Linksys on DanSec Daily

Cybersecurity Brief – 2025-05-30

Fri, 30 May 2025 00:00:00 +0000

Major Incidents or Breaches

ConnectWise, the developer of ScreenConnect remote access software, disclosed a cyberattack attributed to a suspected nation-state threat actor. The breach impacted a limited number of ScreenConnect customers.
Victoria’s Secret took its website and some store services offline following a security incident. The company has engaged third-party experts to investigate.
LexisNexis Risk Solutions reported a data breach affecting over 364,000 individuals, resulting from a December 2024 incident. The breach involved third-party access to customer data, but LexisNexis systems were not directly compromised.
A Managed Service Provider’s SimpleHelp RMM tool was compromised by the DragonForce ransomware group, who exfiltrated data and deployed ransomware across customer endpoints.
SentinelOne experienced a global outage affecting 10 commercial customer consoles, including Singularity Endpoint, XDR, Cloud Security, and related services. Services have since been restored.

Newly Discovered Vulnerabilities

A new Windows Remote Access Trojan (RAT) was identified using corrupted DOS and PE headers to evade detection for weeks.
A vulnerability in Apple Safari enables fullscreen browser-in-the-middle attacks, allowing threat actors to steal account credentials.
Thousands of ASUS routers have been infected and backdoored as part of a large-scale botnet campaign, with the ORB network also affecting Linksys, D-Link, QNAP, and Araknis Network devices.
Microsoft confirmed that some Windows 11 systems may fail to start after installing the KB5058405 security update.
Mozilla released an emergency update (Firefox 139.0.1) to address graphical artifacts on NVIDIA GPUs caused by the previous release.

Notable Threat Actor Activity

Meta disrupted three coordinated influence operations originating from Iran, China, and Romania, which used fake personas to target Romania, Azerbaijan, and Taiwan.
The DragonForce ransomware group exploited flaws in SimpleHelp RMM to deploy ransomware and exfiltrate data from an MSP’s customers.
APT41 (Double Dragon), a Chinese state-sponsored group, used Google Calendar events as command-and-control infrastructure in a recent campaign.
The ‘Everest Group’ is conducting extortion attacks against global organisations by stealing data from SAP SuccessFactors HR tools, targeting entities in multiple countries.
Cybercriminals are distributing malware and ransomware, including CyberLock and Lucky_Gh0$t, via fake installers for popular AI tools such as ChatGPT and InVideo AI.
Threat actors are abusing Google Apps Script to host phishing pages, leveraging the platform’s legitimacy to evade detection.
The ‘Haozi’ gang is selling turnkey phishing-as-a-service kits via Telegram, providing infrastructure and support for low-skilled actors.
PumaBot is targeting Linux devices in a new botnet campaign, employing semi-automated tactics.

Trends, Tools, or Tactics of Interest

Scammers are exploiting uncertainty around US tariff policy to launch phishing and social engineering attacks.
Active credential harvesting phishing campaigns are targeting Capital One customers.
Attackers are increasingly mapping organisational attack surfaces using automated reconnaissance tools, mirroring defender efforts.
Cybercriminals are capitalising on AI tool popularity, using fake installers as lures to spread malware and ransomware.
Usage of the “passwd” command is being tracked in honeypots, indicating ongoing brute-force and credential access attempts.
The deprecation of Microsoft Authenticator’s password autofill feature is prompting migration to Microsoft Edge.
Zscaler’s acquisition of Red Canary highlights the growing importance of telemetry and managed detection and response (MDR) in security operations.

Regulatory or Policy Developments Affecting the Security Industry

The US Treasury Department sanctioned Funnull Technology, a Philippines-based cloud provider, for supporting hundreds of thousands of scam websites involved in “pig butchering” and other cyber fraud schemes linked to over $200 million in losses.
US Customs and Border Protection is storing the DNA of migrant children in a criminal database managed by the FBI, raising privacy and data protection concerns.

