Commvault on DanSec Daily

Cybersecurity Brief – 2025-08-22

Fri, 22 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Colt Technology Services Ransomware Attack
- UK-based Colt Technology Services confirmed a data breach involving customer documentation theft. The Warlock ransomware gang is auctioning the stolen files. The company is working to restore disrupted systems.
Orange Belgium Data Breach
- Orange Belgium disclosed that attackers accessed data of approximately 850,000 customers during a July cyberattack. The breach affected customer accounts but no further technical details were provided.
Ex-Developer Sentenced for Sabotage
- A former developer was sentenced to four years in prison for deploying custom malware and a kill switch on his ex-employer’s network, locking out employees after his account was disabled.
Scattered Spider Member Sentenced
- Noah Michael Urban, a member of the Scattered Spider cybercrime group, was sentenced to 10 years in prison for wire fraud and conspiracy related to high-profile attacks.

Cybersecurity Brief – 2025-05-28

Wed, 28 May 2025 00:00:00 +0000

Major Incidents or Breaches

Adidas has disclosed a data breach following a compromise at a customer service provider, resulting in the theft of data from individuals who contacted the company’s customer service help desk. Payment or financial information was not affected.
MathWorks, the developer of MATLAB, has confirmed a ransomware attack that caused ongoing service outages. The specific ransomware group involved and whether data was exfiltrated remain unclear.
Commvault’s Metallic SaaS service has been targeted by threat actors who gained access to Microsoft 365 environments of a small number of customers, according to a CISA alert.
DragonForce ransomware successfully breached a managed service provider (MSP) and used the SimpleHelp remote monitoring and management (RMM) platform to steal data and deploy ransomware encryptors on downstream customer networks.
Apple reported it prevented over $9 billion in fraudulent transactions via the App Store over the past five years, including $2 billion in 2024, amid rising threats targeting the platform.

Newly Discovered Vulnerabilities

Microsoft has released an emergency update for Windows Server 2022 to address a known issue causing Hyper-V virtual machines to freeze or restart unexpectedly.
Misconfigured Docker API instances are being exploited by new self-spreading malware that transforms them into Dero cryptocurrency mining botnets.

Notable Threat Actor Activity

Russian threat group Void Blizzard (also known as Laundry Bear) has been linked to breaches of over 20 NGOs using Evilginx phishing via fake Microsoft Entra pages. The group has also been connected to the September 2024 Dutch police security breach.
Cybercriminals are cloning legitimate antivirus websites (specifically Bitdefender) to distribute the Venom remote access trojan (RAT) and steal cryptocurrency wallets.
The Luna Moth (Silent Ransom Group) is conducting stealth phishing campaigns, including vishing (voice phishing) attacks, to extort law firms, as highlighted in a recent FBI alert.
A novel campaign is using search engine optimization (SEO) poisoning to trick employees searching for payroll portals into payroll fraud, targeting mobile devices.
The Danabot botnet infrastructure has been seized in the US and key operators indicted, disrupting a major Russian cybercrime operation.
An Iranian national has pleaded guilty to involvement in RobbinHood ransomware attacks that targeted US cities and organisations.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly using AI-generated audio to impersonate senior US officials in phishing attacks, according to an FBI warning.
Attackers are leveraging the SimpleHelp RMM platform in supply chain ransomware attacks, specifically in the DragonForce incident.
SEO poisoning is being used to redirect employees searching for payroll portals to malicious sites, facilitating payroll diversion fraud.
Self-spreading malware targeting Docker containers is automating the creation of cryptocurrency mining botnets.
There is a trend of cybercriminals cloning legitimate software vendor websites to distribute malware such as Venom RAT.
Law enforcement and industry partnerships are achieving significant disruption of cybercrime infrastructure, as demonstrated by the Danabot takedown.

Regulatory or Policy Developments Affecting the Security Industry

The FBI has issued multiple alerts regarding evolving social engineering and extortion tactics, including the use of AI-generated media and vishing campaigns.
CISA has published an advisory on attacks targeting Commvault’s SaaS environment, urging increased vigilance for SaaS providers and their customers.

