Inotiv on DanSec Daily

Cybersecurity Brief – 2025-12-06

Sat, 06 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite, resulting in the theft of database files.
American pharmaceutical company Inotiv reported a ransomware attack in August 2025 that led to the theft of personal information affecting thousands of individuals.
An AI image generator startup exposed a database containing over 1 million images and videos, including nude and “nudified” photos of real people, due to misconfigured internet access.
A human rights lawyer in Pakistan was targeted by Intellexa’s Predator spyware via a malicious WhatsApp link, marking the first known civil society targeting in the region.
Cloudflare experienced a major outage, causing widespread 500 Internal Server Errors, attributed to emergency mitigations for the React2Shell vulnerability.

Newly Discovered Vulnerabilities

React2Shell (CVE-2025-55182): A maximum-severity remote code execution vulnerability in React and Next.js was disclosed. The flaw is under active exploitation, particularly by China-linked threat actors, and has prompted emergency patching efforts including by Cloudflare.
Apache Tika (CVE-2025-66516): A critical XML external entity (XXE) injection vulnerability, rated CVSS 10.0, was disclosed in Apache Tika, requiring urgent patching.
Perplexity’s Comet Browser: A new agentic browser attack was disclosed, allowing a crafted email to trigger deletion of a user’s entire Google Drive contents via a zero-click exploit.
Akamai HTTP Smuggling: Akamai patched a vulnerability allowing HTTP smuggling attacks.

Notable Threat Actor Activity

Multiple China-nexus threat groups began exploiting the React2Shell vulnerability within hours of its public disclosure, targeting React and Next.js applications.
State-sponsored actors from the People’s Republic of China (PRC), including the group Warp Panda, have been observed deploying the BRICKSTORM, Junction, and GuestConduit malware families for long-term persistence in US systems.
Clop ransomware group exploited an Oracle E-Business Suite zero-day in the Barts Health NHS breach.
Intellexa, operators of Predator spyware, continue to leverage newly acquired zero-day exploits and alternative vectors such as ad-based delivery to bypass security controls and target individuals.

Trends, Tools, or Tactics of Interest

Malicious AI Tools: Researchers at Palo Alto Networks’ Unit 42 identified WormGPT 4 and KawaiiGPT, malicious AI tools enabling threat actors to automate the creation of phishing lures and ransomware code.
DDoS Attacks: The Aisuru botnet launched a record-breaking distributed denial-of-service (DDoS) attack, peaking at 29 Tbps and 14.1 billion packets per second, recently mitigated by Cloudflare.
Virtual Kidnapping Scams: The FBI warned of criminals using altered social media images as fake “proof of life” in virtual kidnapping ransom scams.
Attack Surface Management: Emphasis on continuous, automated attack surface visibility as cloud assets and exposures change rapidly.
Detection Tools: Burp Suite has added automated scanning capabilities for React2Shell vulnerabilities in Next.js applications.
Predator Spyware: Leaked Intellexa documents show ongoing use of high-priced zero-day exploits to maintain Predator spyware effectiveness.

Regulatory or Policy Developments

The European Commission fined X (formerly Twitter) €120 million ($140 million) for violating transparency obligations under the Digital Services Act (DSA), specifically related to deceptive blue checkmarks.
India has rolled back its proposed mandate requiring citizens to install a government cybersecurity app, following surveillance and privacy concerns.

Cybersecurity Brief – 2025-12-05

Fri, 05 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a US-based company, disclosed a ransomware attack resulting in the theft of names, addresses, Social Security numbers, and financial and medical information of 9,542 individuals.
Freedom Mobile reported a data breach involving the compromise of customer personal information through its account management platform.
Marquis suffered a data breach impacting over 780,000 people, with compromised data including names, addresses, Social Security numbers, and card numbers.

