Coinbase on DanSec Daily

Cybersecurity Brief – 2026-04-21

Tue, 21 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

KelpDAO suffered a $290 million cryptocurrency theft, attributed to North Korean state-sponsored Lazarus Group hackers. The attackers exploited the DeFi platform to drain assets.
Vercel, the creator of Next.js, confirmed a data breach after a threat actor claimed to have stolen data and offered it for sale for $2 million. The breach reportedly stemmed from compromised OAuth tokens used by an employee’s AI tool.
Seiko USA’s website was defaced, with attackers claiming theft of the Shopify customer database and threatening to leak the data unless a ransom is paid.
Bluesky social network experienced a 24-hour disruption due to a sophisticated DDoS attack, with a pro-Iran hacker group claiming responsibility.
Booking.com was reported as a recent victim of a cyberattack, with further details pending.
A British national, identified as a leader of the Scattered Spider cybercrime collective, pleaded guilty in the US to wire fraud and aggravated identity theft related to cryptocurrency theft.

Newly Discovered Vulnerabilities

Over twenty malicious apps impersonating popular crypto wallets (Metamask, Coinbase, Trust Wallet, OneKey, etc.) were discovered on the Apple App Store, primarily targeting users in China. These apps phished for recovery/seed phrases to steal cryptocurrency.
SGLang (CVE-2026-5760, CVSS 9.8): A critical vulnerability allows remote code execution via malicious GGUF model files.
Anthropic Model Context Protocol (MCP): A critical design weakness was disclosed, enabling remote code execution and posing a supply chain risk for AI deployments.
Serial-to-IP converters from Lantronix and Silex were found to contain 20 new vulnerabilities, exposing OT and healthcare systems to potential attacks.
CISA added eight new exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three affecting Cisco devices.
WhatsApp was found to leak user metadata, allowing attackers to infer limited information about users without direct contact.
Half of the 6 million internet-facing FTP servers were found to lack encryption, exposing users and enterprises to various attacks.

Notable Threat Actor Activity

Lazarus Group (North Korea) linked to the $290 million KelpDAO crypto theft.
Scattered Spider leader pleaded guilty to multiple cybercrimes, including corporate intrusions and cryptocurrency theft.
Pro-Iran hacker group claimed responsibility for the DDoS attack on Bluesky.
The Gentlemen ransomware group was observed using the SystemBC proxy malware botnet (over 1,570 hosts) for bot-powered attacks, facilitating lateral movement and defense evasion.
Threat actors are abusing QEMU, a machine emulator, in campaigns to evade defenses and distribute ransomware and remote access tools.
Microsoft reported increased abuse of Microsoft Teams by threat actors for helpdesk impersonation and lateral movement using legitimate tools.
Reports indicate use of .wav files as a vector for malware delivery.

Trends, Tools, or Tactics of Interest

Third-party tools and compromised OAuth tokens are increasingly leveraged as initial access vectors in breaches, as seen in the Vercel incident.
There is a rise in threat actors exploiting trusted download paths and legitimate collaboration platforms (e.g., Microsoft Teams) for initial access and lateral movement.
The SystemBC proxy is being used by ransomware operators to automate attacks and maintain persistence within victim networks.
QEMU is being leveraged for defense evasion in recent ransomware and RAT campaigns.
Increase in phishing and malicious app distribution on official platforms, such as the Apple App Store, specifically targeting cryptocurrency assets.
Serial-to-IP converters in OT and healthcare environments remain a weak link due to numerous unpatched vulnerabilities.
AI supply chain risks are highlighted by critical vulnerabilities in AI model protocols and concerns about the misuse of powerful AI tools (e.g., Anthropic’s Mythos tool not publicly released over security fears).
Survey data from LevelBlue indicates ongoing concern among security leaders about the human element in cybersecurity, with workforce education seen as insufficient.

Regulatory or Policy Developments

The US Senate extended surveillance powers under a controversial program until 30 April 2026, following legislative delays.
CISA set federal deadlines in April–May 2026 for remediation of newly catalogued exploited vulnerabilities.

Cybersecurity Brief – 2025-06-04

Wed, 04 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Victoria’s Secret has delayed its Q1 2025 earnings release due to ongoing corporate system restoration efforts following a security incident on 24 May.
A data breach at Coinbase has been attributed to bribed customer support representatives at TaskUs in India, leading to data theft from the crypto exchange.

Newly Discovered Vulnerabilities

Hewlett Packard Enterprise (HPE) released security patches for eight vulnerabilities in StoreOnce, including a critical remote authentication bypass flaw.
A critical 10-year-old vulnerability in Roundcube webmail software allows authenticated users to execute malicious code.
Google patched a new Chrome zero-day vulnerability currently being exploited in the wild; this is the third Chrome zero-day exploited this year.
Two newly disclosed vBulletin vulnerabilities (CVE-2025-48827, CVE-2025-48828) are easily exploitable and present risks to bulletin board deployments.
CISA has issued a warning regarding active exploitation of a recently patched ConnectWise ScreenConnect vulnerability that allows remote code execution.

Notable Threat Actor Activity

Scattered Spider has been linked to high-profile attacks on UK retailers Marks & Spencer and Co-op, using tactics such as vishing, adversary-in-the-middle (AiTM) phishing, and exploiting multi-factor authentication gaps to hijack cloud accounts. The group operates as an identity-first threat model rather than a single entity.
Threat actors are using fake DocuSign and Gitcode websites to distribute the NetSupport RAT via multi-stage PowerShell attacks.
The Acreed infostealer has overtaken LummaC2 as the dominant credential theft malware on the Russian Market, reflecting a shift in the threat landscape.
Malicious RubyGems packages impersonating Fastlane CI/CD plugins have been found redirecting Telegram API requests to attacker-controlled servers to steal data.

Trends, Tools, or Tactics of Interest

The Crocodilus Android banking trojan has expanded its targeting from Turkey to eight countries across Europe and South America, now incorporating tactics such as adding fake contacts to victims’ devices to spoof trusted callers.
A new unrestricted AI chatbot, Venice[.]ai, has emerged, capable of generating phishing messages and malware code to assist cybercriminal activity.
Kaspersky research highlights the challenge of determining attack origins in environments lacking container visibility, emphasizing the importance of distinguishing between host-based and container-based threats.
Mozilla has introduced a new system to detect and block Firefox add-ons that function as cryptocurrency drainers.
LayerX has launched ExtensionPedia, and TXOne Networks introduced intelligent vulnerability mitigation capabilities, both reflecting ongoing innovation in endpoint and OT security.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will distrust digital certificates issued by Chunghwa Telecom and Netlock due to compliance and conduct issues, effective from August.
Microsoft and CrowdStrike have launched a shared threat actor glossary to align their threat actor taxonomies and reduce attribution confusion.

Cybersecurity Brief – 2025-05-22

Thu, 22 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack
- Marks & Spencer, a major UK retailer, suffered a cyberattack resulting in widespread operational disruption and a projected profit loss of up to £300 million ($402 million). The company anticipates continued online disruptions until at least July.
Kettering Health Ransomware Attack
- Kettering Health, a US healthcare network, experienced a ransomware attack leading to a system-wide outage and the cancellation of both inpatient and outpatient procedures.
Coinbase Data Breach
- Cryptocurrency exchange Coinbase reported a data breach impacting 69,461 customers. Both customer and corporate data were stolen. Coinbase is offering a $20 million reward for information leading to the perpetrators.
Lumma Infostealer Disruption
- Law enforcement agencies, with support from tech companies, disrupted the Lumma infostealer malware operation, seizing over 2,300 domains and dismantling a major malware-as-a-service infrastructure used globally.

Cybersecurity Brief – 2025-05-18

Sun, 18 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase will reimburse customers up to $400 million following a data breach. This incident highlights the significant financial impact of breaches affecting cryptocurrency platforms.

Notable Threat Actor Activity

Twelve individuals have been indicted in relation to a $263 million cryptocurrency heist, underscoring ongoing organised cybercriminal activity targeting digital assets.

Newly Discovered Vulnerabilities & Tools

A new tool, ‘Defendnot’, has emerged that can disable Microsoft Defender on Windows devices by registering a fake antivirus product. This technique allows attackers to bypass built-in endpoint protection, even if no legitimate AV is installed. The tactic may facilitate further malware deployment or persistence on compromised systems.

Trends, Tools, or Tactics of Interest

The release and ongoing development of tools such as xorsearch.py, designed for detecting XOR-encoded data in malware analysis, reflects continued innovation in both offensive and defensive cyber capabilities. This tool is relevant for analysts investigating obfuscated malicious payloads.

