Cybersecurity Brief – 2025-04-16

Wed, 16 Apr 2025 00:00:00 +0000

Phishing Remains Top Cyberattack in the UK:
- Phishing was identified as the most common and disruptive cyberattack faced by UK organizations in the past year.
North Korea Expands Fraudulent IT Worker Operations:
- North Korea has expanded its fraudulent IT worker operations, posing a new threat.
MITRE’s CVE Funding Expires:
- The U.S. government’s funding for MITRE to operate and maintain the CVE program ends, raising concerns in the cybersecurity community.
Chinese Hackers Target Linux Systems:
- A China-linked threat actor known as UNC5174 is using SNOWLIGHT malware and the VShell tool to target Linux systems.
Critical Apache Roller Vulnerability Discovered:
- A critical vulnerability in Apache Roller blogging server software allows unauthorized session persistence.
Browser Extensions Pose Security Risks:
- Majority of browser extensions can access sensitive enterprise data, posing a risk to organizations.
Malicious PyPI Package Targets MEXC Trading API:
- A malicious package on PyPI targets MEXC trading API to steal credentials and redirect orders.
Python Malware Targets Crypto Developers:
- Python malware disguised as coding challenges targets crypto developers to deliver new stealer malware.
Midnight Blizzard Targets Diplomatic Entities:
- Russian state-sponsored group Midnight Blizzard deploys new GrapeLoader malware in embassy phishing attacks.
Landmark Admin Data Breach Impact Grows:
- Landmark Admin data breach now affects 1.6 million individuals.
Infamous 4chan Forum Taken Down in Hack:
- 4chan was taken offline following a major hack affecting the notorious online forum.
Microsoft Disabling ActiveX Controls:
- Microsoft will disable ActiveX controls in Microsoft 365 and Office 2024 applications.
Google Implements Auto-Reboot for Android Security:
- Google introduces auto-reboot feature on Android to enhance security.
Max Severity Bug in Apache Roller Allows Persistent Access:
- Adversaries could retain access to Apache Roller due to a remediated flaw.
Bad Bots Increasingly Difficult to Detect:
- Bad bots are evolving to mimic human behaviors, making them harder to detect.
AI-Powered Tool Used in Phishing Attacks:
- Threat actors leverage the legitimate presentation tool named “Gamma” in phishing attacks.
Hertz Falls Victim to Cleo Zero-Day Attacks:
- Cleo zero-day attacks lead to the theft of customer data from Hertz.
Wave of Wine-Inspired Phishing Attacks Target EU Diplomats:
- A phishing campaign targeting EU diplomats uses wine-tasting events as a lure.
Funding Expires for Key Cyber Vulnerability Database:
- A critical cybersecurity resource’s funding is at risk of expiring, impacting vulnerability identification and mitigation efforts.

Cybersecurity Brief – 2025-04-15

Tue, 15 Apr 2025 00:00:00 +0000

Newly Discovered Vulnerabilities and Attacks

Gladinet’s Triofox and CentreStack are under active exploitation due to a critical RCE vulnerability, impacting seven organizations.
ResolverRAT, a new remote access trojan, targets healthcare and pharmaceutical sectors through phishing and DLL side-loading attacks.
Cybersecurity researchers have identified a phishing campaign using real-time checks to validate victim emails before credential theft.

Data Breaches and Security Incidents

Hertz Corporation confirms a data breach where customer information and driver’s licenses were stolen in Cleo zero-day data theft attacks.
Conduent, a govtech giant, discloses client data was stolen in a January 2025 cyberattack.

Regulatory and Policy Developments

Meta resumes E.U. AI training using public user data after regulatory approval, aiming to train AI models with public data shared by adults in the European Union.
Microsoft issues Windows updates to fix Active Directory policy issues and advises users to ignore WinRE installation errors.
The CA/Browser Forum votes to reduce SSL/TLS certificate lifespans to 47 days by 2029 to enhance security.

Notable Threat Actors and Tools

Fortinet zero-day bug may lead to arbitrary code execution, with a threat actor posting about the exploit after Fortinet warned of active vulnerabilities.
Chinese APTs exploit EDR “visibility gap” for cyber espionage, targeting network blind spots like firewalls, IoT devices, and the cloud.
Cybersecurity firm Prodaft buys hacker forum accounts to spy on cybercriminals and enhance threat intelligence capabilities.

Industry Impacts and Recommendations

Cybersecurity in the AI era is evolving rapidly, with attackers leveraging AI for automation and sophisticated attacks, highlighting the need for defenders to evolve quickly.
Wazuh, an open-source XDR platform, enhances DevSecOps by providing real-time threat detection, compliance, and vulnerability scanning for stronger security strategies.

Hertz on DanSec Daily

Cybersecurity Brief – 2025-04-16

Cybersecurity Brief – 2025-04-15

Newly Discovered Vulnerabilities and Attacks

Data Breaches and Security Incidents

Regulatory and Policy Developments

Notable Threat Actors and Tools

Industry Impacts and Recommendations