, enabling system control, credential theft, and evasion.
A new malware family, YiBackdoor, was discovered with significant code overlap with IcedID and Latrodectus, suggesting shared development or tool reuse.
A new ransomware variant, Obscura, was observed spreading from a victim’s domain controller.
Scattered Spider: A core member surrendered to authorities amid claims of the group’s shutdown; US prosecutors charged a UK national, linking the group to $115 million in ransomware payments.
Russian threat actors conducted a disinformation campaign targeting the upcoming Moldovan elections, linked to previous 2022 operations.
An npm package was found to use steganography (QR codes) to hide a credential-stealing malware, posing a supply chain risk.

Trends, Tools, or Tactics of Interest

Attackers are exploiting payment iframe security weaknesses to deploy malicious overlays on checkout pages, facilitating credit card data theft.
Burp Suite introduced Burp AI, providing on-demand AI assistance for penetration testing workflows.
AI pentesting is emerging, with new agentic capabilities being integrated into security tools.
Kali Linux 2025.3 was released, featuring ten new tools, Nexmon support, and NetHunter improvements.
OpenAI is internally testing a new GPT-5-based AI agent, “GPT-Alpha”.
Police forces are increasingly using drones equipped with license plate recognition technology.
GitHub is implementing enhanced security measures for npm supply chain protection, including mandatory 2FA, short-lived granular tokens, and trusted publishing workflows.

Regulatory or Policy Developments Affecting the Security Industry

GitHub announced new security requirements for npm package publishing, including mandatory two-factor authentication, expiring granular tokens, and trusted publishing, in response to recent supply chain attacks.

Cybersecurity Brief – 2025-09-24

Wed, 24 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Boyd Gaming Corporation disclosed a data breach following a cyberattack, resulting in the theft of employee and customer data.
Jaguar Land Rover extended its production shutdown due to a cyberattack, with operations paused until at least October 1 as investigations continue.
The American Archive of Public Broadcasting exposed restricted and copyrighted media for years due to inadequate access controls, allowing unauthorised downloads.
CISA reported that attackers breached a US federal agency’s network by exploiting an unpatched GeoServer instance.
The US Secret Service dismantled a major telecom threat in New York, seizing over 300 servers and 100,000 SIM cards used to threaten US officials and potentially disrupt critical infrastructure near the UN.
Eurojust coordinated the arrest of five suspects in a cryptocurrency investment fraud scheme, responsible for over €100 million in losses across 23 countries.
Fake versions of Malwarebytes, LastPass, and other software are being distributed via GitHub pages in a campaign targeting Mac users.
Scammers are impersonating the FBI using fake IC3 websites to steal personal data.

Newly Discovered Vulnerabilities

Pandoc (CVE-2025-51591): Actively exploited security flaw in Linux utility Pandoc allowed attackers to target AWS Instance Metadata Service (IMDS) and steal EC2 IAM credentials.
Libraesva Email Security Gateway (CVE-2025-59689): Command injection vulnerability exploited by state-sponsored actors, triggered via malicious emails with crafted compressed attachments. Emergency fix released.
Supermicro BMC Firmware: Two new vulnerabilities allow attackers to bypass root of trust security, enabling malicious firmware installation. Previous patches have been bypassed.
SolarWinds Web Help Desk (CVE-2025-26399): Critical unauthenticated remote code execution vulnerability. Multiple patch attempts have been made due to previous bypasses.
Microsoft Entra: Research revealed all tenants were exposed to silent compromise via invisible actor tokens.
NPM package ‘fezbox’: Newly discovered package uses QR codes to deliver second-stage, cookie-stealing malware.
SonicWall SMA 100: Firmware update released to remove rootkit malware deployed in recent attacks.

Notable Threat Actor Activity

State-sponsored actors exploited the Libraesva Email Security Gateway vulnerability in the wild.
ShadowV2 botnet operators are exploiting misconfigured AWS Docker containers to build a DDoS-for-hire platform, enabling customers to self-manage attacks.
Chinese-speaking threat actors are conducting SEO poisoning campaigns using BadIIS malware, redirecting traffic and planting web shells on compromised servers.
Scattered Spider: A juvenile suspect associated with this group was arrested in the US on charges of computer intrusion, extortion, and identity theft.
Attackers abused Google’s AppSheet platform to send phishing emails.
Large-scale campaign distributing fake software (Malwarebytes, LastPass, etc.) via GitHub targets Mac users.

Trends, Tools, or Tactics of Interest

DDoS Attacks: Cloudflare mitigated a record-breaking DDoS attack peaking at 22.2 Tbps and 10.6 billion packets per second. ShadowV2 and other botnets are leveraging exposed cloud-native tools (Docker containers) to evade detection and facilitate for-hire DDoS services.
Supply Chain Attacks: Surge in attacks targeting the npm ecosystem, including malicious packages and weak authentication mechanisms.
Ransomware: Despite rising incident counts in 2025, ransomware payments dropped 35% in 2024, indicating changes in RaaS economics.
Phishing: Abuse of legitimate platforms (Google AppSheet) for phishing campaigns continues.
SEO Poisoning: Increased use of SEO poisoning by threat actors to distribute malware and gain financial benefits.
Identity Governance: New free tools are emerging to streamline identity governance, onboarding, and access reviews for small organisations.
AI Security: New research highlights the top 25 vulnerabilities in Model Context Protocols, with risks including prompt injection and command injection targeting AI agents.

Regulatory or Policy Developments

GitHub announced mandatory two-factor authentication and short-lived access tokens for npm publishing, aiming to strengthen supply chain security following recent attacks.
European law enforcement, coordinated by Eurojust, continues cross-border efforts against large-scale cryptocurrency fraud.
CISA announced Steve Casapulla as Executive Assistant Director for Infrastructure Security.
Reports highlight ongoing concerns about the Japanese government’s cybersecurity posture, with incident counts nearly doubling and a significant proportion of critical systems unmanaged.
New revelations show the US Department of Homeland Security collected DNA from nearly 2,000 US citizens, raising oversight and legality concerns.

Boyd Gaming on DanSec Daily

Cybersecurity Brief – 2025-09-25

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-09-24

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments