Fortra on DanSec Daily

Cybersecurity Brief – 2026-10-03

Sat, 03 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Frontline Education suffered a data breach affecting school district employees after attackers exploited a vulnerability in third-party software to gain unauthorized access and steal employee information ^[5].
The Warlock ransomware group, linked to China, targeted a water utility, a telecom provider, a regional government body, and a university by exploiting SharePoint vulnerabilities for initial access ^[6].
U.S. Treasury sanctioned eight members of the Tren de Aragua gang for involvement in ATM jackpotting attacks resulting in the theft of millions of dollars across the United States and Europe ^[8].
Fake Zoom installers targeting macOS users were observed delivering the CloudSyncD backdoor, using a universal Mach-O binary extracted at runtime ^[22].

Newly Discovered Vulnerabilities

GitLab patched a critical remote code execution vulnerability (CVSS 9.9) in its AI Gateway service that allowed a logged-in user with Duo Agent Platform access to execute commands on self-hosted servers ^[2]^[7].
Dell released updates for multiple critical flaws in its Container Storage Modules (CSM) that could allow unauthenticated attackers to gain admin access and root privileges on Kubernetes nodes ^[4].
Fortra addressed critical vulnerabilities in BoKS that could result in authentication bypass, shell command execution, and memory corruption ^[20].
Middleware used in SWIFT banking and government environments was found to enable remote code execution, with the risk of hardware-based MFA bypass if unpatched ^[12].
Kiteworks patched over 100 vulnerabilities in its data-protection platform following reports of attacks and advisories to power down systems during remediation ^[11]^[21].

Notable Threat Actor Activity

A China-nexus espionage campaign deployed the Antino backdoor, using Microsoft Outlook and OneDrive for command and control targeting government and policy organizations across Asia ^[3].
Malicious Linux implants were discovered mimicking Asian mail security products, making detection difficult due to their resemblance to legitimate edge solutions ^[16].
AI policy experts were targeted in phishing attacks ^[21].

Trends, Tools, or Tactics of Interest

Browser-based attacks are increasingly able to evade endpoint detection and response (EDR) telemetry by stealing sessions, abusing extensions, or manipulating users without leaving traditional endpoint artifacts ^[9].
Offensive cyber operations are evolving, with startups like RemoteThreat advancing red teaming to simulate more sophisticated attacker techniques beyond traditional methods ^[10].
The security community is emphasizing the need for clear asset ownership to address vulnerability backlogs, as lack of ownership hinders remediation efforts ^[15].
The proliferation of cloud, AI, and distributed systems is increasing the complexity of cybersecurity environments, particularly in identity management ^[1].
AI agents such as Muse are raising privacy concerns due to their ability to create detailed profiles of users’ contacts ^[17].
New platforms are emerging to prevent AI agent misbehavior online, such as doxx.net’s ADN platform designed to mitigate agentic misadventure ^[19].
Adblocker software was found spying on AI chat sessions ^[21].

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Treasury’s sanctions on Tren de Aragua members represent an increased regulatory focus on transnational cybercrime and ATM fraud ^[8].
Discussions are ongoing regarding upcoming regulatory and governance challenges in the context of artificial intelligence, with industry analysts forecasting increased accountability and security requirements for AI systems by 2027 ^[13].
The Microsoft 2026 Digital Defense Report was published, providing insights into current and anticipated security threats ^[21].

Sources

Frontline Education breach exposes school district employee data - bleepingcomputer.com
Warlock ransomware breach SharePoint in water, telecom operator attacks - bleepingcomputer.com
US sanctions Tren de Aragua gang members in ATM hacks crackdown - bleepingcomputer.com
macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor - securityweek.com
GitLab Patches Critical 9.9 AI Gateway Flaw Allowing Command Execution on Self-Hosted Servers - thehackernews.com
GitLab warns of critical RCE vulnerability in AI Gateway service - bleepingcomputer.com
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes - thehackernews.com
Fortra Patches Critical Vulnerabilities in BoKS - securityweek.com
SWIFT Banking & Government Middleware Enables RCE - darkreading.com
Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response - darkreading.com
In Other News: $15K iCloud Spoofing Bugs, AI Policy Experts Phished, Adblocker Spies on AI Chats - securityweek.com
Antino Backdoor Uses Outlook and OneDrive for C2 in China-Nexus Espionage Campaign - thehackernews.com
Malicious Linux Implants Mimic Asian Mail Security Products - darkreading.com
The EDR blind spot: 3 ways browser attacks evade endpoint telemetry - bleepingcomputer.com
RemoteThreat Bets Security Teams Need to Test What Happens After Defenses Fail - darkreading.com
Vulnerability Backlogs Are an Ownership Problem - darkreading.com
The State of Cybersecurity in 2026: Key Segments, Insights, and Innovations - thehackernews.com
Muse Creates Detailed Profiles of All Your Friends and Family - wired.com
doxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet Misadventures - securityweek.com
Is Your Organization Ready for 2027's AI Accountability Era? - darkreading.com

