Co-op on DanSec Daily

Cybersecurity Brief – 2025-09-29

Mon, 29 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Harrods, a British department store, has notified customers of a data breach involving the compromise of some personal details. Four individuals were arrested in July in connection with cyberattacks targeting Harrods, Marks & Spencer, and the Co-op.

Newly Discovered Vulnerabilities

Akira ransomware operators have been observed breaching SonicWall SSL VPN devices even when One-Time Password (OTP) Multi-Factor Authentication (MFA) is enabled. Attackers are successfully logging in to accounts protected by MFA, indicating a potential vulnerability or bypass method affecting SonicWall VPNs.

Notable Threat Actor Activity

Akira ransomware activity continues to evolve, with threat actors specifically targeting SonicWall SSL VPN appliances and demonstrating the capability to circumvent MFA protections.

Regulatory or Policy Developments Affecting the Security Industry

The European Commission has launched an investigation into SAP over potential anti-competitive practices related to aftermarket services for its on-premise ERP software. This regulatory action may impact support models and third-party service providers in the enterprise software sector.

Cybersecurity Brief – 2025-09-27

Sat, 27 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Volvo and two other international vehicle manufacturers suffered supply chain cyberattacks in the past month, resulting in the theft of Volvo employee Social Security Numbers in a ransomware attack.
Hackers stole data on 8,000 nursery children and contacted their parents directly, demanding ransom payments under threat of leaking the children’s information.
A South Korean credit card company was hacked, and the Maryland Transit Administration experienced a ransomware attack. The UK’s Co-op lost £206 million due to a cyberattack.
Flo Health and Google agreed to pay $56 million to settle lawsuits over the period-tracking app Flo sharing sensitive users’ health data for advertising purposes.
Neon Mobile, a popular US app, pays users to record their phone calls and then sells this data for AI training.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2025-10035, CVSS 10) in Fortra’s GoAnywhere Managed File Transfer (MFT) software was exploited as a zero-day at least eight days prior to public disclosure, allowing unauthenticated remote command injection and the creation of backdoor admin accounts.
Multiple vulnerabilities in Cognex industrial cameras allow for remote hacking; no patches are available, and customers are advised to migrate to newer models.
Google Project Zero highlighted the risk of pointer leaks through pointer-keyed data structures, which can undermine ASLR protections and facilitate remote exploitation.

Notable Threat Actor Activity

The Russian APT group COLDRIVER launched a new campaign using ClickFix-style attacks to deliver two new lightweight malware families.
Iranian APTs, including the Charming Kitten offshoot Subtle Snail, have been observed signing malware with valid code-signing certificates issued by SSL.com.
North Korean threat actors are posing as recruiters to steal developers’ identities and provide these to fraudulent IT workers.
A phishing campaign impersonating Ukrainian government agencies is distributing CountLoader, which subsequently deploys Amatera Stealer and PureMiner malware. PureRAT phishing threats are also targeting Vietnam.
LockBit 5.0 ransomware activity continues to be reported.

Trends, Tools, or Tactics of Interest

The XCSSET macOS malware has a new variant with a four-stage infection chain, an additional persistence mechanism, and new targeting of Firefox browser data, including cryptocurrency transaction hijacking.
Microsoft Edge will introduce a feature to block malicious sideloaded browser extensions.
Generative AI deployments are increasingly recognised as introducing new cyber risks, including phishing, fraud, and model manipulation.
North Korean threat actors are leveraging social engineering by masquerading as recruiters to facilitate identity theft for use by IT worker proxies.
Interpol arrested 260 suspects in Africa involved in online romance scams that used relationship-building to extort or blackmail victims.
A new tool, convert-ts-bash-history.py, has been released to facilitate quick timeline analysis from bash histories.
Breach and Attack Simulation (BAS) is highlighted as an effective method for validating security controls beyond theoretical design.
The Neon Mobile app’s business model of incentivising users to record and sell their phone call data for AI training is drawing privacy concerns.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has restricted access to cloud and AI products for a unit within the Israeli military, following an internal review linking these services to mass surveillance activities in Gaza.
U.S. President Donald Trump signed an executive order approving the restructuring of TikTok’s U.S. operations to address national security concerns, transferring control to U.S. investors.
Google and Flo Health face regulatory enforcement, agreeing to a $56 million settlement over improper sharing of sensitive health data.
Cognex is recommending customers transition to newer products due to unpatched vulnerabilities in its industrial cameras.

