Gladinet on DanSec Daily

Cybersecurity Brief – 2025-12-19

Fri, 19 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The University of Sydney suffered a data breach after attackers accessed an online coding repository, resulting in the theft of files containing personal information of staff and students.
The Richmond Behavioral Health Authority (Virginia, US) experienced a ransomware attack, with threat actors stealing names, Social Security numbers, and financial and health information of 113,000 individuals.
French authorities arrested two crew members from an Italian passenger ferry for allegedly installing malware enabling remote control of the vessel. France’s counterespionage agency is investigating the incident as suspected foreign interference.
The US Department of Justice seized the E-Note cryptocurrency exchange, which was allegedly used to launder over $70 million in ransomware payments.

Newly Discovered Vulnerabilities

Hewlett Packard Enterprise (HPE) patched a critical vulnerability (CVE-2025-37164, CVSS 10.0) in OneView software allowing unauthenticated remote code execution.
SonicWall SMA1000 devices were found to be vulnerable to a zero-day flaw that has been exploited in the wild. Attackers chained this with a previously disclosed critical vulnerability to achieve remote code execution. SonicWall has released a patch.
A UEFI vulnerability affecting ASRock, Asus, Gigabyte, and MSI motherboards allows early-boot DMA attacks, exposing systems to compromise before the operating system loads.
CISA issued a warning regarding CVE-2025-59374, a supply chain backdoor in Asus Live Update, which has been exploited in the wild.
Microsoft confirmed that recent Windows updates have caused issues with Azure Virtual Desktop RemoteApp sessions and broke Message Queuing (MSMQ) functionality in Windows 11 and 10.
Automated password spraying attacks are targeting Cisco SSL VPN and Palo Alto Networks GlobalProtect VPN gateways.
A Chrome extension marketed for privacy was found to collect and exfiltrate users’ AI chat data after installation.

Notable Threat Actor Activity

The China-aligned APT group LongNosedGoblin was identified targeting governmental entities in Southeast Asia and Japan, using Windows Group Policy to deploy espionage malware across networks.
North Korea-linked threat actors, including Kimsuky, were responsible for at least $2.02 billion in global cryptocurrency theft in 2025. Kimsuky has also been observed distributing a new Android malware variant, DocSwap, via QR phishing campaigns impersonating Seoul-based delivery apps.
The Clop ransomware group is targeting Gladinet CentreStack file servers exposed to the internet, conducting data theft and extortion operations.
The Iranian APT group “Prince of Persia,” previously considered dormant, has been confirmed active, employing advanced operational security and cryptographic C2 communications to spy on dissidents.
WhatsApp account hijacking attacks using “GhostPairing” are ongoing, where attackers trick users into linking their accounts to attacker-controlled browsers via fake login prompts.
WeChat phishing attacks are increasing outside China, leveraging the platform’s wide functionality for social engineering.

Trends, Tools, or Tactics of Interest

AI-powered deepfake technologies are increasingly accessible, enabling realistic impersonation in video and audio, which is being leveraged for fraud and social engineering.
Ultra-realistic AI face-swapping platforms, such as “Haotian”, are being used to facilitate romance scams, with live video face swaps making detection difficult.
Attackers are refining credential-based attacks, evidenced by new password spraying campaigns against major VPN gateways.
There is a trend of exploiting supply chain vulnerabilities, as seen with the Asus Live Update backdoor.
The adoption of AI copilots and agents in SaaS applications is rising, increasing the attack surface and driving demand for dynamic AI-SaaS security measures.

Regulatory or Policy Developments Affecting the Security Industry

NIS2 compliance is placing increased emphasis on strong identity and access controls, with weak passwords and inadequate multi-factor authentication now considered compliance risks.
The US Immigration and Customs Enforcement (ICE) agency is seeking to expand its cybersecurity capabilities for enhanced internal monitoring and investigation of employees, reflecting a broader trend of increased internal surveillance in government agencies.

Cybersecurity Brief – 2025-12-13

Sat, 13 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang suffered a data breach affecting 33.7 million customers, traced to a former employee who retained internal system access after departure.
Fieldtex Products experienced a data breach impacting 238,000 individuals, with the Akira ransomware group claiming responsibility for stealing 14 GB of data.
At least nine organizations were compromised through exploitation of a recently patched Gladinet CentreStack vulnerability.
A fake torrent for “One Battle After Another” was used to distribute Agent Tesla RAT malware via malicious subtitle files.
Google ads are being abused to direct Mac users to malicious AI chat sites, resulting in the distribution of the Atomic macOS Stealer (AMOS).
The US government’s policy of publishing H-1B applicant social accounts has raised significant privacy concerns, exposing personal data to potential targeting, impersonation, and extortion.

Newly Discovered Vulnerabilities

Apple released emergency security updates to patch two zero-day WebKit vulnerabilities, both exploited in sophisticated attacks targeting specific individuals.
Two new types of vulnerabilities in React Server Components (RSC) were patched by the React team; these could lead to denial-of-service or source code exposure.
The React2Shell vulnerability (CVE-2025-55182) is under widespread exploitation, prompting emergency mitigation efforts and a CISA directive for federal agencies to patch by 12 December 2025. Some proof-of-concept exploits can bypass web application firewall (WAF) rules.
A new Windows zero-day vulnerability affecting the Remote Access Connection Manager (RasMan) service has been disclosed, with unofficial patches made available.
A critical GeoServer vulnerability is being actively exploited in XML External Entity (XXE) injection attacks, with CISA ordering immediate patching.
Notepad++ patched a vulnerability in its updater mechanism that allowed for update file authentication bypass and potential traffic hijacking.
Kali Linux 2025.4 released with three new hacking tools and desktop environment updates.
Zigbee protocol security assessment revealed two application-level attack vectors that can be exploited to remotely turn Zigbee endpoints on or off.

Notable Threat Actor Activity

North Korean threat actors are conducting job invitation scams via social media platforms such as Threads, going beyond typical fake employer scams.
Fake OSINT and GPT utility repositories on GitHub are being used to distribute a new, previously undocumented JavaScript-based remote access trojan (PyStoreRAT).
Supply chain attacks targeting GitHub Actions have increased in 2025, with researchers urging adoption of a shared responsibility model for open source security.
At least nine organizations were compromised by threat actors exploiting the Gladinet CentreStack vulnerability.
Criminals are leveraging malicious subtitle files in torrents and poisoned AI chat sites via Google ads to spread Agent Tesla RAT and Atomic macOS Stealer, respectively.

Trends, Tools, or Tactics of Interest

Advanced phishing kits (BlackForce, GhostFrame, InboxPrime AI, Spiderman) are using AI and multi-factor authentication (MFA) bypass techniques to facilitate large-scale credential theft.
Email-based phishing kits now leverage Telegram bots and custom administration panels for managing stolen data.
There is an observed increase in attacks exploiting React2Shell, including the use of WAF bypass techniques in proof-of-concept exploits.
Shadow IT in the form of “shadow spreadsheets” is exposing sensitive data outside official controls.
The browser is increasingly the main interface for generative AI tools within enterprises, raising concerns about policy, isolation, and data controls.
$320,000 was awarded at Zeroday.Cloud for exploits against open source projects such as Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL.
The Akira ransomware group continues to claim responsibility for significant breaches.
A new Android in-the-wild exploit (DNG) has been identified through suspicious image files uploaded to VirusTotal.
Vibe coding and unmanaged code practices are highlighted as introducing significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the actively exploited GeoServer vulnerability immediately.
MITRE released its 2025 list of the top 25 most dangerous software weaknesses, with XSS, SQL injection, and CSRF at the top.
Microsoft has expanded its bug bounty program to include critical vulnerabilities in third-party and open source code that impact Microsoft services.
Microsoft will bundle Security Copilot with M365 Enterprise licenses, alongside the launch of 12 new security agents.
The US government’s publication of H-1B applicants’ social media accounts has sparked privacy concerns due to increased exposure to cyber threats.
The Pentagon has ordered an accelerated transition to post-quantum cryptography (PQC) for its systems.
The Trump administration reportedly dropped sanctions against Chinese actors for the Salt Typhoon attacks on US telecoms, raising concerns about prioritising trade over cybersecurity enforcement.

Cybersecurity Brief – 2025-12-12

Fri, 12 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The Pierce County Library suffered a data breach in April 2025, resulting in the theft of personal information belonging to 340,000 patrons, employees, and their family members.
The UK Information Commissioner’s Office fined LastPass £1.2 million over the 2022 data breach that impacted 1.6 million users, citing failure to implement adequate security measures.
Over 700 internet-facing Gogs servers have been compromised via an unpatched zero-day vulnerability, with attackers exploiting the flaw for remote code execution and file overwrites outside repositories.
Hackers exploited an undocumented cryptographic vulnerability in Gladinet CentreStack and Triofox products, enabling remote code execution attacks.
Multiple malware campaigns have been observed:
- Malicious Visual Studio Code Marketplace extensions (19 identified) have been distributing trojans hidden in fake PNG files since February, targeting developers.
- React2Shell attacks are delivering a range of malware, including cryptocurrency miners, Linux backdoors, botnet malware, and post-exploitation implants.
- DroidLock Android malware is locking users out of their devices and demanding ransom for file and device access restoration.

Newly Discovered Vulnerabilities

A high-severity, actively exploited XXE (XML External Entity) vulnerability has been flagged in OSGeo GeoServer and added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
An unpatched zero-day in Gogs, a self-hosted Git service, allows attackers to overwrite files outside repositories, leading to remote code execution. The vulnerability is a bypass for a previously disclosed RCE flaw.
An undocumented cryptographic flaw in Gladinet CentreStack and Triofox enables remote code execution and is being actively exploited.
Notepad++ released version 8.8.9 to address a security weakness in its WinGUp update mechanism, which allowed attackers to push malicious update files.
Google released emergency patches for a new Chrome zero-day (the eighth in 2025), described as a V8 type-confusion issue already being exploited in the wild. The specific CVE and affected component remain undisclosed.
IBM patched over 100 vulnerabilities this week, including several critical issues in third-party dependencies.

Notable Threat Actor Activity

The WIRTE APT group is targeting government and diplomatic entities in the Middle East using a new malware suite named AshTag, installed via AshenLoader DLL sideloading.
Hamas-linked hackers are conducting espionage campaigns against Middle Eastern diplomats, deploying increasingly sophisticated malware.
Researchers detailed NANOREMOTE, a backdoor for Windows that uses the Google Drive API for covert command-and-control communications.

Trends, Tools, or Tactics of Interest

AI-driven cyberattacks are automating reconnaissance, generating malware variants, and evading detection at speeds that challenge traditional network defenses.
Attackers are leveraging trusted platforms for C2 communications, such as NANOREMOTE’s use of Google Drive API.
The Mythic post-exploitation framework’s network traffic and agent-to-C2 communication patterns have been analyzed, resulting in new detection rules for network defense.
ConsentFix, a new attack variant, abuses the Azure CLI OAuth app to hijack Microsoft accounts, bypassing passwords and, in some cases, multi-factor authentication.
Browser add-ons, software updates, and developer tool ecosystems (e.g., VSCode Marketplace) are increasingly being used as vectors for malware distribution.
DLL sideloading continues to be a favored technique for malware delivery, as seen in recent WIRTE activity.
Doxers are impersonating law enforcement to trick tech firms into handing over private user data using spoofed emails and falsified documents.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £1.2 million fine on LastPass for inadequate security leading to the 2022 breach.
In the US, President Trump signed an executive order blocking individual states from enacting their own AI regulations, centralizing AI policy at the federal level.
Microsoft expanded its bug bounty program to reward reports of critical vulnerabilities in any of its online services, including those built on third-party code.