Cybersecurity Brief – 2025-10-12

Sun, 12 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall SSL VPN devices: Huntress reported a widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into over 100 customer environments to access internal systems.
Gladinet CentreStack and TrioFox: Active exploitation of a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox products has been observed, allowing unauthenticated local file access and potential escalation to remote code execution. The flaw remains unpatched.
BreachForums Takedown: The FBI seized all domains of the BreachForums hacking forum operated by the ShinyHunters group, which was used for leaking data from ransomware and extortion attacks, including recent Salesforce-related incidents.
AI Companion Apps Data Leak: Two AI “girlfriend” apps exposed millions of private chat logs belonging to over 400,000 users.
Oracle EBS Zero-Day Attacks: Sophisticated malware was deployed in attacks exploiting a zero-day in Oracle E-Business Suite (EBS), affecting dozens of organizations since at least 10 July.
Discord Age-Verification Data Exposure: A hack exposed sensitive age-verification data of Discord users.
Manufacturing Sector Ransomware: Reports highlight continued ransomware attacks targeting the manufacturing industry, with attackers exploiting unpatched vulnerabilities.
US Universities Payroll Attacks: US universities were targeted by attackers hijacking HR SaaS accounts to divert payroll payments, attributed to the Storm-2657 threat actor.

Newly Discovered Vulnerabilities

Juniper Networks Junos Space: More than 200 vulnerabilities, including nine critical-severity flaws, were patched in Junos Space and Junos Space Security Director.
Ivanti Endpoint Manager: The Zero Day Initiative (ZDI) disclosed 13 unpatched vulnerabilities in Ivanti Endpoint Manager, enabling remote code execution and privilege escalation.
GoAnywhere MFT (CVE-2025-10035): Fortra detailed active exploitation of this critical flaw in GoAnywhere Managed File Transfer, which has since been patched.
Node.js SEA Feature Abuse: The Stealit malware campaign uses Node.js’ Single Executable Application feature to distribute payloads via trojanized game and VPN installers.
Malicious npm Packages: 175 malicious npm packages with over 26,000 downloads were found harvesting credentials as part of a phishing campaign.

Notable Threat Actor Activity

North Korean IT Worker Schemes: North Korean threat actors have expanded fraudulent remote employment operations to target a broad range of industries, including architectural design, using fake identities and documentation.
LockBit/Storm-2603: The LockBit ransomware group (Storm-2603) has been observed abusing the Velociraptor DFIR tool to maintain persistence and facilitate attacks.
Storm-2657: This actor is actively hijacking HR SaaS accounts to redirect payroll payments, targeting a variety of organizations, including universities.
Coordinated Attacks on Network Devices: Infrastructure linked to coordinated attacks is being used to exploit vulnerabilities in Cisco, Fortinet, and Palo Alto Networks devices.
RondoDox Botnet: The RondoDox botnet employs over 50 exploits in a “shotgun” approach to compromise routers, DVRs, NVRs, CCTV systems, and other edge devices globally.
Aisuru DDoS Botnet: The Aisuru botnet is responsible for record-setting DDoS attacks against US ISPs, leveraging large numbers of compromised IoT devices.

Trends, Tools, or Tactics of Interest

Abuse of Legitimate Tools: Increased weaponization of legitimate digital forensics and incident response tools (e.g., Velociraptor) by ransomware groups for persistence and post-exploitation.
AI and Deepfake Threats: OpenAI’s new video and audio generation system raises concerns about the proliferation of deepfakes. Organizations report high awareness but insufficient investment in deepfake detection capabilities.
AI in Security Operations: Advancements in AI-powered Security Operations Center (SOC) platforms, with Microsoft introducing agentic AI capabilities in Sentinel, and the emergence of AI browser agents presenting new authentication challenges.
Supply Chain Risks: Discovery of malicious packages in npm and abuse of Node.js SEA highlight ongoing supply chain threats to software development environments.
Password Guidance: NIST updates suggest a shift away from overly complex password requirements, focusing on usability and security balance.

