Cybersecurity Brief – 2025-08-05

Tue, 05 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Chanel has suffered a data breach as part of a broader wave of attacks targeting Salesforce data, joining other organisations affected by this campaign.
Northwest Radiologists disclosed a data breach impacting 350,000 individuals, with personal information stolen in an incident dating back to January 2025.
Russia’s largest airline, Aeroflot, was reportedly attacked, according to Check Point’s latest threat intelligence report.

Newly Discovered Vulnerabilities

SonicWall is investigating a potential zero-day vulnerability in its SSL VPN devices after a surge in targeted attacks, notably by the Akira ransomware group.
NVIDIA patched multiple critical vulnerabilities in its Triton Inference Server for Windows and Linux. These flaws could allow unauthenticated remote code execution, model theft, data leaks, and response manipulation on AI servers.
A previously undocumented Linux backdoor, dubbed “Plague,” was discovered. The malware, implemented as a malicious PAM module, enables persistent SSH access, bypasses authentication, and removes traces of SSH sessions. It is reported to have evaded detection for over a year.
Proton fixed a vulnerability in its Authenticator iOS app where TOTP secrets were logged in plaintext, potentially exposing multi-factor authentication codes.
Several vulnerabilities were patched in the AI code editor Cursor, which previously allowed attackers to modify sensitive MCP files and execute arbitrary code without user approval.

Notable Threat Actor Activity

Vietnamese threat actors are distributing a Python-based information stealer known as PXA Stealer. The campaign has compromised over 4,000 IP addresses and stolen 200,000 passwords globally.
Akira ransomware operators have escalated attacks using SonicWall SSL VPN devices, leveraging a suspected zero-day for initial access.
Ransomware gangs are exploiting a Microsoft SharePoint vulnerability chain, resulting in breaches of at least 148 organisations.
North Korean IT workers continue to seek fraudulent employment at Western companies, as highlighted in a new FBI advisory.
The “ClickTok” campaign is targeting TikTok Shop users with phishing and trojanised apps, leading to crypto wallet theft and spyware infections.
Mozilla warned of an ongoing phishing campaign targeting add-on developers via its official AMO repository.

Trends, Tools, or Tactics of Interest

Attackers are leveraging Microsoft Teams calls for social engineering, convincing users to install the Matanbuchus malware loader, which is often a precursor to ransomware deployment.
Threat actors are increasingly utilising generative AI tools to enhance offensive cyber operations, including social engineering and malware development.
Recent malware campaigns are adopting advanced evasion techniques, such as blending into legitimate developer workflows and documenting themselves to appear benign.
The proliferation of shadow IT remains a concern, with employees installing unauthorised plugins and tools, increasing organisational risk.
Cisco demonstrated that AI guardrails can be bypassed, allowing sensitive data to be extracted from chatbots trained on proprietary content.

Regulatory or Policy Developments Affecting the Security Industry

CISA and FEMA announced over $100 million in grants to help US states, tribes, and localities enhance cybersecurity resilience.
Illumina agreed to a $9.8 million settlement over allegations that its gene sequencing products supplied to the US government contained cybersecurity vulnerabilities.
Sean Cairncross has been confirmed by the US Senate as National Cyber Director.
Darktrace has acquired Mira Security, contributing to ongoing consolidation in the cybersecurity sector, with 44 M&A deals announced in July 2025.

Cybersecurity Brief – 2025-07-23

Wed, 23 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

AMEOS Group, a large Central European healthcare network, disclosed a security breach potentially exposing customer, employee, and partner information.
Dior confirmed a cyberattack from January 2025 that resulted in the theft of personal information. Payment information was not compromised.
Dell reported a breach of its Customer Solution Center demo environment by the World Leaks group. The company stated the leaked data was synthetic and not from real customers or partners.
A tech startup was found to be selling personal data stolen by infostealer malware and sourced from the dark web.

Newly Discovered Vulnerabilities

Microsoft SharePoint: Two critical vulnerabilities (CVE-2025-49704, CVE-2025-49706) are under active exploitation, with CISA adding them to its Known Exploited Vulnerabilities (KEV) catalog. The flaws have been exploited since at least July 7, 2025.
Cisco Identity Services Engine (ISE): Three recently patched critical remote code execution vulnerabilities are being actively exploited, allowing unauthenticated root access.
Helmholz REX 100 Industrial Routers: Eight vulnerabilities, including those enabling full device control, were discovered and patched.
Microsoft Windows Server: KB5062557 update is causing cluster service and virtual machine restart issues.
Coyote Banking Trojan: A new variant is abusing Microsoft’s UI Automation framework to identify and target banking and cryptocurrency exchange sites.

Notable Threat Actor Activity

Chinese APTs (Linen Typhoon, Violet Typhoon, Storm-2603): Attributed to the exploitation of SharePoint zero-day vulnerabilities (ToolShell chain) targeting internet-facing SharePoint servers, with activity traced back to early July 2025.
China-backed APT41: Conducted a sophisticated cyber-espionage attack on an African IT company, marking the group’s expansion into new geographic regions.
Russian APTs: Three groups and 18 individuals sanctioned by the UK government for involvement in cyber operations against Ukraine, NATO, and the EU.
Interlock Ransomware: CISA and the FBI reported escalating double extortion attacks targeting businesses and critical infrastructure.
AllaKore RAT, SystemBC, PureRAT, and Hijack Loader: Continued use in credential theft and remote access campaigns, particularly targeting Mexican organizations.
Lumma Infostealer: Resumed operations after law enforcement disruption in May 2025, with the infrastructure gradually coming back online.

Trends, Tools, or Tactics of Interest

Ransomware: Increased double extortion tactics and a notable rise in attacks on critical infrastructure and public sector organizations.
AI-Driven Threats: AI is being used to create convincing fake travel destinations and to clone voices for social engineering scams, as demonstrated in a recent AI voice scam extorting money from a victim.
Fake E-commerce Platforms: Surge in AI-powered scam sites used as attack vectors for data theft and fraud.
Infostealer Malware: The ecosystem for trading stolen personal data is expanding, with startups commercializing access to data harvested by malware.
Windows Accessibility Abuse: Malware such as Coyote is exploiting accessibility frameworks for more targeted credential theft.
Windows 11 Resilience: Microsoft introduced new recovery and resilience features, including a Black Screen of Death and automated recovery tools, in the KB5062660 update.

Regulatory or Policy Developments Affecting the Security Industry

UK Ransomware Payment Ban: The UK government is planning to prohibit public sector and critical infrastructure organizations from paying ransoms following ransomware attacks.
UK Sanctions: The UK imposed sanctions on Russian APT groups and individuals associated with high-profile cyber operations.
US Coast Guard Cybersecurity Rule: New cybersecurity requirements for maritime transport safety were issued, with phased implementation over two years to secure shipping ports.
China National Cyber ID: China launched a voluntary national Internet identity system aimed at protecting online identities, raising privacy and surveillance concerns.
Darktrace Acquisition: UK-based Darktrace acquired Mira Security to enhance network visibility and encrypted traffic decryption capabilities.

Darktrace on DanSec Daily

Cybersecurity Brief – 2025-08-05

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-07-23

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry