Brother on DanSec Daily

Cybersecurity Brief – 2025-07-04

Fri, 04 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Spanish police dismantled an investment fraud ring responsible for over €10 million in losses, targeting victims through fraudulent investment schemes.
IdeaLab confirmed data was stolen during a ransomware attack in October 2024, with notifications being sent to affected individuals.
Microsoft is investigating ongoing intermittent access issues affecting SharePoint Online users.
Over 40 malicious Firefox browser extensions targeting cryptocurrency wallets have been discovered, designed to steal wallet secrets and user assets.

Newly Discovered Vulnerabilities

Grafana Labs released critical security updates for the Image Renderer plugin and Synthetic Monitoring Agent, addressing four Chromium vulnerabilities.
Brother printers have a critical security flaw related to default admin credentials; users are advised to change default passwords immediately.

Notable Threat Actor Activity

A major Android ad fraud operation, IconAds, involving 352 malicious apps, was disrupted. The apps loaded out-of-context ads and performed fraud at scale.
Chinese threat actors exploited Ivanti Connect Secure Appliance (CSA) zero-days in attacks against French government, telecommunications, media, finance, and transport sectors.
Hunters International Ransomware-as-a-Service operation has shut down and released free decryptors for its victims.
Dark web vendors are increasingly shifting to selling access to third-party and software supply chain services, with more data on critical infrastructure being advertised.
Attackers are using QR codes in phishing and malware campaigns, as observed by the Anti-Phishing Working Group.
Callback phishing campaigns are impersonating brands such as Microsoft, PayPal, and DocuSign, luring victims to call attacker-controlled numbers.

Trends, Tools, or Tactics of Interest

Malicious IDE extensions can bypass verification checks in popular integrated development environments, posing a hidden risk to the software supply chain.
There is a notable increase in attacks targeting software supply chains and third-party providers, as evidenced by trends on the dark web.
Weaknesses in AI-powered SOC tools have been highlighted, with concerns around reliance on limited training data and insufficient transparency in automated decision-making.
Southeast Asia remains a hotspot for cybercrime, with organizations in the region experiencing some of the highest cybersecurity risks globally, particularly from phishing.
Criminals are increasingly using QR codes as a vector for phishing and malware distribution.
Leaks suggest OpenAI is developing an Operator-like tool for ChatGPT ahead of the GPT-5 launch, potentially impacting conversational AI security.
xAI is preparing to launch Grok 4, a new state-of-the-art AI model intended to compete with Claude and Gemini.

Regulatory or Policy Developments

Microsoft announced the general availability of Exchange Server Subscription Edition (SE) for enterprise customers.
Deloitte released a new cyber blueprint aimed at guiding organizations on AI adoption and preparedness.
The U.S. Treasury’s sanctions against a Chinese national operating a cloud provider linked to virtual currency scams have seen mixed compliance from major technology firms.

Cybersecurity Brief – 2025-07-01

Tue, 01 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Switzerland’s government reported that sensitive data from multiple federal offices was compromised following a ransomware attack on the third-party provider Radix.
Europol, in coordination with Spanish authorities, dismantled a cryptocurrency investment fraud ring responsible for laundering approximately $540 million (€460 million) from over 5,000 victims. Five suspects were arrested.
Over 1,200 Citrix NetScaler ADC and NetScaler Gateway servers remain unpatched against a critical authentication bypass vulnerability, which is reportedly being actively exploited.
The hacker collective Scattered Spider continues its campaign targeting the airline sector, with Microsoft designating the group as a significant cyber threat.
The FBI disclosed that cybercriminals are impersonating health fraud investigators to steal sensitive health information from US citizens.
The US Justice Department revealed that the identities of more than 80 Americans were stolen to facilitate North Korean IT worker scams, with action taken against associated “laptop farms.”
A government report indicated that a hacker was hired by the Sinaloa drug cartel to identify and target individuals connected to the FBI’s investigation, leading to fatal outcomes.

Newly Discovered Vulnerabilities

Vulnerabilities in Airoha Bluetooth chips, used in Sony and Bose earbuds and headphones, could allow attackers to hijack both the audio devices and any connected host systems. Details of the vulnerabilities have not yet been published.
Some Brother printers are affected by a critical security flaw that can be mitigated by changing the default admin password.
Microsoft warned of delays in the delivery of June 2025 Windows security updates due to an incorrect metadata timestamp.