Cybersecurity Brief – 2025-12-11

Thu, 11 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Threat actors are actively exploiting CVE-2025-55182, with observed attacks targeting honeypots and deploying malware.
Multiple threat groups are exploiting WinRAR vulnerability CVE-2025-6218, which has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Gladinet’s CentreStack and Triofox products are under active attack due to hard-coded cryptographic keys, resulting in unauthorized access and code execution in at least nine organizations.
React2Shell vulnerability in React Server Components is being heavily exploited to deliver cryptocurrency miners and other malware across multiple sectors.
Over 10,000 Docker Hub container images have been found leaking sensitive credentials, including production system access, CI/CD database keys, and LLM model keys.
A new AMOS infostealer malware campaign is using Google search ads to lure users into fake ChatGPT and Grok guides, resulting in macOS infections.
A new Android malware, DroidLock, is locking devices for ransom, erasing data, and accessing sensitive information such as messages, contacts, and audio data.
The GhostFrame phishing kit is enabling widespread phishing attacks using dynamic subdomains and hidden iframes to evade detection.
A Ukrainian national has been charged and extradited to the US for assisting Russian hacktivist groups in attacks on critical infrastructure, including water, election, and nuclear systems.
Pro-Russian hacktivists are targeting US critical infrastructure, primarily by compromising VNC connections in operational technology (OT) systems, with potential for increased destructiveness.

Newly Discovered Vulnerabilities

PCIe 5.0+ systems are affected by three vulnerabilities in the Integrity and Data Encryption (IDE) protocol, exposing Intel and AMD processors to information disclosure, privilege escalation, and DoS via local attacks.
The .NET “SOAPwn” flaw allows remote code execution and arbitrary file writes via rogue WSDL files in enterprise applications.
Google patched a Gemini Enterprise zero-click vulnerability (“GeminiJack”) that could have exposed corporate data via crafted emails, calendar invites, or documents.
Fortinet released patches for two critical authentication bypass vulnerabilities impacting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager with FortiCloud SSO enabled.
Ivanti Endpoint Manager (EPM) update addresses a critical XSS vulnerability enabling remote code execution with admin privileges.
SAP’s December 2025 updates fix critical vulnerabilities in Solution Manager, Commerce Cloud, and jConnect SDK, which could lead to code injection and remote code execution.
Siemens, Rockwell, and Schneider have issued patches for multiple vulnerabilities across their industrial control system (ICS) products.
Microsoft issued fixes for 56 vulnerabilities, including three zero-days, one of which is under active exploitation, and introduced a PowerShell warning for unsafe code execution.
A possible new exploit variant for Kubernetes OS command injection vulnerability CVE-2024-9042 has been identified.

Notable Threat Actor Activity

Storm-0249, an initial access broker, is abusing endpoint detection and response (EDR) platforms and Windows utilities in stealthy attacks.
The Silver Fox APT, associated with ValleyRAT malware, continues to evolve, utilizing kernel rootkits and advanced builder techniques.
The Spiderman phishing kit is targeting customers of dozens of European banks and cryptocurrency holders with highly convincing cloned sites.
The AMOS infostealer campaign leverages SEO poisoning and legitimate AI domains for malware delivery to macOS systems.
US authorities indicted Victoria Dubranova for supporting Russia-backed CARR and NoName hacktivist groups in attacks on critical infrastructure.
Two individuals linked to China’s Salt Typhoon hacker group reportedly received training via a Cisco Academy prior to targeting Cisco devices in espionage campaigns.

Trends, Tools, or Tactics of Interest

Phishing attacks have surged 400% year-over-year, with a focus on corporate accounts.
Social engineering campaigns are exploiting Microsoft Teams’ “Chat with Anyone” feature to conduct phishing attacks via external DMs.
Attackers are increasingly exploiting cloud misconfigurations across AWS, AI models, and Kubernetes, bypassing standard security tools.
Supply-chain attacks in manufacturing environments are leveraging compromised credentials, malicious NPM packages, and development tool exploits.
Microsoft Teams is developing a feature to warn IT administrators about suspicious traffic with external domains.
The GhostFrame phishing kit is enabling large-scale, evasive phishing campaigns using dynamic infrastructure.
The Spiderman phishing kit demonstrates sophistication in targeting European financial institutions with pixel-perfect phishing sites.

Regulatory or Policy Developments Affecting the Security Industry

Israeli cybersecurity sector investment reached a record $4.4 billion, reflecting over 500% growth in the past decade.
CISA added the WinRAR CVE-2025-6218 vulnerability to its KEV catalog, mandating remediation for US federal agencies.

Cybersecurity Brief – 2025-11-12

Wed, 12 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

GlobalLogic, a Hitachi group company, is notifying over 10,000 current and former employees of data theft following a breach of Oracle E-Business Suite (EBS).
The Rhadamanthys infostealer malware operation has been disrupted, with operators and customers losing access to their servers.
A Chinese national known as the “Bitcoin Queen” was sentenced in London to over 11 years in prison for laundering Bitcoin from a $7.3 billion cryptocurrency investment scam.

Newly Discovered Vulnerabilities

Microsoft’s November 2025 Patch Tuesday addressed 63 vulnerabilities, including one actively exploited Windows kernel zero-day and several critical flaws. Emergency and cumulative updates were also released for Windows 10 and Windows 11 to address security vulnerabilities and ESU enrollment issues.
Synology patched a critical remote code execution vulnerability in BeeStation products, demonstrated at Pwn2Own Ireland.
Gladinet’s Triofox file-sharing and remote-access platform was found to have a critical vulnerability that allowed attackers to exploit the built-in antivirus feature to gain SYSTEM privileges and deploy remote access tools.
SAP released patches for multiple vulnerabilities, including a maximum severity flaw in SQL Anywhere Monitor due to hardcoded credentials and a critical code execution issue in Solution Manager.
Adobe released security updates addressing 29 vulnerabilities across multiple products, including InDesign, InCopy, Photoshop, Illustrator, Pass, Substance 3D Stager, and Format Plugins.
A critical zero-day vulnerability affecting Samsung mobile devices was exploited in the wild to deliver LANDFALL spyware.
Mozilla introduced new fingerprinting protections in Firefox, reducing the number of trackable users.
A new side-channel attack, dubbed “Whisper Leak,” allows attackers intercepting network traffic to infer user prompt topics in large language model (LLM) conversations, despite end-to-end encryption.

Notable Threat Actor Activity

Threat actors are distributing a new banking malware called “Maverick” via WhatsApp, targeting major Brazilian banks. Maverick shares similarities with the Coyote banking malware.
GootLoader malware has resurfaced, now using a novel font-based obfuscation technique to hide malicious payloads on compromised WordPress sites.
A malicious npm package, “@acitons/artifact”, was discovered typosquatting the legitimate “@actions/artifact” package, targeting GitHub-owned repositories.
The Fantasy Hub Android remote access trojan (RAT) is being sold on Russian-speaking Telegram channels as a Malware-as-a-Service (MaaS), turning Telegram into a distribution hub for threat actors.
Kimsuky (DPRK-linked) APT group is exploiting Google Find Hub to compromise South Korean Android devices, remotely wiping devices and abusing the KakaoTalk messaging app.
RansomHub ransomware was detected during an in-progress attack, initiated via fake browser updates and leading to domain-admin privilege escalation.
Scammers are using AI-generated fake faces combined with real body images in extortion scams, and leveraging AI voice cloning and open-source data for social engineering attacks, particularly targeting the elderly.
Thieves are increasingly phishing Apple ID credentials through fake “Find My” messages to unlock stolen iPhones.

Trends, Tools, or Tactics of Interest

AI-enabled supply chain attacks increased by 156% over the past year, with CISOs advised to reassess traditional defenses.
Script-kiddie-level phishing campaigns remain effective at rapidly stealing credentials, even with poorly crafted lures.
The use of Telegram as a central hub for malware distribution and MaaS offerings is increasing.
Threat actors are exploiting built-in software features (e.g., antivirus in Triofox) to escalate privileges and deploy malware.
Fake browser update lures are being used as initial access vectors for ransomware attacks.
Social engineering attacks are leveraging AI-generated content and public data to bypass human defences.

Regulatory or Policy Developments

The US Department of Defense began enforcement of Cybersecurity Maturity Model Certification (CMMC) requirements for contractors on 10 November 2025.
Microsoft announced end of security update support for Windows 11 23H2 Home and Pro editions; extended security updates for Windows 10 are now available.
Firefox introduced new privacy protections to reduce user tracking.
Tenzai, an Israeli startup, raised $75 million in seed funding to develop an AI-powered penetration testing platform.

Cybersecurity Brief – 2025-11-11

Tue, 11 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Nearly 30 organizations, including Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland, have been named as alleged victims of an Oracle E-Business Suite (EBS) hack on the Cl0p ransomware leak site.
The US Congressional Budget Office (CBO) confirmed a data breach.
Many Forbes AI 50 companies were found to have leaked sensitive secrets, including training data and private models, on public GitHub repositories.

Newly Discovered Vulnerabilities

A critical vulnerability in the expr-eval JavaScript library, used in over 800,000 weekly NPM downloads, allows remote code execution via malicious input.
Three vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) have been patched; these could be exploited to escape container environments.
Multiple vulnerabilities in QNAP devices, demonstrated at Pwn2Own Ireland, have been patched. These flaws could allow remote code execution, information disclosure, and denial-of-service.
A critical, now-patched flaw in Gladinet’s Triofox file-sharing and remote access platform was exploited to install remote access tools via its antivirus feature.
CISA has ordered US federal agencies to patch a critical Samsung zero-day vulnerability exploited in spyware attacks deploying LandFall spyware on WhatsApp-enabled devices.

Notable Threat Actor Activity

The Quantum Route Redirect phishing-as-a-service (PhaaS) platform is being used in a large-scale, automated campaign targeting Microsoft 365 users globally, utilising around 1,000 domains to steal credentials.
The North Korea-linked Konni (APT37) threat actor is abusing Google’s Find Hub tool in new attacks to track GPS positions and trigger remote data wipes on Android devices, as well as targeting Windows systems.
GlassWorm malware has resurfaced, infecting three additional Visual Studio Code extensions and spreading via both the Open VSX marketplace and GitHub repositories, targeting developer environments.
The ClickFix phishing campaign is targeting the hospitality sector, using infostealer and RAT malware to compromise hotel managers and subsequently launch phishing attacks against customers via email and WhatsApp.
A Russian national has pleaded guilty to acting as an initial access broker for Yanluowang ransomware, which targeted at least eight US companies between July 2021 and November 2022.
Fantasy Hub, a spyware-for-rent platform, is distributing RATs via fake Android apps capable of stealing logins, PINs, and messages with only SMS permissions.

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging LinkedIn for phishing campaigns, aiming at executives and exploiting the platform to bypass traditional email security.
Malware is being concealed within virtual machines (e.g., Hyper-V), and there is a noted increase in side-channel attacks targeting AI chat data, as well as spyware campaigns against Android devices.
Scanning activity has been observed targeting “FTP_3cx” usernames, potentially indicating attempts to exploit business phone system software.
The Browser Security Report 2025 highlights that identity, SaaS, and AI-related risks are converging at the browser level, while traditional controls may not adequately address these threats.
Mozilla Firefox 145 has introduced new anti-fingerprinting defenses to enhance user privacy.
OWASP’s revised Top 10 list for web application risks now includes two new categories, with supply chain risks and security misconfiguration ranking highly.

Regulatory or Policy Developments

Australia has imposed sanctions on individuals and entities accused of supporting North Korea’s weapons programme, mirroring recent US actions.
CISA has mandated US federal agencies to patch a Samsung zero-day exploited in spyware campaigns.