Regulatory or Policy Developments Affecting the Security Industry

Apple Bug Bounty Expansion: Apple has doubled its maximum bug bounty payout to $2 million for zero-click RCE vulnerabilities, introduced new research categories, and increased transparency in its rewards structure. Total payouts have reached $35 million, with bonuses for iPhone exploits potentially raising rewards to $5 million.
Windows 11 23H2 End of Support: Microsoft reminded users that Home and Pro editions of Windows 11 23H2 will stop receiving security updates next month.
Chrome Notification Permissions: Google Chrome will automatically revoke notification permissions for inactive websites to reduce notification spam.
Age-Verification Law Privacy Concerns: Apple raised privacy concerns regarding proposed age-verification laws, citing risks associated with increased sensitive data collection.

Cybersecurity Brief – 2025-10-11

Sat, 11 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has seized all domains associated with BreachForums, operated by the ShinyHunters group, which was used as a portal for leaking corporate data obtained through ransomware and extortion attacks, including recent Salesforce-related incidents. Despite the takedown, ShinyHunters continues to issue extortion threats against Salesforce victims.
Two AI companion applications exposed millions of private chat records from over 400,000 users due to inadequate security controls.
A critical zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox file sharing products is being actively exploited in the wild, allowing unauthenticated local attackers to access system files.
Sophisticated malware has been deployed in Oracle E-Business Suite (EBS) zero-day attacks, with exploitation believed to have started as early as July 10 and affecting dozens of organizations.
A large-scale DDoS attack was launched by the Aisuru botnet, leveraging compromised IoT devices hosted on major US ISPs.
Microsoft has observed a threat actor, Storm-2657, hijacking HR SaaS accounts to divert employee salary payments to attacker-controlled accounts; US universities have been specifically targeted in these payroll diversion attacks.

Newly Discovered Vulnerabilities

Fortra disclosed details of active exploitation of CVE-2025-10035, a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
13 unpatched vulnerabilities in Ivanti Endpoint Manager have been publicly released by the Zero Day Initiative (ZDI), permitting remote code execution and privilege escalation.
Juniper Networks released patches for over 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
175 malicious npm packages, collectively downloaded over 26,000 times, have been used in a credential phishing campaign.
Security researchers have detailed an active Stealit malware campaign abusing the Node.js Single Executable Application (SEA) feature, distributed via game and VPN installers.

Notable Threat Actor Activity

North Korean threat actors have expanded their fraudulent remote employment schemes to target nearly every industry hiring remote workers, including architectural design roles, using fake identities and documentation.
Chinese APT group Storm-2603 is abusing the Velociraptor digital forensics and incident response (DFIR) tool to gain persistent access to victim networks and facilitate ransomware deployment.
A coordinated campaign has been identified targeting Cisco, Fortinet, and Palo Alto Networks devices, with attacks originating from shared infrastructure.
The RondoDox botnet employs a “shotgun” approach, using more than 50 exploits against unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices globally.

Trends, Tools, or Tactics of Interest

AI-generated deepfakes are proliferating, with OpenAI releasing an updated AI video and audio generation system, raising concerns about the acceleration and accessibility of deepfake creation.
The security industry is experiencing inadequate investment in deepfake detection, despite high organizational awareness and frequent encounters with AI-augmented threats.
Security Operations Centres (SOCs) are increasingly integrating AI-powered agents, with projections indicating significant transformation in SOC workflows by 2026.
Microsoft has added agentic AI capabilities to its Sentinel platform, previewing new security graph and MCP server features.
Attackers are leveraging malicious npm packages and abusing legitimate software features (e.g., Node.js SEA) to distribute malware and harvest credentials.
1Password addressed a critical security gap in its AI browser agent, which posed risks of credential leakage.
Timely patch management is highlighted as a key defense against escalating ransomware attacks on manufacturing and industrial control system (ICS) environments.

Regulatory or Policy Developments Affecting the Security Industry

Apple has expanded its bug bounty program, doubling the maximum payout to $2 million for zero-click remote code execution vulnerabilities, with potential bonuses raising the maximum to $5 million. The program now includes new research categories and a more transparent reward structure.
Microsoft reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 30 days, after which security updates will cease.
Google Chrome will automatically revoke notification permissions for inactive websites to reduce user alert fatigue.
Apple voiced concerns over proposed age-verification laws, warning that increased data collection for compliance could heighten user privacy risks.
NIST is revising password guidance, indicating that excessively complex password requirements may no longer be necessary.

Cybersecurity Brief – 2025-10-08

Wed, 08 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Salesforce has confirmed a widespread data theft attack affecting its customers, stating it will not pay ransom to the threat actors. The ShinyHunters group is linked to the exfiltration of over a billion records from Salesforce customers and has launched a data leak site to extort victims.
Electronics distributor Avnet disclosed a data breach, noting that stolen data is unreadable without proprietary tools.
BK Technologies, a public safety communications firm, reported an IT intrusion and subsequent data theft.
CPAP Medical suffered a data breach exposing personal and health information of over 90,000 military patients, troops, veterans, and their families.
Discord has warned users of a third-party breach resulting in the theft of names, emails, limited billing information, and some government-ID images.
DraftKings notified customers of account breaches following a credential stuffing attack.
North Korean hackers have reportedly stolen over $2 billion in cryptocurrency assets in 2025, the largest annual total recorded.
Asahi brewery in Japan experienced a ransomware attack that disrupted domestic operations and led to a beer shortage.

Newly Discovered Vulnerabilities

Redis disclosed a critical, 13-year-old vulnerability (CVSS 10.0), tracked as “RediShell,” allowing remote code execution under certain conditions. Over 60,000 servers are currently at risk, with more than 300,000 instances exposed globally.
FreePBX (CVE-2025-57819) is affected by a code execution vulnerability via its web-based admin interface.
Oracle E-Business Suite (EBS) zero-day vulnerability has been exploited by the Clop ransomware gang for data theft since at least early August.
The Year 2038 (Y2K38) bug has been highlighted as a vulnerability that could be exploited in ICS and consumer devices well before the date is reached.

Notable Threat Actor Activity

Microsoft attributed the exploitation of a critical Fortra GoAnywhere MFT vulnerability to the Storm-1175 threat actor, leading to Medusa ransomware deployment. Exploitation began one week before patches were released and reportedly requires a private key.
The Clop ransomware gang exploited a critical Oracle EBS zero-day in data theft operations.
BatShadow, a Vietnamese threat actor, is using a new Go-based malware (“Vampire Bot”) targeting job seekers and digital marketing professionals via social engineering.
OpenAI disrupted three clusters of activity by Russian, North Korean, and Chinese threat actors misusing ChatGPT for malware development.
Security research exposed BIETA and CIII, Beijing-based research institutes, as developers and suppliers of technology supporting Chinese intelligence and military cyber operations.

Trends, Tools, or Tactics of Interest

Microsoft reported a new phishing campaign leveraging AI tools to obfuscate payloads and evade detection.
Researchers observed an uptick in spam and malicious emails using hidden content to bypass security filters.
XWorm 6.0 malware has emerged with over 35 plugins, enhancing its data theft and modular attack capabilities.
AI is identified as the leading data exfiltration channel in enterprise environments, according to new research.
Security teams are adopting AI-powered breach and attack simulation tools to rapidly test and validate defences against emerging threats.
Google DeepMind announced “CodeMender,” an AI agent that detects, patches, and rewrites vulnerable code.
AI-assisted penetration testing is now mainstream, with 70% of surveyed security researchers using AI tools, as reported by HackerOne.
Google launched an AI Vulnerability Reward Program, offering up to $30,000 for reported AI system flaws.
Google decided not to patch a new ASCII smuggling attack in its Gemini AI assistant, which could be used to manipulate responses or alter model behaviour.

Regulatory or Policy Developments Affecting the Security Industry

Docker announced affordable, unlimited access to its Hardened Images catalog for startups and SMBs to support secure development.
Microsoft is removing additional methods to bypass Microsoft account requirements in Windows 11 installations.
Significant cybersecurity M&A activity was reported in September 2025, with major deals involving Check Point, CrowdStrike, F5, Mitsubishi Electric, and SentinelOne.

Cybersecurity Brief – 2025-10-07

Tue, 07 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Red Hat suffered a data breach, with the ShinyHunters extortion group leaking samples of stolen customer engagement reports (CERs) and threatening further exposure.
Discord disclosed that user information, including names, usernames, email addresses, contact details, IP addresses, and billing information, was compromised via a third-party data breach.
Doctors Imaging Group notified approximately 171,000 individuals of a cybersecurity incident that occurred nearly a year ago.
Beer giant Asahi reported a ransomware attack resulting in data theft and disruption to operations at its Japanese subsidiaries, forcing a shift to manual order processing and shipment.
Salesforce faced extortion attempts after data from dozens of customers was stolen; Salesforce stated these relate to past or unsubstantiated incidents, not new intrusions.

Newly Discovered Vulnerabilities

Oracle E-Business Suite: A critical remote code execution vulnerability (CVE-2025-61882) has been exploited in the wild by the Cl0p ransomware group. Oracle has released an emergency patch.
GoAnywhere MFT: Microsoft reported that Storm-1175 has been exploiting a maximum severity vulnerability in GoAnywhere MFT for Medusa ransomware attacks for nearly a month.
Redis: The Redis security team released patches for a maximum-severity vulnerability that could allow remote code execution on thousands of exposed instances.
Unity Game Engine: A code execution vulnerability in the Unity engine could enable attackers to gain code execution on Android and privilege escalation on Windows. Microsoft and Steam have issued warnings and are taking action.
Zimbra: Attackers exploited a zero-day vulnerability in Zimbra via ICS files, targeting Brazilian military entities.
BitLocker Bypass and VMScape vulnerabilities were also highlighted in recent security roundups.

Notable Threat Actor Activity

Cl0p ransomware group exploited Oracle E-Business Suite zero-day (CVE-2025-61882) for data theft and extortion attacks.
ShinyHunters is actively extorting Red Hat following their data breach.
Storm-1175 exploited GoAnywhere MFT vulnerabilities in Medusa ransomware campaigns.
Chinese-speaking cybercrime group UAT-8099 is running a global SEO fraud operation using compromised IIS servers, stealing high-value credentials.
XWorm malware resurfaced with a ransomware module and over 35 plugins, distributed via phishing campaigns.
Water Saci campaign deployed self-propagating malware (Sorvepotel) via WhatsApp in Brazil, targeting financial institutions.
Phishing campaigns are targeting 1Password users with convincing fake breach alert emails.
A threat actor impersonating the Libyan Navy’s Office of Protocol targeted Brazil’s military using Zimbra zero-day exploits.

Trends, Tools, or Tactics of Interest

AI-driven phishing and social engineering attacks are cited as a top concern by nearly 40% of surveyed security leaders.
Machine learning models for detecting DLL hijacking have been developed and integrated into Kaspersky SIEM, enabling early incident detection.
Increased use of AI in cybersecurity, including open-source XDR/SIEM platforms like Waziuh and the risk of insecure AI-generated code (“vibe coding”).
XWorm’s modular architecture and plugin system highlight evolving malware sophistication.
High-profile phishing and social engineering attacks continue to leverage realistic lures and automation.
Self-propagating malware targeting messaging platforms (e.g., WhatsApp) is being used for credential theft and financial fraud.
The launch of the Zeroday.Cloud hacking competition offers $4.5 million in bounties for exploits targeting open-source cloud and AI tools.

Notable Threat Actor Attribution

CrowdStrike attributes recent Oracle EBS exploitation to Graceful Spider (aka Cl0p).
Chinese research firms BIETA and CIII have been linked to the Ministry of State Security (MSS) and assessed as fronts for PRC cyber operations.
Reports highlight Chinese government fronts collaborating with Western organisations to acquire cyber technologies for state intelligence purposes.

Regulatory or Policy Developments Affecting the Security Industry

LinkedIn has filed a lawsuit against ProAPIs Inc. and its founder for scraping user data via over one million fake accounts, addressing large-scale data harvesting.
Compliance training updates and frameworks (e.g., KnowBe4’s Compliance Plus and the DEEP Matrix for unified defence) are being promoted to address evolving human risk management and regulatory requirements.