Newly Discovered Vulnerabilities

A critical command injection vulnerability in Array Networks AG Series secure access gateways (ArrayOS AG VPN devices) has been actively exploited since August 2025. Threat actors are deploying webshells and creating rogue users.
A maximum-severity vulnerability, CVE-2025-55182 (“React2Shell”), exists in React Server Components’ ‘Flight’ protocol, enabling remote code execution without authentication in React and Next.js applications. AWS and other sources confirm active exploitation attempts, including by China-linked threat groups. Only instances using a newer feature are affected.
Google released a Chrome update addressing 13 security issues, including a high-severity vulnerability in Digital Credentials.

Notable Threat Actor Activity

Chinese state-sponsored actors are actively exploiting the React2Shell vulnerability and targeting VMware vSphere servers with BrickStorm malware, as warned by CISA, NSA, and international partners. The BrickStorm malware is being used to backdoor VMware servers in government and technology sectors.
The Predator spyware, developed by Intellexa, is leveraging a new zero-click infection vector (“Aladdin”) that compromises targets via malicious advertisements without user interaction.
The financially motivated group GoldFactory is distributing modified banking apps in Southeast Asia (Indonesia, Thailand, Vietnam), resulting in over 11,000 mobile infections.
The Silver Fox threat actor is conducting a false flag campaign in China, distributing ValleyRAT malware via fake Microsoft Teams installers and search engine optimization (SEO) poisoning.
Russian state-sponsored hackers targeted Reporters Without Borders (RSF) using phishing emails to deliver malware.
China-based SMS phishing groups have shifted tactics to promote scams involving loyalty points, taxes, and fake retailers during the holiday season.
A student was found selling access to compromised government and university websites to Chinese threat actors for low prices.

Trends, Tools, or Tactics of Interest

Sophisticated fraud attacks are increasing, driven by the accessibility of AI tools and fraud-as-a-service platforms, making advanced techniques available to unskilled attackers.
Multi-stage phishing campaigns targeting Microsoft 365 credentials have been observed since November 2025, employing advanced evasion techniques.
AutoIT3 compiled scripts are being used to deliver shellcode payloads in Windows environments.
There is a marked increase in AI-powered attacks, evolving injection techniques, and the use of automation in both offensive and defensive cyber operations.
Cloudflare reported blocking 416 billion AI bot requests since July 1, indicating a surge in automated scraping and reconnaissance activity.
SMS phishing campaigns are adapting to current events and seasonal trends, with new lures targeting points, taxes, and fake retailers.

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) announced the testing of a “Proactive Notifications” service to alert UK organizations about vulnerabilities in exposed devices.
CISA, NSA, and allied cyber agencies published security guidance for the integration of AI in operational technology (OT) environments, outlining principles for secure AI deployment in critical infrastructure.
India’s Ministry of Communications rescinded an order that would have required smartphone manufacturers to preinstall a government cybersecurity app (“Sanchar Saathi”) and prevent users from disabling it.
Canadian police are trialing facial recognition body cameras, raising potential privacy and accuracy concerns.
The US Inspector General’s report on the “Signalgate” incident recommended a single procedural change to improve the handling of classified material.
ServiceNow acquired Veza, a provider of non-human identity (NHI) access control, to enhance its governance and AI Control Tower offerings.

Cybersecurity Brief – 2025-08-26

Tue, 26 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Farmers Insurance disclosed a data breach affecting 1.1 million individuals, with the compromise traced to broader attacks on Salesforce environments.
French retailer Auchan reported a cyberattack that exposed sensitive loyalty account data of several hundred thousand customers.
Aspire Rural Health System confirmed a data breach impacting nearly 140,000 individuals, attributed to the BianLian ransomware group.
Data I/O, a chip programming firm, experienced a ransomware attack disrupting communications, shipping, and production operations.
Arch Linux Project has been subject to a week-long DDoS attack, affecting its website, repository, and forums.
US pharmaceutical company Inotiv suffered a cyberattack, as reported in threat intelligence bulletins.
Lab-Dookhtegen claimed responsibility for attacks disabling communications on more than 60 Iranian cargo ships and oil tankers.

