Cybersecurity Brief – 2025-10-04

Sat, 04 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Renault and Dacia UK notified customers of a data breach affecting sensitive information, resulting from a compromise at a third-party provider.
Japanese beer company Asahi confirmed a ransomware attack that caused IT disruptions and factory shutdowns.
ShinyHunters launched a new data leak site to extort 39 victims impacted by recent Salesforce breaches, leaking samples of stolen data. The Scattered Lapsus$ Hunters group also resurfaced with threats to publish Salesforce customer data if extortion demands are unmet.
Jaguar Land Rover experienced repeat cyberattacks, reportedly due to incomplete remediation from a previous breach, highlighting ongoing operational and financial impacts.
Hackers who targeted Kido nurseries with ransom demands and posted children’s data online have reportedly removed the data following public backlash.
Dutch authorities arrested two teenagers for alleged pro-Russian espionage, noted as part of a broader Russian hybrid attack campaign in Europe.

Newly Discovered Vulnerabilities

CISA added CVE-2025-4008, a high-severity flaw in Smartbedded Meteobridge, to its Known Exploited Vulnerabilities catalog. The vulnerability allows remote unauthenticated attackers to execute arbitrary commands with root privileges; it was patched in mid-May but is being actively exploited.
An unauthenticated remote code execution (RCE) vulnerability affecting DrayTek routers was patched. The flaw could be exploited via crafted HTTP/S requests to the device’s web interface.
Chrome 141 and Firefox 143 released patches for high-severity vulnerabilities. Chrome addressed issues in WebGPU and Video components, while Firefox fixed flaws in Graphics and JavaScript Engine components.
A new attack, ‘CometJacking,’ exploits URL parameters in Perplexity’s Comet AI browser to access sensitive user data, such as emails and calendars, from connected services.

Notable Threat Actor Activity

The North Korean group “DeceptiveDevelopment” is using social engineering tactics to target job seekers, according to ESET.
The Detour Dog threat actor has been identified as operating DNS-powered malware campaigns distributing Strela Stealer, an information-stealing malware.
The Rhadamanthys Stealer threat actor has updated their stealer to include device fingerprinting and payloads concealed via PNG steganography. They are also advertising additional tools, Elysium Proxy Bot and Crypt Service.
A new self-propagating malware campaign, SORVEPOTEL, is targeting Brazilian WhatsApp users, spreading via trusted contacts on the messaging platform.
The “Cavalry Werewolf” threat actor, with links to YoroTrooper, has targeted Russian public sector entities using the FoalShell and StallionRAT malware families.
UAT-8099, a Chinese-language threat actor, is hijacking reputable websites for SEO fraud and data theft, infecting servers, poisoning sites with SEO spam, and stealing organizational data.
Oracle linked ongoing Clop ransomware extortion attacks to E-Business Suite vulnerabilities patched in July 2025, indicating exploitation of known flaws.
Cybercriminals reportedly offered money to a BBC journalist for cooperation, highlighting ongoing targeting of media professionals.

Trends, Tools, or Tactics of Interest

A Gartner survey found that 62% of organizations experienced a deepfake attack in the past 12 months, indicating a significant increase in the use of deepfakes in cyberattacks.
Signal introduced Sparse Post-Quantum Ratchet (SPQR), a cryptographic protocol designed to protect against quantum computing threats.
Gmail business users can now send end-to-end encrypted emails to recipients on any platform.
Microsoft’s “Windows Speak for Me” voice cloning technology has been identified as a potential vector for attacks, enabling creation of convincing voice replicas for use in SaaS platforms and communications.
Brain-computer interface (BCI) technology is being highlighted for its potential cybersecurity risks as adoption increases.
A free template was released to help CISOs present AI adoption, risks, and controls to boards, reflecting growing governance concerns around GenAI.
MokN, a French cybersecurity startup, introduced a “phish-back” solution that tricks attackers into revealing stolen credentials.
Passwork 7 was released as an on-premises platform for enterprise password and secrets management, addressing credential storage and sharing complexity.

