Cox on DanSec Daily

Cybersecurity Brief – 2025-11-25

Tue, 25 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

SitusAMC, a major real-estate finance services provider, disclosed a data breach impacting customer data.
Harvard University reported a compromise of its Alumni Affairs and Development systems via a voice phishing attack, resulting in exposure of personal data of students, alumni, donors, and staff.
Delta Dental of Virginia suffered a breach affecting 146,000 individuals, with names, Social Security numbers, ID numbers, and health information stolen from a compromised email account.
Spanish airline Iberia notified customers of a data breach following claims of 77GB of stolen data.
Multiple organisations, including Canon, Cox, and Mazda, have been named as victims in the Oracle E-Business Suite (EBS) extortion campaign, with Cox confirming over 1.6 TB of data was stolen and Canon confirming subsidiary impact. Mazda reported no data leakage or operational impact.
Illegal streaming devices (e.g., Superbox, modded Amazon Fire TV Sticks) have been implicated in widespread scams, data theft, and integration into botnets.
Russian-linked threat actors are distributing StealC V2 infostealer malware via malicious Blender 3D model files uploaded to online marketplaces.
CISA issued a warning about active spyware campaigns targeting high-value Signal and WhatsApp users, leveraging commercial spyware and remote access trojans (RATs).

Newly Discovered Vulnerabilities

Five vulnerabilities have been identified in Fluent Bit, a widely used open-source telemetry agent, which can be chained to achieve remote code execution and stealthy intrusions into cloud infrastructure.
A critical flaw in Oracle Identity Manager (CVE-2025-61757) is under active exploitation and has been added to CISA’s Known Exploited Vulnerabilities catalog.
New Chrome and Fortinet zero-day vulnerabilities were reported as being actively exploited.
Microsoft confirmed a critical bug in Windows 11 24H2 causing File Explorer and Start Menu crashes when provisioning systems with cumulative updates.
Issues with URL mapping and URL-based access control continue to present high-profile vulnerabilities, notably in Oracle Identity Manager.
The Ray framework, used in AI clusters, has an exploitable flaw being used to hijack infrastructure for cryptomining and data theft.

Notable Threat Actor Activity

A new wave of Shai-Hulud malware attacks is targeting the npm registry, infecting over 500 packages (including well-known names like Zapier and Postman) and leaking secrets on GitHub. The campaign now executes malicious code during the preinstall phase, increasing exposure risks in build and runtime environments.
Threat actors are exploiting Black Friday by distributing phishing emails, scams, and malware targeting online shoppers and gamers. They are also selling stolen data and compromised accounts on the dark web.
The “ClickFix” attack uses a fake Windows Update animation in browsers to trick users and deliver malware, with the payload hidden in image files.
Matrix Push C2 is abusing browser push notifications to deliver realistic phishing and malware alerts.
CrowdStrike terminated an insider who aided hackers in falsely claiming a system breach by sharing internal screenshots.
The “Scattered LAPSUS$ Hunters” group continues to be active, according to recent threat intelligence reporting.

Trends, Tools, or Tactics of Interest

Vision language models are being advanced for physical security applications, enhancing employee safety monitoring.
Amazon has deployed an Autonomous Threat Analysis system using specialised AI agents for automated bug detection and remediation.
Research shows that the Chinese DeepSeek-R1 AI model generates insecure code, particularly when prompted with topics related to Tibet or Uyghurs.
Microsoft highlighted security risks introduced by new agentic AI features, warning that AI agents could perform malicious actions without proper controls.
Increased use of cloud-native patching is being advocated due to limitations and deprecation of traditional tools (SCCM and WSUS) in hybrid work environments.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced the removal of Windows Internet Name Service (WINS) support from Windows Server releases starting November 2034.
CISA’s alert and addition of Oracle Identity Manager’s CVE-2025-61757 to the KEV catalog increases urgency for remediation across affected organisations.

Cybersecurity Brief – 2025-11-23

Sun, 23 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Cox Enterprises has disclosed a data breach involving its Oracle E-Business Suite. Attackers exploited a zero-day vulnerability to gain access to the company network, exposing personal data of impacted individuals.
Researchers exploited a flaw in WhatsApp’s contact-discovery API, which lacked rate limiting, to scrape 3.5 billion mobile phone numbers and associated personal information.