Cybersecurity Brief – 2025-09-26

Fri, 26 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

The Co-operative Group (UK) reported a loss of £80 million ($107 million) in operating profit due to a cyberattack attributed to the Scattered Spider threat group.
RTX (Raytheon Technologies) confirmed a ransomware attack affecting its airport services division.
Volvo Group disclosed that employee data was stolen in a ransomware attack linked to the Miljödata breach, impacting multiple Swedish organizations and municipalities.
An unofficial npm package mimicking ‘postmark-mcp’ was found to exfiltrate users’ email communications.
Over 500 npm packages were infected by the Shai-Hulud worm in a supply-chain attack, impacting packages with millions of downloads.
Two malicious Rust crates (fast_tlog and fast_log) on crates.io were found stealing Solana and Ethereum wallet keys from developers, with 8,424 downloads confirmed.

Newly Discovered Vulnerabilities

Cisco disclosed multiple zero-day vulnerabilities in its ASA firewalls and IOS devices, several of which have been actively exploited in the wild, including by nation-state actors (notably the “ArcaneDoor” campaign). Exploits have resulted in remote code execution and privilege escalation.
Salesforce patched a critical vulnerability (“ForcedLeak”) in the Agentforce AI platform that allowed prompt injection attacks, potentially exposing CRM data via AI agent manipulation and expired domain abuse.
Cisco patched a zero-day flaw affecting routers and switches, enabling remote attackers with admin privileges to execute arbitrary code as root.

Notable Threat Actor Activity

The China-linked APT group UNC5221 deployed new versions of the “Brickstorm” backdoor on edge devices, targeting appliances that cannot run traditional EDR agents. Campaigns persisted undetected for nearly 400 days, with evidence of analysis of stolen code to weaponize additional zero-day vulnerabilities.
North Korean actors behind the “Contagious Interview” campaign have been linked to a new backdoor dubbed AkdoorTea, along with tools TsunamiKit and ExistentialKit, targeting global cryptocurrency developers.
The threat actor “Vane Viper” was identified as operating a large-scale ad fraud and malware network, generating over 1 trillion DNS queries and using shell companies to obfuscate operations.
Chinese APT “RedNovember” targeted US defense contractors, government, aerospace, and legal organizations in a recent espionage campaign.
Microsoft reported a new variant of the XCSSET macOS malware targeting Xcode developers, with enhanced browser targeting and credential theft features.

Trends, Tools, or Tactics of Interest

A new AI-driven phishing platform, “SpamGPT”, was observed automating attack campaigns by leveraging generative AI and integrated email campaign tools.
Attackers are using AI-powered development platforms (Lovable, Netlify, Vercel) to rapidly create and host convincing fake CAPTCHA pages for phishing.
A fresh phishing campaign is targeting PyPI users by impersonating administrators and directing victims to credential-harvesting sites.
SVG-based phishing campaigns continue, with recent attacks using malicious SVG files disguised as recipes to deliver malware.
Webshells are increasingly being hidden in “.well-known” directories to evade detection.
Gcore Radar reported that the technology sector has overtaken gaming as the top target for DDoS attacks, with a 41% year-on-year increase and attack peaks reaching 2.2 Tbps.
Cloud Security Alliance introduced a SaaS Security Controls Framework to help customers manage shared responsibility in SaaS environments.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive mandating federal agencies to identify, mitigate, and patch Cisco zero-day vulnerabilities exploited in active attacks.
Microsoft announced it will offer free extended security updates for Windows 10 users in the European Economic Area (EEA), including all EU member states, Iceland, Liechtenstein, and Norway.
LinkedIn will use user data for AI training by default unless users opt out.
Canadian privacy commissioners accused TikTok of improperly collecting data from hundreds of thousands of children on its platform.