Newly Discovered Vulnerabilities

Docker released patches for CVE-2025-9074, a critical container escape vulnerability (CVSS 9.3) in Docker Desktop for Windows and macOS, which allowed attackers to compromise host systems even with Enhanced Container Isolation enabled.
CISA added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, impacting Citrix Session Recording and Git.
Researchers described the “OneFlip” attack, a Rowhammer-based technique that flips a single bit in neural network weights, enabling stealthy backdoors in AI systems.
Multiple password manager flaws and an Apple 0-day were highlighted as being exploited in the wild.
Researchers detailed a new AI attack method that hides data-theft prompts in downscaled images processed by large language models.
The “ClickFix” attack was described, where AI-generated content summaries are abused to push malware.
Prompt injection vulnerabilities in AI browsers were reported, with potential for significant financial risk to users.

Notable Threat Actor Activity

The China-nexus threat actor UNC6384 was attributed to attacks against diplomats in Southeast Asia and globally, deploying PlugX malware via captive portal hijacks and valid certificates.
Transparent Tribe (APT36), a Pakistani state-sponsored group, targeted Indian government entities and Linux systems with malicious desktop shortcut files as part of a phishing campaign.
The Anatsa Android banking trojan expanded operations, now targeting 830 financial and cryptocurrency applications across additional countries.
A new phishing campaign was identified using fake voicemail and purchase order emails to deliver the UpCrypter malware loader, which installs remote access trojans (RATs) for persistent access.
Surge in coordinated scanning activity detected against Microsoft Remote Desktop Web Access and RDP authentication servers, involving nearly 2,000 IP addresses.
BianLian ransomware group was confirmed as responsible for the Aspire Rural Health System breach.

Trends, Tools, or Tactics of Interest

Seventy-seven malicious Android apps, totalling over 19 million installs, were removed from Google Play after being found to contain various types of malware.
Fast-spreading, complex phishing campaigns are increasingly delivering RATs, enabling both credential theft and long-term network persistence.
Attackers are leveraging malware persistence techniques such as scheduled tasks and startup scripts, with detection and blocking methods highlighted for platforms like Wazuh.
SIEM rule effectiveness was analysed using 160 million attack simulations, revealing common detection failures and the need for improved tuning.
Ongoing DDoS attacks continue to target open-source and infrastructure projects, as seen with the Arch Linux Project.

Regulatory or Policy Developments Affecting the Security Industry

Google announced forthcoming requirements to verify the identity of all Android app developers in four countries, extending to those distributing apps outside the Play Store.
CISA published updated guidance on the Minimum Elements for a Software Bill of Materials (SBOM) and requested public feedback.
The US Federal Trade Commission (FTC) chair issued letters to major tech companies, urging them not to weaken encryption in response to foreign government demands.

Cybersecurity Brief – 2025-08-21

Thu, 21 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a pharmaceutical company, confirmed a ransomware attack that resulted in the compromise and encryption of internal systems, with business operations impacted.
Vulnerabilities in a Workhorse Software application used by hundreds of municipalities exposed sensitive data; CERT/CC disclosed details following the release of patches.
Vulnerable internal services at Intel exposed information of 270,000 employees, as reported by a security researcher.
Microsoft is investigating an outage affecting Copilot and Office.com, impacting user access across North America.
Six major password managers are currently vulnerable to unpatched clickjacking flaws, potentially exposing user credentials, two-factor authentication codes, and credit card information.
McDonald’s staff and partner portals were found to have exposed APIs, sensitive data, and corporate documents due to security flaws.
Hackers are using legitimate ADFS redirects via office.com links to steal Microsoft 365 login credentials through phishing attacks.
The RapperBot DDoS-for-hire botnet was disrupted, and the alleged developer and administrator has been charged by the US Department of Justice.
A member of the “Scattered Spider” cybercrime group was sentenced to 10 years in prison and ordered to pay $13 million in restitution for SIM-swapping and related cyber offences.
Europol has clarified that a purported $50,000 reward for Qilin ransomware group members is a scam.