Cybersecurity Brief – 2025-09-27

Sat, 27 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Volvo and two other international vehicle manufacturers suffered supply chain cyberattacks in the past month, resulting in the theft of Volvo employee Social Security Numbers in a ransomware attack.
Hackers stole data on 8,000 nursery children and contacted their parents directly, demanding ransom payments under threat of leaking the children’s information.
A South Korean credit card company was hacked, and the Maryland Transit Administration experienced a ransomware attack. The UK’s Co-op lost £206 million due to a cyberattack.
Flo Health and Google agreed to pay $56 million to settle lawsuits over the period-tracking app Flo sharing sensitive users’ health data for advertising purposes.
Neon Mobile, a popular US app, pays users to record their phone calls and then sells this data for AI training.

Newly Discovered Vulnerabilities

A critical vulnerability (CVE-2025-10035, CVSS 10) in Fortra’s GoAnywhere Managed File Transfer (MFT) software was exploited as a zero-day at least eight days prior to public disclosure, allowing unauthenticated remote command injection and the creation of backdoor admin accounts.
Multiple vulnerabilities in Cognex industrial cameras allow for remote hacking; no patches are available, and customers are advised to migrate to newer models.
Google Project Zero highlighted the risk of pointer leaks through pointer-keyed data structures, which can undermine ASLR protections and facilitate remote exploitation.

Notable Threat Actor Activity

The Russian APT group COLDRIVER launched a new campaign using ClickFix-style attacks to deliver two new lightweight malware families.
Iranian APTs, including the Charming Kitten offshoot Subtle Snail, have been observed signing malware with valid code-signing certificates issued by SSL.com.
North Korean threat actors are posing as recruiters to steal developers’ identities and provide these to fraudulent IT workers.
A phishing campaign impersonating Ukrainian government agencies is distributing CountLoader, which subsequently deploys Amatera Stealer and PureMiner malware. PureRAT phishing threats are also targeting Vietnam.
LockBit 5.0 ransomware activity continues to be reported.

Trends, Tools, or Tactics of Interest

The XCSSET macOS malware has a new variant with a four-stage infection chain, an additional persistence mechanism, and new targeting of Firefox browser data, including cryptocurrency transaction hijacking.
Microsoft Edge will introduce a feature to block malicious sideloaded browser extensions.
Generative AI deployments are increasingly recognised as introducing new cyber risks, including phishing, fraud, and model manipulation.
North Korean threat actors are leveraging social engineering by masquerading as recruiters to facilitate identity theft for use by IT worker proxies.
Interpol arrested 260 suspects in Africa involved in online romance scams that used relationship-building to extort or blackmail victims.
A new tool, convert-ts-bash-history.py, has been released to facilitate quick timeline analysis from bash histories.
Breach and Attack Simulation (BAS) is highlighted as an effective method for validating security controls beyond theoretical design.
The Neon Mobile app’s business model of incentivising users to record and sell their phone call data for AI training is drawing privacy concerns.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft has restricted access to cloud and AI products for a unit within the Israeli military, following an internal review linking these services to mass surveillance activities in Gaza.
U.S. President Donald Trump signed an executive order approving the restructuring of TikTok’s U.S. operations to address national security concerns, transferring control to U.S. investors.
Google and Flo Health face regulatory enforcement, agreeing to a $56 million settlement over improper sharing of sensitive health data.
Cognex is recommending customers transition to newer products due to unpatched vulnerabilities in its industrial cameras.

Cybersecurity Brief – 2025-09-23

Tue, 23 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

A ransomware attack against a third-party provider disrupted check-in and boarding systems at multiple major European airports, including Heathrow, causing widespread delays and flight cancellations. Collins Aerospace is reportedly facing recovery challenges following the incident.
Stellantis, a major automotive manufacturer, confirmed a data breach involving the compromise of North American customer data after attackers accessed a third-party service provider’s Salesforce environment.
A vulnerability in the American Archive of Public Broadcasting’s website allowed unauthorized downloading of protected and private media for several years before being patched this month.
The FBI issued a warning about a spoofed IC3 (Internet Crime Complaint Center) website being used by threat actors for personal information theft and fraudulent activities.
A verified Steam game, BlockBlasters, was used to steal $32,000 in cryptocurrency donations intended for a streamer’s cancer treatment.

Newly Discovered Vulnerabilities

Fortra released a patch for a critical deserialization vulnerability (CVE-2025-10035, CVSS 10) in GoAnywhere MFT, which could allow command injection.
Researchers demonstrated a new “L1TF Reloaded” exploit combining L1TF and half-Spectre hardware flaws, enabling data leakage from public cloud environments by bypassing existing software mitigations.
A new proof-of-concept tool, EDR-Freeze, leverages Microsoft’s Windows Error Reporting (WER) system to suspend endpoint security software from user mode, allowing attackers to evade detection.
A Chrome 0-day vulnerability was highlighted in recent security recaps, with attackers rapidly adopting new exploitation techniques.
Microsoft resolved a Windows 11 face detection bug that had blocked updates to version 24H2 on affected devices.
Microsoft acknowledged recent updates causing DRM video playback issues in some applications.

Notable Threat Actor Activity

The previously undocumented group “ComicForm,” along with SectorJ149, has been conducting phishing campaigns deploying Formbook malware against organizations in Belarus, Kazakhstan, and Russia since at least April 2025.
Iran-linked threat actor “Nimbus Manticore” (UNC1549/Smoke Sandstorm) has deployed improved malware variants in campaigns targeting European organizations, expanding beyond its typical focus region.
Widespread infostealer campaigns are targeting macOS users-especially LastPass customers-via malicious GitHub repositories, delivering Atomic infostealer through SEO poisoning and fake pages.
Attackers are increasingly using multi-channel phishing tactics, moving beyond email to social media, chat applications, and malicious ads to steal credentials.
Zelle transfer scams continue to be active, with ongoing reports of fraudulent activity.

Trends, Tools, or Tactics of Interest

Security researchers demonstrated that ChatGPT can be manipulated into solving CAPTCHAs by framing them as non-security-related tasks.
The rise of autonomous AI agents in security operations is evidenced by funding announcements for new platforms such as Mycroft and HoundBytes, both leveraging AI to automate security and compliance tasks.
The “EDR-Freeze” tool exemplifies a trend in attackers exploiting legitimate system features (Windows WER) to evade endpoint detection and response (EDR) products.
Zero trust remains a prominent strategy in response to AI-driven attacks, quantum computing threats, and the proliferation of connected devices.
Mozilla introduced a rollback feature for Firefox extension developers, enabling rapid mitigation of faulty or malicious add-on updates.

Regulatory or Policy Developments

No significant regulatory or policy developments were identified in the provided headlines.

Cybersecurity Brief – 2025-09-21

Sun, 21 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-nexus cyber espionage group, compromised 34 devices across 11 European telecommunications firms using LinkedIn job lures and the MINIBIKE malware.
Over 600,000 individuals were impacted by healthcare data breaches in the past day, with additional major intrusions attributed to the ShinyHunters group.
The Royal Canadian Mounted Police dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million linked to criminal activity.
FBI issued an alert regarding cybercriminals impersonating the FBI’s Internet Crime Complaint Center (IC3) via fake reporting portals for malicious purposes.

Newly Discovered Vulnerabilities

Fortra released a critical patch for a command injection vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT) software, specifically in its License Servlet. Exploitation enables arbitrary command execution.
OpenAI’s ChatGPT Deep Research agent was found vulnerable to a zero-click flaw, allowing attackers to exfiltrate Gmail inbox data via a single crafted email. The vulnerability has since been patched.
Novakon HMIs were reported to have unpatched remote code execution and information exposure vulnerabilities, exposing industrial control systems to remote attacks.
A critical vulnerability was disclosed and fixed in Microsoft Azure Entra ID that could have enabled catastrophic identity and access management attacks if exploited.

Notable Threat Actor Activity

Russian APT groups Turla and Gamaredon, both linked to the FSB, were observed collaborating to compromise high-profile Ukrainian targets. Turla deployed malware on systems previously accessed by Gamaredon, including the Kazuar backdoor.
The Iranian APT group, including a Charming Kitten subgroup, conducted sophisticated cyberattacks targeting telecommunications and satellite companies, using bespoke targeting techniques.
The Scattered Spider group had two suspected members arrested in the UK, with one charged in the US for hacking critical infrastructure.
SystemBC malware is powering the REM Proxy botnet, leveraging approximately 1,500 daily VPS victims and 80 C2 servers to provide proxy services to threat actors.

