Cybersecurity Brief – 2025-10-23

Thu, 23 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Over 250 Magento and Adobe Commerce stores were compromised overnight through active exploitation of the critical “SessionReaper” vulnerability (CVE-2025-54236), with hundreds of attack attempts recorded.
FinWise suffered a data breach attributed to insider threat activity, exposing sensitive data.
Jewett-Cameron, a fencing and pet company, was hit by ransomware, with attackers exfiltrating sensitive information and threatening to release it unless a ransom is paid.
More than 100 Chrome extensions were found to be abusing WhatsApp Web for bulk messaging, violating both Chrome and WhatsApp anti-spam policies.
Ukraine war relief organizations and regional government entities were targeted in a spear-phishing campaign (“PhantomCaptcha”) delivering remote access malware via weaponized PDFs and fake Zoom meeting invitations.
Home Depot customers were targeted by a phishing campaign using fake Halloween giveaways, leveraging tracking pixels and compromised websites.
A fake Nethereum NuGet package using homoglyph attacks was discovered stealing cryptocurrency wallet keys via a supply chain attack.
The North Korean Lazarus Group is conducting cyber-espionage campaigns targeting European drone manufacturing data.
The Iranian MuddyWater APT group targeted over 100 global government and private organizations with the Phoenix backdoor, leveraging compromised mailboxes and phishing with macro-enabled documents.

Newly Discovered Vulnerabilities

Critical “SessionReaper” vulnerability (CVE-2025-54236) in Adobe Commerce and Magento Open Source is being actively exploited for unauthorized access and session hijacking.
A high-severity remote code execution vulnerability (“TARmageddon”) was identified in the abandoned async-tar Rust library and its forks, potentially affecting any dependent software.
Critical vulnerabilities in TP-Link’s Omada Gateways were patched, including a flaw allowing remote unauthenticated arbitrary command execution.
Zero-click Dolby audio bug (CVE-2025-54957) allows code execution via audio files on Android and Windows devices.
Motex Lanscope Endpoint Manager has a critical security flaw now listed in CISA’s Known Exploited Vulnerabilities catalog, confirmed to be under active attack.
Oracle released its October 2025 Critical Patch Update addressing 374 vulnerabilities across its product suite.
Microsoft SharePoint’s ToolShell vulnerability (CVE-2025-53770) is being exploited by Chinese threat actors even after public disclosure and patch release.

Notable Threat Actor Activity

Iranian APT MuddyWater used the Phoenix backdoor in a global espionage campaign, targeting government, financial, and industrial organizations, primarily in the Middle East and Africa.
Chinese threat actors associated with the ToolShell campaign exploited a SharePoint vulnerability to compromise organizations across government, telecom, and education sectors on four continents.
Russian APT Star Blizzard shifted to new backdoors (NoRobot/BaitSwitch and MaybeRobot/SimpleFix) after their previous malware, LostKeys, was exposed by researchers.
Lazarus Group (North Korea) is actively seeking sensitive data from European drone manufacturers.
APT group PassiveNeuron, identified by Kaspersky, is targeting government, financial, and industrial entities in Asia, Africa, and Latin America using custom malware (Neursite, NeuralExecutor).

Trends, Tools, or Tactics of Interest

Attackers are abusing X’s generative AI bot Grok to spread phishing links by manipulating the AI into responding with malicious URLs.
Threat actors are exploiting public cloud outages (e.g., AWS) to launch themed phishing attacks against affected users.
Researchers demonstrated that poisoning large language models (LLMs) can be achieved with as few as 250 documents, significantly lowering the barrier for AI model manipulation.
Data sprawl and the prevalence of hardcoded credentials, access tokens, and API keys are increasing the risk of data breaches due to over-privileged secrets.
Burp Suite’s new agentic Burp AI capabilities were tested for automated vulnerability discovery, showing notable effectiveness in identifying web application flaws.
Meta introduced new anti-scam tools for WhatsApp and Messenger to enhance user protection against scams.
Over 100 Chrome extensions are circumventing anti-spam controls on WhatsApp Web, indicating ongoing abuse of browser platforms for message automation.
Supply chain attacks continue to target package managers, as evidenced by the malicious Nethereum NuGet package.
Pwn2Own Ireland 2025 saw researchers exploit 90 previously unknown vulnerabilities across two days, earning over $1.3 million in rewards, highlighting the ongoing discovery of zero-days in widely used devices and platforms.

Regulatory or Policy Developments

Canada fined Cryptomus, a digital payments platform, $176 million for facilitating transactions with Russian cryptocurrency exchanges and cybercrime-linked websites.
WhatsApp secured a permanent ban on NSO Group after a six-year legal battle, with NSO ordered to pay $4 million in damages and prohibited from reverse-engineering WhatsApp or creating new accounts.
Russia is increasing enforcement actions against domestic hackers, reassessing its approach to providing safe haven in response to Western law enforcement pressure.

Cybersecurity Brief – 2025-09-16

Tue, 16 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Over 40 npm packages were compromised in a software supply chain attack, with attackers leveraging a malicious bundle.js file to steal credentials from affected developers and users.
FinWise Bank disclosed an insider breach impacting 689,000 American First Finance customers. A former employee accessed sensitive files after termination, exposing customer information.
KillSec ransomware group breached a major Brazilian healthcare software provider, stealing sensitive patient data and affecting a critical element of the healthcare technology supply chain.
Google confirmed that hackers created a fraudulent account in its Law Enforcement Request System (LERS), potentially enabling unauthorised access to sensitive law enforcement data requests.
The FBI’s IC3 issued a warning regarding threat actors UNC6040 and UNC6395 targeting Salesforce customers. These groups have conducted data theft and extortion campaigns against organisations using Salesforce, with the FBI sharing indicators of compromise (IoCs).
Panama’s Ministry of Economy and Finance (MEF) was affected by a cyber incident, as reported in recent threat intelligence bulletins.
Fairmont Federal Credit Union in West Virginia is notifying 187,000 people of a 2023 data breach that compromised personal, financial, and medical information.

Newly Discovered Vulnerabilities

Samsung patched a zero-day vulnerability affecting Android devices, which allowed remote code execution and was reportedly exploited by a spyware vendor. The flaw was reported by Meta and WhatsApp.
Academic researchers disclosed a new “Phoenix” Rowhammer attack variant that bypasses current DDR5 memory protection mechanisms from SK Hynix, allowing bit-flipping attacks despite existing mitigations.
Apple released iOS/iPadOS/macOS/watchOS/tvOS 26, addressing multiple security issues across its ecosystem.
Microsoft confirmed that the September 2025 Windows updates are causing connection issues to SMBv1 shares.
Microsoft has removed a safeguard hold for Windows 11 24H2 upgrades after resolving compatibility issues causing Bluetooth audio device malfunctions.

Notable Threat Actor Activity

Mustang Panda, a China-aligned threat group, was observed deploying an updated TONESHELL backdoor and a previously undocumented USB worm named SnakeDisk. The worm targets Thailand-based IPs and is used to deliver the Yokai backdoor.
Threat actors UNC6040 and UNC6395 continue to target Salesforce customers, conducting data theft and extortion campaigns.
Researchers demonstrated a “Lies-in-the-Loop” attack against Anthropic’s AI coding agent, tricking it into unsafe behaviour and enabling a potential supply chain attack.

Trends, Tools, or Tactics of Interest

Supply chain attacks continue to target open-source software repositories, as evidenced by the npm package compromise.
Increased focus on browser-based attacks, with reports highlighting a significant rise in attacks targeting users via web browsers.
AI integration protocols, specifically the Model Context Protocol (MCP), are being scrutinised for potential abuse in supply chain attacks, with proof-of-concept attacks demonstrating risks associated with insufficient validation of AI agent interactions.
Zero Trust security adoption remains inconsistent, with uneven implementation leaving organisations exposed despite its status as a security standard.
The use of USB worms for lateral movement and payload delivery, as seen with Mustang Panda’s SnakeDisk, indicates ongoing innovation in threat actor tactics.
“AI-powered” attacks and the security of AI agents are emerging as key areas of concern, including the manipulation of AI coding assistants.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft Exchange Server 2016 and 2019 will reach end of extended support next month, with Microsoft providing guidance for decommissioning outdated servers.
Microsoft will begin automatically installing the Microsoft 365 Copilot app on Windows devices outside of the EEA region for users with Microsoft 365 desktop client apps, starting in October.
Google reportedly conducted a behind-the-scenes campaign against new California privacy legislation, though the legislation ultimately passed, potentially impacting privacy compliance requirements for tech companies operating in California.
CISA’s “Secure by Design” initiative is emphasising the need for resilient IT infrastructure and secure system design practices.

FinWise on DanSec Daily

Cybersecurity Brief – 2025-10-23

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2025-09-16

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry