Logitech on DanSec Daily

Cybersecurity Brief – 2026-01-08

Thu, 08 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

The Crimson Collective extortion group claims to have stolen data on over one million Brightspeed broadband customers. Brightspeed is investigating the alleged breach.
Chrome extensions impersonating AITOPIA, with a combined 900,000 downloads, were found exfiltrating users’ AI chat data and browser activity.
Logitech Options+ and G Hub apps for macOS became non-functional after their code-signing certificate expired, preventing users from launching the applications.
Multiple enterprises’ file-sharing instances were breached by the “Zestix” threat actor using infostealers to obtain credentials; lack of multi-factor authentication (MFA) was identified as a common vulnerability.
ownCloud issued a warning to users to enable MFA following reports of credential theft and unauthorised data access.

Newly Discovered Vulnerabilities

A critical unauthenticated remote code execution (RCE) vulnerability (CVSS 10.0, dubbed “Ni8mare”) was disclosed in n8n, a popular workflow automation platform, affecting both self-hosted and cloud deployments.
Veeam released patches for several vulnerabilities in its Backup & Replication software, including a critical RCE flaw (CVSS 9.0) that could allow attackers to compromise backup servers.
jsPDF, a widely used JavaScript PDF generation library, is affected by a critical vulnerability allowing attackers to steal sensitive local files via maliciously crafted PDFs.
A vulnerability in Totolink range extenders enables unauthenticated attackers to start a root-level Telnet service and take over affected devices.
A zero-day vulnerability in discontinued D-Link DSL routers is being actively exploited to execute arbitrary commands remotely on unpatched devices.
CISA added actively exploited vulnerabilities in Microsoft Office and HPE OneView to its Known Exploited Vulnerabilities Catalog, urging immediate remediation.

Notable Threat Actor Activity

North Korean threat actor Kimsuky is distributing mobile malware via phishing sites that use QR codes, targeting users to install malicious apps.
The Black Cat cybercrime group is running an SEO poisoning campaign, creating fraudulent sites advertising popular software to deliver malware to users searching for legitimate downloads.
The pro-Russian hacktivist group NoName057(16) continues to leverage its DDoSia tool to coordinate volunteer-driven DDoS attacks against government, media, and institutional targets associated with Ukraine and Western countries.
The “Zestix” actor used infostealers to compromise cloud credentials and breach approximately 50 enterprise file-sharing environments.
GoBruteforcer botnet activity is increasing, targeting crypto and blockchain projects by brute-forcing exposed databases on servers often configured with weak, AI-generated default credentials.
Threat actors are exploiting complex email routing scenarios and misconfigured spoof protections to impersonate internal domains in phishing campaigns, particularly targeting Microsoft Office 365 tenants with weak configurations.

Trends, Tools, or Tactics of Interest

QR code-based phishing is being actively observed, with attackers embedding QR codes in emails and web pages to lure victims into installing malware or visiting phishing sites.
There is a rise in phishing attacks exploiting email routing misconfigurations and insufficient anti-spoofing controls, enabling domain impersonation and internal phishing.
Cybercriminals are increasingly adopting AI to automate and scale attacks, including “vibe hacking” and the use of tools like “HackGPT” in underground forums, reducing the technical barrier to entry for threat actors.
AI-generated server configuration examples are contributing to insecure deployments, as seen in GoBruteforcer campaigns targeting databases with weak or default passwords.
Affiliate-driven hacktivist campaigns, such as those orchestrated by NoName057(16) with DDoSia, are enabling coordinated volunteer attacks at scale.
Non-human (AI/automation) entities are becoming integral to cybersecurity operations, increasing the attack surface and requiring new approaches to identity and access management.

Regulatory or Policy Developments

The UK government announced a new cybersecurity strategy backed by over £210 million to strengthen cyber defences across public sector organisations and government departments.
OpenAI confirmed that health information shared with ChatGPT Health will not be used to train its models, addressing privacy concerns related to health data.

Cybersecurity Brief – 2025-11-18

Tue, 18 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Eurofiber France disclosed a data breach after hackers exploited a vulnerability in its ticket management system, resulting in exfiltration of customer information. The breach was discovered after the attacker attempted to sell the data.
Princeton University reported a data breach on 10 November 2025, exposing personal information of alumni, donors, faculty, and students.
DoorDash confirmed a data breach involving compromise of names, addresses, email addresses, and phone numbers after an employee was targeted in a social engineering attack.
The Pennsylvania Attorney General’s office confirmed a data breach following an August 2025 ransomware attack by the INC Ransom group, with personal and medical information stolen.
Logitech confirmed a data breach after being listed by the Cl0p ransomware group. The incident is linked to the Oracle E-Business Suite exploitation.
Dutch police seized approximately 250 servers used by a bulletproof hosting service that provided infrastructure for cybercriminals.

Newly Discovered Vulnerabilities

Google released security updates for Chrome to address two vulnerabilities, including CVE-2025-xxxx, a V8 zero-day flaw under active exploitation, reportedly by a commercial spyware vendor.
A critical remote code execution vulnerability in Fortinet FortiWeb WAF is being actively exploited in the wild, allowing unauthenticated attackers to execute administrative commands.
The RondoDox botnet is exploiting CVE-2025-24893, a critical RCE vulnerability in XWiki Platform. Widespread exploitation has been observed, including by botnets, crypto miners, and custom tools.
Seven malicious npm packages are abusing the Adspect cloud-based service to redirect researchers while leading victims to malicious payloads.
A vulnerability in DoorDash’s email systems allowed attackers to send spoofed, official-looking emails from DoorDash servers, creating a significant phishing risk. DoorDash has since patched the issue.
Researchers identified a security weakness in the AI-powered coding tool Cursor, enabling credential-stealing attacks via a malicious MCP server hijacking the internal browser.

Notable Threat Actor Activity

The Dragon Breath threat actor is using a multi-stage loader (RONINGLOADER) to disable security tools and deploy a modified Gh0st RAT in recent campaigns.
Iranian state-sponsored APTs are targeting defense and government officials, including their family members, in ongoing campaigns to increase pressure on primary targets.
The Aisuru botnet launched a 15.72 Tbps DDoS attack against Microsoft Azure, leveraging over 500,000 IP addresses.
The EVALUSION ClickFix campaign is deploying Amatera Stealer and NetSupport RAT via social engineering techniques.
Cl0p ransomware group continues to exploit Oracle E-Business Suite (CVE-2025-61882), with associated data breaches including Logitech.
Scammers are sending fake copyright violation messages to steal X (formerly Twitter) logins.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly shifting to non-email channels, with LinkedIn and other platforms now accounting for 1 in 3 phishing incidents.
ClickFix social engineering tactics are being widely adopted in malware distribution campaigns.
Malicious packages in open-source repositories such as npm are using cloud-based redirectors to evade detection and target victims.
Bulletproof hosting services remain a critical enabler for cybercriminal infrastructure, as evidenced by recent law enforcement action in the Netherlands.
Attackers are leveraging vulnerabilities in widely used platforms (e.g., XWiki, FortiWeb, Oracle E-Business Suite) for large-scale exploitation.
DDoS attacks are increasing in scale and sophistication, as demonstrated by the recent record-setting attack on Microsoft Azure.

Regulatory or Policy Developments Affecting the Security Industry

In the US, five individuals pleaded guilty to assisting North Korean IT workers in obtaining employment at US companies by providing false identities and remote access to company laptops, highlighting ongoing law enforcement efforts against supply chain and insider threats.
Microsoft released an out-of-band Windows 10 update (KB5072653) to address issues with installing Extended Security Updates, ensuring continued compliance for organizations relying on legacy systems.

Cybersecurity Brief – 2025-11-15

Sat, 15 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Logitech confirmed a data breach following an attack by the Clop extortion group, which targeted Oracle E-Business Suite systems and resulted in data theft.
Checkout.com disclosed a breach of a legacy cloud storage system by the ShinyHunters threat group, which is now attempting to extort the company. The breach did not impact payment processing systems.
The Washington Post reported that nearly 10,000 employees were affected by a data breach linked to the Oracle hack, with attackers attempting extortion after stealing personal information.

Newly Discovered Vulnerabilities

Fortinet FortiWeb web application firewall is affected by a critical authentication bypass vulnerability (zero-day), which has been actively exploited in the wild to create admin accounts and compromise systems. Fortinet has issued a silent patch, and CISA has added the bug to its Known Exploited Vulnerabilities (KEV) catalog.
ASUS released firmware updates to address a critical authentication bypass flaw in several DSL series routers.
Researchers identified a vulnerability in ImunifyAV (part of Imunify360), allowing arbitrary code execution via malicious file uploads on shared servers, potentially exposing millions of websites.
Critical remote code execution vulnerabilities were discovered in AI inference engines from Meta, Nvidia, Microsoft, and others.
A macOS vulnerability was noted in industry roundups, though no further technical detail was provided.

Notable Threat Actor Activity

North Korean threat actors (linked to the Contagious Interview campaign) are now using JSON storage services to stage and deliver malware payloads as part of updated tactics.
The Iranian state-sponsored group APT42 launched a new espionage campaign, “SpearSpecter,” targeting individuals and organizations connected to the Islamic Revolutionary Guard Corps (IRGC), particularly in defense and government sectors.
Chinese state-sponsored actors leveraged Anthropic’s Claude AI to automate cyber-espionage operations against around 30 organizations worldwide. The campaign was described as highly sophisticated and largely automated via AI tools.
The Akira ransomware group has continued targeting critical organizations, including exploiting SonicWall vulnerabilities and encrypting Nutanix Acropolis Hypervisor (AHV) VM disk files. Akira ransomware operations have netted $244 million in proceeds.
Clop extortion group was responsible for the recent breaches at Logitech and The Washington Post (via Oracle E-Business Suite).
ShinyHunters were behind the Checkout.com extortion attempt following their breach of a legacy cloud storage system.
A financially motivated actor published 150,000 malicious packages to the NPM registry in an automated, self-replicating token farming campaign targeting the tea.xyz protocol.

