Dassault on DanSec Daily

Cybersecurity Brief – 2025-10-30

Thu, 30 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

A subsidiary of Japanese marketing and PR giant Dentsu (Merkle) experienced a data breach resulting in the theft of sensitive employee, client, and supplier data by unidentified threat actors.
The Canadian Centre for Cyber Security reported that hacktivists breached multiple water and energy facilities, gaining access to and modifying industrial controls across Canada.
A data leak exposed information about students attending Iran’s Ministry of Intelligence and Security (MOIS) training academy.
Microsoft experienced a global DNS outage affecting Azure and Microsoft 365 services, preventing customer logins and access.
No evidence was found of a Gmail breach; recent panic was due to circulation of old stolen credentials on the dark web.

Newly Discovered Vulnerabilities

The Anti-Malware Security and Brute-Force Firewall WordPress plugin (100,000+ installs) contains a vulnerability allowing site subscribers to read any file on the server, exposing private data.
Multiple security flaws in Dassault Systèmes DELMIA Apriso and XWiki are under active exploitation. In DELMIA Apriso, two vulnerabilities can be chained to gain privileged access and execute arbitrary code remotely. XWiki vulnerabilities are being used in cryptocurrency mining operations.
A new attack method, TEE.fail, targets DDR5 memory to steal cryptographic keys from Intel and AMD Trusted Execution Environments (TEEs), with both vendors issuing advisories.
OpenAI’s Atlas browser and similar agentic web browsers are exposed to context poisoning and prompt injection attacks, enabling attackers to manipulate AI model outputs and privacy.

Notable Threat Actor Activity

Russian-origin threat actors targeted Ukrainian organizations using living-off-the-land (LotL) tactics to exfiltrate data and maintain persistent access.
The “PhantomRaven” campaign published over 120 malicious npm packages, stealing developer credentials, authentication tokens, CI/CD secrets, and GitHub credentials from Windows, Linux, and macOS systems. Over 86,000 downloads were recorded.
Various botnets, including Mirai, Gafgyt, and Mozi, have increased automated attacks against PHP servers, IoT devices, and cloud gateways, exploiting vulnerabilities and misconfigurations to expand their control over internet-connected assets.

Trends, Tools, or Tactics of Interest

76% of organizations report struggling to keep pace with AI-powered attacks, with adversaries increasing sophistication and speed in ransomware and other threats.
New AI-targeted cloaking attacks are tricking AI crawlers (e.g., Perplexity, Atlas, ChatGPT) into indexing and citing fabricated information as facts, highlighting susceptibility of AI systems to context poisoning.
MITRE released ATT&CK v18, updating detection, mobile, and ICS (Industrial Control Systems) matrices with new defensive techniques and threat mappings.
BeyondTrust predicts a rise in attacks leveraging ghost identities, poisoned accounts, and autonomous AI agents, with traditional defenses proving less effective against emerging vectors.
Increased use of “invisible” dependencies and multi-layered obfuscation in malicious npm packages to evade detection.
Security experts note a sharp increase in cloud-focused attacks by botnets exploiting web-exposed and misconfigured assets.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will default to HTTPS for public sites starting October 2026, prompting users before allowing access to non-secure connections.
Microsoft introduced a security-focused change for Azure VMs, but provided a temporary reprieve after concerns it could disrupt apps requiring public internet access.

Cybersecurity Brief – 2025-10-29

Wed, 29 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Dentsu Data Breach: Japanese advertising giant Dentsu disclosed a cybersecurity incident at its U.S. subsidiary Merkle, resulting in the exposure of staff and client data.
Oracle EBS Attacks: Numerous organizations, including Schneider Electric and Emerson, have been identified as victims of attacks exploiting Oracle E-Business Suite zero-day CVE-2025-61882. Data stolen from these companies has been made available on the Cl0p ransomware leak site.
Swedish Power Grid Incident: Hackers targeted a Swedish power grid operator, stealing information from a file transfer solution. The country’s power supply was not affected.
183 Million Credentials Traded: Cybercriminals are trading 183 million stolen credentials on Telegram and dark web forums, with 16.4 million email addresses not previously seen in data breaches.