Cybersecurity Brief – 2025-05-17

Sat, 17 May 2025 00:00:00 +0000

Major Incidents and Breaches

Procolored Printer Malware Incident: Official drivers for Procolored printers were found to be distributing malware, including a remote access trojan and a cryptocurrency stealer, for at least six months.
Australian Human Rights Commission Data Breach: An internal error resulted in the public exposure of sensitive documents, increasing the risk of follow-on cyberattacks.
Coinbase Extortion: Coinbase was extorted following a cyberattack and is now offering a $20 million reward for information leading to the identification of the attackers, signalling a potentially new approach in incident response.
Nomad Bridge Crypto Hack – Arrest: Israeli authorities arrested a suspect linked to the $190 million Nomad Bridge cryptocurrency hack from August 2022.
US Crypto Theft Charges: Twelve additional individuals have been charged in the US for their alleged roles in a $230 million cryptocurrency theft and associated money laundering.
Email-Based Attacks and Cyber Insurance: Business email compromise (BEC) and funds transfer fraud (FTF) accounted for 60% of cyber insurance claims in 2024, underscoring the continued prevalence and impact of email-based threats.

Newly Discovered Vulnerabilities

Intel CPU Flaws: Researchers identified new vulnerabilities affecting all modern Intel CPUs, enabling sensitive memory leaks and facilitating Spectre v2-style attacks.
Chrome Zero-Day: CISA has warned that a recently patched high-severity Chrome browser vulnerability is being actively exploited in the wild.
Pwn2Own Zero-Days: Multiple zero-day vulnerabilities were exploited during Pwn2Own Berlin 2025, targeting Microsoft SharePoint, VMware ESXi, Oracle VirtualBox, and Red Hat Enterprise Linux.
Microsoft Windows 10 BitLocker Issue: Microsoft confirmed that May 2025 security updates are causing some Windows 10 systems to boot into BitLocker recovery mode unexpectedly.

Notable Threat Actor Activity

HTTPBot Botnet: A newly identified botnet, HTTPBot, has conducted over 200 targeted DDoS attacks, primarily affecting the gaming, technology, and education sectors.
Remcos RAT Campaign: Attackers are delivering fileless Remcos RAT using LNK files and MSHTA in PowerShell-based attacks, enhancing evasion and persistence.
Skitnet Post-Exploitation Tool: Ransomware gangs are increasingly deploying the Skitnet (“Bossnet”) malware for stealthy post-exploitation activities within compromised networks.
Dynamic DNS Abuse: Groups including Scattered Spider are leveraging dynamic DNS services to obfuscate their infrastructure and impersonate legitimate brands during phishing and other attacks.
Threat Actor Specialization: There is a trend toward increased specialization among threat actors, complicating attribution and defensive modelling.

Trends, Tools, and Tactics of Interest

Agentic AI Ransomware: Forecasts indicate that AI-enabled, agentic ransomware may emerge as early as this year, potentially transforming the ransomware threat landscape.
AI in Security and Offence: KnowBe4 is highlighting advancements in AI-driven human risk management, while OpenAI’s Codex (now integrated with ChatGPT) is being rolled out to automate programming tasks-raising both defensive and offensive security considerations.
Code-to-Cloud Security Gaps: Security teams are struggling to keep up with the pace of modern application development, particularly as organisations rapidly adopt cloud infrastructure.
Incident Response Metrics: Emphasis is being placed on developing and communicating clear metrics for Cybersecurity Incident Response Programs (CSIRPs) to improve transparency and decision-making.

Regulatory or Policy Developments

CISA Directive on Chrome Vulnerability: US federal agencies have been directed to address the actively exploited Chrome vulnerability, reflecting ongoing regulatory attention to patch management and rapid response.
Data Privacy Regulation Pressure: Increasing regulatory scrutiny is noted in relation to data privacy, with organisations urged to enhance data protection measures in response to tightening compliance requirements.

Cybersecurity Brief – 2025-05-16

Fri, 16 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach: Coinbase disclosed a breach affecting approximately 1% of its users. Cybercriminals bribed customer support agents to steal customer data, including government-issued IDs. Attackers attempted to extort $20 million, but the attempt failed.
Nova Scotia Power Data Breach: Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data.
Steel Manufacturer Cyber Incident: Nucor, a major steelmaker, halted operations due to a cyber incident. Details on the nature and scope of the breach remain undisclosed.
Breachforums Settlement: The former administrator of Breachforums agreed to pay nearly $700,000 to settle a civil lawsuit related to a healthcare data breach.

Newly Discovered Vulnerabilities

Google Chrome Zero-Day: Google patched a high-severity Chrome vulnerability (with a public exploit in the wild) that enables cross-origin data leaks via Loader Referrer Policy. Emergency updates have been released.
Samsung MagicInfo Server (CVE-2025-4632): Threat actors are actively exploiting a patch bypass for a previously disclosed vulnerability in Samsung MagicInfo 9 Server.
SAP NetWeaver (CVE-2025-31324): Ongoing exploitation of a critical SAP NetWeaver vulnerability is being observed. Administrators are urged to patch immediately.
Windows 10 KB5058379 Update Issue: The latest Windows 10 update is triggering unexpected BitLocker recovery prompts on some devices after installation.