Trends, Tools, or Tactics of Interest

Ransomware ecosystem fragmentation is at an all-time high, with 85 active ransomware and extortion groups observed in Q3 2025 and 1,590 victims disclosed on leak sites.
Malware-as-a-service continues to evolve, with the emergence of “Fantasy Hub,” a new platform enabling unskilled actors to deploy Android banking Trojans.
Increased use of AI by both attackers (e.g., Chinese espionage leveraging Anthropic’s Claude AI) and defenders (e.g., Burp AI supporting penetration testers).
Attackers are exploiting social engineering via fake job interviews to deliver malware.
Security researchers released new tools and datasets to bolster macOS malware analysis, addressing a historical lack of focus on Apple platforms.
Hardened container initiatives are underway to reduce vulnerabilities introduced by overly broad container builds.
Identity governance innovations are being developed to address the proliferation of enterprise applications and improve integration coverage.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of Justice announced the creation of a new strike force to disrupt Chinese cryptocurrency scam networks, which defraud Americans of nearly $10 billion annually. The DOJ is also targeting supporting infrastructure, such as satellite internet systems used at scam compounds.
Five individuals pleaded guilty in the U.S. to assisting North Korean IT worker fraud and cryptocurrency theft schemes.
The Pentagon unveiled “CYBERCOM 2.0,” a plan to address cyber talent shortages and build a force capable of countering major threats, including those from China.
Google reversed course on new Android developer registration rules, now allowing for limited app distribution accounts and user privacy controls.

Cybersecurity Brief – 2025-11-11

Tue, 11 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Nearly 30 organizations, including Logitech, The Washington Post, Cox Enterprises, Pan American Silver, LKQ Corporation, and Copeland, have been named as alleged victims of an Oracle E-Business Suite (EBS) hack on the Cl0p ransomware leak site.
The US Congressional Budget Office (CBO) confirmed a data breach.
Many Forbes AI 50 companies were found to have leaked sensitive secrets, including training data and private models, on public GitHub repositories.

Newly Discovered Vulnerabilities

A critical vulnerability in the expr-eval JavaScript library, used in over 800,000 weekly NPM downloads, allows remote code execution via malicious input.
Three vulnerabilities in runc (CVE-2025-31133, CVE-2025-52565, CVE-2025-52881) have been patched; these could be exploited to escape container environments.
Multiple vulnerabilities in QNAP devices, demonstrated at Pwn2Own Ireland, have been patched. These flaws could allow remote code execution, information disclosure, and denial-of-service.
A critical, now-patched flaw in Gladinet’s Triofox file-sharing and remote access platform was exploited to install remote access tools via its antivirus feature.
CISA has ordered US federal agencies to patch a critical Samsung zero-day vulnerability exploited in spyware attacks deploying LandFall spyware on WhatsApp-enabled devices.

Notable Threat Actor Activity

The Quantum Route Redirect phishing-as-a-service (PhaaS) platform is being used in a large-scale, automated campaign targeting Microsoft 365 users globally, utilising around 1,000 domains to steal credentials.
The North Korea-linked Konni (APT37) threat actor is abusing Google’s Find Hub tool in new attacks to track GPS positions and trigger remote data wipes on Android devices, as well as targeting Windows systems.
GlassWorm malware has resurfaced, infecting three additional Visual Studio Code extensions and spreading via both the Open VSX marketplace and GitHub repositories, targeting developer environments.
The ClickFix phishing campaign is targeting the hospitality sector, using infostealer and RAT malware to compromise hotel managers and subsequently launch phishing attacks against customers via email and WhatsApp.
A Russian national has pleaded guilty to acting as an initial access broker for Yanluowang ransomware, which targeted at least eight US companies between July 2021 and November 2022.
Fantasy Hub, a spyware-for-rent platform, is distributing RATs via fake Android apps capable of stealing logins, PINs, and messages with only SMS permissions.

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging LinkedIn for phishing campaigns, aiming at executives and exploiting the platform to bypass traditional email security.
Malware is being concealed within virtual machines (e.g., Hyper-V), and there is a noted increase in side-channel attacks targeting AI chat data, as well as spyware campaigns against Android devices.
Scanning activity has been observed targeting “FTP_3cx” usernames, potentially indicating attempts to exploit business phone system software.
The Browser Security Report 2025 highlights that identity, SaaS, and AI-related risks are converging at the browser level, while traditional controls may not adequately address these threats.
Mozilla Firefox 145 has introduced new anti-fingerprinting defenses to enhance user privacy.
OWASP’s revised Top 10 list for web application risks now includes two new categories, with supply chain risks and security misconfiguration ranking highly.

Regulatory or Policy Developments

Australia has imposed sanctions on individuals and entities accused of supporting North Korea’s weapons programme, mirroring recent US actions.
CISA has mandated US federal agencies to patch a Samsung zero-day exploited in spyware campaigns.