CPAP Medical on DanSec Daily

Cybersecurity Brief – 2025-10-08

Wed, 08 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Salesforce has confirmed a widespread data theft attack affecting its customers, stating it will not pay ransom to the threat actors. The ShinyHunters group is linked to the exfiltration of over a billion records from Salesforce customers and has launched a data leak site to extort victims.
Electronics distributor Avnet disclosed a data breach, noting that stolen data is unreadable without proprietary tools.
BK Technologies, a public safety communications firm, reported an IT intrusion and subsequent data theft.
CPAP Medical suffered a data breach exposing personal and health information of over 90,000 military patients, troops, veterans, and their families.
Discord has warned users of a third-party breach resulting in the theft of names, emails, limited billing information, and some government-ID images.
DraftKings notified customers of account breaches following a credential stuffing attack.
North Korean hackers have reportedly stolen over $2 billion in cryptocurrency assets in 2025, the largest annual total recorded.
Asahi brewery in Japan experienced a ransomware attack that disrupted domestic operations and led to a beer shortage.

Newly Discovered Vulnerabilities

Redis disclosed a critical, 13-year-old vulnerability (CVSS 10.0), tracked as “RediShell,” allowing remote code execution under certain conditions. Over 60,000 servers are currently at risk, with more than 300,000 instances exposed globally.
FreePBX (CVE-2025-57819) is affected by a code execution vulnerability via its web-based admin interface.
Oracle E-Business Suite (EBS) zero-day vulnerability has been exploited by the Clop ransomware gang for data theft since at least early August.
The Year 2038 (Y2K38) bug has been highlighted as a vulnerability that could be exploited in ICS and consumer devices well before the date is reached.

Notable Threat Actor Activity

Microsoft attributed the exploitation of a critical Fortra GoAnywhere MFT vulnerability to the Storm-1175 threat actor, leading to Medusa ransomware deployment. Exploitation began one week before patches were released and reportedly requires a private key.
The Clop ransomware gang exploited a critical Oracle EBS zero-day in data theft operations.
BatShadow, a Vietnamese threat actor, is using a new Go-based malware (“Vampire Bot”) targeting job seekers and digital marketing professionals via social engineering.
OpenAI disrupted three clusters of activity by Russian, North Korean, and Chinese threat actors misusing ChatGPT for malware development.
Security research exposed BIETA and CIII, Beijing-based research institutes, as developers and suppliers of technology supporting Chinese intelligence and military cyber operations.

Trends, Tools, or Tactics of Interest

Microsoft reported a new phishing campaign leveraging AI tools to obfuscate payloads and evade detection.
Researchers observed an uptick in spam and malicious emails using hidden content to bypass security filters.
XWorm 6.0 malware has emerged with over 35 plugins, enhancing its data theft and modular attack capabilities.
AI is identified as the leading data exfiltration channel in enterprise environments, according to new research.
Security teams are adopting AI-powered breach and attack simulation tools to rapidly test and validate defences against emerging threats.
Google DeepMind announced “CodeMender,” an AI agent that detects, patches, and rewrites vulnerable code.
AI-assisted penetration testing is now mainstream, with 70% of surveyed security researchers using AI tools, as reported by HackerOne.
Google launched an AI Vulnerability Reward Program, offering up to $30,000 for reported AI system flaws.
Google decided not to patch a new ASCII smuggling attack in its Gemini AI assistant, which could be used to manipulate responses or alter model behaviour.

Regulatory or Policy Developments Affecting the Security Industry

Docker announced affordable, unlimited access to its Hardened Images catalog for startups and SMBs to support secure development.
Microsoft is removing additional methods to bypass Microsoft account requirements in Windows 11 installations.
Significant cybersecurity M&A activity was reported in September 2025, with major deals involving Check Point, CrowdStrike, F5, Mitsubishi Electric, and SentinelOne.

Cybersecurity Brief – 2025-08-24

Sun, 24 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

DaVita, a kidney dialysis provider, confirmed that a ransomware gang breached its network and exfiltrated personal and health information of nearly 2.7 million individuals.
CPAP Medical Supplies and Services disclosed a data breach impacting 90,000 individuals, stemming from an intrusion in December 2024.
Hundreds of organisations were targeted in a new Atomic macOS Stealer campaign via malvertising between June and August 2025.
A clickjacking attack was reported that can steal credentials from browser-integrated password managers.
Grok AI chats, intended to be shared privately, were indexed by Google and became publicly searchable.

Newly Discovered Vulnerabilities

Apple patched a zero-day vulnerability (CVE-2025-43300) exploited in sophisticated attacks against targeted individuals.
A flaw in the ReVault control board in commonly used Dell laptops allowed attackers to gain malicious access down to the device firmware.
AWS addressed a vulnerability that allowed attackers to trick Trusted Advisor into displaying unprotected S3 buckets as secure.
Microsoft confirmed that August 2025 Windows security updates are causing severe issues with NDI streaming software on Windows 10 and 11.
MITRE released an updated list of the most important hardware weaknesses, reflecting current hardware security challenges.