Cybersecurity Brief – 2025-05-23

Fri, 23 May 2025 00:00:00 +0000

Major Incidents or Breaches

Chinese Threat Actor Activity:
- Chinese-speaking group UAT-6382 exploited a now-patched remote code execution vulnerability in Trimble Cityworks to breach multiple US local government networks, deploying Cobalt Strike and VShell.
- Chinese nexus actors exploited recently patched Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities to target government agencies and enterprises across Europe, North America, and Asia.
Phishing Campaign Targeting International Students:
- The FBI reported an ongoing phishing campaign specifically targeting Middle Eastern students studying in the US, aiming to steal personal and financial information.
Database Exposure:
- A database containing 184 million login credentials, including those for Apple, Google, Meta, and various government services, was discovered and subsequently taken offline.
Cryptocurrency Theft via Fake Apps:
- Cybercriminals are distributing fake Ledger apps targeting macOS users to steal cryptocurrency seed phrases and digital assets.

Cybersecurity Brief – 2025-05-07

Wed, 07 May 2025 00:00:00 +0000

Major Incidents or Breaches

UK Legal Aid Agency (LAA) Incident: The LAA, part of the UK’s Ministry of Justice, is investigating a cybersecurity incident that may have exposed law firm data. The agency has warned impacted firms of potential data access by attackers.
T-Mobile Data Breach Settlement: Payments to victims of T-Mobile’s 2021 data breach (which exposed data of 76 million customers) have begun distribution after previous delays.
Langflow AI App Servers Compromised: A critical remote code execution (RCE) vulnerability in Langflow has been exploited in the wild, with CISA urging immediate patching.
Samsung MagicINFO 9 Server Exploits: Active exploitation of an unauthenticated RCE flaw in Samsung MagicINFO 9 Server has been observed, leading to device hijacking and malware deployment.
GeoVision IoT Devices Used in Mirai Botnet: Threat actors are exploiting vulnerabilities in end-of-life GeoVision IoT devices to conscript them into Mirai botnets for DDoS attacks.
Commvault Vulnerability Still Exploitable: Despite prior patches, CVE-2025-34028 affecting Commvault remains exploitable and is under active attack.
SonicWall SMA Devices Under Attack: Two vulnerabilities in SonicWall’s Secure Mobile Access (SMA) devices are being actively exploited by threat actors.
Linux Supply Chain Attack: Malicious Go modules uploaded to GitHub have been used to deliver disk-wiping malware targeting Linux servers.

Newly Discovered or Actively Exploited Vulnerabilities

Apache Parquet CVE-2025-30065: A proof-of-concept exploit for this maximum severity vulnerability has been released, increasing the risk to unpatched servers.
Google Android FreeType Flaw: Google patched an actively exploited, zero-click FreeType 2 code execution vulnerability in Android as part of its May 2025 security updates.
Langflow Critical RCE: The Langflow platform is subject to an easily exploitable RCE vulnerability (CVSS 9.8), now under active exploitation.
Samsung MagicINFO 9 Server RCE: Ongoing exploitation of the unauthenticated RCE flaw is resulting in widespread device compromise.
SonicWall SMA Device Vulnerabilities: CISA has highlighted two actively exploited vulnerabilities affecting SonicWall’s SMA remote access devices.
Commvault CVE-2025-34028: Despite being previously patched, this vulnerability remains exploitable and is being leveraged in attacks.

Notable Threat Actor Activity

Mirai Botnet Expansion: Threat actors are leveraging vulnerabilities in Samsung MagicINFO and GeoVision IoT devices to expand Mirai botnet operations, primarily for DDoS attacks.
Investment Scam Operations: Two threat actor groups are running investment scams using Facebook ads, RDGA domains, and IP filtering to target victims and evade detection.
Device Code Phishing: Attackers are employing “device code phishing” tactics to bypass multi-factor authentication, targeting users with social engineering campaigns that exploit device enrolment flows.

Trends, Tools, or Tactics of Interest

Modular Malware: Continued evolution in malware development with increased use of modular architectures, allowing threat actors to rapidly adapt and repurpose code.
Machine Credentials and Third-Party Risk: The Verizon 2025 DBIR highlights that third-party access and compromised machine credentials are leading drivers behind major breaches, surpassing ransomware and zero-day exploits.
External Attack Surface Management (EASM): Growing emphasis on EASM as organisations struggle to maintain visibility and control over sprawling digital assets and shadow IT.
Kubernetes Security Risks: Microsoft warns that default Helm chart configurations in Kubernetes deployments may lead to data leaks due to insecure defaults and misconfigurations.
Supply Chain Attacks via Open-Source Modules: The attack on Linux servers via malicious Go modules underscores ongoing risks in the open-source software supply chain.