Trends, Tools, or Tactics of Interest

A phishing-as-a-service (PhaaS) surge was observed, with Lighthouse and Lucid platforms linked to over 17,500 phishing domains targeting 316 brands across 74 countries.
Atomic Infostealer is being distributed to macOS users via fake GitHub repositories, with campaigns targeting LastPass users.
Researchers identified the earliest known malware, codenamed MalTerminal, embedding GPT-4 LLM capabilities for automated ransomware creation and reverse shell generation.
CISA published an analysis of malware kits deployed in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, detailing tactics such as system information collection, credential dumping, and arbitrary code execution.
Ransomware attacks continue to evade defenses, with prevention rates dropping to 62% and data exfiltration prevention at only 3%, per the Picus Blue Report 2025.
Synthetic identity fraud is resurging in the finance and lending sector, with estimated damages reaching $3.3 billion from new accounts.
ChatGPT was demonstrated to be capable of solving CAPTCHAs and mimicking human cursor behaviour, highlighting risks in automated abuse of AI agents.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and reaching a valuation of $8.6 billion.
Valve announced Steam will end support for 32-bit Windows in January 2026, affecting software compatibility and potentially security posture for legacy systems.

Cybersecurity Brief – 2025-09-20

Sat, 20 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-linked cyber espionage group, successfully infiltrated 34 devices across 11 European telecommunications organisations using LinkedIn job lures and the MINIBIKE malware.
Russian threat groups Gamaredon and Turla collaborated in a campaign targeting Ukrainian entities, with Turla malware deployed on systems previously compromised by Gamaredon.
Over 600,000 individuals were impacted by recent healthcare sector breaches; ShinyHunters was identified as responsible for major attacks.
The FBI issued a warning about cybercriminals creating fake FBI Internet Crime Complaint Center (IC3) portals for malicious activity.
The REM Proxy botnet, powered by SystemBC malware, currently controls approximately 1,500 VPS victims daily via 80 C2 servers.
A surge in phishing-as-a-service (PhaaS) operations, notably Lighthouse and Lucid, has resulted in over 17,500 phishing domains targeting 316 brands in 74 countries.

Newly Discovered Vulnerabilities

Fortra disclosed and patched a critical vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT), allowing remote command injection via the License Servlet.
A zero-click vulnerability in OpenAI ChatGPT’s Deep Research agent enabled attackers to exfiltrate Gmail inbox data through a crafted email. OpenAI has since patched the issue.
Novakon Human-Machine Interfaces (HMIs) were found to have unpatched remote code execution and information exposure vulnerabilities.
A critical flaw in Microsoft Azure Entra ID was disclosed and fixed; it could have enabled catastrophic identity and access management attacks.
CISA released an analysis of malware kits used in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, where attackers chained two flaws to collect system information, dump credentials, and execute malware.

Notable Threat Actor Activity

Iranian APT group UNC1549 targeted European telecom and satellite companies with highly bespoke attacks, leveraging LinkedIn lures and custom malware.
Russian APTs Gamaredon and Turla collaborated to compromise Ukrainian organisations, with evidence of sequential deployment of their respective malware.
Scattered Spider group members were arrested in the UK and charged in the US for attacks on critical infrastructure organisations.

Trends, Tools, or Tactics of Interest

Researchers identified the earliest known malware (MalTerminal) embedding GPT-4-powered LLM capabilities, enabling autonomous creation of ransomware and reverse shells.
ChatGPT was demonstrated as capable of solving CAPTCHAs and mimicking human cursor movement, highlighting ongoing risks of AI-driven automation in bypassing security controls.
Ransomware continues to evade defences, with latest data showing only 62% prevention rates and data exfiltration prevention dropping to 3%.
Synthetic identity fraud in the finance and lending sector is rising post-pandemic, with estimated damages reaching $3.3 billion from new accounts.
The Tines platform released over 1,000 pre-built AI-driven security automation workflows, facilitating automated alert triage and response using AI agents and Confluence SOPs.
Industrial automation systems remain a high-value target, with Kaspersky reporting a broad range of malicious objects detected on ICS computers in Q2 2025.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and achieving a valuation of $8.6 billion.
Valve announced that Steam will end support for 32-bit Windows systems in January 2026, impacting legacy software environments.