Lenovo on DanSec Daily

Cybersecurity Brief – 2026-09-03

Thu, 03 Sep 2026 00:00:00 +0000

Major Incidents or Breaches

A BGP hijack was used to divert Softaculous traffic, enabling attackers to deliver a malicious Virtualizor update to some customers, resulting in persistent root access on affected systems ^[12].
Dropbox reported that attackers exploited a flaw in Lenovo’s email verification process to register fraudulent Lenovo IDs and access Dropbox accounts ^[20].
Cybercriminals are selling 153 million digital scans of US and Canadian driver’s licenses on the dark web, likely sourced from a breach at IDScan.net ^[32].
Brazilian government and educational institution web servers were compromised by the Gambling Goblin group, who installed malicious Apache modules to hijack traffic and redirect it to betting pages ^[11].

Newly Discovered Vulnerabilities

A privilege escalation zero-day vulnerability dubbed FalconFlank has been disclosed in CrowdStrike Falcon ^[6].
Seven new security flaws have been added to CISA’s Known Exploited Vulnerabilities catalog, including vulnerabilities being used to deploy reverse shells and crypto miners ^[7].
An unauthenticated SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox is being actively exploited for remote code execution ^[16].
A critical authentication bypass flaw (CVE-2026-82329) in JFrog Artifactory is under active exploitation, enabling attackers to forge admin tokens ^[18].
The All-in-One WP Migration and Backup plugin for WordPress contains an SQL injection flaw (CVE-2026-19949) that could allow unauthenticated remote code execution, affecting over 3 million sites ^[17]^[33].
Multiple vulnerabilities in Plex desktop clients and media servers prompted an urgent patch advisory from Plex ^[14].
SonicWall SMA 1000 devices are affected by zero-day vulnerabilities enabling unauthenticated remote code execution ^[23].
Cisco has issued patches for critical vulnerabilities in IOS XR and Nexus switches that could allow remote code execution and authentication bypass, and has warned of unpatched S/MIME flaws in its secure email products ^[34].
Rockwell Automation released patches for over a dozen vulnerabilities across several products, including RSLinx Classic and FactoryTalk ^[37].
An exploit has been published for a new Cleo Harmony vulnerability that allows remote authentication bypass via argument bearer manipulation ^[38].
Eight security flaws were disclosed across seven command-line AI coding agents, where malicious .git configurations could cause agents like Claude and Codex to execute attacker-controlled code ^[10].

Notable Threat Actor Activity

Threat actors are leveraging the Node.js runtime as a malware delivery tool in targeted attacks, abusing its trusted status to deploy malicious payloads ^[3].
The Shai-Hulud infostealer worm variant has expanded its credential theft capabilities, now scanning 469 locations across developer and CI/CD environments ^[4].
The “Spring Ring” threat group is targeting Microsoft Teams users with vishing attacks aimed at session hijacking, malware distribution, and infrastructure compromise ^[25].
The Gambling Goblin group, a Chinese-speaking cybercrime cluster, is responsible for malicious Apache module deployment on Brazilian government web servers ^[11].
The “Breeze Comet” threat group is conducting high-impact attacks on Brazilian and global financial systems ^[21].
A new Android banking trojan, StreamRat, was distributed to Spanish-speaking users through fake streaming campaigns on Meta ads, enabling near-complete device control ^[13].
NSO Group’s Pegasus spyware was used in a zero-click exploit to infect the iPhone of a Serbian student protest movement member ^[5].

Trends, Tools, or Tactics of Interest

Recruitment-themed phishing campaigns are using Browser-in-the-Browser (BitB) attacks to steal enterprise credentials ^[1].
The Balonx phishing kit uses generative AI to fully automate vishing attacks, including voice calls ^[2].
Active malware campaigns are distributing fake software installers that disable Windows Update and weaken Microsoft Defender, targeting users seeking popular software downloads ^[9].
Meta ads are being used as a distribution channel for Android malware, such as the StreamRat banking trojan ^[13].
Tech support scams are evolving, with scammers using new methods and targeting platforms more intelligently ^[40]^[41].
AI is being leveraged by cybercriminals to accelerate the speed and scale of attacks, providing significant time advantages ^[24].
Security tools for AI agents are emerging, such as OpenLeash, which adds human-in-the-loop checks for risky agent actions, and AIR Security’s firewall for AI skills and plugins ^[31]^[35].
Google, Anthropic, and OpenAI have released new cybersecurity-focused AI models, safeguards, and access programs to support defenders ^[8].

Regulatory or Policy Developments Affecting the Security Industry

The UK government has introduced late amendments to the Cyber Security and Resilience Bill, granting ministers new powers to block high-risk technology suppliers from critical infrastructure in response to supply chain attack concerns ^[36].
California and Colorado will require operating systems to collect users’ ages for compliance, with open-source software like Linux likely exempt ^[39].

Sources

BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access - thehackernews.com
Dropbox accounts breached through Lenovo email verification flaw - bleepingcomputer.com
153 Million Driver License Images Offered on Dark Web - securityweek.com
Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages - thehackernews.com
Researcher Releases FalconFlank PoC Showing Privilege Escalation in CrowdStrike Falcon - thehackernews.com
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners - thehackernews.com
Hackers exploit Sangoma Switchvox flaw to deploy reverse shells - bleepingcomputer.com
Hackers exploit critical JFrog Artifactory flaw to forge admin tokens - bleepingcomputer.com
WordPress backup plugin flaw exposes millions of sites to takeover attacks - bleepingcomputer.com
Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability - securityweek.com
Plex warns users to patch security vulnerabilities immediately - bleepingcomputer.com
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE - darkreading.com
Cisco Warns of Unpatched Secure Email Flaws, Patches Critical Switch Vulnerabilities - securityweek.com
Rockwell Automation Patches Over a Dozen Vulnerabilities Across Products - securityweek.com
Exploit Published for Fresh Cleo Harmony Vulnerability - securityweek.com
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code - thehackernews.com
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks - thehackernews.com
Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means - thehackernews.com
Threat Gang 'Springs' Vishing Attacks on Microsoft Teams Users - darkreading.com
'Breeze Comet' Tears Into Brazilian & Global Financial Systems - darkreading.com
Meta Ads Push StreamRat Android Trojan That Can Gain Near-Complete Device Control - thehackernews.com
Pegasus Zero-Click Spyware Exploit Infects Serbian Student Movement Member's iPhone - thehackernews.com
Recruitment-Themed Phishing Campaign Targets Enterprise Users - blog.knowbe4.com
New Phishing Kit Uses AI to Fully Automate Vishing Attacks - blog.knowbe4.com
Fake Software Installers Disable Windows Update and Weaken Microsoft Defender - thehackernews.com
Tech support scams look different now. Here’s what to watch for - malwarebytes.com
Scammers are getting smarter about where they target you - malwarebytes.com
AI Gives Cybercriminals a Dangerous Time Advantage - darkreading.com
AI Agent Firewall Startup AIR Security Emerges From Stealth With $50 Million - securityweek.com
OpenLeash Adds a Human Check to Risky AI Agent Actions - securityweek.com
Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs - thehackernews.com
UK Moves to Block High-Risk Tech Suppliers From Critical Infrastructure - securityweek.com
Your phone or computer may soon ask how old you are - malwarebytes.com

Cybersecurity Brief – 2025-08-12

Tue, 12 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Connex Credit Union disclosed a data breach affecting 172,000 members, with attackers stealing personal and financial information after breaching its systems.
The Netherlands’ National Cyber Security Centre (NCSC) reported exploitation of Citrix NetScaler vulnerability CVE-2025-6543 to breach critical organisations in the country.
Air France experienced a data breach resulting in the leak of frequent flyer data (as per Check Point’s weekly threat bulletin).
A major automaker’s dealership platform used by over 1,000 US dealerships was found to be vulnerable, allowing car hacking and personal data theft, including the ability for unauthorised remote vehicle unlocking.
Two hackers reportedly breached North Korean state-sponsored group Kimsuky, stealing and leaking internal data.
Law enforcement, in collaboration with international partners, took down infrastructure and seized over $1 million associated with the BlackSuit (Royal) ransomware group.
Over 29,000 Microsoft Exchange servers remain unpatched against a high-severity vulnerability, leaving them exposed to lateral movement and cloud environment compromise.

Newly Discovered Vulnerabilities

Researchers identified new security flaws in the TETRA (Terrestrial Trunked Radio) communications protocol, including weaknesses in its proprietary end-to-end encryption, impacting law enforcement and critical infrastructure communications.
A critical vulnerability in the OPC UA industrial protocol was disclosed, exposing utilities and factories to risk despite the protocol’s use of complex cryptography.
A sandbox escape with remote code execution was discovered in Google Chrome, earning a $250,000 bug bounty.
A path traversal vulnerability in WinRAR (CVE-2025-8088) was exploited as a zero-day by the Russian ‘RomCom’ group, targeting financial, defence, manufacturing, and logistics sectors in Europe and Canada.
A BadUSB attack technique, dubbed BadCam, was demonstrated against Lenovo Linux webcams, allowing persistent compromise via malicious USB devices.
Flaws in a major automaker’s dealership portal exposed customer and vehicle data and enabled unauthorised remote access to vehicles.

Notable Threat Actor Activity

The Russian-linked ‘RomCom’ hacking group exploited the WinRAR CVE-2025-8088 zero-day in targeted attacks on organisations in Europe and Canada.
North Korean Kimsuky hackers were themselves compromised, with internal data reportedly leaked by adversarial actors.
US authorities charged four Ghanaian nationals for their involvement in a $100 million fraud ring involving romance scams and business email compromise attacks.
The BlackSuit (Royal) ransomware gang suffered infrastructure seizures and asset forfeiture following coordinated law enforcement action.
An affiliate of the REvil ransomware group accused the Russian government of orchestrating the 2021 Kaseya supply chain attack.
Malicious actors have been actively exploiting a critical Erlang/OTP SSH vulnerability, with 70% of detected attacks targeting operational technology (OT) firewalls.

Trends, Tools, or Tactics of Interest

Surge in exploitation of Erlang/OTP SSH vulnerabilities, with a focus on OT firewall targets.
Increase in “native phishing” campaigns, where attackers abuse Microsoft 365 apps such as OneNote and OneDrive to deliver internal phishing lures.
Jailbreaking techniques for GPT-5 were demonstrated using “echo chamber” prompts and storytelling, bypassing safeguards without using inappropriate language.
The DarkBit ransomware (linked to MuddyWater) encryption was cracked by researchers, enabling free victim data recovery.
Exposure of persistent threats via USB-based attacks (BadCam) targeting Linux webcams.
Ongoing risk from large numbers of unpatched Exchange servers, facilitating potential lateral movement and cloud compromise.

Regulatory or Policy Developments

The Netherlands’ NCSC issued a public warning regarding active exploitation of Citrix NetScaler CVE-2025-6543, urging immediate remediation for critical infrastructure.

Cybersecurity Brief – 2025-08-10

Sun, 10 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Google confirmed a data breach involving one of its Salesforce CRM instances, exposing information related to potential Google Ads customers.
The US federal court records system was compromised in a cyberattack, with details on the scope and impact emerging.
Sixty malicious Ruby gems containing credential-stealing code were downloaded over 275,000 times since March 2023, targeting developer accounts.

Newly Discovered Vulnerabilities

Vulnerabilities in select Linux-based Lenovo webcam models were disclosed, allowing remote attackers to exploit them as BadUSB devices for injecting keystrokes.
Researchers identified security flaws in free Wi-Fi systems on buses, enabling remote hacking that could allow attackers to track, control, or spy on bus systems.

Notable Threat Actor Activity

Distribution of malicious Ruby gems targeting developers with credential theft has been ongoing since March 2023, indicating a sustained supply chain attack campaign.

Trends, Tools, or Tactics of Interest

A jailbreak technique for OpenAI’s GPT-5 LLM was uncovered, enabling bypass of ethical guardrails and production of illicit instructions. Researchers also demonstrated “zero-click” AI agent attacks targeting cloud and IoT systems.
The Uncut Gem project introduced a fully open-source quantum sensor initiative, potentially broadening access to quantum sensing technology.

Regulatory or Policy Developments Affecting the Security Industry

Instagram faced public backlash over the privacy implications of its new map feature, raising concerns about user data exposure.