Cybersecurity Brief – 2025-07-17

Thu, 17 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

UK retailer Co-op confirmed the theft of personal data belonging to 6.5 million members following a major cyberattack in April, which also disrupted operations and caused food shortages.
Louis Vuitton disclosed that customer data breaches in the UK, South Korea, and Turkey are linked to a single security incident, reportedly associated with the ShinyHunters group.
United Natural Foods, Inc. (UNFI) projected up to $400 million in sales impact and $50–$60 million in net income loss due to a June cyberattack that disrupted operations, with insurance expected to cover most losses.
Compumedics, a medical technology company, suffered a ransomware attack by the VanHelsing group, resulting in the theft of files affecting 318,000 individuals.
An adoption agency left 1.1 million sensitive records of children and parents exposed on the open web due to a data misconfiguration.
A former US Army colonel leaked national secrets via a foreign dating app after being targeted by a scammer.
Amazon warned 200 million Prime customers about an ongoing phishing campaign targeting their login credentials.

Newly Discovered Vulnerabilities

Cisco disclosed a critical vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that allows unauthenticated attackers to execute code as root.
Google released a critical Chrome update addressing six vulnerabilities, including CVE-2025-6558, a high-severity sandbox escape zero-day exploited in the wild.
Researchers identified a critical design flaw in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling cross-domain attacks and persistent access.
Oracle patched a critical bug in its Cloud Code Editor that could allow attackers to compromise the full suite of developer tools in Oracle Cloud Infrastructure.
Public exploits for a recently patched remote code execution vulnerability in Fortinet FortiWeb are suspected to be linked to ongoing attacks involving web shells on exposed instances.
Google’s AI-driven “Big Sleep” framework discovered and blocked exploitation of a critical SQLite vulnerability before it was weaponised.

Notable Threat Actor Activity

Threat cluster UNC6148 is exploiting a likely zero-day vulnerability to deploy the OVERSTEP backdoor and rootkit on fully patched, end-of-life SonicWall SMA 100 series appliances. The campaign is financially motivated and has suspected ties to the Abyss ransomware group.
The pro-Russian hacktivist group NoName057(16), responsible for DDoS attacks on European and NATO-related targets, had its infrastructure disrupted in an international law enforcement operation coordinated by Europol (Operation Eastwood).
The VanHelsing ransomware group was identified as responsible for the Compumedics breach.
Chinese APT group Salt Typhoon (aka APT41) compromised a US National Guard unit’s network, accessing internal and inter-unit communications.
A former US Army soldier pleaded guilty to hacking and extorting at least ten US tech and telecom companies, including AT&T and Verizon.
Matanbuchus 3.0, a new variant of the malware loader, is being distributed via Microsoft Teams and features enhanced evasion techniques, including EDR detection and DNS-based C2 communication.

Trends, Tools, or Tactics of Interest

Manufacturing remains a prime target for cyberattacks in Europe due to increased digital connectivity and automation.
Attackers are engineering phishing campaigns to bypass secure email gateways, using advanced tactics to evade perimeter detection.
AI-driven social engineering attacks are increasing in sophistication, leveraging deepfakes, fake recruiters, and cloned executive personas for targeted campaigns.
The new Konfety Android malware variant uses APK manipulation and dynamic code loading, combined with the evil twin Wi-Fi technique, to evade detection and commit ad fraud.
Free file sharing services continue to be abused for data exfiltration, as evidenced by recent malicious samples using platforms like catbox.moe.
Organizations are rapidly integrating AI into security workflows, but concerns remain over AI agents’ elevated privileges and the need for identity-first security controls.
Matanbuchus 3.0’s use of advanced stealth features and delivery via collaboration platforms highlights an ongoing trend of leveraging trusted business tools for initial access.
There is a growing emphasis on aligning cybersecurity budgets with measurable risk reduction and financial impact.

Regulatory or Policy Developments Affecting the Security Industry

Europol’s Operation Eastwood demonstrates continued international cooperation in disrupting cybercriminal infrastructure, particularly pro-Russian hacktivist operations targeting critical infrastructure and NATO-aligned entities.
Cambodia conducted a major anti-cybercrime operation, arresting more than 1,000 suspects in coordinated raids across multiple provinces.
The US Department of Homeland Security faces renewed scrutiny over the collection and retention of DNA from approximately 133,000 migrant children, raising privacy and civil liberties concerns.