Newly Discovered Vulnerabilities

A zero-day vulnerability in Oracle E-Business Suite was exploited in the breach of Cox Enterprises, allowing attackers to access sensitive data.
WhatsApp’s API was found to lack adequate rate limiting, enabling large-scale enumeration and scraping of user data.

Notable Threat Actor Activity

The China-linked APT group APT31 has been attributed to cyberattacks targeting the Russian IT sector between 2024 and 2025. The group used cloud services to conduct stealthy operations.
Qilin ransomware operators were investigated following an attack that involved rogue ScreenConnect access, unsuccessful infostealer deployment, and ransomware execution.

Trends, Tools, or Tactics of Interest

APT31’s operations against Russian IT targets leveraged cloud services to enhance stealth and persistence.
The Qilin ransomware case demonstrated the use of legitimate remote access tools (ScreenConnect) as an initial access vector, followed by attempted infostealer deployment and ransomware execution.

Regulatory or Policy Developments Affecting the Security Industry

The US Securities and Exchange Commission (SEC) has decided not to pursue further action against SolarWinds following its 2020 breach.
US Border Patrol’s surveillance practices were highlighted, involving the monitoring of millions of American drivers, raising ongoing concerns about privacy and surveillance policy.

Cybersecurity Brief – 2025-11-11

Tue, 11 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Nearly 30 organizations, including Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland, have been named as alleged victims of an Oracle E-Business Suite (EBS) hack on the Cl0p ransomware leak site.
The US Congressional Budget Office (CBO) confirmed a data breach.
Many Forbes AI 50 companies were found to have leaked sensitive secrets, including training data and private models, on public GitHub repositories.

Newly Discovered Vulnerabilities

A critical vulnerability in the expr-eval JavaScript library, used in over 800,000 weekly NPM downloads, allows remote code execution via malicious input.
Three vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) have been patched; these could be exploited to escape container environments.
Multiple vulnerabilities in QNAP devices, demonstrated at Pwn2Own Ireland, have been patched. These flaws could allow remote code execution, information disclosure, and denial-of-service.
A critical, now-patched flaw in Gladinet’s Triofox file-sharing and remote access platform was exploited to install remote access tools via its antivirus feature.
CISA has ordered US federal agencies to patch a critical Samsung zero-day vulnerability exploited in spyware attacks deploying LandFall spyware on WhatsApp-enabled devices.

Notable Threat Actor Activity

The Quantum Route Redirect phishing-as-a-service (PhaaS) platform is being used in a large-scale, automated campaign targeting Microsoft 365 users globally, utilising around 1,000 domains to steal credentials.
The North Korea-linked Konni (APT37) threat actor is abusing Google’s Find Hub tool in new attacks to track GPS positions and trigger remote data wipes on Android devices, as well as targeting Windows systems.
GlassWorm malware has resurfaced, infecting three additional Visual Studio Code extensions and spreading via both the Open VSX marketplace and GitHub repositories, targeting developer environments.
The ClickFix phishing campaign is targeting the hospitality sector, using infostealer and RAT malware to compromise hotel managers and subsequently launch phishing attacks against customers via email and WhatsApp.
A Russian national has pleaded guilty to acting as an initial access broker for Yanluowang ransomware, which targeted at least eight US companies between July 2021 and November 2022.
Fantasy Hub, a spyware-for-rent platform, is distributing RATs via fake Android apps capable of stealing logins, PINs, and messages with only SMS permissions.

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging LinkedIn for phishing campaigns, aiming at executives and exploiting the platform to bypass traditional email security.
Malware is being concealed within virtual machines (e.g., Hyper-V), and there is a noted increase in side-channel attacks targeting AI chat data, as well as spyware campaigns against Android devices.
Scanning activity has been observed targeting “FTP_3cx” usernames, potentially indicating attempts to exploit business phone system software.
The Browser Security Report 2025 highlights that identity, SaaS, and AI-related risks are converging at the browser level, while traditional controls may not adequately address these threats.
Mozilla Firefox 145 has introduced new anti-fingerprinting defenses to enhance user privacy.
OWASP’s revised Top 10 list for web application risks now includes two new categories, with supply chain risks and security misconfiguration ranking highly.

Regulatory or Policy Developments

Australia has imposed sanctions on individuals and entities accused of supporting North Korea’s weapons programme, mirroring recent US actions.
CISA has mandated US federal agencies to patch a Samsung zero-day exploited in spyware campaigns.