Regulatory or Policy Developments Affecting the Security Industry

ICE (U.S. Immigration and Customs Enforcement) plans to build a 24/7 social media surveillance team, hiring contractors to monitor platforms such as X, Facebook, and TikTok for enforcement purposes.
LinkedIn user data will be used to train AI systems, raising privacy and data protection considerations.
Oneleet and MokN, cybersecurity startups, raised significant funding to expand operations and AI capabilities, indicating continued investment in compliance and anti-phishing technologies.

Cybersecurity Brief – 2025-10-03

Fri, 03 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Red Hat has confirmed a breach of its private GitLab repositories, with a threat actor claiming compromise of 28,000 repositories, including data related to major clients. Red Hat has initiated remediation.
WestJet disclosed that 1.2 million individuals were impacted by a data breach resulting from a June cyberattack. Analysis of stolen information has been completed.
Dealership software provider Motility suffered a ransomware attack on August 19, impacting 766,000 individuals. Stolen data includes names, contact details, Social Security numbers, and driver’s license numbers.
Allianz Life reported a data breach in July affecting 1.5 million individuals, with hackers stealing files containing names, addresses, dates of birth, and Social Security numbers from a cloud-based CRM.
Cybercriminals have launched an extortion campaign targeting Oracle E-Business Suite customers, with executives receiving threats alleging theft of sensitive data. The campaign is possibly linked to Cl0p and FIN11 ransomware groups.

Newly Discovered Vulnerabilities

DrayTek issued an advisory for a remote code execution vulnerability affecting several Vigor router models. The flaw allows remote, unauthenticated attackers to execute arbitrary code.
A critical vulnerability, dubbed “WireTap,” has been disclosed in Intel SGX. The attack leverages a passive interposer to extract the DCAP attestation key, undermining the enclave’s security mechanism.
A malicious Python Package Index (PyPI) package named “soopsocks” was found to have infected 2,653 systems before removal. The package masqueraded as a SOCKS5 proxy tool while stealing sensitive information.
Microsoft announced that Outlook for Web and the new Outlook for Windows will stop displaying inline SVG images to mitigate attacks exploiting this feature.
Microsoft Defender for Endpoint has a bug causing erroneous BIOS update alerts, incorrectly tagging some devices’ firmware as outdated.

Notable Threat Actor Activity

The Confucius APT group has been linked to new phishing campaigns targeting Pakistan, deploying WooperStealer and Anondoor malware. The group’s tactics have evolved to include Python-based surveillance tools.
Google Mandiant and Google Threat Intelligence Group are tracking a new extortion wave targeting Oracle E-Business Suite customers, potentially linked to the Cl0p ransomware group.
Android spyware campaigns (“ProSpy” and “ToSpy”) have been discovered targeting users in the UAE, impersonating Signal and ToTok apps to steal sensitive data.
Scam Facebook groups are distributing malicious Android malware to senior users via fake community and travel groups.

Trends, Tools, or Tactics of Interest

ENISA’s 2025 Threat Landscape report highlights a significant number of attacks targeting operational technology (OT) systems within the EU.
Attackers are increasingly scanning for critical vulnerabilities in firewalls and exploiting unpatched systems, as well as employing BYOVD (Bring Your Own Vulnerable Driver) and SQL C2 (Command and Control) attack techniques.
There is a documented shift in phishing tactics from email to mobile channels, including SMS, voice, and QR-code phishing.
The “.well-known” directory continues to be exploited for hiding webshells and malicious files.
Service desks are being actively targeted for social engineering attacks, prompting recommendations for NIST-aligned, role- and points-based user verification workflows.
Automation of penetration testing delivery is highlighted as a key workflow for continuous security validation.
The bug bounty platform HackerOne reported $81 million in payouts to security researchers over the past year, reflecting sustained engagement in vulnerability disclosure.

Regulatory or Policy Developments Affecting the Security Industry

The US Federal Trade Commission (FTC) has accused the Sendit app and its CEO of illegally signing up minors, misusing their data, and engaging in deceptive practices including fake messages and hidden fees.
Meta announced it will use user interactions with its generative AI to serve targeted ads, raising privacy and data usage concerns.
Despite a record number of CVEs projected for 2025, cyber insurers are reportedly not adjusting policy terms or requirements in response to the increased vulnerability disclosures.

DrayTek on DanSec Daily

Cybersecurity Brief – 2025-10-04

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-10-03

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry