Cybersecurity Brief – 2025-05-29

Thu, 29 May 2025 00:00:00 +0000

Major Incidents or Breaches

Over 100,000 WordPress sites are at risk due to a critical, unpatched vulnerability (CVSS 10.0) in the TI WooCommerce Wishlist plugin, allowing unauthenticated attackers to upload arbitrary files.
Over 9,000 ASUS routers have been compromised by the “AyySSHush” botnet, which adds a persistent SSH backdoor. The botnet also targets SOHO routers from Cisco, D-Link, and Linksys.
Cellcom experienced a cyberattack impacting regional mobile services in Wisconsin and Michigan, with outages lasting nearly a week and continued intermittent service.
A financially motivated threat actor known as “Mimo” has exploited CVE-2025-32432 (RCE) in Craft CMS to deploy cryptominers and proxyware payloads.
The Interlock ransomware gang has deployed a new remote access trojan (NodeSnake RAT) against universities, enabling persistent access to networks.
The “Dark Partner” cybercrime group is conducting large-scale cryptocurrency theft through a network of fake AI, VPN, and crypto software download sites.
Researchers observed 251 Amazon-hosted IPs used in coordinated exploit scans targeting ColdFusion, Apache Struts, and Elasticsearch exposure points.

Newly Discovered Vulnerabilities

A critical unpatched vulnerability in the TI WooCommerce Wishlist WordPress plugin (CVSS 10.0) allows unauthenticated file uploads, exposing over 100,000 sites.
A security flaw in Microsoft OneDrive File Picker allows web applications to access a user’s entire cloud storage content, not just the files selected for upload.
CVE-2025-32432, a recently disclosed remote code execution vulnerability in Craft CMS, is being actively exploited.

Notable Threat Actor Activity

The Chinese APT31 group was formally attributed by the Czech Republic for cyberattacks against the Ministry of Foreign Affairs and critical infrastructure in 2022.
APT41 (China-linked) is using new malware (“ToughProgress”) that leverages Google Calendar for stealthy command-and-control communications.
The Iranian national Sina Gholinejad pleaded guilty in the US for involvement in the Robbinhood ransomware attack on Baltimore, part of a $19 million international extortion scheme.
Pakistan authorities arrested 21 individuals associated with the “Heartsender” malware and spam dissemination service, which operated for over a decade.
The newly identified PumaBot botnet, written in Go, is targeting Linux-based IoT devices by brute-forcing SSH credentials to deploy cryptominers and facilitate further attacks.
The Interlock ransomware group is using the NodeSnake RAT to maintain persistent access to university networks.

Trends, Tools, or Tactics of Interest

Stealer malware campaigns are increasingly focused on capturing live sessions and moving rapidly to account takeover, rather than just stealing static credentials.
“Browser-in-the-Middle” attacks are being used to hijack user sessions in seconds, bypassing traditional credential theft methods.
Alternate Data Streams are highlighted as a defense evasion technique for adversaries, with detection guidance provided.
The “Dark Partner” group utilises fake software download sites to distribute malware and facilitate cryptocurrency theft.
The evolution of the Zanubis Android banking trojan includes the adoption of RC4 and AES encryption, expanded credential theft capabilities, and new targeting in Peru.
PumaBot and AyySSHush botnets demonstrate ongoing targeting of IoT and SOHO network devices, focusing on SSH brute-forcing and persistent backdoor installation.

Regulatory or Policy Developments Affecting the Security Industry

The Czech Republic publicly attributed the 2022 Ministry of Foreign Affairs cyberattack to China-linked APT31, marking a formal diplomatic accusation.
Microsoft introduced a new update orchestration platform for Windows, aiming to unify software, driver, and system component updates.
Microsoft launched Windows Backup for Organizations, designed to streamline enterprise backup and migration processes.
Apple reported blocking over $9 billion in fraudulent App Store transactions since 2020, with $2 billion prevented in 2024.
Zscaler announced an agreement to acquire Red Canary, aiming to integrate threat detection and AI-powered security operations capabilities.