Notable Threat Actor Activity

APT28 Cyber Espionage: Russia-linked APT28 exploited a zero-day in MDaemon and other webmail servers (Roundcube, Horde, Zimbra) via XSS vulnerabilities in a global campaign (“RoundPress”) targeting government organizations.
Malicious npm Package: Researchers identified a malicious npm package (“os-info-checker-es6”) using Unicode steganography to hide its payload and Google Calendar links as command-and-control infrastructure.

Trends, Tools, or Tactics of Interest

Industrial Automation Threats: Kaspersky ICS CERT reported a continued high threat landscape for industrial automation systems in Q1 2025, with increased targeting of critical infrastructure and persistent OT security gaps.
Ransomware Evolution: Ransomware actors are leveraging legitimate IT tools and increasingly sophisticated tactics to evade detection and disrupt business continuity.
AI-Driven Voice Deepfakes: The FBI warned of ongoing voice phishing attacks against US officials using AI-generated audio deepfakes since April.
Anonymity Tools: Tor released Oniux, a command-line tool enabling any Linux application to route network traffic through the Tor network for enhanced anonymity.
Penetration Testing Practices: Industry discussion highlights the inadequacy of compliance-only penetration testing, emphasizing the need for continuous and adaptive security assessments.
Pwn2Own Berlin 2025: Security researchers demonstrated successful zero-day exploits against Windows 11, Red Hat Linux, Docker Desktop, and Oracle VirtualBox on the first day, earning $260,000 in rewards.

Regulatory or Policy Developments

Meta AI Data Use Controversy: Meta plans to use E.U. user data for AI training without explicit consent from May 27. The Austrian privacy group noyb has issued a cease-and-desist letter and is threatening a class action lawsuit if Meta proceeds.
Critical Infrastructure Security Warnings: Federal agencies continue to warn that OT security in critical infrastructure remains inadequate amid persistent and sophisticated cyber threats.

Artificial Intelligence Developments

OpenAI ChatGPT Integrations: Leaks confirm upcoming integration of Model Context Protocol (MCP), enabling ChatGPT to connect with third-party services. Additionally, a new feature will allow ChatGPT to record, transcribe, and summarize meetings, potentially increasing exposure of sensitive business communications.

Cybersecurity Brief – 2025-05-15

Thu, 15 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach and Extortion Attempt
- Coinbase disclosed a data breach affecting approximately 1% of its users after cybercriminals bribed customer support agents. Attackers accessed sensitive customer information, including government IDs, and attempted to extort $20 million. The extortion attempt failed, but the incident highlights ongoing risks to cryptocurrency platforms from both insider and external threats.
Nova Scotia Power Data Breach
- Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data. The breach was discovered last month and underscores the persistent targeting of critical infrastructure and utility providers.

Newly Discovered Vulnerabilities

SAP NetWeaver (CVE-2025-31324)
- A critical vulnerability in SAP NetWeaver is being actively exploited by multiple threat actors, including ransomware groups BianLian and RansomExx. The flaw allows remote code execution and has led to a surge in attacks against unpatched systems. Immediate patching is strongly advised.
Samsung MagicINFO 9 Server (CVE-2025-4632)
- Samsung patched a critical vulnerability (CVSS 9.8) in MagicINFO 9 Server that was actively exploited to deploy Mirai botnet variants. Organizations using this software should update immediately.
Google Chrome High-Severity Flaw
- Google released emergency updates addressing a high-severity Chrome vulnerability that has a public exploit and is being used in the wild for cross-origin data leaks via the Loader Referrer Policy. All users are advised to update promptly.
Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Flaws
- Ivanti confirmed exploitation in the wild of zero-day vulnerabilities in EPMM, affecting a limited number of customers. The flaws stem from open source library issues and are being used in chained attacks.