Cybersecurity Brief – 2025-05-29

Thu, 29 May 2025 00:00:00 +0000

Major Incidents or Breaches

Over 100,000 WordPress sites are at risk due to a critical, unpatched vulnerability (CVSS 10.0) in the TI WooCommerce Wishlist plugin, allowing unauthenticated attackers to upload arbitrary files.
Over 9,000 ASUS routers have been compromised by the “AyySSHush” botnet, which adds a persistent SSH backdoor. The botnet also targets SOHO routers from Cisco, D-Link, and Linksys.
Cellcom experienced a cyberattack impacting regional mobile services in Wisconsin and Michigan, with outages lasting nearly a week and continued intermittent service.
A financially motivated threat actor known as “Mimo” has exploited CVE-2025-32432 (RCE) in Craft CMS to deploy cryptominers and proxyware payloads.
The Interlock ransomware gang has deployed a new remote access trojan (NodeSnake RAT) against universities, enabling persistent access to networks.
The “Dark Partner” cybercrime group is conducting large-scale cryptocurrency theft through a network of fake AI, VPN, and crypto software download sites.
Researchers observed 251 Amazon-hosted IPs used in coordinated exploit scans targeting ColdFusion, Apache Struts, and Elasticsearch exposure points.

Newly Discovered Vulnerabilities

A critical unpatched vulnerability in the TI WooCommerce Wishlist WordPress plugin (CVSS 10.0) allows unauthenticated file uploads, exposing over 100,000 sites.
A security flaw in Microsoft OneDrive File Picker allows web applications to access a user’s entire cloud storage content, not just the files selected for upload.
CVE-2025-32432, a recently disclosed remote code execution vulnerability in Craft CMS, is being actively exploited.

Notable Threat Actor Activity

The Chinese APT31 group was formally attributed by the Czech Republic for cyberattacks against the Ministry of Foreign Affairs and critical infrastructure in 2022.
APT41 (China-linked) is using new malware (“ToughProgress”) that leverages Google Calendar for stealthy command-and-control communications.
The Iranian national Sina Gholinejad pleaded guilty in the US for involvement in the Robbinhood ransomware attack on Baltimore, part of a $19 million international extortion scheme.
Pakistan authorities arrested 21 individuals associated with the “Heartsender” malware and spam dissemination service, which operated for over a decade.
The newly identified PumaBot botnet, written in Go, is targeting Linux-based IoT devices by brute-forcing SSH credentials to deploy cryptominers and facilitate further attacks.
The Interlock ransomware group is using the NodeSnake RAT to maintain persistent access to university networks.

Trends, Tools, or Tactics of Interest

Stealer malware campaigns are increasingly focused on capturing live sessions and moving rapidly to account takeover, rather than just stealing static credentials.
“Browser-in-the-Middle” attacks are being used to hijack user sessions in seconds, bypassing traditional credential theft methods.
Alternate Data Streams are highlighted as a defense evasion technique for adversaries, with detection guidance provided.
The “Dark Partner” group utilises fake software download sites to distribute malware and facilitate cryptocurrency theft.
The evolution of the Zanubis Android banking trojan includes the adoption of RC4 and AES encryption, expanded credential theft capabilities, and new targeting in Peru.
PumaBot and AyySSHush botnets demonstrate ongoing targeting of IoT and SOHO network devices, focusing on SSH brute-forcing and persistent backdoor installation.

Regulatory or Policy Developments Affecting the Security Industry

The Czech Republic publicly attributed the 2022 Ministry of Foreign Affairs cyberattack to China-linked APT31, marking a formal diplomatic accusation.
Microsoft introduced a new update orchestration platform for Windows, aiming to unify software, driver, and system component updates.
Microsoft launched Windows Backup for Organizations, designed to streamline enterprise backup and migration processes.
Apple reported blocking over $9 billion in fraudulent App Store transactions since 2020, with $2 billion prevented in 2024.
Zscaler announced an agreement to acquire Red Canary, aiming to integrate threat detection and AI-powered security operations capabilities.