Ingram Micro on DanSec Daily

Cybersecurity Brief – 2026-01-20

Tue, 20 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro disclosed that a ransomware attack in July 2025 resulted in a data breach affecting over 42,000 individuals, with compromised data including names, dates of birth, Social Security numbers, and employment-related information.
A Fortune 100 company in the finance sector was targeted by ransomware attackers, who deployed a new malware strain named PDFSider to deliver malicious payloads on Windows systems.
Spanish energy company Endesa reported a data breach, as noted in Check Point’s latest threat intelligence report.
A Tennessee man pleaded guilty to hacking the U.S. Supreme Court’s electronic filing system and breaching accounts at AmeriCorps and the Department of Veterans Affairs, subsequently leaking stolen Supreme Court data on Instagram.

Newly Discovered Vulnerabilities

A hardware vulnerability, codenamed StackWarp, was disclosed affecting AMD Zen 1–5 CPUs. The flaw breaks Secure Encrypted Virtualization – Secure Nested Paging (SEV-SNP) protections, potentially undermining the security guarantees of AMD’s confidential computing technology.
TP-Link patched a vulnerability in its VIGI security cameras that exposed over 2,500 internet-facing devices to remote hacking risks.
Cybersecurity researchers disclosed an indirect prompt injection flaw in Google Gemini, which allowed attackers to bypass authorization guardrails and access private Google Calendar data via malicious calendar invites.

Notable Threat Actor Activity

The UK government issued warnings regarding ongoing attacks by Russian-aligned hacktivist groups targeting UK critical infrastructure and local government organisations with disruptive activities.
A Jordanian national pleaded guilty in US court to operating as an access broker, selling unauthorized access to at least 50 corporate networks.
Researchers identified a new information stealer dubbed SolyxImmortal, which abuses legitimate APIs and libraries to exfiltrate data via Discord webhooks.
A campaign named KongTuke was observed using a malicious Chrome extension, CrashFix, which masquerades as an ad blocker and intentionally crashes browsers to facilitate further malware installation via ClickFix-style lures.
Additional malvertising campaigns were reported using fake ad blocker extensions (e.g., NexShield) on Chrome and Edge to crash browsers and launch ClickFix attacks.
New sleeper browser extensions were found spying on users and installing backdoors, now targeting Firefox in addition to Chrome and Edge.

Trends, Tools, or Tactics of Interest

The emergence of PDFSider malware highlights the continued use of custom payloads by ransomware groups targeting large enterprises.
The use of browser extensions (CrashFix, NexShield) as vectors for malvertising and malware delivery is increasing, with attackers employing browser crashes as part of social engineering tactics.
Threat actors are leveraging Discord webhooks for data exfiltration, as seen with the SolyxImmortal information stealer.
Indirect prompt injection attacks targeting AI assistants (e.g., Google Gemini) are being actively researched and exploited as a means to bypass security controls and access sensitive data.
Sleeper extensions that remain dormant before activating malicious behaviour are being deployed across multiple browsers, broadening the attack surface for user surveillance and backdoor installation.

Regulatory or Policy Developments Affecting the Security Industry

The UK government’s public warning about Russian hacktivist group activity signals heightened concern over threats to national critical infrastructure and may prompt increased defensive measures and reporting requirements across the sector.

Cybersecurity Brief – 2025-07-31

Thu, 31 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group has been linked to data breaches at Qantas, Allianz Life, LVMH, and Adidas, using voice phishing attacks to steal data from Salesforce environments.
SafePay ransomware group claims to have stolen 3.5TB of data from Ingram Micro and is threatening to leak the data.
Telecom provider Orange suffered a cyberattack resulting in service disruptions for both corporate and individual customers.
The UNC2891 (LightBasin) threat group attempted a physical intrusion by planting a 4G-equipped Raspberry Pi on a bank’s network during a failed ATM heist.
The City of Saint Paul, Minnesota, called in the National Guard to respond to a cyberattack.
The National Treasury of South Africa and several other organisations were compromised in mass exploits of on-premises Microsoft SharePoint servers.
A U.S.-based chemicals company was breached via exploitation of a SAP NetWeaver vulnerability, leading to deployment of the Auto-Color backdoor.
The Python Software Foundation warned that attackers are using a fake PyPI website to phish for developer credentials.
Over 250 fake mobile apps targeting Koreans have been used to deploy spyware and conduct blackmail campaigns.
Discord and other social platforms are being flooded with fraudulent online gaming and wagering sites, which lure users and steal funds.