Newly Discovered Vulnerabilities

TEE.Fail Side-Channel Attack: Academic researchers disclosed TEE.Fail, a side-channel attack enabling extraction of secrets from trusted execution environments in Intel, AMD, and NVIDIA CPUs, undermining confidential computing.
QNAP NetBak PC Agent Vulnerability: The software is affected by a recent critical ASP.NET Core flaw that allows HTTP request smuggling, data access, server file modification, or denial-of-service.
Dassault Systèmes DELMIA Apriso: CISA warned of two actively exploited vulnerabilities in this manufacturing operations management platform.
Chrome Zero-Day: A now-patched Chrome zero-day was exploited to deliver Memento Labs’ LeetAgent spyware.
BiDi Swap Phishing Technique: Attackers are abusing bidirectional text to craft fake URLs that appear legitimate, reviving a browser flaw for phishing.
Atroposia Malware: A new malware-as-a-service platform, Atroposia, includes a built-in local vulnerability scanner for post-compromise exploitation.

Notable Threat Actor Activity

BlueNoroff (North Korea): The BlueNoroff APT group is running twin campaigns (GhostCall and GhostHire) targeting Web3 and blockchain sectors with cross-platform malware, using fake business collaboration and job recruitment lures.
Qilin Ransomware: The Qilin operation is abusing Windows Subsystem for Linux (WSL) to run Linux encryptors on Windows systems, evading traditional security tools.
Herodotus Android Trojan: A new banking trojan, Herodotus, is targeting Italy and Brazil, using random delay injection to mimic human typing and bypass anti-fraud and security detection mechanisms.
Aisuru Botnet: The Aisuru botnet, previously responsible for massive Mirai-class DDoS attacks exceeding 20 Tbps, has shifted to operating as a residential proxy network for more sustainable monetization.
YouTube Ghost Network: This malware operation leverages compromised YouTube accounts and botnets to distribute infostealers, with activity tripling in 2025.

Trends, Tools, or Tactics of Interest

AI-Powered Attacks in Africa: Cybersecurity firms report a surge in AI-driven phishing, deepfakes, and impersonation attacks across Africa, with adversaries testing new techniques on government and enterprise targets.
Deepfake-as-a-Service: The emergence of voice cloning and synthetic media fraud services is impacting enterprise security, with documented cases of business compromise and evolving detection tactics.
Invisible Characters in Phishing: Attackers are using invisible characters in email subject lines to bypass detection and trick recipients.
Grok Abuse for Phishing: Attackers are exploiting the Grok platform to distribute phishing links.
Surge in Credential Theft: Large-scale credential theft and trading continues unabated, with significant numbers of newly compromised emails.
Chrome HTTP Warnings: Google Chrome will begin warning users before connecting to insecure HTTP sites starting with version 154 in October 2026.

Regulatory or Policy Developments

UN Cybercrime Convention: Around 70 countries have signed a new UN cybercrime convention, though concerns have been raised about expanded surveillance and potential criminalization of security research.
Python Software Foundation Grant Rejection: The PSF withdrew a $1.5 million U.S. National Science Foundation grant proposal due to terms that conflicted with its diversity and inclusion commitments.
Microsoft Copilot Lawsuit: The Australian Competition and Consumer Commission (ACCC) has filed suit against Microsoft, alleging the company misled 2.7 million Australians into subscribing to Copilot M365.
Windows 11 Security Update: Microsoft released the KB5067036 preview update, introducing the Administrator Protection cybersecurity feature for Windows 11 24H2 and 25H2.

Cybersecurity Brief – 2025-09-14

Sun, 14 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Apple has issued a fourth round of spyware attack notifications to users in France in 2025, confirmed by CERT-FR. These alerts relate to targeted campaigns using sophisticated spyware, with at least four notification waves sent this year.
The U.S. FBI has issued a flash alert regarding cybercriminal groups UNC6040 and UNC6395, which have conducted data theft attacks targeting Salesforce platforms. Indicators of compromise have been released to assist in detection and response.
A critical remote code execution vulnerability (CVE-2025-5086) in Dassault Systèmes DELMIA Apriso Manufacturing Operations Management software is being actively exploited. The vulnerability arises from deserialization of untrusted data, allowing attackers to achieve RCE. CISA has issued a warning regarding ongoing exploitation.
A payment system vendor, KioSoft, took over a year to patch a serious NFC card vulnerability that allowed infinite card top-ups, despite being notified in 2023. The patch has only recently been released.