Cybersecurity Brief – 2025-11-05

Wed, 05 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The Swedish IT systems supplier Miljödata suffered a data breach impacting 1.5 million individuals. The Swedish Authority for Privacy Protection (IMY) is investigating.
Japanese media conglomerate Nikkei reported a data breach after its Slack platform was compromised, exposing personal data of over 17,000 employees and business partners.
Hundreds of malicious Android apps on Google Play were downloaded over 42 million times between June 2024 and May 2025, according to Zscaler, distributing various malware strains.
Threat actors are actively exploiting a critical vulnerability in the Post SMTP WordPress plugin (installed on 400,000+ sites) to hijack admin accounts.
Attackers are exploiting a critical authentication bypass flaw in the JobMonster WordPress theme, allowing admin account hijacking under certain conditions.
European authorities dismantled a cryptocurrency fraud and money laundering network responsible for defrauding victims of over €600 million, arresting nine individuals.
U.S. prosecutors indicted three individuals for deploying BlackCat (ALPHV) ransomware against five U.S. companies between May and November 2023, resulting in network compromise and extortion.
Transportation and logistics companies have been targeted by threat actors using sophisticated attack chains to deploy remote access tools and steal cargo.

Newly Discovered Vulnerabilities

CISA added critical vulnerabilities in Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog. The CWP flaw (CVE-2025-48703) allows remote, unauthenticated command execution and is being actively exploited.
A critical vulnerability (CVE-2025-11953) in the “@react-native-community/cli” npm package for React Native allowed arbitrary command/code execution on Windows, macOS, and Linux. The issue has now been patched.
Four security flaws were disclosed in Microsoft Teams enabling attackers to impersonate colleagues and edit messages without detection, facilitating social engineering and phishing attacks.
Google’s AI-powered agent “Big Sleep” discovered five new vulnerabilities in Apple’s Safari WebKit. Apple has issued patches addressing these and over 100 other vulnerabilities across its operating systems.
The November 2025 Android update patched two critical remote code execution vulnerabilities in the platform’s System component.
Apple released updates for iOS and macOS addressing 110 vulnerabilities, including 19 in WebKit, some of which were critical.

Notable Threat Actor Activity

A new cybercrime collective has formed, merging Scattered Spider, LAPSUS$, and ShinyHunters. The group has created at least 16 Telegram channels since August 2025, indicating increased coordination.
The Russian threat group “Curly COMrades” is abusing Microsoft Hyper-V to deploy hidden Alpine Linux-based virtual machines on Windows hosts, bypassing endpoint detection and response (EDR) solutions to run malware undetected.
Operation SkyCloak: Threat actors are deploying a Tor-enabled OpenSSH backdoor via weaponized phishing attachments, targeting defense sectors in Russia and Belarus.
The North Korean group Kimsuky has debuted the HTTPTroy backdoor against South Korean targets, with enhanced obfuscation and anti-analysis features.
The SesameOp backdoor has been observed using the OpenAI API as a covert command-and-control (C2) channel, demonstrating the misuse of generative AI services for stealthy communications.
Criminals are impersonating U.S. Immigration and Customs Enforcement (ICE) agents in social engineering campaigns, prompting an FBI warning to law enforcement.

Trends, Tools, or Tactics of Interest

Browser sandbox evasion: Attackers are exploiting browser behaviors to steal credentials, abuse extensions, and move laterally, bypassing traditional security tools.
Increased ransomware and extortion attacks in Europe, with attackers leveraging geopolitical tensions and AI-enhanced social engineering.
Malicious Android apps continue to proliferate on official app stores, using fake news and identification apps as lures for banking trojans and data theft.
Use of AI and cloud APIs (e.g., OpenAI) by threat actors for covert C2 and operational security.
Open source security: The Wazuh platform is being promoted for ransomware defense, reflecting ongoing interest in open source security tooling.

Regulatory or Policy Developments

Microsoft announced plans to remove Defender Application Guard from Office, starting with Office version 2602 in February 2026 and completing removal by December 2027.
California fined Sling TV for deceptive privacy practices, including misleading opt-out controls and improper use of children’s data for ad targeting.
The Swedish privacy regulator (IMY) is investigating the Miljödata breach for potential violations of data protection requirements.

Industry Moves

Bugcrowd acquired application security firm Mayhem, nearly doubling its valuation.
Zscaler acquired AI security company SPLX to enhance its Zero Trust Exchange platform with red teaming and threat inspection capabilities.

Cybersecurity Brief – 2025-10-18

Sat, 18 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Envoy Air, a subsidiary of American Airlines, confirmed a data compromise involving its Oracle E-Business Suite application. The Clop extortion gang has claimed responsibility.
Sotheby’s disclosed a data breach involving theft of sensitive personal information, including Social Security Numbers.
Prosper suffered a data breach impacting 17.6 million accounts, with exposed data including names, addresses, dates of birth, email addresses, Social Security numbers, government IDs, and other sensitive information.
Cybercriminals exploited lax authentication in Zendesk’s customer service platform to execute email bombing attacks, flooding targeted inboxes with abusive messages from legitimate Zendesk accounts.

Newly Discovered Vulnerabilities

A malicious npm package was identified delivering the AdaptixC2 post-exploitation agent, targeting Windows, Linux, and macOS platforms.
Researchers disclosed a critical vulnerability in WatchGuard Fireware’s VPN functionality, allowing unauthenticated remote code execution. The flaw has been patched.
ConnectWise issued a security update for its Automate product, addressing critical vulnerabilities that could allow adversary-in-the-middle (AiTM) update attacks and interception/modification of sensitive communications.
Microsoft patched CVE-2025-55315, an HTTP request smuggling vulnerability in ASP.NET Core with the highest-ever severity score for the platform. The flaw can lead to information leaks, file tampering, and server crashes.
Over 266,000 F5 BIG-IP instances remain exposed online following a recently disclosed security breach.
Gladinet patched an actively exploited CentreStack vulnerability, an unauthenticated local file inclusion bug enabling remote code execution via ViewState deserialization.
Vulnerabilities in Phoenix Contact UPS devices were disclosed, allowing attackers to trigger a permanent denial-of-service condition that prevents remote restoration.