Cybersecurity Brief – 2025-07-31

Thu, 31 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group has been linked to data breaches at Qantas, Allianz Life, LVMH, and Adidas, using voice phishing attacks to steal data from Salesforce environments.
SafePay ransomware group claims to have stolen 3.5TB of data from Ingram Micro and is threatening to leak the data.
Telecom provider Orange suffered a cyberattack resulting in service disruptions for both corporate and individual customers.
The UNC2891 (LightBasin) threat group attempted a physical intrusion by planting a 4G-equipped Raspberry Pi on a bank’s network during a failed ATM heist.
The City of Saint Paul, Minnesota, called in the National Guard to respond to a cyberattack.
The National Treasury of South Africa and several other organisations were compromised in mass exploits of on-premises Microsoft SharePoint servers.
A U.S.-based chemicals company was breached via exploitation of a SAP NetWeaver vulnerability, leading to deployment of the Auto-Color backdoor.
The Python Software Foundation warned that attackers are using a fake PyPI website to phish for developer credentials.
Over 250 fake mobile apps targeting Koreans have been used to deploy spyware and conduct blackmail campaigns.
Discord and other social platforms are being flooded with fraudulent online gaming and wagering sites, which lure users and steal funds.

Newly Discovered Vulnerabilities

Apple released security updates for iOS, iPadOS, and Safari, patching 29 vulnerabilities, including a WebKit flaw that was exploited as a zero-day in Google Chrome.
Lenovo issued UEFI firmware updates to address high-severity BIOS flaws enabling Secure Boot bypass in certain desktop models.
Critical, now-patched vulnerabilities in Dahua smart camera firmware could allow remote hijacking via ONVIF and file upload exploits.
Researchers disclosed a critical authentication bypass in the Vibe coding platform Base44, which exposed private enterprise applications; Wix patched the issue.
A critical unauthenticated arbitrary file upload vulnerability in the WordPress ‘Alone’ theme is being actively exploited for remote code execution and full site takeovers.

Notable Threat Actor Activity

Cobalt Strike Beacon is being delivered via social media, Microsoft Learn Challenge, Quora, and GitHub in a campaign targeting Russian entities.
Hackers are distributing JSCEAL malware through Facebook ads promoting fake cryptocurrency trading apps, using compiled V8 JavaScript to capture sensitive data.
Chinese state-sponsored group Silk Typhoon (Hafnium) is linked to over 15 technology patents for cyber espionage tools, highlighting PRC-backed contractor involvement.
Scattered Spider’s activity has decreased following recent arrests, but their social engineering and backup targeting tactics are being adopted by other financially motivated actors.

Trends, Tools, or Tactics of Interest

Device Bound Session Credentials (DBSC) launched in open beta in Google Chrome to protect against session cookie theft.
A new attack vector allows threat actors to use malicious browser extensions to inject prompts into popular generative AI tools, including ChatGPT and Gemini (“Man in the Prompt” attack).
AI adoption in vCISO services is rapidly increasing, with a reported 68% reduction in workload and tripling of adoption rates among MSPs and MSSPs.
VPN usage in the UK is rising sharply in response to age verification controls mandated by the Online Safety Act.
Security awareness training and tools, such as KnowBe4’s Phish Alert Button, can significantly increase employee phishing reporting rates, as evidenced by a 50-fold increase in a large retail organisation.
Fraudsters are exploiting Discord and social media to promote sophisticated scam gaming sites.
Mass exploitation of on-premises Microsoft SharePoint servers continues to impact organisations, particularly in Africa.
Threat actors are using phishing with fake PyPI sites to target software developers and steal credentials.

Regulatory or Policy Developments

The US Senate Committee has advanced the nomination of Sean Plankey to lead the Cybersecurity and Infrastructure Security Agency (CISA).
The UK’s Online Safety Act, which mandates age verification on adult sites, is directly influencing a surge in VPN adoption across the region.

Industry Developments

Palo Alto Networks announced the acquisition of CyberArk for $25 billion, marking a significant move into the identity security market.
BlinkOps raised $50 million for its agentic security automation platform, bringing total funding to $90 million.
Legion emerged from stealth with $38 million in funding for its browser-native AI Security Operations Center (SOC) platform.
Cyata, an Israeli startup focused on AI agent monitoring and control, raised $8.5 million in funding.
The average cost of a data breach in the US has risen to $10.22 million, while the global average has decreased slightly to $4.44 million, according to IBM.

