Cognizant on DanSec Daily

Cybersecurity Brief – 2026-03-07

Sat, 07 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

TriZetto Provider Solutions, part of Cognizant, suffered a data breach exposing sensitive health information of 3.4 million patients.
The FBI is investigating a breach affecting systems used to manage surveillance and wiretap warrants, with the scope and impact under assessment.
Transport for London experienced a data breach impacting 10 million users.
Iranian APT actors have compromised networks of US organizations, including an airport, a bank, and a software company, with activity observed since February.
Cyberattackers reportedly gained access to Mexican government agencies and citizens’ data using AI tools and detailed playbook prompts.
A Ghanaian national pleaded guilty to participating in a $100 million fraud ring leveraging business email compromise and romance scams.

Newly Discovered Vulnerabilities

CISA added three iOS vulnerabilities exploited in cyberespionage and crypto-theft attacks (via the Coruna exploit kit) to its Known Exploited Vulnerabilities list, affecting iOS versions 13 to 17.2.1. US federal agencies have been ordered to patch.
A Rockwell Automation ICS vulnerability, disclosed and mitigated in 2021, is now being actively exploited in the wild, allowing remote attacks on industrial control systems.
Avira antivirus vulnerabilities have been disclosed.

Notable Threat Actor Activity

The Pakistan-aligned APT group Transparent Tribe is using AI-powered coding tools to mass-produce malware implants in campaigns targeting India.
Iran-linked MuddyWater hackers deployed a new “Dindoor” backdoor in attacks against US companies, including banks, airports, and software firms.
Chinese APT actors targeted South American telecommunications infrastructure using TernDoor, PeerTime, and BruteEntry malware, affecting both Windows and Linux systems as well as edge devices.
North Korean APTs are employing AI tools to enhance IT worker scams, including face-swapping and automating communications.
Multi-stage VOID#GEIST malware campaigns are delivering XWorm, AsyncRAT, and Xeno RAT through batch scripts and encrypted payloads.
Fake calendar invitation campaigns have expanded from Gmail to Microsoft Outlook, increasing the attack surface for social engineering.
Threat actors are using a new InstallFix social engineering technique to distribute infostealers under the guise of legitimate installation guides, including fake Claude Code install guides.
Fake Google Meet update prompts are enrolling victims’ Windows PCs into attackers’ device management systems.
Bing search results have been manipulated to direct users to malicious GitHub repositories distributing fake OpenClaw installers.
A fake CleanMyMac website is distributing SHub Stealer, a macOS infostealer that steals credentials and backdoors crypto wallets.
Hundreds of attempts by Iranian state hackers to hijack consumer-grade security cameras have been observed, often timed to coincide with missile and drone strikes.

Trends, Tools, or Tactics of Interest

Increased use of AI by threat actors for malware development, phishing, and social engineering, including the use of large language models (LLMs) and playbook prompts for attack orchestration.
The use of C2 frameworks in APT attacks continues to be a significant trend, as highlighted in Q4 2025 exploit and vulnerability research.
Email weaponization remains a prevalent attack vector, with a wide array of tools enabling non-technical attackers to conduct sophisticated campaigns.
Data loss incidents are frequently attributed to human errors rather than technical failures, emphasizing the ongoing risk of insider threats and accidental disclosures.
Hacking of IP and consumer-grade security cameras is now a regular tactic in both state-sponsored cyber operations and hybrid warfare scenarios.
Social engineering attacks are increasingly leveraging fake software update prompts and manipulated search results to distribute malware.

Regulatory or Policy Developments Affecting the Security Industry

The European Union is introducing new cybersecurity standards for the automotive industry, with a focus on addressing risks from both climate change and cyber threats.
CISA has mandated urgent patching of iOS vulnerabilities for US federal agencies due to active exploitation.
The EC-Council launched an expanded Enterprise AI Credential Suite to bolster AI workforce readiness and security in the US.
James ‘Aaron’ Bishop has been appointed as the new Pentagon CISO, succeeding David McKeown.

Cybersecurity Brief – 2025-07-25

Fri, 25 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Law enforcement has seized the dark web extortion sites of the BlackSuit ransomware operation, which has breached hundreds of organizations globally.
Toptal’s GitHub organization account was compromised, with attackers publishing ten malicious npm packages to the npm registry.
Security flaws in Airportr, a luggage service used by 10 airlines, exposed user data and allowed attackers to potentially redirect or steal luggage.
A threat actor named EncryptHub compromised an early access Steam game to distribute info-stealing malware to users.
CastleLoader malware has infected 469 devices by leveraging fake GitHub repositories and phishing techniques (ClickFix) to deliver info-stealers and remote access trojans.
Multiple npm developer accounts were compromised in a phishing campaign, resulting in malware being injected into popular npm packages.

Newly Discovered Vulnerabilities

Microsoft SharePoint: Five vulnerabilities collectively known as ToolShell were detailed, including a POST request exploit that can bypass initial patches. Over 400 SharePoint servers, including US government systems, have been targeted.
Mitel MiVoice MX-ONE: A critical authentication bypass vulnerability has been disclosed and patched, allowing attackers to gain full access to affected systems.
Sophos Firewall and SonicWall SMA 100 Series: Critical remote code execution vulnerabilities have been patched. SonicWall specifically urges immediate updates due to recent malware attacks exploiting these flaws.
Airportr: Web security bugs exposed sensitive user data and allowed privilege escalation.
AI-generated image watermarks have been found to be easily removable, undermining some anti-misinformation controls.

