Louis Vuitton on DanSec Daily

Cybersecurity Brief – 2026-02-17

Tue, 17 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Washington Hotel in Japan disclosed a ransomware attack that compromised its servers and exposed business data.
Eurail B.V. confirmed that data stolen in a breach earlier this year is now being sold on the dark web. The breach impacted traveler data for the European rail operator.
Dutch telecom provider Odido was hit by a data breach, as noted in Check Point’s weekly threat intelligence report.
Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea following data breaches linked to attacks on Salesforce instances by the Scattered LAPSUS$ Hunters group.

Newly Discovered Vulnerabilities

Google released emergency updates for Chrome, patching CVE-2026-2441, a high-severity vulnerability exploited in zero-day attacks. The flaw could allow arbitrary code execution and marks the first actively exploited Chrome zero-day patched in 2026.
CISA ordered US federal agencies to patch a vulnerability in BeyondTrust Remote Support within three days due to active exploitation.
A study identified 25 password recovery attack vectors in major cloud-based password managers, including Bitwarden, Dashlane, and LastPass, which could allow account compromise under certain conditions.

Notable Threat Actor Activity

The GS7 cyberthreat group (Operation DoppelBrand) is targeting US financial institutions by creating highly convincing fake corporate portals to steal credentials and gain remote access.
A new mobile spyware platform, ZeroDayRAT, is being advertised on Telegram, offering real-time surveillance and data theft capabilities.
Information-stealing malware has been observed targeting OpenClaw (formerly Clawdbot/Moltbot) AI agent configuration files, exfiltrating API keys, authentication tokens, and gateway credentials.
Attackers are leveraging the ClickFix attack technique, abusing DNS lookups (nslookup commands) to deliver the ModeloRAT remote access trojan to targeted systems.
A phishing campaign has been observed using fake incident reports as lures.

Trends, Tools, or Tactics of Interest

Over 260,000 Chrome users were deceived by 30 fake AI browser extensions posing as legitimate tools, indicating a continued trend in leveraging AI-themed lures for malware distribution.
The ClickFix campaign’s use of nslookup for RAT delivery highlights increased abuse of built-in system tools for malware deployment.
Infostealer malware is adapting to target secrets and configuration files associated with widely adopted AI agentic frameworks such as OpenClaw.
There is a growing focus on passwordless authentication and passkey adoption, with organisations seeking to maintain ISO/IEC 27001 compliance while moving away from traditional passwords.
Android 17 Beta introduces further secure-by-default features, strengthening privacy and app security controls.
Apple is testing end-to-end encryption for RCS messaging in the iOS 26.4 developer beta, expanding secure messaging capabilities.

Regulatory or Policy Developments

Dior, Louis Vuitton, and Tiffany were fined $25 million in South Korea for data breaches involving Salesforce, following regulatory action related to the Scattered LAPSUS$ Hunters attacks.
CISA is operating at 38% staff capacity due to the ongoing DHS shutdown, potentially impacting the agency’s ability to respond to cyber incidents.
Amazon’s Ring terminated its partnership with Flock Safety, a police surveillance technology company, following public backlash.
Lithuania is advancing national initiatives to address AI-driven cyber fraud, with the KTU Consortium outlining strategies for a safe and inclusive digital society.

Cybersecurity Brief – 2026-02-14

Sat, 14 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Dutch telecommunications provider Odido disclosed a data breach impacting 6 million customers, with hackers stealing personal information including names, addresses, and phone numbers from a customer contact system.
South Korea fined luxury brands Louis Vuitton, Christian Dior Couture, and Tiffany a combined $25 million for failing to implement adequate security measures, which resulted in unauthorized access and data breaches.
Researchers identified malicious Google Chrome extensions stealing data associated with Meta Business Suite and Facebook Business Manager; a total of 30 credential-stealing Chrome extensions have been uncovered.
Threat actors are abusing Claude LLM artifacts and Google Ads in ClickFix campaigns to deliver infostealer malware to macOS users.
Fake online shops are targeting fans of the Winter Olympics 2026, with nearly 20 fraudulent sites identified selling counterfeit merchandise.