Cybersecurity Brief – 2025-07-30

Wed, 30 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The City of Saint Paul, Minnesota, suffered a significant cyberattack, prompting the activation of the National Guard in response to disruptions.
French telecommunications giant Orange disclosed a cyberattack after detecting a breached system on its network.
Russian airline Aeroflot experienced a cyberattack resulting in the cancellation of over 60 flights and severe delays.
Allianz Life reported a data breach impacting the majority of its 1.4 million US customers, exposing sensitive personal information.
The Tea Dating Advice app suffered two security incidents, resulting in the leak of approximately 72,000 images and 59,000 additional images from posts, comments, and direct messages, including unauthorized access to private messages.
A U.S.-based chemicals company was targeted by attackers exploiting a SAP NetWeaver vulnerability (CVE-2025-31324) to deploy the Linux Auto-Color malware.
The FBI seized $2.4 million in Bitcoin from a member of the newly emerged Chaos ransomware operation, linked to cyberattacks and extortion payments in Texas.

Newly Discovered Vulnerabilities

A critical access bypass flaw was discovered and patched in the Base44 AI-powered coding platform, which could have allowed unauthorized access to private applications.
Lenovo firmware vulnerabilities were identified that enable privilege escalation, code execution, and security bypass, facilitating persistent implant deployment.
Apple released updates for iOS, iPadOS, macOS, watchOS, tvOS, and visionOS, addressing a total of 89 vulnerabilities, including significant security issues.
A macOS vulnerability was disclosed that could allow bypass of Transparency, Consent, and Control (TCC) protections, exposing cached information such as geolocation and biometric data.
Ongoing exploitation of a two-year-old PaperCut vulnerability is enabling remote code execution by threat actors.
Researchers continue to observe supply chain attacks leveraging backdoors, poisoned code, and malicious commits in widely used tools including GitHub Actions, Gravity Forms, and npm.

Notable Threat Actor Activity

The Chaos ransomware-as-a-service (RaaS) group has emerged, believed to comprise former BlackSuit members following law enforcement takedown of BlackSuit infrastructure. Chaos has demanded $300,000 from U.S. victims and is linked to recent extortion and crypto seizures.
The ‘Gunra’ ransomware group has developed a Linux variant, expanding from initial Windows targeting and employing multithreaded encryption.
Ongoing phishing campaigns are targeting Python Package Index (PyPI) users with fake verification emails and lookalike domains, aiming to redirect victims to fraudulent PyPI sites.
Attackers are exploiting SAP NetWeaver (CVE-2025-31324) to deploy Linux malware in targeted attacks.
Cybercriminals are conducting large-scale mobile malware campaigns across Asia, distributing fake apps (dating, social, cloud storage, car service) to steal data and blackmail users.
Node.JS is being leveraged by threat actors to launch the JSCeal malware, targeting cryptocurrency applications.

Trends, Tools, or Tactics of Interest

Ransomware activity is increasing in sophistication, with 2025 trends highlighting smarter evasion and extortion tactics.
Attackers are bypassing “phishing-resistant” authentication methods using downgrade attacks, device-code phishing, and OAuth manipulation.
JavaScript injection attacks remain prevalent despite modern frameworks like React, with attackers exploiting prototype pollution and new injection techniques.
Browsers are increasingly becoming primary cyberattack vectors, with attackers exploiting both software vulnerabilities and user behavior.
Supply chain attacks remain a significant risk, with recent incidents involving poisoned code and malicious commits in popular development tools.
Security solutions and investments are focusing on AI-driven SOC analysts, securing LLMs/generative AI, and human risk management platforms.
The integration of SecurityCoach with Microsoft Edge for Business aims to bridge security gaps between technical controls and user behavior.

Regulatory or Policy Developments Affecting the Security Industry

UK age verification laws for adult content have led to a surge in VPN usage, raising concerns over privacy and the future of open internet access.
Google Project Zero reaffirmed its “90+30” vulnerability disclosure policy, emphasizing transparency and timely patching.