Regulatory or Policy Developments

NSO Group Fined for Pegasus Spyware Attacks: A US federal jury ordered NSO Group to pay $168 million to WhatsApp (Meta) for facilitating Pegasus spyware attacks against 1,400 users, setting a significant legal precedent for spyware vendors.
California Privacy Enforcement: The California Privacy Protection Agency issued a six-figure fine and mandated business practice changes for a national clothing retailer over privacy violations, reinforcing active regulatory oversight.
US CISA Funding and Policy Scrutiny: US lawmakers are questioning proposed cuts to CISA funding and demanding a comprehensive national cybersecurity plan.
DOD Cyber Policy Review: The US Department of Defense’s nominee for cyber policy has pledged to re-evaluate guardrails for offensive cyber operations, signalling potential policy shifts.

Other Noteworthy Items

Signal Clone Security Issue: Analysis of TM Signal, a Signal clone, revealed that it sends user message logs in plaintext, raising concerns over secure messaging app clones.
Credential Hygiene in Public Figures: Reports indicate poor password practices among high-profile individuals, including the US Director of National Intelligence, highlighting ongoing issues with credential reuse at senior levels.

Cybersecurity Brief – 2025-05-06

Tue, 06 May 2025 00:00:00 +0000

Major Incidents or Breaches

UK Retail Sector Attacks: The UK’s National Cyber Security Centre (NCSC) issued new security guidance following three significant cyberattacks targeting major UK retailers.
TeleMessage Breach: TeleMessage, an unofficial Signal message archiving tool used by US government officials, suspended all services after a reported hack.
Educational Sector Disruptions (US): Multiple school districts in Georgia and a university in New Mexico experienced disruptive cyberattacks as the academic year ends.
Darcula Phishing Campaign: The Darcula phishing-as-a-service (PhaaS) platform stole 884,000 credit cards globally via malicious SMS campaigns.
Disney Data Leak: An individual pleaded guilty to stealing sensitive Disney data and falsely claiming to be a Russian hacktivist.
Peru Ransomware Claim: The Rhysida ransomware group claimed responsibility for an attack on the Peruvian government’s domain, though the government denies the incident.

Newly Discovered Vulnerabilities

Android Zero-Day: Google’s May 2025 security update addresses 46 Android vulnerabilities, including one actively exploited in the wild.
Apple AirPlay Zero-Click RCE: Researchers disclosed now-patched, wormable vulnerabilities in Apple’s AirPlay protocol that enabled zero-click remote code execution over public Wi-Fi.
Langflow Critical Flaw: A critical vulnerability in the open-source Langflow platform has been added to CISA’s Known Exploited Vulnerabilities (KEV) list following evidence of active exploitation.
Commvault Command Center: CVE-2025-34028, a maximum-severity flaw in Commvault Command Center, was also added to CISA’s KEV list after confirmation of in-the-wild exploitation.
Samsung MagicINFO CMS: The Mirai botnet is now exploiting a previously patched arbitrary file upload vulnerability (CVE-2024-7399) in Samsung MagicINFO CMS for remote code execution.
Kubernetes Helm Chart Risks: Microsoft warns that default configurations in Kubernetes Helm charts may expose sensitive data publicly.
EDR Bypass Technique: A new “Bring Your Own Installer” technique has been used to bypass SentinelOne’s tamper protection, enabling threat actors to disable endpoint detection and response (EDR) tools.

Notable Threat Actor Activity

Luna Moth (Silent Ransom Group): Increased callback phishing campaigns by Luna Moth targeting US legal and financial institutions, impersonating IT help desks to gain initial access.
Venom Spider: Arctic Wolf Labs identified a spear-phishing campaign by “Venom Spider” targeting hiring managers and recruiters by posing as job seekers.
Russian-Linked Hacktivism: Russian hacktivist group conducted DDoS attacks on Romanian state websites during national elections.
FSB Recruitment via TikTok: Ukrainian authorities detained an alleged FSB agent recruited via TikTok for military espionage.
Myanmar Cyber Scam Sanctions: The US sanctioned Myanmar’s Karen National Army and its leader for involvement in cyber fraud operations.