Notable Threat Actor Activity

The Silver Fox threat group has expanded operations using the Winos 4.0 (ValleyRAT) malware, now targeting Japan and Malaysia with the HoldingHands RAT, in addition to previous campaigns in China and Taiwan.
North Korean threat actors associated with the Contagious Interview campaign have merged BeaverTail and OtterCookie malware into an advanced JavaScript-based strain, indicating ongoing tool development.
Microsoft disrupted a ransomware campaign abusing Azure certificates, revoking over 200 digital certificates used to sign malicious Teams binaries for Rhysida ransomware distribution.
Europol dismantled a SIM-box operation (SIMCARTEL) that facilitated over 3,200 fraud cases and caused losses exceeding €4.5 million by renting numbers for cybercrime.
TikTok videos are being used to promote malware installation, leveraging social engineering and new communication channels.

Trends, Tools, or Tactics of Interest

Phishing remains the leading initial access vector for cyberattacks across Europe, accounting for 60% of incidents between July 2024 and June 2025, per ENISA.
Microsoft reports increasing use of AI by Russian and Chinese threat actors to escalate cyberattacks, particularly targeting the United States.
Attackers are exploiting AI chat data as a rich source of sensitive enterprise information, raising concerns about privacy, accountability, and law enforcement access.
Shared responsibility models for securing AI agents and agentic services are becoming more prominent, with ongoing challenges in user and team awareness.
Social engineering tactics continue to evolve, with attackers leveraging platforms like TikTok and exploiting authentication weaknesses in SaaS products such as Zendesk.

Regulatory or Policy Developments Affecting the Security Industry

Capita has been fined £14 million in connection with a security incident.
The European Union Agency for Cybersecurity (ENISA) published statistics on initial access vectors, highlighting phishing as the predominant method in Europe.

Cybersecurity Brief – 2025-10-17

Fri, 17 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Sotheby’s disclosed a data breach in which threat actors accessed sensitive information, including financial details of individuals.
Financial services company Prosper suffered a breach impacting over 17.6 million accounts, with personal information stolen.
F5 confirmed a long-term breach of its systems, with attribution linked to Chinese threat actors. The attack exploited BIG-IP vulnerabilities, prompting patch releases and government alerts.
Video call app Huddle01 exposed over 600,000 user logs due to a misconfigured Kafka broker.
Fashion retailer Mango reported a data breach at a third-party marketing provider, exposing limited contact details.
LastPass and other top password managers are being targeted by phishing campaigns aiming to exploit user trust in password vaults.

Newly Discovered Vulnerabilities

Cisco IOS and IOS XE Software: CVE-2025-20352, a remote code execution vulnerability, is being actively exploited to deploy Linux rootkits on older networking devices.
Gladinet CentreStack: A local file inclusion vulnerability (CVE-2025-11371) has been exploited as a zero-day since late September; security updates have been released.
Adobe Experience Manager: A maximum-severity vulnerability in AEM Forms is being actively exploited to execute code on unpatched systems.
Fuji Electric HMI Configurator: Multiple vulnerabilities have been disclosed and patched, with advisories issued to industrial organizations.
Windows Kernel (Rust-based GDI component): A security vulnerability identified by Check Point Research in January 2025.
Microsoft Windows 11: Recent updates have broken HTTP/2 connections to localhost (127.0.0.1), impacting applications relying on this functionality.

Notable Threat Actor Activity

North Korean-affiliated actors are leveraging the EtherHiding technique to distribute malware and steal cryptocurrency, using blockchain smart contracts for resilience and stealth.
Financially motivated threat actor UNC5142 is abusing blockchain smart contracts to distribute information stealers such as Atomic (AMOS), Lumma, and RedLine via infected WordPress sites.
Chinese threat actors have been linked to the F5 breach and are reportedly testing AI-optimized attack chains in Taiwan.
Vanilla Tempest (aka Vice Spider/Vice Society) used over 200 fraudulent certificates to sign malicious binaries in Rhysida ransomware campaigns, targeting Microsoft Teams users. Microsoft has revoked these certificates to disrupt ongoing attacks.
Attackers are exploiting a Cisco SNMP flaw to deploy Linux rootkits (including the newly discovered LinkPro rootkit, which uses eBPF for stealth and activates via magic TCP packets) on AWS-hosted and on-premises infrastructure.

Trends, Tools, or Tactics of Interest

Increased abuse of blockchain technologies (smart contracts) for malware distribution and command-and-control, notably by both state-aligned and financially motivated actors.
Emergence of new Linux rootkits (e.g., LinkPro) employing advanced stealth techniques such as eBPF and covert activation mechanisms.
Phishing campaigns specifically targeting users of password managers, exploiting trust in these platforms.
Security risks in the software supply chain highlighted by the discovery of over 550 unique secrets exposed in Microsoft Visual Studio Code marketplaces.
AI-driven security tools are gaining traction, with new products emerging to automate vulnerability remediation and enterprise data protection.
Security Operations Centers (SOCs) are under pressure to adopt AI-based platforms for scaling detection and response capabilities.
Ongoing concerns regarding secure coding practices in AI-generated code, with emphasis on the need for improved training and oversight.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft Office 2016 and Office 2019 have reached end of extended support as of October 14, 2025, with implications for continued security updates and compliance.
Regulatory scrutiny on data handling practices, as evidenced by allegations against Roku for collecting and selling children’s data in violation of privacy laws.
Financial institutions are facing increasing challenges in data governance and regulatory risk management amid evolving compliance requirements.