Newly Discovered Vulnerabilities

Researchers observed active exploitation of CVE-2026-1731, a critical unauthenticated remote code execution vulnerability (CVSS 9.9) affecting BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) products. Exploitation began within 24 hours of public PoC release.
CISA flagged a critical Microsoft Configuration Manager (SCCM) vulnerability, patched in October 2024, as being exploited in the wild.
Chrome version 145 patched 11 vulnerabilities, including three high-severity flaws.
CISA warned of active exploitation of vulnerabilities in SolarWinds and Notepad++ products, including a SolarWinds flaw likely exploited as a zero-day since December 2025.

Notable Threat Actor Activity

North Korean threat actors are targeting software developers, particularly those with JavaScript and Python skills, using fake job recruiter campaigns. These campaigns employ social engineering and malicious coding challenges, often related to cryptocurrency, to deliver malware.
Google Threat Intelligence Group attributed malware attacks using the CANFAIL family to a previously undocumented Russian threat actor, targeting Ukrainian organizations.
Several state-sponsored actors from China, Iran, Russia, and North Korea are conducting coordinated cyber operations against the defense industrial base sector. Espionage groups have exploited at least two dozen zero-days in edge devices to infiltrate defense contractors.
A previously unknown threat actor, tracked as UAT-9921, is using a new modular malware framework called VoidLink to target technology and financial services sectors.

Trends, Tools, or Tactics of Interest

Threat actors are exploiting Windows drivers to carry out BYOVD (Bring Your Own Vulnerable Driver) attacks, terminating security processes in targeted networks.
AI agents are increasingly being deployed in coordinated, autonomous “swarms,” amplifying organizational attack surfaces and security complexity.
Integration of external IP-based threat intelligence (e.g., Criminal IP) into SIEM and SOAR platforms like IBM QRadar is enhancing automated detection and response workflows.
Threat actors are leveraging widely used platforms (such as Google Ads and Chrome extensions) for malware delivery and credential theft.
npm completed a major authentication overhaul in December 2025 to harden its supply chain in response to previous incidents.

Regulatory or Policy Developments Affecting the Security Industry

CISA announced new town halls to engage stakeholders on cyber incident reporting requirements for critical infrastructure.
Check Point acquired three Israeli cybersecurity firms-Cyata, Cyclops, and Rotate-reflecting ongoing consolidation in the cybersecurity sector.
South Korean regulatory action against major luxury brands for data protection failures underscores increased enforcement of data security obligations.
The US government (CISA) has issued new directives for federal agencies to secure systems against actively exploited vulnerabilities, including those in Microsoft Configuration Manager.

Cybersecurity Brief – 2025-07-26

Sat, 26 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Ransomware attacks increased by 63% year-over-year in Q2 2025, with 276 publicly disclosed incidents reported.
A hacker compromised Amazon’s Q Developer Extension for Visual Studio Code, injecting data-wiping commands into the AI-powered coding agent.
Louis Vuitton experienced a data breach impacting customers in multiple countries.
Steam’s game publishing platform was abused to distribute info-stealing malware via a pre-release version of a game.
UK national Ollie Holman was sentenced to prison for selling over 1,000 phishing kits, causing losses exceeding $134 million.
Instagram users are being targeted in a novel phishing campaign leveraging legitimate-looking emails to steal credentials.

Newly Discovered Vulnerabilities

Mitel patched a critical authentication bypass vulnerability in its MiVoice MX-ONE enterprise communication platform, which could allow attackers to access user or admin accounts.
LG Innotek LNV5110R security cameras are affected by an unauthenticated remote code execution vulnerability; no patch is currently available.
A Google Cloud Build vulnerability was disclosed, earning a $30,000 bug bounty.
Microsoft removed a compatibility hold blocking Windows 11 2024 Update installations for users of Easy Anti-Cheat, following resolution of a blue screen issue.