Newly Discovered Vulnerabilities

Apple released security updates for iOS, iPadOS, and Safari, patching 29 vulnerabilities, including a WebKit flaw that was exploited as a zero-day in Google Chrome.
Lenovo issued UEFI firmware updates to address high-severity BIOS flaws enabling Secure Boot bypass in certain desktop models.
Critical, now-patched vulnerabilities in Dahua smart camera firmware could allow remote hijacking via ONVIF and file upload exploits.
Researchers disclosed a critical authentication bypass in the Vibe coding platform Base44, which exposed private enterprise applications; Wix patched the issue.
A critical unauthenticated arbitrary file upload vulnerability in the WordPress ‘Alone’ theme is being actively exploited for remote code execution and full site takeovers.

Notable Threat Actor Activity

Cobalt Strike Beacon is being delivered via social media, Microsoft Learn Challenge, Quora, and GitHub in a campaign targeting Russian entities.
Hackers are distributing JSCEAL malware through Facebook ads promoting fake cryptocurrency trading apps, using compiled V8 JavaScript to capture sensitive data.
Chinese state-sponsored group Silk Typhoon (Hafnium) is linked to over 15 technology patents for cyber espionage tools, highlighting PRC-backed contractor involvement.
Scattered Spider’s activity has decreased following recent arrests, but their social engineering and backup targeting tactics are being adopted by other financially motivated actors.

Trends, Tools, or Tactics of Interest

Device Bound Session Credentials (DBSC) launched in open beta in Google Chrome to protect against session cookie theft.
A new attack vector allows threat actors to use malicious browser extensions to inject prompts into popular generative AI tools, including ChatGPT and Gemini (“Man in the Prompt” attack).
AI adoption in vCISO services is rapidly increasing, with a reported 68% reduction in workload and tripling of adoption rates among MSPs and MSSPs.
VPN usage in the UK is rising sharply in response to age verification controls mandated by the Online Safety Act.
Security awareness training and tools, such as KnowBe4’s Phish Alert Button, can significantly increase employee phishing reporting rates, as evidenced by a 50-fold increase in a large retail organisation.
Fraudsters are exploiting Discord and social media to promote sophisticated scam gaming sites.
Mass exploitation of on-premises Microsoft SharePoint servers continues to impact organisations, particularly in Africa.
Threat actors are using phishing with fake PyPI sites to target software developers and steal credentials.

Regulatory or Policy Developments

The US Senate Committee has advanced the nomination of Sean Plankey to lead the Cybersecurity and Infrastructure Security Agency (CISA).
The UK’s Online Safety Act, which mandates age verification on adult sites, is directly influencing a surge in VPN adoption across the region.

Industry Developments

Palo Alto Networks announced the acquisition of CyberArk for $25 billion, marking a significant move into the identity security market.
BlinkOps raised $50 million for its agentic security automation platform, bringing total funding to $90 million.
Legion emerged from stealth with $38 million in funding for its browser-native AI Security Operations Center (SOC) platform.
Cyata, an Israeli startup focused on AI agent monitoring and control, raised $8.5 million in funding.
The average cost of a data breach in the US has risen to $10.22 million, while the global average has decreased slightly to $4.44 million, according to IBM.

Cybersecurity Brief – 2025-07-11

Fri, 11 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Four individuals were arrested in the UK for cyberattacks targeting major retailers Marks & Spencer, Co-op, and Harrods. The suspects are believed to be connected to the Scattered Spider group, which has also targeted airlines and other sectors.
Qantas confirmed a data breach affecting 5.7 million customers. Exposed information includes names, addresses, email addresses, phone numbers, and other personal data.
Nippon Steel’s NS Solutions subsidiary suffered a breach exposing customer and employee data. There is currently no evidence of the data being leaked on dark web sites.
Ingram Micro experienced a ransomware attack that disrupted online ordering for customers. The company has since restored operations.
McDonald’s suffered a data exposure incident involving its AI-powered job application bot, which allowed access to applicant data using a weak default password.