Newly Discovered Vulnerabilities

Samsung has patched a critical zero-day vulnerability (CVE-2025-21043) affecting its Android devices, which was being actively exploited in the wild. The flaw enabled remote code execution and was initially reported via WhatsApp.
Researchers have identified a new ransomware strain, HybridPetya, which mimics Petya/NotPetya and exploits CVE-2024-7344 to bypass UEFI Secure Boot protections. The malware installs a malicious application on the EFI System Partition.
Academics have disclosed VMScape, a new variant of the Spectre attack that breaks cloud isolation by exploiting incomplete mitigations in the branch predictor state, enabling leakage of arbitrary memory between virtual machines.

Notable Threat Actor Activity

The ransomware group Yurei, first observed on 5 September 2025, has been identified as a new actor leveraging open-source ransomware. The group has begun listing victims on its leak site.
AI-powered phishing and social engineering attacks are being leveraged by threat actors to increase the success rate of ransomware campaigns, as highlighted in a report from Resilience.

Trends, Tools, or Tactics of Interest

AI-driven phishing campaigns are demonstrating higher success rates than traditional methods, fueling increased ransomware losses.
HybridPetya represents an evolution in ransomware tactics by targeting UEFI Secure Boot, indicating a shift toward lower-level system attacks.
Cloud-native security is increasingly focused on runtime visibility due to the widespread adoption of containers, Kubernetes, and serverless technologies.
Security researchers are combining tools like Burp Suite Professional with bug bounty platforms such as HackerOne to efficiently identify and report high-impact vulnerabilities.
The emergence of agentic and AI browsers is being discussed, with attention to their safety and implications for the future of web browsing.

Regulatory or Policy Developments Affecting the Security Industry

CISA has announced that the CVE Program will focus on enhancing the quality, trust, and responsiveness of vulnerability data.
Microsoft has reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 60 days, after which they will no longer receive security updates.
F5 has announced the acquisition of CalypsoAI for $180 million, aiming to integrate adaptive AI inference security solutions into its Application Delivery and Security Platform.

Cybersecurity Brief – 2025-09-13

Sat, 13 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Apple has sent a fourth round of spyware notifications to users in France in 2025, with CERT-FR confirming a targeted spyware campaign against Apple device users in the country.
Dassault Systèmes DELMIA Apriso Manufacturing Operations Management (MOM) software is being actively exploited via a critical remote code execution vulnerability (CVE-2025-5086), with multiple advisories and warnings from CISA.
A payment system vendor (KioSoft) reportedly took over a year to patch a critical NFC card vulnerability that enabled infinite card top-ups, despite being notified in 2023.
A new ransomware group called Yurei was identified, with initial victim data published.

Newly Discovered Vulnerabilities

Samsung has patched a critical zero-day vulnerability (CVE-2025-21043) in its Android devices, which was exploited in the wild, including attacks reported via WhatsApp.
A new ransomware strain, HybridPetya, has been discovered. It is a Petya/NotPetya copycat that can bypass UEFI Secure Boot protections by exploiting CVE-2024-7344.
Academics have disclosed VMScape, a new Spectre variant attack capable of breaking cloud isolation by leaking arbitrary memory through speculative execution flaws.
DELMIA Apriso MOM software is affected by CVE-2025-5086, a deserialization of untrusted data flaw allowing remote code execution, currently under active exploitation.
Undocumented radios have been found in solar-powered devices used in US highway infrastructure, raising concerns about unreported communications capabilities.

Notable Threat Actor Activity

A new ransomware group, Yurei, was discovered on 5 September, with evidence of at least one victim being targeted.
HybridPetya ransomware demonstrates advanced capabilities by bypassing UEFI Secure Boot and targeting the EFI System Partition, indicating continued adaptation of malware based on known destructive strains.

Trends, Tools, or Tactics of Interest

AI-powered phishing and social engineering attacks are reported to be significantly more successful than traditional methods, contributing to increased ransomware losses.
HybridPetya’s use of a UEFI Secure Boot bypass highlights a trend towards targeting firmware-level security mechanisms.
The security of cloud-native applications is being challenged by the proliferation of containers, Kubernetes, and serverless technologies, with an increased emphasis on runtime visibility.
Bug bounty hunters are combining tools like Burp Suite Professional and HackerOne to uncover high-impact vulnerabilities more efficiently.
Agentic and AI-powered browsers are emerging, raising questions about their security implications.

