Cybersecurity Brief – 2025-05-20

Tue, 20 May 2025 00:00:00 +0000

Major Incidents and Breaches

UK Legal Aid Agency Data Breach: The UK Legal Aid Agency confirmed a significant data breach, with hackers stealing a large volume of sensitive applicant data. The breach led to the shutdown of the affected online service, and warnings have been issued to lawyers and defendants.
Arla Foods Cyberattack: Arla Foods experienced a cyberattack disrupting production operations and causing delays.
RVTools Supply Chain Compromise: The official RVTools website was compromised, distributing a trojanized installer delivering Bumblebee malware to users. Both Robware.net and RVTools.com are offline pending remediation.
Fake KeePass Distributions: Threat actors have been distributing trojanized KeePass password manager installers for at least eight months, leading to credential theft, Cobalt Strike beacon deployment, and subsequent ESXi ransomware attacks.

Firefox Zero-Days Patched: Mozilla released emergency updates for two zero-day vulnerabilities exploited at the Pwn2Own Berlin 2025 competition. These flaws could lead to sensitive data exposure or code execution.
O2 UK Location Leak: O2 UK patched a vulnerability in its VoLTE and WiFi Calling implementations that allowed attackers to determine user locations and other identifiers via call metadata.
Windows 10 BitLocker Recovery Issue: Microsoft issued out-of-band patches to address a problem causing Windows 10 systems to boot into BitLocker recovery mode after the May 2025 updates.

Ransomware Gangs Using Skitnet Malware: Multiple ransomware groups are employing Skitnet malware for post-exploitation activities, including stealthy data theft and establishing remote access.
Malicious PyPI Packages: Researchers identified malicious Python packages on PyPI that check stolen email addresses against Instagram and TikTok APIs, likely to validate credentials for further exploitation.
Operation RoundPress Targeting Ukraine: A cyber-espionage campaign is targeting Ukrainian government entities with spear-phishing attacks exploiting XSS vulnerabilities in webmail platforms.
Phishing Kit Evolution: Commodity phishing kits are increasingly capable of auto-generating tailored login pages, enhancing the effectiveness of phishing attacks.

Continuous Threat Exposure Management (CTEM): CTEM is increasingly adopted as a core strategy for CISOs, moving from conceptual to operational in enterprise security programs.
Zero-Day Exploitation at Scale: Pwn2Own Berlin saw researchers exploit 29 zero-day vulnerabilities, earning over $1 million in rewards, highlighting ongoing challenges in proactive vulnerability management.
AI and Deepfake Use in Scams: Criminals are leveraging AI and deepfake technologies to enhance social engineering and scam campaigns, as seen in training provided to West African scam groups.
Supply Chain Attacks via Trusted Software: The RVTools and KeePass incidents underscore the growing risk of software supply chain attacks through compromised or fake installers.

CISA Leadership Update: Madhu Gottumukkala has been appointed as the new Deputy Director of the US Cybersecurity and Infrastructure Security Agency (CISA).
CVE System Uncertainty: Ongoing disruption and uncertainty within the Common Vulnerabilities and Exposures (CVE) system may undermine foundational defensive security efforts.
Take It Down Act Enacted in US: The new law mandates quick removal of nonconsensual intimate imagery from online platforms, raising potential free speech and censorship concerns.
23andMe Acquisition and Data Privacy: Regeneron’s acquisition of 23andMe brings increased scrutiny to the privacy and security of genetic data.
Microsoft AI and Security Initiatives: Microsoft announced support for Anthropic’s MCP standard for AI agent security, open-sourced the Windows Subsystem for Linux, and introduced Windows AI Foundry to support secure AI-powered applications.