Cybersecurity Brief – 2025-04-28

Mon, 28 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

M&S Cyberattack: Marks & Spencer (M&S), a major UK retailer, experienced a cyberattack that disrupted warehouse operations, resulting in approximately 20% of logistics workers being told not to report to work. The incident highlights ongoing threats to supply chain and logistics infrastructure.
Ukrainian Service Outage: A Ukrainian cloud provider restored state and banking services following a data centre power outage that impacted government agencies and major companies.
WooCommerce Phishing Campaign: A large-scale phishing campaign is targeting WooCommerce users with fake security alerts, tricking them into installing backdoors under the guise of a “critical patch.”
Craft CMS Zero-Day Exploits: Attackers are actively exploiting two newly disclosed critical vulnerabilities in Craft CMS, compromising hundreds of servers to gain unauthorized access.
SAP NetWeaver Exploitation: Over 1,200 internet-facing SAP NetWeaver servers remain vulnerable to a maximum severity, unauthenticated file upload flaw that is being actively exploited to hijack servers.

Notable Threat Actor Activity

Earth Kurma APT Campaign: A newly identified APT group, Earth Kurma, has been conducting sophisticated attacks against government and telecommunications sectors in Southeast Asia since June 2023. Tactics include rootkit deployment and cloud-based data theft tools.
Uyghur Cyber-Espionage: Researchers identified a highly targeted spearphishing campaign deploying custom malware against senior members of the exiled World Uyghur Congress, indicative of ongoing cyber-espionage activities against dissident groups.
Iran Infrastructure Attack Claims: Iranian officials reported repelling “widespread and complex” cyberattacks targeting national infrastructure, though details remain unspecified.

Newly Discovered Vulnerabilities

Craft CMS: Two critical, newly disclosed vulnerabilities are being exploited in the wild in Craft CMS installations, enabling attackers to breach servers.
SAP NetWeaver: An unauthenticated file upload vulnerability (maximum severity) is under active exploitation, affecting over 1,200 exposed SAP NetWeaver instances.
Vulnerability Chaining: Analysis of five real-world vulnerabilities demonstrates that even lower-risk flaws can be chained or escalated by advanced threat actors to achieve significant breaches.

Trends, Tools, and Tactics

AI-Powered Phishing & Automation: Attackers are increasingly leveraging AI-driven phishing kits and automation, lowering the technical barrier to launching sophisticated attacks and exploiting commodity tools and credentials available on the dark web.
DDoS Attack Surge: Cloudflare reported a record number of DDoS attacks in 2024, with a 358% year-over-year increase, reflecting a significant escalation in volumetric and application-layer attack activity.
Forensic Tooling: Release of DataSurgeon, an open-source Linux tool for fast data extraction and transformation, enhances forensic investigation capabilities.
SRUM-DUMP v3: Updated forensic tools like SRUM-DUMP v3 are being used to uncover malware activity through advanced system resource usage monitoring.
Security Tooling: Ongoing development of anti-scam and anti-phishing features in security products such as Malwarebytes to counter evolving online fraud methods.

Regulatory and Policy Developments

US DoJ Data Security Program: The US Department of Justice announced new compliance rules for its Data Security Program, requiring organisations to reassess data sharing practices and business relationships.
Connected Vehicle Surveillance Risks: Reports indicate increased law enforcement interest in exploiting data generated by internet-connected vehicle features, raising privacy and surveillance concerns.

Operational and Platform Updates

Kali Linux Repository Signing Key: Offensive Security warned Kali Linux users to manually update their repository signing key to prevent update failures, following the loss of the previous key.
Microsoft Outlook & SharePoint Online: Microsoft is addressing ongoing issues with Outlook on the web and SharePoint Online, where users have experienced search delays and failures.
Coinbase 2FA Log Bug: Coinbase resolved an error in its 2FA activity logs that caused users to mistakenly believe their accounts had been compromised.

Cybersecurity Brief – 2025-04-27

Sun, 27 Apr 2025 00:00:00 +0000

Major Incidents or Breaches

Microsoft has disclosed ongoing attacks by the threat actor Storm-1977, targeting cloud tenants in the education sector. The group has used password spraying techniques to compromise accounts and has deployed over 200 crypto mining containers within affected environments.

Notable Threat Actor Activity

Storm-1977 continues to focus on education sector cloud environments, utilising automated password spraying and deploying crypto mining infrastructure post-compromise, indicating a trend towards monetisation via illicit resource use.

Trends, Tools, or Tactics of Interest

Password spraying remains an effective attack vector against cloud-based accounts, particularly in sectors with broad user bases and potentially weaker password hygiene.
Brave has released “Cookiecrumbler,” an open-source tool leveraging large language models (LLMs) and community input to identify and block intrusive cookie consent notices, reflecting a trend towards AI-assisted privacy tools and community-driven content moderation.

Other Security Developments

Coinbase resolved a bug in its 2FA account activity logs that previously led users to mistakenly believe their accounts had been compromised.