Cybersecurity Brief – 2025-07-11

Fri, 11 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Four individuals were arrested in the UK for cyberattacks targeting major retailers Marks & Spencer, Co-op, and Harrods. The suspects are believed to be connected to the Scattered Spider group, which has also targeted airlines and other sectors.
Qantas confirmed a data breach affecting 5.7 million customers. Exposed information includes names, addresses, email addresses, phone numbers, and other personal data.
Nippon Steel’s NS Solutions subsidiary suffered a breach exposing customer and employee data. There is currently no evidence of the data being leaked on dark web sites.
Ingram Micro experienced a ransomware attack that disrupted online ordering for customers. The company has since restored operations.
McDonald’s suffered a data exposure incident involving its AI-powered job application bot, which allowed access to applicant data using a weak default password.

Newly Discovered Vulnerabilities

CISA added CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
A critical remote code execution vulnerability was discovered in the open-source mcp-remote project, affecting over 437,000 downloads.
Multiple critical vulnerabilities, dubbed “PerfektBlue,” were identified in the BlueSDK Bluetooth stack used by Mercedes, Volkswagen, and Skoda vehicles. These flaws could allow remote code execution and potential access to critical vehicle systems.
A high-severity flaw, CVE-2025-3648, was disclosed in the ServiceNow platform. Exploitation could lead to data exposure via misconfigured access control lists (ACLs).
AMD disclosed a new class of vulnerabilities called Transient Scheduler Attacks, impacting a wide range of its CPUs and potentially allowing information disclosure.
A 6-year-old Oracle vulnerability affecting eSIM technology was disclosed, enabling potential spying and device takeover across millions of phones.
The Model Context Protocol (MCP) ecosystem, widely adopted for integrating AI models with external data, was found to have critical security vulnerabilities opening new attack vectors.

Notable Threat Actor Activity

Scattered Spider, a data theft and extortion group, has shifted its targeting to the aviation and transportation sectors, according to warnings from the FBI and cybersecurity experts.
Kaspersky identified malicious open-source packages for Cursor AI that deploy the Quasar backdoor and a cryptocurrency stealer.
Ongoing social engineering campaigns are using fake gaming and AI startup firms on Telegram and Discord to distribute malware targeting cryptocurrency users.
A new ZuRu malware variant is propagating via trojanized versions of the Termius macOS app, targeting developers.
Deepfake attacks are being used to impersonate high-profile political figures, such as Marco Rubio, to attempt to extract government secrets.
A Russian professional basketball player was arrested in France at the request of the US for allegedly acting as a negotiator for a ransomware gang.

Trends, Tools, or Tactics of Interest

AI-driven attacks are becoming more sophisticated, faster, and pervasive, with increased use of generative AI in offensive operations.
SSH tunneling, specifically direct-tcp requests, is highlighted as an active technique.
Force Push Scanner is a new tool for red teams to identify leaked secrets in ephemeral GitHub commits.
Anubis, an open-source self-hosted firewall, is being used to block AI bots from scraping website content.
SIM swap fraud is reportedly increasing, highlighting ongoing risks to mobile-based authentication.
Microsoft replaced the default JScript engine with JScript9Legacy in Windows 11 version 24H2 and later, aiming to improve scripting security.

Regulatory or Policy Developments

The FBI issued guidance on CJIS (Criminal Justice Information Services) compliance, emphasizing password hygiene, multi-factor authentication, and access control for law enforcement data handlers.
The U.S. Department of Homeland Security is advising law enforcement to treat certain protest activities as violent tactics, including livestreaming and skateboarding, potentially affecting policing and surveillance practices.
CISA’s update to the KEV catalog with Citrix NetScaler CVE-2025-5777 signals heightened regulatory attention to actively exploited enterprise vulnerabilities.

Cybersecurity Brief – 2025-06-22

Sun, 22 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The April 2025 cyberattacks on UK retailers Marks & Spencer and Co-op have been attributed to the threat group Scattered Spider. The incidents have been classified as a “single combined cyber event,” with estimated damages reaching up to $592 million.
The UK Information Commissioner’s Office (ICO) has imposed a significant fine on 23andMe following its 2023 data breach.

Notable Threat Actor Activity

Scattered Spider has been identified as the group behind the coordinated attacks on Marks & Spencer and Co-op.
Israeli authorities have accused Iranian state-linked actors of hacking security cameras in Israel for espionage purposes.
Ukrainian hackers have reportedly disrupted a major Russian internet provider.
China’s Salt Typhoon threat group has claimed responsibility for another cyberattack, details of which were not specified.