Cybersecurity Brief – 2025-10-12

Sun, 12 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall SSL VPN devices: Huntress reported a widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into over 100 customer environments to access internal systems.
Gladinet CentreStack and TrioFox: Active exploitation of a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox products has been observed, allowing unauthenticated local file access and potential escalation to remote code execution. The flaw remains unpatched.
BreachForums Takedown: The FBI seized all domains of the BreachForums hacking forum operated by the ShinyHunters group, which was used for leaking data from ransomware and extortion attacks, including recent Salesforce-related incidents.
AI Companion Apps Data Leak: Two AI “girlfriend” apps exposed millions of private chat logs belonging to over 400,000 users.
Oracle EBS Zero-Day Attacks: Sophisticated malware was deployed in attacks exploiting a zero-day in Oracle E-Business Suite (EBS), affecting dozens of organizations since at least 10 July.
Discord Age-Verification Data Exposure: A hack exposed sensitive age-verification data of Discord users.
Manufacturing Sector Ransomware: Reports highlight continued ransomware attacks targeting the manufacturing industry, with attackers exploiting unpatched vulnerabilities.
US Universities Payroll Attacks: US universities were targeted by attackers hijacking HR SaaS accounts to divert payroll payments, attributed to the Storm-2657 threat actor.

Newly Discovered Vulnerabilities

Juniper Networks Junos Space: More than 200 vulnerabilities, including nine critical-severity flaws, were patched in Junos Space and Junos Space Security Director.
Ivanti Endpoint Manager: The Zero Day Initiative (ZDI) disclosed 13 unpatched vulnerabilities in Ivanti Endpoint Manager, enabling remote code execution and privilege escalation.
GoAnywhere MFT (CVE-2025-10035): Fortra detailed active exploitation of this critical flaw in GoAnywhere Managed File Transfer, which has since been patched.
Node.js SEA Feature Abuse: The Stealit malware campaign uses Node.js’ Single Executable Application feature to distribute payloads via trojanized game and VPN installers.
Malicious npm Packages: 175 malicious npm packages with over 26,000 downloads were found harvesting credentials as part of a phishing campaign.

Notable Threat Actor Activity

North Korean IT Worker Schemes: North Korean threat actors have expanded fraudulent remote employment operations to target a broad range of industries, including architectural design, using fake identities and documentation.
LockBit/Storm-2603: The LockBit ransomware group (Storm-2603) has been observed abusing the Velociraptor DFIR tool to maintain persistence and facilitate attacks.
Storm-2657: This actor is actively hijacking HR SaaS accounts to redirect payroll payments, targeting a variety of organizations, including universities.
Coordinated Attacks on Network Devices: Infrastructure linked to coordinated attacks is being used to exploit vulnerabilities in Cisco, Fortinet, and Palo Alto Networks devices.
RondoDox Botnet: The RondoDox botnet employs over 50 exploits in a “shotgun” approach to compromise routers, DVRs, NVRs, CCTV systems, and other edge devices globally.
Aisuru DDoS Botnet: The Aisuru botnet is responsible for record-setting DDoS attacks against US ISPs, leveraging large numbers of compromised IoT devices.

Trends, Tools, or Tactics of Interest

Abuse of Legitimate Tools: Increased weaponization of legitimate digital forensics and incident response tools (e.g., Velociraptor) by ransomware groups for persistence and post-exploitation.
AI and Deepfake Threats: OpenAI’s new video and audio generation system raises concerns about the proliferation of deepfakes. Organizations report high awareness but insufficient investment in deepfake detection capabilities.
AI in Security Operations: Advancements in AI-powered Security Operations Center (SOC) platforms, with Microsoft introducing agentic AI capabilities in Sentinel, and the emergence of AI browser agents presenting new authentication challenges.
Supply Chain Risks: Discovery of malicious packages in npm and abuse of Node.js SEA highlight ongoing supply chain threats to software development environments.
Password Guidance: NIST updates suggest a shift away from overly complex password requirements, focusing on usability and security balance.

Regulatory or Policy Developments Affecting the Security Industry

Apple Bug Bounty Expansion: Apple has doubled its maximum bug bounty payout to $2 million for zero-click RCE vulnerabilities, introduced new research categories, and increased transparency in its rewards structure. Total payouts have reached $35 million, with bonuses for iPhone exploits potentially raising rewards to $5 million.
Windows 11 23H2 End of Support: Microsoft reminded users that Home and Pro editions of Windows 11 23H2 will stop receiving security updates next month.
Chrome Notification Permissions: Google Chrome will automatically revoke notification permissions for inactive websites to reduce notification spam.
Age-Verification Law Privacy Concerns: Apple raised privacy concerns regarding proposed age-verification laws, citing risks associated with increased sensitive data collection.

Cybersecurity Brief – 2025-10-11

Sat, 11 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has seized all domains associated with BreachForums, operated by the ShinyHunters group, which was used as a portal for leaking corporate data obtained through ransomware and extortion attacks, including recent Salesforce-related incidents. Despite the takedown, ShinyHunters continues to issue extortion threats against Salesforce victims.
Two AI companion applications exposed millions of private chat records from over 400,000 users due to inadequate security controls.
A critical zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox file sharing products is being actively exploited in the wild, allowing unauthenticated local attackers to access system files.
Sophisticated malware has been deployed in Oracle E-Business Suite (EBS) zero-day attacks, with exploitation believed to have started as early as July 10 and affecting dozens of organizations.
A large-scale DDoS attack was launched by the Aisuru botnet, leveraging compromised IoT devices hosted on major US ISPs.
Microsoft has observed a threat actor, Storm-2657, hijacking HR SaaS accounts to divert employee salary payments to attacker-controlled accounts; US universities have been specifically targeted in these payroll diversion attacks.

Newly Discovered Vulnerabilities

Fortra disclosed details of active exploitation of CVE-2025-10035, a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
13 unpatched vulnerabilities in Ivanti Endpoint Manager have been publicly released by the Zero Day Initiative (ZDI), permitting remote code execution and privilege escalation.
Juniper Networks released patches for over 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
175 malicious npm packages, collectively downloaded over 26,000 times, have been used in a credential phishing campaign.
Security researchers have detailed an active Stealit malware campaign abusing the Node.js Single Executable Application (SEA) feature, distributed via game and VPN installers.