Trends, Tools, or Tactics of Interest

Stealth and Persistence: Notable rise in stealth tactics designed for long-term access and silent control, with attackers leveraging AI for adaptive, persistent threats.
Phishing-as-a-Service (PhaaS): Darcula’s large-scale SMS phishing operation underlines the growing sophistication and reach of PhaaS platforms.
EDR Evasion: Increasing use of advanced techniques, such as “Bring Your Own Installer,” to bypass endpoint security controls.
Deepfake Evolution: Research reveals deepfakes now retain biometric signals (e.g., heartbeats), presenting new challenges for detection and authentication.
Supply Chain Risks: Ongoing concerns about open-source software security, with warnings about persistent risks from tools like easyjson due to foreign influence and supply chain exposure.

Regulatory or Policy Developments

CISA KEV List Updates: Addition of Langflow and Commvault vulnerabilities to the US CISA Known Exploited Vulnerabilities catalog, increasing urgency for patching.
US Sanctions: Expansion of US sanctions targeting entities and individuals involved in cybercrime and cyber scam operations in Myanmar.
NCSC Guidance: UK’s NCSC published updated security guidance in response to recent cyberattacks on the retail sector, urging all organisations to review and strengthen their cyber defences.

Cybersecurity Brief – 2025-05-02

Fri, 02 May 2025 00:00:00 +0000

Major Incidents and Breaches

Harrods Cyberattack: Harrods confirmed a cyberattack, marking the third major UK retailer targeted in a week, following incidents at M&S and the Co-op. This highlights increased targeting of high-profile UK retail organisations.
Ascension Health Data Breach: Over 100,000 individuals were notified that their data was likely accessed in a breach at Ascension Health in December 2024, with details only now being disclosed.
Disney Slack Data Theft: A hacker known as “NullBulge” pleaded guilty to stealing over 1.1TB of internal data from Disney’s Slack channels.
Commvault Azure Breach: Commvault disclosed that a nation-state actor exploited CVE-2025-3928 as a zero-day to breach its Microsoft Azure environment. No evidence of customer data compromise was found.
Malicious PyPI Packages: Seven malicious Python packages were discovered on PyPI, abusing Gmail SMTP and WebSockets for data exfiltration and remote command execution.
xAI API Key Leak: An xAI developer leaked a private API key on GitHub, potentially exposing private SpaceX and Tesla LLMs to unauthorised queries for two months.

Newly Discovered Vulnerabilities

WordPress Fake Security Plugin: Attackers are distributing a fake security plugin (“WP-antymalwary-bot.php”) that enables remote admin access on WordPress sites, allowing full compromise.
Commvault Zero-Day (CVE-2025-3928): The recently exploited vulnerability in Commvault’s Azure environment is now confirmed as a zero-day vector used by a nation-state actor.

Notable Threat Actor Activity

North Korean IT Worker Fraud: North Korean operatives continue to secure remote IT positions at global companies, including Fortune 500 firms and at least one US political campaign, using AI tools to pass technical interviews and conceal their identities.
Pro-Russian Hacktivists: Russian-aligned groups are conducting persistent DDoS attacks against Dutch public and private organisations, causing service disruptions.
Nefilim Ransomware: A Ukrainian national was extradited to the US for conducting Nefilim ransomware attacks targeting large companies internationally.
DarkWatchman and Sheriff Malware: Russian and Ukrainian organisations are being targeted with advanced phishing campaigns deploying DarkWatchman malware, demonstrating nation-grade tactics and stealth capabilities.
Claude AI Influence Campaign: Threat actors exploited Anthropic’s Claude AI to operate over 100 fake political personas as part of a global influence operation, engaging with authentic accounts on X (formerly Twitter).

Trends, Tools, and Tactics

Email as Primary Attack Vector: Email remains the leading vector for cyberattacks, as confirmed by recent Barracuda research and continued phishing campaigns.
Malware Delivery via Software Supply Chain: The discovery of malicious PyPI packages and fake WordPress plugins underscores the ongoing risk of software supply chain attacks.
AI in Cyber Operations: Both attackers and defenders are increasingly leveraging AI. Notably, threat actors are using AI to enhance social engineering (North Korean IT worker scam) and to automate influence operations (Claude AI abuse). Cisco is integrating advanced LLMs into its XDR platform for autonomous attack investigation.
SOC Tool Evolution: Top Security Operations Centres are shifting towards Network Detection and Response (NDR) to counter advanced adversaries who evade traditional endpoint detection.
Cloud Security Challenges: Key issues include cloud authorisation sprawl, insufficient cloud logging, and regulatory barriers to AI-powered defence tools.
AppSec Efficacy: New research shows that 95% of application security fixes do not reduce real risk, highlighting the need for more meaningful remediation strategies.

Regulatory and Policy Developments

US Defense Contractor Settlement: Defense contractors agreed to pay $8.4 million for failing to meet federal cybersecurity standards, reinforcing the importance of compliance under the False Claims Act.
Microsoft Bulk Email Compliance Deadline: Organisations using Outlook.com must meet new bulk email compliance requirements by 5 May 2025.
Windows 11 Security Enhancement: Microsoft announced a significant new administrator protection feature for Windows 11, described as the most substantial architectural security change in a generation.
Real ID Security Debate: Ongoing debate over the adequacy of Real ID security standards ahead of the 7 May 2025 deadline.

Other Noteworthy Observations

Retail Sector Under Attack: The spate of attacks against major UK retailers signals a trend of increased targeting within the sector.
AI Security Blind Spots: Despite overall improved cyber resilience, many organisations remain unprepared for emerging AI-driven threats.
Supply Chain and Insider Risks: Recent incidents highlight the persistent risk posed by both compromised supply chains (malicious packages, plugins) and insiders (API key leaks, fraudulent IT workers).

Cybersecurity Brief – 2025-05-01

Thu, 01 May 2025 00:00:00 +0000

Major Incidents and Breaches

SonicWall SMA100 Exploitation
- SonicWall has confirmed active exploitation of two now-patched vulnerabilities in its SMA100 Secure Mobile Access appliances. Attackers are targeting unpatched systems in the wild.
UK Retailer Co-op Cyberattack
- Co-op Food, a major UK supermarket chain, experienced limited operational disruption after a cyberattack, prompting the shutdown of some IT systems.
Ascension Healthcare Data Breach
- Ascension, a large US healthcare provider, is notifying patients of a data breach stemming from a December 2024 third-party hacking incident, with personal and health information stolen.
Commvault Azure Breach
- Data protection firm Commvault reported a breach of its Azure environment by a nation-state actor but stated customer backup data was not impacted.
Phishing Platform LabHost Takedown
- The FBI released a list of 42,000 phishing domains tied to the dismantled LabHost phishing-as-a-service (PhaaS) operation, one of the largest of its kind.
RansomHub Ransomware Group Offline
- The RansomHub ransomware-as-a-service operation’s infrastructure has gone dark since 1 April 2025, causing affiliates to migrate to other groups such as Qilin and DragonForce.

Cybersecurity Brief – 2025-04-30

Wed, 30 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

SK Telecom Data Breach: South Korean telecom provider SK Telecom is offering free SIM replacements to 25 million customers after a USIM data breach, though only 6 million cards are currently available.
Ukraine Retail Cyberattack: Epicentr, Ukraine’s largest home improvement retailer, suffered a cyberattack that disrupted key IT systems.
Targeted Attacks on French Organizations: The French government attributed 12 cyberattacks on domestic entities over four years to Russian state-backed APT28 (GRU).
Uyghur Community Targeted: Chinese threat actors delivered Trojanized word-processing software via spear-phishing to members of the World Uyghur Congress.
Outlaw Botnet Activity: Kaspersky identified an SSH-based mining botnet operated by the Outlaw cybergang, targeting organisations globally.
Reconnaissance on SentinelOne: SentinelOne reported that the China-linked “PurpleHaze” threat cluster attempted reconnaissance against its infrastructure and clients.
Proton Mail Blocked in India: An Indian high court ordered the nationwide blocking of Proton Mail due to allegations of its use in AI deepfake scams.