Newly Discovered Vulnerabilities

Apple released emergency security updates for iOS, iPadOS, and macOS, patching CVE-2025-43300, an out-of-bounds write zero-day vulnerability actively exploited in targeted attacks.
Google and Mozilla issued patches for multiple high-severity vulnerabilities in Chrome and Firefox browsers.
DOM-based clickjacking vulnerabilities affecting major password manager browser extensions could allow attackers to steal credentials and sensitive data.
A vulnerability in GPT-5’s routing mechanism can redirect user queries to older, less secure models, risking exposure to jailbreaks and unsafe outputs.
Researchers identified prompt injection vulnerabilities in AI browsers, such as Perplexity’s Comet, allowing malicious prompts to trigger unintended actions, including fraudulent purchases.
Vulnerabilities in McDonald’s internal portals exposed sensitive APIs and corporate documents.
CERT/CC disclosed information exposure vulnerabilities in Workhorse Software, used by local governments, after patch release.

Notable Threat Actor Activity

The Russian state-sponsored group “Static Tundra” (aka Energetic Bear) is exploiting a seven-year-old flaw in Cisco IOS/IOS XE software, targeting unpatched, end-of-life devices for cyber espionage against enterprises and critical infrastructure.
North Korean threat actors have conducted a coordinated cyber espionage campaign against diplomatic missions in South Korea, leveraging GitHub for command and control and deploying spear-phishing tactics.
Detailed spear-phishing attacks targeting European government entities in Seoul have been attributed to North Korea, China, or both.
Cybercriminals are increasingly abusing the AI-powered Lovable website builder to generate phishing pages, malware delivery sites, and fraudulent portals.
Low-skill attackers are leveraging LLM-generated scripts and services like Lovable to rapidly create convincing malicious websites.
Increased scanning activity targeting Airtell routers and web servers has been observed via honeypots.

Trends, Tools, or Tactics of Interest

HR-themed phishing attacks have surged by 120% in Q1 2025, with attackers impersonating internal HR communications to increase success rates.
The use of legitimate infrastructure (e.g., office.com, ADFS) in phishing campaigns is on the rise, enabling more convincing credential theft schemes.
AI browsers and agentic tools are being actively researched for vulnerabilities, with prompt injection and clickjacking emerging as significant risks.
The “Warlock” ransomware group is specifically targeting vulnerable on-premises SharePoint servers using sophisticated attack methods.
There is a notable increase in the abuse of AI-driven website builders (e.g., Lovable, Vibe) to lower barriers for cybercriminals, enabling rapid deployment of malicious sites.
The disruption of the RapperBot botnet and law enforcement action against its administrator highlight ongoing efforts to combat DDoS-for-hire operations.
Increased focus on shadow AI agents within enterprises, with concerns that unmonitored deployments could introduce significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced its Quantum-Safe Program, aiming to ensure all products and services are secured against quantum-based attacks by 2033.
Incode has acquired AuthenticID to enhance AI-driven identity verification, combining AI models with large-scale, regulated identity programme experience.
Europol issued a warning about fraudulent reward offers targeting ransomware group members, clarifying that a recently publicised Qilin reward is a scam.