Newly Discovered Vulnerabilities

CISA added CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
A critical remote code execution vulnerability was discovered in the open-source mcp-remote project, affecting over 437,000 downloads.
Multiple critical vulnerabilities, dubbed “PerfektBlue,” were identified in the BlueSDK Bluetooth stack used by Mercedes, Volkswagen, and Skoda vehicles. These flaws could allow remote code execution and potential access to critical vehicle systems.
A high-severity flaw, CVE-2025-3648, was disclosed in the ServiceNow platform. Exploitation could lead to data exposure via misconfigured access control lists (ACLs).
AMD disclosed a new class of vulnerabilities called Transient Scheduler Attacks, impacting a wide range of its CPUs and potentially allowing information disclosure.
A 6-year-old Oracle vulnerability affecting eSIM technology was disclosed, enabling potential spying and device takeover across millions of phones.
The Model Context Protocol (MCP) ecosystem, widely adopted for integrating AI models with external data, was found to have critical security vulnerabilities opening new attack vectors.

Notable Threat Actor Activity

Scattered Spider, a data theft and extortion group, has shifted its targeting to the aviation and transportation sectors, according to warnings from the FBI and cybersecurity experts.
Kaspersky identified malicious open-source packages for Cursor AI that deploy the Quasar backdoor and a cryptocurrency stealer.
Ongoing social engineering campaigns are using fake gaming and AI startup firms on Telegram and Discord to distribute malware targeting cryptocurrency users.
A new ZuRu malware variant is propagating via trojanized versions of the Termius macOS app, targeting developers.
Deepfake attacks are being used to impersonate high-profile political figures, such as Marco Rubio, to attempt to extract government secrets.
A Russian professional basketball player was arrested in France at the request of the US for allegedly acting as a negotiator for a ransomware gang.

Trends, Tools, or Tactics of Interest

AI-driven attacks are becoming more sophisticated, faster, and pervasive, with increased use of generative AI in offensive operations.
SSH tunneling, specifically direct-tcp requests, is highlighted as an active technique.
Force Push Scanner is a new tool for red teams to identify leaked secrets in ephemeral GitHub commits.
Anubis, an open-source self-hosted firewall, is being used to block AI bots from scraping website content.
SIM swap fraud is reportedly increasing, highlighting ongoing risks to mobile-based authentication.
Microsoft replaced the default JScript engine with JScript9Legacy in Windows 11 version 24H2 and later, aiming to improve scripting security.

Regulatory or Policy Developments

The FBI issued guidance on CJIS (Criminal Justice Information Services) compliance, emphasizing password hygiene, multi-factor authentication, and access control for law enforcement data handlers.
The U.S. Department of Homeland Security is advising law enforcement to treat certain protest activities as violent tactics, including livestreaming and skateboarding, potentially affecting policing and surveillance practices.
CISA’s update to the KEV catalog with Citrix NetScaler CVE-2025-5777 signals heightened regulatory attention to actively exploited enterprise vulnerabilities.

Cybersecurity Brief – 2025-07-10

Thu, 10 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas confirmed a data breach affecting 5.7 million customers, with threat actors exfiltrating customer data.
Bitcoin Depot reported a data breach impacting nearly 27,000 cryptocurrency users, exposing sensitive customer information.
Ingram Micro is restoring operations after a ransomware attack by the SafePay group, which disrupted systems and business services.
McDonald’s AI hiring platform, operated by Paradox.ai, exposed the personal information of tens of millions of job applicants due to basic security flaws, including the use of the password ‘123456’.
Nippon Steel Solutions disclosed a data breach following exploitation of a zero-day vulnerability in network equipment.
Nova Scotia Power, a Canadian electric utility, reported disruption of power meters and a data breach affecting individuals in both Canada and the United States.
Researchers identified millions of users being spied on via malicious browser extensions available in the Chrome and Edge web stores.

Newly Discovered Vulnerabilities

Microsoft released patches for 130 vulnerabilities, including critical flaws in SPNEGO and SQL Server. One of the patched vulnerabilities was publicly known prior to remediation.
A new vulnerability in ServiceNow, dubbed “Count(er) Strike,” allows low-privileged users to enumerate and extract restricted data from tables they should not access.
Multiple severe vulnerabilities remain unpatched in Ruckus Wireless management products, allowing attackers to fully compromise managed network environments.
A container escape vulnerability in the NVIDIA Container Toolkit could allow attackers to access AI datasets across Kubernetes tenants.
Ivanti, Fortinet, and Splunk released security updates addressing critical and high-severity vulnerabilities in their respective products.
Siemens, Schneider Electric, and Phoenix Contact issued July 2025 ICS Patch Tuesday advisories, addressing vulnerabilities in industrial control systems.