Notable Threat Actor Activity

The North Korean IT worker scheme remains active; the US sanctioned a North Korean front company and three nationals for fraudulent remote IT work, and an Arizona woman was sentenced to prison for operating a laptop farm enabling North Korean infiltration of over 300 US firms.
The Patchwork threat actor is conducting spear-phishing campaigns targeting Turkish defense firms using malicious LNK files to collect strategic intelligence.
A cyber espionage campaign dubbed “Operation Caramel” targeted Russian aerospace and defense sectors with the EAGLET backdoor for data exfiltration.
The Chinese-nexus group “Fire Ant” targeted virtual environments, exploiting networking and virtualization flaws to breach isolated network segments.
Two malware campaigns, Soco404 and Koske, targeted cloud services with cross-platform cryptomining attacks exploiting vulnerabilities and misconfigurations.
AI-generated malware, specifically the Koske Linux miner, is being actively deployed, demonstrating advanced features such as persistence and adaptive payload development.

Trends, Tools, or Tactics of Interest

Use of generative AI tools developed in China is widespread among employees in the US and UK, often without security team oversight.
AI is increasingly being used to develop sophisticated malware, as seen with the Koske Linux miner, which rivals or exceeds traditional human-developed malware.
Attackers are leveraging vulnerabilities and misconfigurations in cloud environments for cryptomining operations.
Security nudges are being adopted as behavioural interventions but face challenges related to overuse.
There is a growing trend of young individuals being recruited into cybercriminal groups, motivated by community, financial gain, and perceived low risk of prosecution.
Organisations’ attack surfaces are expanding, increasing exposure to threats.

Regulatory or Policy Developments Affecting the Security Industry

The US Department of the Treasury’s OFAC sanctioned a North Korean front company and three nationals for involvement in fraudulent IT worker schemes.
The US Department of Justice sentenced an Arizona woman to over eight years in prison for aiding North Korean IT worker infiltration of US companies.
The US announced a $15 million reward for information leading to the disruption of North Korea’s illicit IT worker operations.

Cybersecurity Brief – 2025-07-22

Tue, 22 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Dell confirmed that the “World Leaks” extortion group breached one of its product demonstration/test lab platforms. The group is attempting to extort Dell for ransom.
Dior has begun notifying U.S. customers of a May cybersecurity incident that compromised their personal information.
Cierant Corporation and law firm Zumpano Patricios disclosed separate data breaches, each affecting over 200,000 individuals.
The Alcohol & Drug Testing Service (TADTS) reported a ransomware attack in July 2024 that exposed personal information of 750,000 people.
Over 1,000 CrushFTP servers are currently exposed online and vulnerable to hijack attacks exploiting a critical security bug that provides admin access via HTTPS.
Louis Vuitton suffered a cyberattack, as reported in recent threat intelligence bulletins.
Ring users reported a surge in unauthorized device logins on May 28. Ring (Amazon) attributed the incident to a backend update bug and denied an external breach.

Newly Discovered Vulnerabilities

Microsoft released emergency patches for two actively exploited SharePoint zero-days, CVE-2025-53770 (“ToolShell”) and CVE-2025-53771. These vulnerabilities have been used in ongoing attacks against US government agencies and other organizations.
A zero-day vulnerability in CrushFTP is being exploited to gain administrative privileges on exposed servers. Over 1,000 instances remain vulnerable.
ExpressVPN fixed a flaw in its Windows client that caused Remote Desktop Protocol (RDP) traffic to bypass the VPN tunnel, exposing users’ real IP addresses during remote sessions.
Wireshark 4.4.8 was released, addressing nine bugs.
WinRAR 7.10 does not propagate all Mark-of-the-Web (MOTW) data when extracting files, potentially impacting security controls.

Notable Threat Actor Activity

APT41, a China-linked cyber espionage group, launched a targeted campaign against government IT services in Africa, using hardcoded internal server names and advanced techniques to evade detection.
Iranian APT MuddyWater deployed new variants of the DCHSpy Android spyware, masquerading as VPN apps to target dissidents and Android users, particularly since the escalation of conflict with Israel.
The Russian cybercrime group NoName057(16) has been disrupted by Europol, with seven arrest warrants issued. The group is known for recruiting followers to conduct DDoS attacks on perceived adversaries.
A surveillance firm was found bypassing SS7 protections to obtain user location data from wireless carriers.

Trends, Tools, or Tactics of Interest

Attackers continue to gain access in well-secured environments by leveraging weak system configurations, outdated encryption, and trusted but unprotected tools, rather than relying solely on novel exploits.
Research is emerging on malicious implants targeting AI components and applications, indicating a new vector for stealthy attacks against AI-powered systems.
The propagation of Mark-of-the-Web (MOTW) data by WinRAR has changed, which may impact the effectiveness of MOTW-based security mechanisms.
Zero Trust security, now seen as a foundational requirement, is increasingly incorporating AI to enhance detection and response capabilities.

Regulatory or Policy Developments Affecting the Security Industry

Intel announced the end of the Clear Linux OS project, archiving its GitHub repositories and ceasing further development.
Veeam warned that recent changes to Recovery Orchestrator’s multi-factor authentication (MFA) rollout are preventing users from logging into the Web UI.

Cybersecurity Brief – 2025-07-17

Thu, 17 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

UK retailer Co-op confirmed the theft of personal data belonging to 6.5 million members following a major cyberattack in April, which also disrupted operations and caused food shortages.
Louis Vuitton disclosed that customer data breaches in the UK, South Korea, and Turkey are linked to a single security incident, reportedly associated with the ShinyHunters group.
United Natural Foods, Inc. (UNFI) projected up to $400 million in sales impact and $50–$60 million in net income loss due to a June cyberattack that disrupted operations, with insurance expected to cover most losses.
Compumedics, a medical technology company, suffered a ransomware attack by the VanHelsing group, resulting in the theft of files affecting 318,000 individuals.
An adoption agency left 1.1 million sensitive records of children and parents exposed on the open web due to a data misconfiguration.
A former US Army colonel leaked national secrets via a foreign dating app after being targeted by a scammer.
Amazon warned 200 million Prime customers about an ongoing phishing campaign targeting their login credentials.

Newly Discovered Vulnerabilities

Cisco disclosed a critical vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) that allows unauthenticated attackers to execute code as root.
Google released a critical Chrome update addressing six vulnerabilities, including CVE-2025-6558, a high-severity sandbox escape zero-day exploited in the wild.
Researchers identified a critical design flaw in delegated Managed Service Accounts (dMSAs) in Windows Server 2025, enabling cross-domain attacks and persistent access.
Oracle patched a critical bug in its Cloud Code Editor that could allow attackers to compromise the full suite of developer tools in Oracle Cloud Infrastructure.
Public exploits for a recently patched remote code execution vulnerability in Fortinet FortiWeb are suspected to be linked to ongoing attacks involving web shells on exposed instances.
Google’s AI-driven “Big Sleep” framework discovered and blocked exploitation of a critical SQLite vulnerability before it was weaponised.

Notable Threat Actor Activity

Threat cluster UNC6148 is exploiting a likely zero-day vulnerability to deploy the OVERSTEP backdoor and rootkit on fully patched, end-of-life SonicWall SMA 100 series appliances. The campaign is financially motivated and has suspected ties to the Abyss ransomware group.
The pro-Russian hacktivist group NoName057(16), responsible for DDoS attacks on European and NATO-related targets, had its infrastructure disrupted in an international law enforcement operation coordinated by Europol (Operation Eastwood).
The VanHelsing ransomware group was identified as responsible for the Compumedics breach.
Chinese APT group Salt Typhoon (aka APT41) compromised a US National Guard unit’s network, accessing internal and inter-unit communications.
A former US Army soldier pleaded guilty to hacking and extorting at least ten US tech and telecom companies, including AT&T and Verizon.
Matanbuchus 3.0, a new variant of the malware loader, is being distributed via Microsoft Teams and features enhanced evasion techniques, including EDR detection and DNS-based C2 communication.

Trends, Tools, or Tactics of Interest

Manufacturing remains a prime target for cyberattacks in Europe due to increased digital connectivity and automation.
Attackers are engineering phishing campaigns to bypass secure email gateways, using advanced tactics to evade perimeter detection.
AI-driven social engineering attacks are increasing in sophistication, leveraging deepfakes, fake recruiters, and cloned executive personas for targeted campaigns.
The new Konfety Android malware variant uses APK manipulation and dynamic code loading, combined with the evil twin Wi-Fi technique, to evade detection and commit ad fraud.
Free file sharing services continue to be abused for data exfiltration, as evidenced by recent malicious samples using platforms like catbox.moe.
Organizations are rapidly integrating AI into security workflows, but concerns remain over AI agents’ elevated privileges and the need for identity-first security controls.
Matanbuchus 3.0’s use of advanced stealth features and delivery via collaboration platforms highlights an ongoing trend of leveraging trusted business tools for initial access.
There is a growing emphasis on aligning cybersecurity budgets with measurable risk reduction and financial impact.

Regulatory or Policy Developments Affecting the Security Industry

Europol’s Operation Eastwood demonstrates continued international cooperation in disrupting cybercriminal infrastructure, particularly pro-Russian hacktivist operations targeting critical infrastructure and NATO-aligned entities.
Cambodia conducted a major anti-cybercrime operation, arresting more than 1,000 suspects in coordinated raids across multiple provinces.
The US Department of Homeland Security faces renewed scrutiny over the collection and retention of DNA from approximately 133,000 migrant children, raising privacy and civil liberties concerns.

Cybersecurity Brief – 2025-07-15

Tue, 15 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Louis Vuitton has notified customers in the UK, South Korea, Turkey, and possibly other countries of a data breach affecting their personal information.
McDonald’s has suffered a data breach resulting in the exposure of customer data.
Two versions of the Gravity Forms WordPress plugin, distributed via the official download page, were compromised in a supply chain attack, with malware injected into the plugin.
A malicious Visual Studio Code extension for the Cursor AI IDE led to the theft of $500,000 in cryptocurrency from a Russian crypto firm, after infecting devices with remote access tools and infostealers.
India’s Central Bureau of Investigation (CBI) dismantled a transnational cybercrime syndicate responsible for a £390,000 UK tech support scam, arresting key operatives at a Noida call center.

Newly Discovered Vulnerabilities

Multiple Gigabyte motherboard models have UEFI firmware vulnerabilities that allow attackers to bypass Secure Boot and install persistent bootkit malware invisible to the operating system and capable of surviving OS reinstalls.
Vulnerabilities in Gigabyte firmware could allow attackers to disable Secure Boot and execute code during the early boot phase, facilitating backdoor deployment.
A vulnerability in train End-of-Train and Head-of-Train radio systems allows remote attackers to trigger train brakes; this issue has been known in the industry for 20 years.
CISA has added the recently disclosed CitrixBleed 2 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, designating it as an unacceptable risk.
Google Gemini AI assistant is vulnerable to prompt-injection attacks, allowing attackers to craft invisible, malicious prompts that can be used to display phishing messages, including when summarising emails in Google Workspace.

Notable Threat Actor Activity

The Interlock ransomware group is distributing a new PHP-based variant of its remote access trojan (RAT) using a delivery mechanism called FileFix, in campaigns targeting multiple industries. The group is leveraging the KongTuke Traffic Distribution System (TDS) and legitimate websites for web-inject campaigns to gain control of victim devices.
Cybercriminals are impersonating major news outlets (CNN, BBC, CNBC) via sponsored ads and fake news websites to lure victims into investment scams.
Scattered Spider threat actor arrests have been reported, indicating law enforcement action against this group.
Exposed Git repositories continue to be a source of sensitive data leaks across enterprises, representing a persistent but often overlooked risk.

Trends, Tools, or Tactics of Interest

There is a reported increase in honeypot log volumes, indicating a rise in scanning and malicious activity observed on internet-facing systems.
The UserAssist Windows artifact, including previously undocumented binary data structures, has been detailed for forensic and incident response purposes, with a new parsing tool released.
Attackers are increasingly targeting supply chains, as evidenced by the compromise of the Gravity Forms WordPress plugin.
The use of prompt-injection attacks against AI assistants is an emerging tactic for phishing and social engineering.

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) has launched the Vulnerability Research Initiative (VRI), a new programme to strengthen collaboration with external cybersecurity experts for vulnerability discovery and reporting.