Notable Threat Actor Activity

The Chinese state-sponsored group Murky Panda (Silk Typhoon) escalated cloud and telecom espionage, exploiting trusted relationships in cloud environments to access downstream customer networks and data, particularly targeting North American organisations. The group leveraged both n-day and zero-day vulnerabilities for initial access.
Pakistani APT36 is abusing Linux .desktop files to install malware in new campaigns against Indian government and defence entities.
Campaigns exploiting known vulnerabilities in GeoServer, Redis, and other platforms have been observed, with attackers leveraging these for botnet expansion and malicious activities.
A new infostealer malware, Shamos, is targeting Mac devices through fake troubleshooting guides and fixes in ClickFix attacks.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly abusing generative AI tools to produce convincing phishing websites rapidly, as observed by Palo Alto Networks’ Unit 42.
Survey scam phishing emails are evolving in sophistication, using technical measures to evade detection and steal financial data.
Linux malware campaigns are employing malicious RAR filenames in phishing emails to deliver the open-source VShell backdoor, evading antivirus detection.
Automation is increasingly redefining penetration testing delivery, with a shift towards more scalable and efficient reporting.
The proliferation of AI agents, chatbots, and machine credentials is creating new security management challenges, as these non-human identities now outnumber human users.
Insurers are considering limiting payouts for breaches involving unpatched critical vulnerabilities, with resistance from most organisations.
AI-assisted code and security reviews (e.g., Anthropic’s Claude) are being explored to enhance application security.
Apple Intelligence was found to be collecting more user data than previously understood, including music preferences, location, and potentially encrypted messages.
Modern vehicle cybersecurity trends highlight growing threats and the need for new security approaches in automotive systems.

Regulatory or Policy Developments

INTERPOL’s Operation Serengeti 2.0 resulted in the arrest of over 1,200 cybercriminals across 18 African nations, dismantling criminal infrastructure and recovering nearly $100 million.
CISA released a draft Software Bill of Materials (SBOM) guide for public comment.
Ongoing concerns about personal liability for CISOs remain, with increased risk of both legal and criminal targeting.
Microsoft has limited China’s access to the Microsoft Active Protections Program (MAPP).

Cybersecurity Brief – 2025-08-23

Sat, 23 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

DaVita, a kidney dialysis provider, confirmed a ransomware attack resulted in the theft of personal and health information for nearly 2.7 million individuals.
CPAP Medical Supplies and Services disclosed a data breach stemming from a December 2024 intrusion, impacting approximately 90,000 people.
Over 300 entities were targeted between June and August in a new campaign using the Atomic macOS Stealer, delivered via malvertising.
A clickjacking attack capable of stealing credentials from browser-integrated password managers was disclosed.
Grok AI chat logs intended to be private were indexed by Google Search, exposing user conversations to the public web.

Newly Discovered Vulnerabilities

Apple released a patch for a zero-day vulnerability (CVE-2025-43300) exploited in targeted attacks, likely linked to spyware or nation-state actors.
A vulnerability in Dell laptops’ ReVault control board allowed attackers to gain access down to the device firmware.
AWS addressed a flaw in Trusted Advisor that allowed unprotected S3 buckets to be incorrectly reported as secure.
Microsoft confirmed that August 2025 Windows updates are causing severe lag and stuttering issues with NDI streaming software on Windows 10 and 11.
MITRE updated its list of Most Important Hardware Weaknesses to reflect current hardware security risks.

Notable Threat Actor Activity

Chinese APT group Murky Panda (Silk Typhoon) exploited trusted relationships in cloud environments to gain access to downstream customer networks and data, targeting North American organisations and leveraging both n-day and zero-day vulnerabilities for initial access.
Pakistani APT36 group was observed using malicious Linux .desktop files to install malware in attacks against Indian government and defence entities.
New Linux malware infection chain employing phishing emails to deliver the open-source VShell backdoor was documented, using malicious RAR filenames to evade antivirus detection.
Mac users were targeted by the new ‘Shamos’ infostealer, distributed via fake troubleshooting guides and fixes (ClickFix attacks).
Cybercriminals are increasingly leveraging generative AI tools to automate the creation of convincing phishing websites.
Survey scam phishing campaigns have become more technically sophisticated, evading detection and stealing financial data through fake offers of free gifts.

Trends, Tools, or Tactics of Interest

Automation is transforming penetration testing delivery, with increased focus on efficient result reporting and remediation tracking.
The proliferation of AI agents, chatbots, and machine identities is introducing complex security management challenges, as these non-human entities now outnumber human users in many environments.
ChromeAlone, a new red team tool, turns the Chromium browser into a stealthy command-and-control implant with credential capture and persistence capabilities.
Modern vehicle cybersecurity is facing evolving threats, including increased attack surfaces in electric and connected vehicles, with a focus on supply chain, telematics, and over-the-air update security.
AI-assisted website generators are being abused by threat actors to rapidly create phishing sites.
Clickjacking remains a viable attack vector for compromising browser-based password managers.

Regulatory or Policy Developments

CISA issued a draft Software Bill of Materials (SBOM) guide for public comment, aiming to standardise SBOM practices across industries.
Some cyber insurers are moving to limit payouts for breaches where organisations have failed to remediate serious vulnerabilities in a timely manner.
Ongoing concerns over personal liability for CISOs persist, with increased scrutiny over liability protections and targeting by threat actors due to their privileged access.