Cybersecurity Brief – 2025-08-20

Wed, 20 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Allianz Life (US): Hackers stole personal information of 1.1 million individuals in a Salesforce data theft attack. Exposed data includes physical addresses, dates of birth, phone numbers, and other sensitive information for life insurance customers.
Business Council of New York State (US): Data breach in February led to theft of personal, financial, and health information of over 47,000 individuals.
Inotiv (US): Ransomware attack resulted in encryption of systems and data, impacting business operations.
Bragg Gaming Group (Global): Hackers accessed internal systems, though operations reportedly unaffected.
TPG Telecom/iiNet (Australia): Unauthorised access detected in iiNet order management system; investigation ongoing.
Highly Sensitive Medical Cannabis Data (US): Nearly one million records, including SSNs, government IDs, and health data, exposed due to an unsecured database.
Polish Power Plant (Poland): Russian hacktivists launched a cyberattack causing operational disruption at a power plant.
RapperBot DDoS Botnet: US authorities charged a 22-year-old Oregon man for operating the RapperBot botnet, which powered over 370,000 distributed denial-of-service attacks.

Newly Discovered Vulnerabilities

Apache ActiveMQ: Threat actors are exploiting a nearly two-year-old security flaw to gain persistent access to cloud Linux systems, deploying the DripDropper malware. Attackers have been observed patching the exploited vulnerability post-compromise to maintain exclusive access.
SAP NetWeaver: A public exploit chaining two critical, now-patched vulnerabilities has been released, exposing unpatched systems to remote code execution and data theft.
Windows CLFS (CVE-2025-29824): Previously zero-day flaw exploited in the wild as part of Play ransomware attack chains, enabling attackers to gain system-level privileges.
Windows Recovery/Reset: August 2025 security updates introduced an issue breaking reset and recovery operations on Windows 10 and some Windows 11 versions. Microsoft has released emergency out-of-band updates to address the problem.

Notable Threat Actor Activity

GodRAT: Financial institutions, especially trading and brokerage firms, are being targeted by a new remote access trojan dubbed GodRAT. The malware uses steganography and is based on Gh0st RAT code, likely as a successor to AwesomePuppet and attributed to the Winnti group.
ScarCruft (North Korea): The group has added ransomware to its toolset, distributing it via phishing emails.
PipeMagic Backdoor: Attackers are using the modular PipeMagic malware, which masquerades as a ChatGPT application, in conjunction with exploitation of Windows CLFS vulnerabilities as part of Play ransomware campaigns.
Russian Hacktivists: Conducted a disruptive cyberattack against a Polish power plant.
Yemen Cyber Army: UK courts sentenced Al-Tahery Al-Mashriky to 20 months in prison for hacktivist campaigns involving website defacement.

Trends, Tools, or Tactics of Interest

DripDropper Malware: Attackers exploiting Apache ActiveMQ are patching the same vulnerability after deploying their malware, a tactic to prevent other actors from leveraging the same entry point.
Linux Evasion: RingReaper, a sophisticated post-compromise tool, abuses the Linux kernel’s io_uring interface to evade endpoint detection and response (EDR) systems.
Darknet Communications: Criminal actors are increasingly migrating from traditional IRC forums to Telegram networks for operational security and resilience.
AI and Security: Increased discussion on the dual-use nature of AI helpers, with risks of AI-powered tools being leveraged for malicious purposes, including zero-click exploits against AI agents.
Supply Chain Attacks: Ongoing concern over GitHub risk vectors and supply chain compromise, with new research highlighting overlooked attack surfaces.
Increased Reconnaissance: Rise in scans targeting Elasticsearch instances, seeking misconfigurations or exposed data.
Vendor Security Requirements: Asian organizations, including a Japanese chipmaker and the Singaporean government, are mandating cybersecurity checks for suppliers in response to breach upticks.

Regulatory or Policy Developments

UK Encryption Policy: The UK government has dropped its demand for Apple to implement encryption backdoors following pressure from US civil liberties groups.
PyPI Security: The Python Package Index has implemented protections against domain resurrection attacks, reducing the risk of account hijacking through expired domain-based password resets.
Okta/Threat Detection: Okta has open-sourced a catalog of Sigma-based Auth0 detection rules to help customers identify account takeovers, misconfigurations, and suspicious behaviors in event logs.