Trends, Tools, or Tactics of Interest

Alternate Data Streams (ADS) are being highlighted as a method for adversary defense evasion, with recent discussions focusing on detection techniques using Python tools.

Regulatory or Policy Developments

The UK has levied a substantial fine against 23andMe in response to its 2023 data breach, indicating ongoing regulatory scrutiny of data protection practices.

Cybersecurity Brief – 2025-06-04

Wed, 04 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Victoria’s Secret has delayed its Q1 2025 earnings release due to ongoing corporate system restoration efforts following a security incident on 24 May.
A data breach at Coinbase has been attributed to bribed customer support representatives at TaskUs in India, leading to data theft from the crypto exchange.

Newly Discovered Vulnerabilities

Hewlett Packard Enterprise (HPE) released security patches for eight vulnerabilities in StoreOnce, including a critical remote authentication bypass flaw.
A critical 10-year-old vulnerability in Roundcube webmail software allows authenticated users to execute malicious code.
Google patched a new Chrome zero-day vulnerability currently being exploited in the wild; this is the third Chrome zero-day exploited this year.
Two newly disclosed vBulletin vulnerabilities (CVE-2025-48827, CVE-2025-48828) are easily exploitable and present risks to bulletin board deployments.
CISA has issued a warning regarding active exploitation of a recently patched ConnectWise ScreenConnect vulnerability that allows remote code execution.

Notable Threat Actor Activity

Scattered Spider has been linked to high-profile attacks on UK retailers Marks & Spencer and Co-op, using tactics such as vishing, adversary-in-the-middle (AiTM) phishing, and exploiting multi-factor authentication gaps to hijack cloud accounts. The group operates as an identity-first threat model rather than a single entity.
Threat actors are using fake DocuSign and Gitcode websites to distribute the NetSupport RAT via multi-stage PowerShell attacks.
The Acreed infostealer has overtaken LummaC2 as the dominant credential theft malware on the Russian Market, reflecting a shift in the threat landscape.
Malicious RubyGems packages impersonating Fastlane CI/CD plugins have been found redirecting Telegram API requests to attacker-controlled servers to steal data.

Trends, Tools, or Tactics of Interest

The Crocodilus Android banking trojan has expanded its targeting from Turkey to eight countries across Europe and South America, now incorporating tactics such as adding fake contacts to victims’ devices to spoof trusted callers.
A new unrestricted AI chatbot, Venice[.]ai, has emerged, capable of generating phishing messages and malware code to assist cybercriminal activity.
Kaspersky research highlights the challenge of determining attack origins in environments lacking container visibility, emphasizing the importance of distinguishing between host-based and container-based threats.
Mozilla has introduced a new system to detect and block Firefox add-ons that function as cryptocurrency drainers.
LayerX has launched ExtensionPedia, and TXOne Networks introduced intelligent vulnerability mitigation capabilities, both reflecting ongoing innovation in endpoint and OT security.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will distrust digital certificates issued by Chunghwa Telecom and Netlock due to compliance and conduct issues, effective from August.
Microsoft and CrowdStrike have launched a shared threat actor glossary to align their threat actor taxonomies and reduce attribution confusion.

Cybersecurity Brief – 2025-05-03

Sat, 03 May 2025 00:00:00 +0000

Major Incidents and Breaches

Co-op Data Theft Confirmed: Co-op has verified that significant data was stolen in a recent cyberattack, following claims by the DragonForce ransomware group. The breach impacts a substantial number of current and former customers.
Magento Supply Chain Attack: Between 500 and 1,000 e-commerce stores, including a $40 billion multinational, were compromised through 21 backdoored Magento extensions in a widespread supply chain attack.
UK Retail Sector Under Attack: Multiple major British retailers, including Harrods, have been targeted by likely ransomware attacks in recent weeks. The UK NCSC has characterised these incidents as a “wake-up call” for the sector, urging improved cyber resilience.
Ransomware Surge in Food and Agriculture: Ransomware attacks targeting the food and agriculture sector have doubled in 2025, with the increase attributed largely to Clop’s exploitation of a popular file-sharing service.