Notable Threat Actor Activity

North Korean threat actors have expanded their fraudulent remote employment schemes to target nearly every industry hiring remote workers, including architectural design roles, using fake identities and documentation.
Chinese APT group Storm-2603 is abusing the Velociraptor digital forensics and incident response (DFIR) tool to gain persistent access to victim networks and facilitate ransomware deployment.
A coordinated campaign has been identified targeting Cisco, Fortinet, and Palo Alto Networks devices, with attacks originating from shared infrastructure.
The RondoDox botnet employs a “shotgun” approach, using more than 50 exploits against unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices globally.

Trends, Tools, or Tactics of Interest

AI-generated deepfakes are proliferating, with OpenAI releasing an updated AI video and audio generation system, raising concerns about the acceleration and accessibility of deepfake creation.
The security industry is experiencing inadequate investment in deepfake detection, despite high organizational awareness and frequent encounters with AI-augmented threats.
Security Operations Centres (SOCs) are increasingly integrating AI-powered agents, with projections indicating significant transformation in SOC workflows by 2026.
Microsoft has added agentic AI capabilities to its Sentinel platform, previewing new security graph and MCP server features.
Attackers are leveraging malicious npm packages and abusing legitimate software features (e.g., Node.js SEA) to distribute malware and harvest credentials.
1Password addressed a critical security gap in its AI browser agent, which posed risks of credential leakage.
Timely patch management is highlighted as a key defense against escalating ransomware attacks on manufacturing and industrial control system (ICS) environments.

Regulatory or Policy Developments Affecting the Security Industry

Apple has expanded its bug bounty program, doubling the maximum payout to $2 million for zero-click remote code execution vulnerabilities, with potential bonuses raising the maximum to $5 million. The program now includes new research categories and a more transparent reward structure.
Microsoft reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 30 days, after which security updates will cease.
Google Chrome will automatically revoke notification permissions for inactive websites to reduce user alert fatigue.
Apple voiced concerns over proposed age-verification laws, warning that increased data collection for compliance could heighten user privacy risks.
NIST is revising password guidance, indicating that excessively complex password requirements may no longer be necessary.

Cybersecurity Brief – 2025-04-15

Tue, 15 Apr 2025 00:00:00 +0000

Newly Discovered Vulnerabilities and Attacks

Gladinet’s Triofox and CentreStack are under active exploitation due to a critical RCE vulnerability, impacting seven organizations.
ResolverRAT, a new remote access trojan, targets healthcare and pharmaceutical sectors through phishing and DLL side-loading attacks.
Cybersecurity researchers have identified a phishing campaign using real-time checks to validate victim emails before credential theft.

Data Breaches and Security Incidents

Hertz Corporation confirms a data breach where customer information and driver’s licenses were stolen in Cleo zero-day data theft attacks.
Conduent, a govtech giant, discloses client data was stolen in a January 2025 cyberattack.

Regulatory and Policy Developments

Meta resumes E.U. AI training using public user data after regulatory approval, aiming to train AI models with public data shared by adults in the European Union.
Microsoft issues Windows updates to fix Active Directory policy issues and advises users to ignore WinRE installation errors.
The CA/Browser Forum votes to reduce SSL/TLS certificate lifespans to 47 days by 2029 to enhance security.

Notable Threat Actors and Tools

Fortinet zero-day bug may lead to arbitrary code execution, with a threat actor posting about the exploit after Fortinet warned of active vulnerabilities.
Chinese APTs exploit EDR “visibility gap” for cyber espionage, targeting network blind spots like firewalls, IoT devices, and the cloud.
Cybersecurity firm Prodaft buys hacker forum accounts to spy on cybercriminals and enhance threat intelligence capabilities.

Industry Impacts and Recommendations

Cybersecurity in the AI era is evolving rapidly, with attackers leveraging AI for automation and sophisticated attacks, highlighting the need for defenders to evolve quickly.
Wazuh, an open-source XDR platform, enhances DevSecOps by providing real-time threat detection, compliance, and vulnerability scanning for stronger security strategies.

Cybersecurity Brief – 2025-04-11

Fri, 11 Apr 2025 00:00:00 +0000

Major Incidents and Attacks

GOFFEE continues to attack organizations in Russia: Kaspersky researchers analyze GOFFEE’s campaign in H2 2024, with updated infection scheme, new PowerModul implant, and switch to a binary Mythic agent.
Russian Threat Actor Launches Spear-Phishing Campaign Against Ukrainians: The Russian threat actor Gamaredon targets Ukrainians with spear-phishing documents related to troop movements.

Vulnerabilities and Exploits

OttoKit WordPress Plugin Admin Creation Vulnerability Under Active Exploitation: A high-severity security flaw impacting OttoKit has been under active exploitation within hours of public disclosure.
Incomplete Patch in NVIDIA Toolkit Leaves CVE-2024-0132 Open to Container Escapes: Cybersecurity researchers detail an incomplete patch for a security flaw impacting the NVIDIA Container Toolkit.
Malicious npm Package Targets Atomic Wallet, Exodus Users by Swapping Crypto Addresses: Threat actors upload malicious packages to the npm registry to tamper with legitimate libraries and execute malicious code.

Industry Developments

Zero-Day in CentreStack File Sharing Platform Under Attack: A critical deserialization flaw in Gladinet’s platform is under attack, impacting managed service providers and their customers.
AuthZEN Aims to Harmonize Fractured Authorization Controls: An open specification aims to manage permissions and authorizations across multiple cloud services.
Ping Identity Doubles Down on Partner Strategy with New Partner Program and Advisory Board: Ping Identity reveals a new partner program and advisory board to enhance its partner strategy.

Regulatory and Policy News

US to sign Pall Mall pact aimed at countering spyware abuses: The U.S. plans to sign an international agreement to govern the use of commercial spyware.
Oregon’s environmental agency shuts down network after cyberattack: Oregon’s Department of Environmental Quality experiences a cyberattack, disrupting services like vehicle inspections.

These incidents and developments highlight ongoing threats from threat actors targeting organizations with sophisticated attacks and the importance of addressing vulnerabilities to enhance cybersecurity measures. The regulatory and policy news also underlines the need for international cooperation to combat cyber threats effectively.