Notable Threat Actor Activity

US agencies (CISA, FBI, NSA, DC3) issued a joint advisory regarding increased Iranian state-sponsored cyber activity targeting US defense, operational technology (OT) networks, and critical infrastructure.
Blind Eagle, a known threat actor, has been linked to the use of the Russian bulletproof hosting service Proton66 for phishing campaigns and remote access trojan (RAT) deployment targeting Colombian banks.
Ongoing AI-themed SEO poisoning attacks are distributing Lumma and Vidar infostealers and other malware via malicious websites optimized for AI-related search terms.

Trends, Tools, or Tactics of Interest

Microsoft Defender for Office 365 now automatically detects and blocks email bombing attacks.
Identity-based attacks, including impersonation and credential theft, continue to rise in frequency and sophistication.
Attackers are increasingly leveraging legitimate system functionality and user credentials, often exploiting “by design” behaviors rather than technical flaws.

Regulatory or Policy Developments Affecting the Security Industry

The Canadian government ordered Hikvision Canada to cease all operations due to national security concerns, though individuals and private businesses may still purchase Hikvision products.
The Berlin Data Protection Commissioner formally requested Google and Apple to remove the DeepSeek AI application from their app stores for GDPR violations.
Microsoft announced it will remove password management functionality from its Authenticator app starting August 1, 2025, as part of a shift towards passkey-based authentication.
Proposed US legislation aims to reduce federal AI funding for states that enact AI regulations, with exemptions for laws addressing unfair practices and child sexual abuse material.

Cybersecurity Brief – 2025-06-27

Fri, 27 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

United Natural Foods Inc. (UNFI), a major supplier to Whole Foods, has restored its core systems and electronic ordering/invoicing platforms after a cyberattack. Details of the attack vector or threat actor have not been disclosed.
Hawaiian Airlines reported a cyberattack that disrupted access to some systems. Flight operations were not affected. The investigation is ongoing.
The U.S. Department of Justice charged a British national, alleged to be the threat actor “IntelBroker,” in connection with several high-profile breaches.
New South Wales Police arrested a former Western Sydney University student accused of repeatedly hacking university systems for personal gain, including manipulating parking and accessing data.
A Kansas City man pleaded guilty to hacking multiple organizations to promote his own cybersecurity services.
AT&T has agreed to a $177 million settlement following a data breach that resulted in customer information being leaked and sold on the dark web.
The “Cyber Fattah” hacktivist group leaked data from Saudi Games, amid increased hacktivist activity linked to regional tensions.

Newly Discovered Vulnerabilities

Researchers disclosed a critical vulnerability in the Open VSX Registry (“open-vsx[.]org”) that could allow attackers to take control of the registry and conduct supply chain attacks affecting millions of developers.
Cisco released updates to address two maximum-severity unauthenticated remote code execution vulnerabilities in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), which could allow attackers to gain root access.
CISA reported active exploitation of a maximum severity vulnerability in AMI MegaRAC Baseboard Management Controller (BMC) software, enabling server hijacking and potential bricking of affected systems.
A bug affecting 689 Brother printer models (and 53 models from other manufacturers) exposes default administrator passwords that can be generated remotely, putting devices at risk of unauthorized access.

Notable Threat Actor Activity

Iranian state-sponsored group APT35 (linked to the IRGC) is conducting spear-phishing campaigns targeting Israeli journalists, cybersecurity experts, and tech professionals using AI-powered phishing techniques.
Cybercriminals are exploiting open-source and publicly available tools to target financial institutions across Africa in attacks ongoing since at least July 2023.
Scattered Spider, a well-known threat actor, has shifted its targeting from global retailers to U.S.-based insurance firms, employing advanced TTPs.
Researchers observed a significant increase (517%) in ClickFix social engineering attacks using fake CAPTCHA verifications as an initial access vector. A new related method, FileFix, has emerged.
Ongoing phishing campaigns are abusing Microsoft 365’s “Direct Send” feature to send phishing emails as internal users, bypassing standard email security controls.
Bitdefender reported a surge in social engineering attacks targeting WhatsApp users, aiming to compromise accounts through various scam tactics.
New Trojan malware is targeting sensitive information stored in mobile device screenshots, including cryptocurrency wallet seed phrases.

Trends, Tools, or Tactics of Interest

Use of open-source and commodity tools by cybercriminals for targeting financial institutions is increasing, particularly in Africa.
Fake CAPTCHA (ClickFix) and document-based (FileFix) social engineering tactics are on the rise as initial access methods.
Abuse of Microsoft 365’s “Direct Send” feature is being used to bypass detection and facilitate internal phishing.
AI-powered phishing is being adopted by state-sponsored actors, as seen in APT35’s recent campaigns.
SaaS adoption continues to outpace the development of effective data resilience and security controls, increasing organizational risk.

Regulatory or Policy Developments

The U.S. Federal Trade Commission (FTC) approved $126 million in refunds to Fortnite users as part of a settlement over the use of “dark patterns” by Epic Games to induce unwanted purchases.
Microsoft has rolled out changes to Windows security architecture aimed at preventing outages similar to the 2024 CrowdStrike incident, improving system resilience and recovery.
AT&T’s $177 million settlement over a major data breach establishes compensation for affected users whose personal data was leaked.

Cybersecurity Brief – 2025-06-26

Thu, 26 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Citrix NetScaler ADC Vulnerability (CVE-2025-6543): Citrix released emergency patches for a critical vulnerability in NetScaler ADC appliances, which has been actively exploited in the wild for denial of service and session hijacking attacks. The flaw, dubbed “CitrixBleed 2,” allows unauthenticated attackers to steal authentication tokens and disrupt services.
SonicWall NetExtender Trojan: Unknown threat actors have distributed a trojanized version of SonicWall’s NetExtender SSL VPN client, enabling credential theft from users who install the compromised application.
Pro-Iranian Hacktivist Data Leak: The Cyber Fattah group, aligned with Iranian interests, leaked thousands of personal records related to athletes and visitors of the 2024 Saudi Games.
BreachForums Operator Arrests: French authorities reportedly arrested five operators of the BreachForums cybercrime forum, which facilitated the trade and exposure of stolen data.
‘IntelBroker’ Charged: A British national known as “IntelBroker” has been charged in the US for stealing and selling sensitive data from global victims, causing $25 million in damages.

Newly Discovered Vulnerabilities

Citrix NetScaler ADC (CVE-2025-6543, “CitrixBleed 2”): Critical vulnerability allowing token theft, session hijacking, and denial of service. Actively exploited prior to patch release.
SAP GUI for Windows and Java: Two vulnerabilities, now patched, could have allowed attackers to access sensitive user data via exploitation of the input history feature.
WinRAR (CVE-2025-6218): Directory traversal vulnerability allowing malware execution from specially crafted archives upon extraction.
Brother Printers: Multiple vulnerabilities, including a critical unpatchable flaw (CVSS 9.8) that enables attackers to generate default admin passwords on hundreds of models.
Microsoft Entra ID (nOAuth): A known vulnerability in Entra ID still affects 9% of SaaS apps two years after discovery, risking account takeovers. Additional research highlights risks related to guest user invitation and access control gaps.

Notable Threat Actor Activity

North Korean Supply Chain Attacks: The “Contagious Interview” campaign linked to North Korea continues, with 35 new malicious npm packages targeting developers and job seekers. Packages deliver infostealers and backdoors.
Charming Kitten (Iran): This Iran-sponsored APT has targeted Israeli cybersecurity experts with spear-phishing campaigns.
Dire Wolf Ransomware: An emerging ransomware group has compromised 16 organizations in technology and manufacturing sectors across 11 countries since May, employing double extortion tactics.
Abuse of ConnectWise ScreenConnect: Threat actors are modifying the Authenticode signature of ScreenConnect installers to create signed remote access malware.
OneClik Campaign: Attackers are leveraging Microsoft’s ClickOnce deployment tool and AWS infrastructure to deliver custom Golang backdoors, targeting the energy sector.

Trends, Tools, or Tactics of Interest

Social Engineering: Europol reports that social engineering remains a leading initial access vector for cybercriminals.
AI and Collaboration Tool Abuse: Kaspersky’s SMB threat report highlights increasing targeting of small and medium businesses through AI-powered scams, phishing, and malware, particularly via collaboration platforms.
Generative AI in Supply Chain Attacks: Malicious actors are leveraging AI-generated software components to compromise software supply chains.
Remote Access Tool Abuse: Both SonicWall NetExtender and ConnectWise ScreenConnect have been abused for distributing malware and credential theft.
AI Evasion Tactics: Researchers identified a rudimentary malware (“Skynet”) that attempts to instruct AI-based security tools to ignore it, suggesting early stages of adversarial AI evasion.
Open MCP Servers: Hundreds of MCP servers exposing AI models are vulnerable to abuse and remote code execution.
Security Features in Consumer Products: Avast has integrated AI-powered scam detection into its antivirus products; WhatsApp and Ring have added AI features for message and video summarization; Android 16 introduces new security features requiring user activation.

Regulatory or Policy Developments

CISA Downsizing: Reports note reductions in staffing and resources at the US Cybersecurity and Infrastructure Security Agency (CISA), with potential implications for the broader cybersecurity landscape.