Notable Threat Actor Activity

Storm-2603, a China-based threat actor, is actively exploiting SharePoint ToolShell vulnerabilities to deploy Warlock ransomware in ongoing campaigns.
Fire Ant, a threat actor, is targeting VMware ESXi hosts and vCenter environments in a prolonged cyber espionage campaign.
China-nexus APTs have deployed fake Dalai Lama apps to spy on the Tibetan community in multi-stage attacks.
BlackSuit ransomware infrastructure was disrupted by law enforcement following a global campaign of breaches.
High-value npm developer accounts have been targeted in phishing campaigns to distribute malicious packages.
Koske, a new Linux malware, is using steganography-hiding malicious payloads in panda JPEG images-and may have been developed with AI.

Trends, Tools, or Tactics of Interest

Ransomware groups are increasingly exploiting SharePoint ToolShell vulnerabilities, with a focus on unpatched systems.
CastleLoader demonstrates the use of fake GitHub repositories and phishing as initial infection vectors for malware distribution.
New malware delivery methods include steganography (Koske) and compromised software supply chains (npm, Steam games).
The evilreplay tool enables real-time browser session hijacking via XSS without the need for cookie theft, providing interactive post-exploitation control.
Offensive security is shifting towards continuous, proactive testing rather than annual penetration tests.
Law enforcement actions are increasing against cybercrime forums (e.g., XSS) and ransomware operations.

Regulatory or Policy Developments Affecting the Security Industry

The UK has implemented mandatory age verification for adult content access, raising privacy and security concerns about the collection and management of personal data.
New York is seeking public input on proposed cyber regulations for water systems, including incident reporting, response plans, and compliance certification.
Clorox has filed a $380 million lawsuit against Cognizant over a 2023 hack, alleging that IT provider actions enabled the breach.

Cybersecurity Brief – 2025-07-24

Thu, 24 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The US National Nuclear Security Administration was breached via exploitation of a Microsoft SharePoint zero-day vulnerability chain. At least three Chinese nation-state cyber-espionage groups are implicated in targeting older, on-premises SharePoint instances after a flawed patch attempt.
Clorox has filed a $380M lawsuit against Cognizant, alleging gross negligence after hackers successfully impersonated an employee and convinced the help desk to reset credentials, enabling a major August 2023 cyberattack.
Ongoing phishing campaigns are mimicking the US Department of Education’s G5 grant portal, exploiting recent layoffs and political turmoil to target users.
The npm package ‘is’, with 2.8 million weekly downloads, was compromised in a supply chain attack, injecting backdoor malware that gave attackers full device access.
npm accidentally removed the Stylus package, breaking builds and pipelines globally that depend on the library.
Ukraine arrested the suspected administrator of the Russian-language cybercrime forum XSS.is at the request of French authorities.

Newly Discovered Vulnerabilities

Sophos patched five critical vulnerabilities in Sophos Firewall that allowed for remote code execution by unauthenticated attackers.
CISA issued an alert regarding active exploitation of two vulnerabilities in SysAid ITSM software, which attackers are using to hijack administrator accounts.
Cisco reported active exploitation attempts of critical Cisco Identity Services Engine (ISE) vulnerabilities, which could lead to unauthenticated remote code execution.
Multiple high-severity memory safety vulnerabilities were patched in both Chrome and Firefox browsers.
Persistent exploitation of known Ivanti remote code execution vulnerabilities continues, particularly affecting Japanese organizations due to patching complications.

Notable Threat Actor Activity

Threat actor “Mimo” has shifted tactics to target Magento CMS and misconfigured Docker instances for crypto mining and proxyware deployment, expanding from previous campaigns against Craft CMS.
Chinese threat actors continue to exploit Ivanti RCE vulnerabilities in targeted attacks.
The Lumma Stealer malware re-emerged and resumed activity after a prior law enforcement takedown.
The Interlock ransomware group is actively targeting organizations through drive-by download attacks, prompting a government alert.
Hackers are using stolen credit cards and loyalty points to book travel for clients, with risks extending to remote workers, SMBs, and travel brands.

Trends, Tools, or Tactics of Interest

Researchers identified a new stealthy WordPress backdoor hidden in the “mu-plugins” directory, enabling persistent administrative access and evading standard detection.
The Coyote banking trojan is the first known malware to abuse the Windows UI Automation (UIA) accessibility framework to steal banking credentials, with attacks observed against banks and crypto exchanges in Brazil.
Kerberoasting attacks remain effective due to weaknesses in current detection methods; new approaches to detection and Active Directory hardening are being discussed.
Increased exploitation of SharePoint vulnerabilities is observed, with multiple exploit attempts and scanning activity detected shortly after public disclosure.
File integrity monitoring receives renewed focus with the release of the ficheck.py tool for forensic analysis.
Google launched the OSS Rebuild initiative to enhance security in open-source package ecosystems and address software supply chain attack risks.
Brave browser implemented a feature to block Windows Recall from capturing screenshots of browser activity by default.
Proton launched “Lumo,” a privacy-focused encrypted AI assistant that does not log user conversations or use prompts for training.
OpenAI is rolling out new ChatGPT features, including “personality” toggles and a “Study together” mode for exam preparation.
AI bot traffic is increasingly impacting website performance, with new mitigation strategies under discussion.
OpenAI CEO Sam Altman warned of the rising threat of AI voice fraud in banking, stating that voice clones are becoming indistinguishable from real voices and require new verification methods.

Regulatory or Policy Developments

The UK is considering a ban on ransomware payments, with debate over potential unintended consequences such as victims hiding incidents or attackers shifting tactics.
ISO 42001, a new international standard for AI governance, is being highlighted as a framework for responsible AI development and deployment.