Digiever on DanSec Daily

Cybersecurity Brief – 2025-12-26

Fri, 26 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Encrypted vault backups stolen during the 2022 LastPass breach have enabled threat actors to compromise weak master passwords and steal cryptocurrency assets, with thefts continuing through 2025.

Newly Discovered Vulnerabilities

Fortinet has reported active exploitation of CVE-2020-12812, a five-year-old FortiOS SSL VPN vulnerability that allows two-factor authentication bypass under certain configurations.
CISA has added a vulnerability affecting Digiever DS-2105 Pro network video recorders to its Known Exploited Vulnerabilities (KEV) catalogue. This flaw allows remote code execution and is being actively exploited.

Notable Threat Actor Activity

Attackers are increasingly leveraging stealth loaders, hijacking legitimate tools, trusted applications, and AI assistants to blend malicious activity with normal operations, complicating detection and response.
Cryptocurrency thefts linked to the LastPass breach highlight persistent threat actor interest in exploiting compromised credentials and vault data over extended periods.

Trends, Tools, or Tactics of Interest

The threat landscape for industrial automation systems in Q3 2025 shows continued targeting of ICS computers with miners, ransomware, spyware, and other malware, indicating ongoing risk to industrial environments.
Attackers are exploiting flaws in AI chatbots and containerisation platforms such as Docker, reflecting a trend towards abusing emerging technologies and infrastructure components in attack chains.