Notable Threat Actor Activity

DragonForce Ransomware: Claimed responsibility for the Co-op breach, confirming ongoing ransomware activity against UK retailers.
Black Kingdom Ransomware: US authorities indicted a Yemeni national believed to be the developer and main operator behind Black Kingdom, which conducted approximately 1,500 attacks on Microsoft Exchange servers.
Scattered Spider: Despite recent law enforcement arrests, the group continues to conduct high-profile cyberattacks, underscoring its resilience and operational capability.
MintsLoader and GhostWeaver: The MintsLoader malware loader is being used to deliver the PowerShell-based remote access trojan GhostWeaver via phishing campaigns. The attacks leverage domain generation algorithms (DGA) and TLS encryption for stealth.

Newly Discovered Vulnerabilities and Exploits

Magento Extensions Backdoors: The compromised Magento extensions represent a significant supply chain vulnerability, affecting hundreds of e-commerce sites.
Developer Secrets Targeting: Threat actors are increasingly scanning for exposed secrets in configuration and repository files, highlighting the ongoing risk of credential leakage in software development pipelines.

Trends, Tools, and Tactics

Passwordless Authentication: Microsoft has made all new accounts passwordless by default, aiming to reduce risks from phishing, brute-force, and credential-stuffing attacks.
Automated Vulnerability Response: The Tines platform is promoting community-driven, pre-built workflows to automate CVE and vulnerability advisory responses, supporting more rapid and consistent remediation.
Stealth Malware Delivery: Recent campaigns (e.g., MintsLoader/GhostWeaver) demonstrate advanced use of multi-stage infection chains, obfuscation, DGA, and TLS for evasion.
Retail Sector Targeting: The ongoing wave of ransomware and cyberattacks against UK retailers signals a trend of increased targeting of the retail sector, likely due to its data-rich environment and operational impact.

Regulatory and Policy Developments

TikTok Fined for GDPR Breach: The Irish Data Protection Commission fined TikTok €530 million ($601 million) for illegally transferring personal data of EEA users to China, in violation of GDPR. This is among the largest fines issued under GDPR, reinforcing regulatory scrutiny of cross-border data transfers.
NCSC Advanced Cryptography Guidance: The UK NCSC has published a white paper on “Advanced Cryptography,” defining and providing guidance on cryptographic techniques for processing encrypted data and enhancing privacy and security.
US Regulatory Actions: The US Treasury is moving to cut off Huione Group, which is accused of laundering funds from North Korean cybercrime and investment scams. Separately, new security rules from the New York Department of Financial Services require finance firms to implement stronger protections against unauthorised access to information systems.

Other Industry Notes

Microsoft Exchange Online Issue Resolved: Microsoft fixed a bug in Exchange Online that was incorrectly flagging Gmail emails as spam due to a machine learning model error.
Privacy Concerns with Consumer Devices: Ongoing media coverage highlights persistent privacy risks associated with smart TVs and streaming devices collecting user data.

Cybersecurity Brief – 2025-05-02

Fri, 02 May 2025 00:00:00 +0000

Major Incidents and Breaches

Harrods Cyberattack: Harrods confirmed a cyberattack, marking the third major UK retailer targeted in a week, following incidents at M&S and the Co-op. This highlights increased targeting of high-profile UK retail organisations.
Ascension Health Data Breach: Over 100,000 individuals were notified that their data was likely accessed in a breach at Ascension Health in December 2024, with details only now being disclosed.
Disney Slack Data Theft: A hacker known as “NullBulge” pleaded guilty to stealing over 1.1TB of internal data from Disney’s Slack channels.
Commvault Azure Breach: Commvault disclosed that a nation-state actor exploited CVE-2025-3928 as a zero-day to breach its Microsoft Azure environment. No evidence of customer data compromise was found.
Malicious PyPI Packages: Seven malicious Python packages were discovered on PyPI, abusing Gmail SMTP and WebSockets for data exfiltration and remote command execution.
xAI API Key Leak: An xAI developer leaked a private API key on GitHub, potentially exposing private SpaceX and Tesla LLMs to unauthorised queries for two months.

Newly Discovered Vulnerabilities

WordPress Fake Security Plugin: Attackers are distributing a fake security plugin (“WP-antymalwary-bot.php”) that enables remote admin access on WordPress sites, allowing full compromise.
Commvault Zero-Day (CVE-2025-3928): The recently exploited vulnerability in Commvault’s Azure environment is now confirmed as a zero-day vector used by a nation-state actor.