Notable Threat Actor Activity

The Initial Access Broker (IAB) Gold Melody has been linked to campaigns exploiting leaked ASP.NET machine keys to gain unauthorized access to organizations and sell that access.
APT group DoNot, with suspected ties to India, expanded operations targeting European foreign ministries using the LoptikMod malware for data harvesting.
The U.S. Department of the Treasury sanctioned a North Korean hacker affiliated with the Andariel group for involvement in remote IT worker schemes and malware campaigns.
Xu Zewei, a Chinese national, was arrested in Milan for alleged involvement with the Silk Typhoon state-sponsored group and cyberattacks against U.S. organizations.
Researchers reported a North American APT exploiting a Microsoft Exchange zero-day to target a Chinese entity.
The SatanLock ransomware group has shut down its operations but plans to leak additional files stolen from victims.

Trends, Tools, or Tactics of Interest

Attackers are bypassing legacy MFA solutions using real-time phishing and fake websites, highlighting the limitations of traditional authenticator apps.
A proof-of-concept AI malware using reinforcement learning was demonstrated to reliably evade Microsoft Defender.
Deepfake technology was used to impersonate a government official, successfully deceiving diplomats and politicians, exemplifying the growing national security threat from AI-generated impersonations.
Malicious browser extensions continue to be distributed via official Chrome and Edge stores, enabling large-scale user surveillance.
The open-source bot blocker “Anubis” was introduced to prevent AI scrapers from accessing website content using a proof-of-work firewall.
SSH tunneling and direct-tcp requests were highlighted as active techniques for covert network access.
Security automation platforms like Tines are offering extensive libraries of pre-built workflows for ticketing, device identification, and threat triage.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s OFAC imposed sanctions on a North Korean cyber actor for their role in IT worker schemes supporting the Andariel group.
Microsoft confirmed a widespread issue with Windows Server Update Services (WSUS) preventing synchronization and deployment of Windows updates.
Microsoft announced that Windows 10 Extended Security Updates (ESU) will be available for consumers and businesses post-October 2025, with varying pricing models.
Microsoft Authenticator on iOS will transition backups to iCloud, removing the requirement for a Microsoft personal account.
Google disclosed further details on Android’s Advanced Protection for Chrome, emphasizing enhanced security measures.
Samsung announced new security features for Galaxy smartphones, including on-device AI protections, cross-device threat detection, and quantum-resistant encryption for network security.

Cybersecurity Brief – 2025-07-08

Tue, 08 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro, a major IT distributor, experienced a ransomware attack causing widespread outages and disruption to customer ordering and services. The company is working to restore systems; details on data theft remain undisclosed.
Qantas confirmed it is being extorted by threat actors following a cyberattack that potentially exposed the data of 6 million customers.
Hackers stole nearly $140 million from six Brazilian banks by using credentials purchased from a C&M employee for $920.
The International Criminal Court (ICC) disclosed a sophisticated cyberattack in its latest threat intelligence report.
The PC version of Call of Duty: WWII was taken offline after reports of gamers being hacked.
Several Russian industrial enterprises were targeted in a phishing campaign delivering the newly discovered Batavia spyware, which exfiltrates sensitive data from corporate devices.

Newly Discovered Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Researchers released proof-of-concept exploits for CVE-2025-5777 (“CitrixBleed2”), a critical Citrix NetScaler vulnerability that is easily exploitable and now publicly available.
Grafana patched multiple Chromium bugs, including CVE-2025-6554, a zero-day vulnerability exploited in the wild that could allow remote code execution and memory corruption.

Notable Threat Actor Activity

A Chinese national allegedly linked to the Silk Typhoon (APT41) group was arrested in Milan for cyberespionage activities targeting American organizations.
North Korean threat actors were observed targeting cryptocurrency and Web3 platforms on Telegram using malicious Zoom meeting requests to deliver the NimDoor macOS malware.
TAG-140 targeted Indian government entities using “ClickFix-style” lures, leading to BroaderAspect .NET loader execution.
Iranian hackers breached a U.S. water facility, gaining control over a pressure station serving 7,000 people.
Batavia spyware campaigns used contract-themed phishing emails to compromise Russian industrial organizations.
Over 8,500 SMB users were targeted in an SEO poisoning campaign delivering the Oyster malware loader disguised as AI tools.
Hackers exploited a leaked copy of the Shellter Elite red team tool to deploy infostealers in live attacks.

Trends, Tools, or Tactics of Interest

The Atomic macOS infostealer (AMOS) has added a backdoor for persistent access to compromised systems.
The new “Bert” ransomware strain targets both Linux and Windows systems, featuring aggressive multithreading and cross-platform capabilities.
A Chrome browser extension with over 100,000 downloads was found to contain sophisticated spyware, hijacking sessions and redirecting users to malicious sites.
Modern malware increasingly incorporates anti-debugging and anti-analysis features to evade detection.
Hunters International, a Ransomware-as-a-Service (RaaS) group and successor to Hive, announced its shutdown and transition to “World Leaks,” focusing on data theft and extortion. Free decryptors were offered to previous victims.
PayPal has implemented an AI-powered scam alert system that may intercept suspicious transactions to combat increasingly sophisticated fraud attempts.
Let’s Encrypt began issuing free certificates for IP addresses, which, while enhancing security, also presents new opportunities for cybercriminal abuse.

Regulatory or Policy Developments Affecting the Security Industry

CISA’s addition of four new actively exploited vulnerabilities to its KEV catalog may prompt accelerated patching and mitigation efforts across affected organizations.
Let’s Encrypt’s rollout of certificates for IP addresses introduces new considerations for certificate management and threat actor abuse.

Cybersecurity Brief – 2025-07-06

Sun, 06 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro, a major IT distributor, is experiencing an ongoing outage attributed to a SafePay ransomware attack. Internal systems have been shut down as a result of the incident.

Newly Discovered Vulnerabilities

Exposed Java Debug Wire Protocol (JDWP) interfaces are being actively exploited by threat actors to gain remote code execution and deploy cryptocurrency miners on compromised systems.

Notable Threat Actor Activity

Attackers are leveraging exposed JDWP interfaces for illicit crypto mining operations.
Hpingbot malware is targeting SSH services to facilitate Distributed Denial of Service (DDoS) attacks.
Iran-linked hackers have threatened to release emails related to the Trump campaign.
Chinese state-linked threat actors reportedly maintain persistent access within US telecommunications networks.

Trends, Tools, or Tactics of Interest

SSH and Telnet honeypot data has revealed the use of new and notable usernames by attackers, indicating ongoing credential stuffing and brute-force attempts.
The Flipper Zero multi-tool continues to gain attention for its versatile capabilities, which include radio protocol manipulation and device access, underscoring its popularity among security researchers and potential misuse by threat actors.
AI research tools such as ChatGPT Deep Research are expanding integration options, with new connectors including Slack, potentially broadening the attack surface if misconfigured or abused.

Regulatory or Policy Developments Affecting the Security Industry

Taiwan’s National Security Bureau (NSB) has issued a public warning regarding the security risks posed by Chinese-developed applications, specifically RedNote (Xiaohongshu), Weibo, TikTok, WeChat, and Baidu Cloud, citing concerns over excessive data collection and potential foreign influence.
Android is reportedly developing a feature to warn users about fake cell towers (IMSI catchers), aimed at improving user privacy and security against mobile interception threats.

Cybersecurity Brief – 2025-07-05

Sat, 05 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ingram Micro has suffered a global outage affecting its websites and internal systems. Customers have expressed concern that this may be the result of a cyberattack, although the company has not issued an official statement regarding the cause.
A hacker has claimed to have stolen and leaked 106GB of data from Spanish telecommunications provider Telefónica. The company has not confirmed the breach.

Newly Discovered Vulnerabilities

Two critical vulnerabilities have been disclosed in the Sudo command-line utility for Linux and Unix-like operating systems. These flaws allow local attackers to escalate privileges to root. The vulnerabilities impact major Linux distributions.

Notable Threat Actor Activity

Threat actors are exploiting exposed Java Debug Wire Protocol (JDWP) interfaces to execute code remotely and deploy cryptocurrency miners on compromised systems. Additionally, Hpingbot malware is targeting SSH services to launch DDoS attacks.
A previously undocumented threat actor, NightEagle (also known as APT-Q-95), has been observed exploiting a Microsoft Exchange zero-day vulnerability to target China’s military and technology sectors.

Trends, Tools, or Tactics of Interest

There is increased threat activity leveraging exposed development and debugging interfaces (such as JDWP) for initial access and subsequent crypto mining payload deployment.
AI agents and custom generative AI workflows are emerging as potential sources of sensitive data leakage, introducing new risks for enterprises.

Regulatory or Policy Developments Affecting the Security Industry

A U.S. court has ordered Google to pay $314 million for misusing Android users’ cellular data by passively transmitting information while devices were idle, without user permission.
Taiwan’s National Security Bureau (NSB) has issued a public warning about the security risks associated with Chinese-developed applications including TikTok, Weibo, RedNote (Xiaohongshu), WeChat, and Baidu Cloud, citing concerns over excessive data collection and ties to China.