Newly Discovered Vulnerabilities

Apple AirPlay Zero-Click RCE (“AirBorne”): Multiple vulnerabilities in Apple’s AirPlay protocol and SDK allow remote code execution on unpatched Apple and third-party devices via Wi-Fi, requiring no user interaction.
Broadcom Fabric OS and Commvault Flaws: CISA warned of active exploitation of vulnerabilities in Broadcom Brocade Fabric OS, Commvault web servers, and Qualitia Active! Mail clients.
Fuel Tank Monitoring System Exposure: Thousands of automatic tank gauge (ATG) devices are accessible online and vulnerable to disruption, posing risks to critical infrastructure.
Ongoing SonicWall CVE-2021-20016 Scanning: Increased scanning activity for this older SonicWall vulnerability suggests continued exploitation risk.

Notable Threat Actor Activity

APT28 (Russian GRU): Publicly attributed by France for a series of cyberattacks on French organizations.
Chinese Espionage (PurpleHaze): Ongoing reconnaissance and spear-phishing campaigns against Western targets, including SentinelOne and the Uyghur diaspora.
Outlaw Mining Botnet: Continues to leverage SSH-based infection chains for cryptomining operations worldwide.
Increased Scanning for Secrets: Threat actors are intensifying scans for leaked Git tokens, configuration files, and SMS gateways/APIs to compromise cloud services and send unauthorised messages.

Trends, Tools, and Tactics

Zero-Day Exploitation:
- Google reported 75 zero-days exploited in 2024, with 44–50% targeting enterprise security products and spyware-linked attacks.
- Exploitation is increasingly affecting enterprise and security technologies rather than general consumer software.
Device Code Phishing: Russian state actors are leveraging “device code phishing” techniques to bypass multi-factor authentication, as highlighted by recent Microsoft and KnowBe4 reports.
Generative AI Security Risks:
- Multiple GenAI platforms are susceptible to jailbreaks, unsafe code generation, and data theft.
- Google DeepMind introduced CaMeL, a new approach to mitigating prompt injection in large language models.
- WhatsApp launched “Private Processing” to enable AI features while maintaining message privacy, though experts caution about residual risks.
Cryptocurrency Exchange Rebranding: Grinex is suspected to be a rebrand of the sanctioned Russian exchange Garantex, indicating ongoing evasion of regulatory actions.
Social Engineering Scams: Threat actors are exploiting current events (e.g., the death of Pope Francis) for phishing and social engineering campaigns.

Regulatory and Policy Developments

India Blocks Proton Mail: Legal action taken against end-to-end encrypted email services over deepfake-related abuse, highlighting growing regulatory scrutiny of privacy-focused platforms.
Microsoft Windows Server Hotpatching: Starting with Windows Server 2025, hotpatching will require a paid subscription, impacting patch management strategies for enterprise clients.
US Cyber Policy: Calls for reauthorisation of cyberthreat information sharing laws and review of CISA funding and structure were raised during the RSA Conference.
France’s Public Attribution: France’s rare public attribution of cyberattacks to APT28 signals a more assertive posture in state-level cyber diplomacy.

Summary of Key Risks and Recommendations

Heightened threat from state-backed APTs (Russia, China) targeting critical infrastructure, enterprises, and dissident communities.
Ongoing exploitation of zero-day and legacy vulnerabilities, especially in enterprise and security products.
Increased risk from generative AI systems, both as attack vectors (prompt injection, jailbreaks) and as privacy concerns for end-users.
Regulatory shifts may impact encrypted communications and patch management practices.
Continued vigilance is recommended for SSH exposure, Git/secrets management, and rapid patching of high-profile vulnerabilities.

Cybersecurity Brief – 2025-04-29

Tue, 29 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Ransomware Attack
- Marks & Spencer experienced significant operational disruption, including outages and warehouse worker furloughs, due to a ransomware attack attributed to the “Scattered Spider” group.
Hitachi Vantara Ransomware Incident
- Hitachi Vantara took servers offline to contain an Akira ransomware attack, impacting business operations.
VeriSource Data Breach
- Employee benefits firm VeriSource confirmed that a February breach exposed personal information of 4 million individuals.
Urban One Data Breach
- Urban One, a major media company, disclosed a data breach following claims by a ransomware group.
World Uyghur Congress Targeted by Malware
- Senior members of the World Uyghur Congress were targeted in a sophisticated malware campaign via a trojanized UyghurEdit++ tool, indicating ongoing cyber-espionage efforts against exiled Uyghur groups.