Cybersecurity Brief – 2025-05-21

Wed, 21 May 2025 00:00:00 +0000

Major Incidents or Breaches

Cellcom Cyberattack: Wisconsin-based mobile carrier Cellcom confirmed a cyberattack caused widespread service outages beginning 14 May 2025.
SK Telecom Data Breach: SK Telecom disclosed a malware breach lasting three years (since 2022), exposing USIM data of 27 million subscribers.
RVTools Supply Chain Attack: The official website for RVTools, a VMware management utility, was compromised in a supply chain attack. Trojanized installers delivered the Bumblebee malware loader.
PowerSchool Extortion: A 19-year-old has pleaded guilty to a cyberattack on PowerSchool, involving extortion and exposure of student data.
KrebsOnSecurity DDoS Attack: KrebsOnSecurity experienced a near-record DDoS attack peaking at 6.3 Tbps.

Newly Discovered Vulnerabilities

WordPress ‘Motors’ Theme: A critical privilege escalation vulnerability allows unauthenticated attackers to take over admin accounts on sites using the premium Motors theme.
Virgin Media O2 Location Leak: A security flaw in Virgin Media O2’s mobile network could allow attackers to pinpoint call recipient locations within 100 square meters.
AWS Default IAM Roles: Researchers identified risky default IAM roles in AWS that can enable lateral movement and cross-service exploitation if misconfigured.

Notable Threat Actor Activity

Hazy Hawk: This group has been actively hijacking abandoned cloud resources (e.g., S3 buckets, Azure endpoints) via DNS misconfigurations and CNAME hijacking, targeting high-profile organizations including the US CDC, to deliver malware and conduct scams.
Scattered Spider: The group continues to target large retailers, shifting focus from UK to US organizations, leveraging IT help desk social engineering for initial access.
SideWinder APT: Targeted ministries in Sri Lanka, Bangladesh, and Pakistan using spear phishing, exploiting old Microsoft Office vulnerabilities, and deploying custom malware.
UnsolicitedBooker (China-aligned): Deployed the new MarsSnake backdoor in a multi-year campaign against a Saudi Arabian organization.
RedisRaider: A new Go-based cryptojacking campaign targets publicly accessible Redis servers to deploy XMRig miners.
VanHelsing Ransomware: The ransomware builder, affiliate panel, and data leak blog source code were leaked online, increasing the risk of further ransomware proliferation.
Fake Chrome Extensions: Over 100 malicious Chrome extensions have been discovered since February 2024, used to hijack browser sessions, steal credentials, and inject ads.

Trends, Tools, and Tactics

Service Desk Social Engineering: Attackers are increasingly targeting IT service desks with social engineering to bypass security controls (e.g., password resets, disabling MFA).
Novel Phishing Techniques: Recent phishing campaigns combine AES encryption with malicious npm packages to evade detection.
Supply Chain Threats: The RVTools incident highlights ongoing risks in software supply chains, with attackers distributing malware via compromised legitimate utilities.
Rise in Asia-based APTs: China and North Korea-aligned groups now account for over half of global APT attacks, with expanding international focus.
Exposure Management Enhancements: Tenable has added third-party connectors (AWS, Microsoft, competitors) to its platform for improved attack surface visibility.
Security Key Solutions: Yubico has expanded its YubiKey-as-a-Service globally, supporting hardware-based authentication in 175 countries.
AI Security Impacts: Increased adoption of AI agents is driving both new security opportunities and challenges, with most security leaders anticipating compliance and threat management implications.

Regulatory or Policy Developments

Genetic Data Privacy Concerns: Regeneron’s planned acquisition of 23andMe raises privacy concerns due to the lack of comprehensive federal regulation on genetic information transfers.

Cellcom on DanSec Daily

Cybersecurity Brief – 2025-05-29

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-05-21

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, and Tactics

Regulatory or Policy Developments