Regulatory or Policy Developments Affecting the Security Industry

CISA announced a renewed focus for the CVE Program on improving the quality, trust, and responsiveness of vulnerability data.
Microsoft reminded customers that Windows 11 23H2 Home and Pro editions will reach end of support in 60 days, after which they will stop receiving security updates.

Cybersecurity Brief – 2025-09-04

Thu, 04 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover experienced a severe cyberattack, forcing the disconnection of systems and causing significant disruption to both retail and manufacturing operations.
Workiva, a major SaaS provider, disclosed a data breach after attackers accessed customer data via a compromised third-party Salesforce CRM system.
Multiple security firms, including Cloudflare, Palo Alto Networks, and Zscaler, were impacted by a breach involving Salesforce, Salesloft, and Drift, resulting in the exposure of customer contact information and case data.
The Pennsylvania Attorney General’s office confirmed a ransomware attack that caused weeks-long outages of email, phone, and web services. No ransom was paid.
Wiz Research reported a data leak at Chinese AI company DeepSeek, exposing over 1 million sensitive log streams.
The US Department of Justice filed a lawsuit against Apitor Technology for exposing children’s geolocation data to a Chinese third party without consent.
Disney agreed to pay $10 million to settle US FTC claims regarding the improper collection of children’s data on YouTube.

Newly Discovered Vulnerabilities

Google released September 2025 Android updates addressing over 100 vulnerabilities, including at least two zero-days (CVE-2025-2355, CVE-2025-2356) that are actively exploited.
A high-severity use-after-free vulnerability in Google Chrome’s V8 JavaScript engine was patched, preventing potential remote code execution.
CISA flagged an actively exploited vulnerability in TP-Link TL-WA855RE Wi-Fi range extenders, allowing attackers to reset and hijack affected devices. CISA recommends retiring these discontinued devices.
Exploit attempts were observed for CVE-2025-5086, a vulnerability in Dassault DELMIA Apriso used in manufacturing environments.
A WhatsApp bug, in conjunction with an Apple zero-day, is being used in targeted zero-click attacks against iPhone users, potentially for spyware deployment.

Notable Threat Actor Activity

An Iran-linked group, identified as Homeland Justice APT and associated with MOIS, conducted a coordinated spear-phishing campaign targeting over 100 embassy and consulate email accounts globally, aiming to spy on diplomats and international organisations.
Russian APT28 (Fancy Bear) is leveraging new ‘NotDoor’ malware to abuse Microsoft Outlook for covert data exfiltration.
North Korean IT worker scams remain a focus of regional countermeasures, with Japan and South Korea collaborating with private sector partners to disrupt these operations.
Malicious npm packages targeting Ethereum smart contract developers were discovered, using blockchain smart contracts to perform malicious actions on compromised systems.
Automated sextortion spyware, identified as a variant of “infostealer” malware, is taking screenshots and webcam photos of victims viewing adult content for extortion purposes.
Threat actors are using X’s Grok AI assistant to bypass link posting restrictions and distribute malicious links on the platform.
PayPal users are being targeted in a sophisticated email scam with the subject “Set up your account profile.”

Trends, Tools, or Tactics of Interest

Threat actors are rapidly adopting AI-powered offensive tools, specifically HexStrike AI, to exploit newly disclosed n-day vulnerabilities, including Citrix flaws, within days of public disclosure.
Increasing use of generative AI by attackers to craft more convincing phishing emails.
Endpoint security is seeing a shift towards AI-driven solutions, as highlighted in the 2025 Gartner Magic Quadrant, with a focus on countering advanced ransomware and phishing attacks.
Research indicates that compromised routers can remain undetected and accessible on the internet for years, highlighting persistent risks to infrastructure.
Geolocation data is being increasingly weaponised in advanced persistent threat (APT) operations and malware, enabling targeted attacks based on physical location.

Regulatory or Policy Developments

CISA, NSA, and 19 international partners released a joint statement outlining a shared vision for the Software Bill of Materials (SBOM), promoting its role in securing global software supply chains.
The US Department of State announced a $10 million bounty for information on three Russian FSB officers involved in cyberattacks against US critical infrastructure.
Law enforcement, in cooperation with the Alliance for Creativity and Entertainment, disrupted Streameast, the world’s largest illegal sports streaming platform, with arrests made in Egypt.