Newly Discovered and Actively Exploited Vulnerabilities

SAP NetWeaver Visual Composer (CVE-2025-31324)
- Over 1,200 internet-facing SAP NetWeaver servers remain vulnerable to an actively exploited unauthenticated file upload flaw, allowing server hijacking. Attacks began before SAP released a patch.
Craft CMS Zero-Day Flaws
- Two newly disclosed critical vulnerabilities in Craft CMS are being exploited in the wild, with hundreds of servers likely compromised.
Broadcom Brocade Fabric OS and Commvault Web Server
- CISA added high-severity vulnerabilities in Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) database, indicating active exploitation.
Pymatgen 2024.1 Remote Code Execution
- A high-risk remote code execution vulnerability has been disclosed in Pymatgen 2024.1.
WooCommerce Phishing Campaign
- Attackers are distributing fake security patches to WooCommerce users, installing backdoors under the guise of critical updates.

Notable Threat Actor Activity

Earth Kurma APT
- Newly identified APT group “Earth Kurma” has targeted government and telecom sectors in Southeast Asia since June 2023, using rootkits and cloud-based data theft tools.
Scattered Spider
- Linked to the ransomware attack on Marks & Spencer, demonstrating continued targeting of UK-based large enterprises.
AI-Powered Phishing and Commodity Tools
- Increased use of AI-powered phishing kits and automated attack tools is lowering the barrier to entry for less skilled threat actors.

Trends, Tools, and Tactics

AI and Automation in Threat Landscape
- Attackers are leveraging AI, automation, and dark web resources to accelerate attack sophistication and frequency.
Record DDoS Attack Volumes
- Cloudflare reported a 358% year-over-year increase in DDoS attacks, highlighting a surge in volumetric and application-layer attacks.
Supply Chain and Update Risks
- Kali Linux users were warned of update failures due to a lost repository signing key, underscoring the importance of secure software supply chains.
Surveillance Risks in Connected Vehicles
- Law enforcement agencies are increasingly exploiting data from internet-connected vehicle features for surveillance purposes.

Regulatory and Policy Developments

CISA KEV Updates
- The U.S. CISA’s addition of new vulnerabilities to its KEV database may prompt UK organisations to review their own exposure and patch management processes.
US DoJ Data Security Program
- New compliance rules from the US Department of Justice will require organisations to reassess data sharing practices, with potential implications for multinational firms operating in or with the US.
Windscribe Legal Precedent
- Windscribe VPN was acquitted on charges regarding user data collection, reinforcing the legal standing of privacy-first service providers.

Other Notable Developments

Operational Disruptions
- Ukrainian state and banking services were temporarily disrupted due to a data centre power outage, affecting government and corporate customers.
Security Tooling
- Malwarebytes highlighted as a tool for combating online scams, reflecting ongoing emphasis on endpoint protection and anti-fraud solutions.

Summary of Key Risks

Ransomware remains a significant threat to large enterprises, with notable UK impact.
Actively exploited vulnerabilities in widely used enterprise software (SAP, Craft CMS, Broadcom, Commvault) require urgent attention.
AI-driven attack automation and phishing are reshaping the threat landscape, enabling more actors to launch sophisticated campaigns.
Regulatory changes and legal rulings are influencing data security and privacy practices globally.

Cybersecurity Brief – 2025-04-25

Fri, 25 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Healthcare Sector Data Breaches
- Frederick Health Medical Group suffered a ransomware attack in January, exposing data of nearly one million patients.
- Yale New Haven Health (YNHHS) disclosed a breach affecting 5.5 million patients, with threat actors stealing personal data.
- The Interlock ransomware gang claimed responsibility for an attack on DaVita, a kidney dialysis firm, and has leaked stolen data.
- The 2023 cyberattack on Long Beach, California, has been confirmed to have leaked data of nearly 500,000 individuals.
Lazarus Group Espionage Campaign
- North Korea-linked Lazarus Group targeted at least six South Korean organizations across software, IT, finance, and telecommunications sectors.
- Attackers exploited flaws in Cross EX and Innorix software, deploying ThreatNeedle malware in watering hole attacks.
Microsoft 365 Account Hijacking
- Russian threat actors exploited OAuth 2.0 authentication workflows to hijack Microsoft 365 accounts, targeting organizations related to Ukraine and human rights.