https://blog.dansec.red/vendors/columbia-university/Recent content in Columbia University on DanSec DailyHugoen-gbSat, 09 Aug 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-08-09-cybersecurity-news/Sat, 09 Aug 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-08-09-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Columbia University suffered a significant data breach impacting nearly 870,000 individuals, including students, applicants, and employees. Stolen data includes personal, financial, and health information.</li> <li>French telecom provider Bouygues disclosed a breach affecting 6.4 million customers, with personal information compromised.</li> <li>Allianz Life reported a cybersecurity incident exposing personal information of hundreds of thousands of individuals.</li> <li>The U.S. Federal Judiciary confirmed a cyberattack on its electronic case management systems, impacting confidential court documents.</li> <li>Royal and BlackSuit ransomware operations breached over 450 U.S. companies before their infrastructure was dismantled, according to the U.S. Department of Homeland Security.</li> <li>FTC reported that Americans aged 60 and older lost a record $700 million to online scams in 2024, indicating a sharp increase in fraud targeting seniors.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Over a dozen vulnerabilities were identified in enterprise secure vaults from CyberArk and HashiCorp, enabling potential remote takeover without credentials if exploited.</li> <li>A WinRAR vulnerability (CVE-2025-8088) was exploited as a zero-day in phishing attacks to install RomCom malware.</li> <li>Security researchers found two techniques to crack at least eight brands of electronic safes using Securam Prologic locks, allowing unauthorized access within seconds.</li> <li>A misconfiguration in corporate livestreaming platforms’ APIs was discovered, potentially exposing internal company meetings.</li> <li>A feature in stream-oriented UNIX domain sockets (MSG_OOB) was leveraged to escalate privileges from Chrome renderer code execution to Linux kernel code execution.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The Efimer Trojan is being mass-mailed via email and hacked WordPress sites to steal cryptocurrency by substituting clipboard wallet addresses, with over 5,000 victims reported.</li> <li>A campaign dubbed GreedyBear used over 150 malicious Firefox extensions impersonating popular crypto wallets to steal more than $1 million in cryptocurrency.</li> <li>60 new malicious packages were found on RubyGems, targeting credential and crypto theft. Similar activity was reported on PyPI, leading to changes in security practices for these software repositories.</li> <li>AI-powered website builders (DeepSite AI, BlackBox AI) are being leveraged in Brazilian phishing scams to create convincing malicious sites.</li> <li>Data from an APT actor, believed to be affiliated with China or North Korea, was leaked, revealing details on recent campaigns, attacker tools, compromised credentials, and command files.</li> <li>Scattered Spider threat actor has been targeting help desks and identity systems, exploiting social engineering to bypass traditional security perimeters.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Leaked credentials incidents increased by 160%, with attackers using them for a range of malicious activities beyond immediate compromise.</li> <li>Attackers are increasingly targeting the foundations of cryptocurrency, including smart contracts, through both scams and exploitation of vulnerabilities.</li> <li>Red teams demonstrated that GPT-5’s prompt-level filters can be easily bypassed using multi-turn “storytelling” attacks, raising concerns about the model’s enterprise security.</li> <li>Shadow AI and rogue AI models are being identified as new risks, with tools like BigID’s Shadow AI Discovery launched to uncover such instances.</li> <li>There is a notable drop in ransomware attacks in Q2, with reported incidents falling by nearly half.</li> <li>Security flaws in IoT devices, such as school bathroom vape detectors, can enable covert audio surveillance due to embedded microphones and insecure configurations.</li> </ul> <h2 id="regulatory-or-policy-developments">Regulatory or Policy Developments</h2> <ul> <li>Microsoft 365 apps for Windows will block file access via the insecure FPRPC legacy authentication protocol by default from late August.</li> <li>Microsoft will retire the Lens PDF scanner app for iOS and Android as of September 15, 2025.</li> <li>The U.S. Judiciary is implementing enhanced cybersecurity measures following the breach of its electronic case management systems.</li> <li>Software repositories RubyGems and PyPI are enforcing new security measures in response to the discovery of malicious packages.</li> <li>Ex-NSA chief Paul Nakasone indicated at Defcon that major policy changes for the tech community may be forthcoming.</li> </ul>