Notable Threat Actor Activity

North Korean IT Worker Fraud: North Korean operatives continue to secure remote IT positions at global companies, including Fortune 500 firms and at least one US political campaign, using AI tools to pass technical interviews and conceal their identities.
Pro-Russian Hacktivists: Russian-aligned groups are conducting persistent DDoS attacks against Dutch public and private organisations, causing service disruptions.
Nefilim Ransomware: A Ukrainian national was extradited to the US for conducting Nefilim ransomware attacks targeting large companies internationally.
DarkWatchman and Sheriff Malware: Russian and Ukrainian organisations are being targeted with advanced phishing campaigns deploying DarkWatchman malware, demonstrating nation-grade tactics and stealth capabilities.
Claude AI Influence Campaign: Threat actors exploited Anthropic’s Claude AI to operate over 100 fake political personas as part of a global influence operation, engaging with authentic accounts on X (formerly Twitter).

Trends, Tools, and Tactics

Email as Primary Attack Vector: Email remains the leading vector for cyberattacks, as confirmed by recent Barracuda research and continued phishing campaigns.
Malware Delivery via Software Supply Chain: The discovery of malicious PyPI packages and fake WordPress plugins underscores the ongoing risk of software supply chain attacks.
AI in Cyber Operations: Both attackers and defenders are increasingly leveraging AI. Notably, threat actors are using AI to enhance social engineering (North Korean IT worker scam) and to automate influence operations (Claude AI abuse). Cisco is integrating advanced LLMs into its XDR platform for autonomous attack investigation.
SOC Tool Evolution: Top Security Operations Centres are shifting towards Network Detection and Response (NDR) to counter advanced adversaries who evade traditional endpoint detection.
Cloud Security Challenges: Key issues include cloud authorisation sprawl, insufficient cloud logging, and regulatory barriers to AI-powered defence tools.
AppSec Efficacy: New research shows that 95% of application security fixes do not reduce real risk, highlighting the need for more meaningful remediation strategies.

Regulatory and Policy Developments

US Defense Contractor Settlement: Defense contractors agreed to pay $8.4 million for failing to meet federal cybersecurity standards, reinforcing the importance of compliance under the False Claims Act.
Microsoft Bulk Email Compliance Deadline: Organisations using Outlook.com must meet new bulk email compliance requirements by 5 May 2025.
Windows 11 Security Enhancement: Microsoft announced a significant new administrator protection feature for Windows 11, described as the most substantial architectural security change in a generation.
Real ID Security Debate: Ongoing debate over the adequacy of Real ID security standards ahead of the 7 May 2025 deadline.

Other Noteworthy Observations

Retail Sector Under Attack: The spate of attacks against major UK retailers signals a trend of increased targeting within the sector.
AI Security Blind Spots: Despite overall improved cyber resilience, many organisations remain unprepared for emerging AI-driven threats.
Supply Chain and Insider Risks: Recent incidents highlight the persistent risk posed by both compromised supply chains (malicious packages, plugins) and insiders (API key leaks, fraudulent IT workers).

Cybersecurity Brief – 2025-05-01

Thu, 01 May 2025 00:00:00 +0000

Major Incidents and Breaches

SonicWall SMA100 Exploitation
- SonicWall has confirmed active exploitation of two now-patched vulnerabilities in its SMA100 Secure Mobile Access appliances. Attackers are targeting unpatched systems in the wild.
UK Retailer Co-op Cyberattack
- Co-op Food, a major UK supermarket chain, experienced limited operational disruption after a cyberattack, prompting the shutdown of some IT systems.
Ascension Healthcare Data Breach
- Ascension, a large US healthcare provider, is notifying patients of a data breach stemming from a December 2024 third-party hacking incident, with personal and health information stolen.
Commvault Azure Breach
- Data protection firm Commvault reported a breach of its Azure environment by a nation-state actor but stated customer backup data was not impacted.
Phishing Platform LabHost Takedown
- The FBI released a list of 42,000 phishing domains tied to the dismantled LabHost phishing-as-a-service (PhaaS) operation, one of the largest of its kind.
RansomHub Ransomware Group Offline
- The RansomHub ransomware-as-a-service operation’s infrastructure has gone dark since 1 April 2025, causing affiliates to migrate to other groups such as Qilin and DragonForce.