MongoDB on DanSec Daily

Cybersecurity Brief – 2026-02-03

Tue, 03 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Notepad++ Supply Chain Attack:
- Chinese state-sponsored group “Lotus Blossom” compromised the Notepad++ hosting provider for approximately six months.
- Attackers hijacked the official update mechanism, redirecting select users to malicious servers and distributing trojanised updates.
- The campaign was highly targeted and attributed to Chinese state interests with medium confidence.
NationStates Data Breach:
- The multiplayer browser-based game NationStates confirmed a data breach and temporarily shut down its website to investigate the incident.
Panera Bread Data Breach:
- The data breach at Panera Bread impacted 5.1 million accounts, as confirmed by Have I Been Pwned.
MongoDB Database Compromise:
- Over 1,400 out of 3,100 unprotected MongoDB instances were compromised, with most attributed to a single threat actor.
Polish Energy Sector ICS Attack:
- Attackers exploited default credentials to gain access to industrial control systems (ICS) at Polish energy facilities, resulting in destructive impacts.

Cybersecurity Brief – 2026-02-02

Mon, 02 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

eScan Antivirus update servers were compromised by unknown attackers, resulting in the delivery of multi-stage malware through the official update channel. The attack leveraged the trusted update infrastructure of MicroWorld Technologies, impacting users who downloaded updates during the compromise period.
The Open VSX Registry, a popular extension registry for Visual Studio Code, was targeted in a supply chain attack. Threat actors compromised a legitimate developer’s account to distribute malicious extensions containing the GlassWorm malware to end users.
Exposed MongoDB instances continue to be targeted in automated data extortion attacks. Threat actors are accessing unsecured databases, exfiltrating data, and demanding low-value ransoms from database owners to restore access.

Cybersecurity Brief – 2026-01-06

Tue, 06 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Brightspeed, a major US broadband provider, is investigating claims of a security breach and data theft made by the Crimson Collective extortion gang. The group alleges theft of personal information of over 1 million customers.
Sedgwick confirmed a cyberattack on a file transfer system at its government subsidiary, affecting agencies it serves.
Ledger notified customers of a data breach at third-party payment processor Global-e, resulting in exposure of personal data.
Multiple corporate data theft incidents have been linked to threat actor Zestix, who breached ShareFile, Nextcloud, and OwnCloud instances and is offering stolen data from dozens of companies.
Artisans’ Bank and VeraBank, two US banks, disclosed security incidents.
NordVPN denied breach claims, stating that attackers only accessed dummy data from a third-party automated testing platform.
No evidence of cyberattack was found in the communications failure that grounded flights in Greece.

Newly Discovered Vulnerabilities

n8n, an open-source workflow automation platform, disclosed a critical vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary system commands.
The “@adonisjs/bodyparser” npm package is affected by a critical vulnerability (CVSS 9.2) enabling arbitrary file writes on servers.
A critical ‘MongoBleed’ vulnerability in MongoDB allows unauthenticated attackers to extract passwords and tokens via a memory leak. The flaw is under active attack.
VSCode IDE forks, including Cursor, Windsurf, Google Antigravity, and Trae, expose users to attacks via non-existent “recommended extensions” that can be abused for malicious purposes.
Risks associated with newer IP-based KVM devices have been highlighted, as out-of-band access could introduce security concerns.
WhatsApp metadata leak through device fingerprinting was reported, with Meta rolling out fixes.

Notable Threat Actor Activity

Russia-aligned group UAC-0184 targeted Ukrainian military and government entities by delivering malicious ZIP archives via the Viber messaging platform.
The Kimwolf Android botnet has infected over 2 million devices, leveraging exposed ADB interfaces and residential proxy networks for DDoS attacks, app installs, and proxy bandwidth resale.
Zestix is offering for sale corporate data stolen from cloud file-sharing platforms.
The Crimson Collective extortion gang claimed responsibility for the Brightspeed breach.
US cyber professionals pleaded guilty to working as affiliates of the ALPHV/BlackCat ransomware group.
The RondoDox botnet has expanded operations by exploiting React2Shell vulnerabilities, targeting Next.js servers for cryptomining and botnet payload delivery.
New VVS Stealer malware, written in Python, is targeting Discord accounts to harvest credentials and tokens.

Trends, Tools, or Tactics of Interest

The ClickFix social engineering campaign is targeting the European hospitality sector, using fake Windows Blue Screen of Death (BSOD) screens to trick users into executing malware.
Threat actors are increasingly abusing cloud file-sharing platforms for corporate data theft.
The Kimwolf botnet demonstrates the growing use of residential proxy networks for botnet expansion and monetization.
AI-powered IDEs recommending non-existent extensions present a new supply chain risk vector.
Agentic AI adoption is raising identity management challenges, with AI agents acting as a new class of identity that CISOs must manage.
CISA’s Known Exploited Vulnerabilities (KEV) catalog expanded by 20% in 2025, now including 1,484 entries, with 24 new vulnerabilities known to be exploited by ransomware groups.
Automated License Plate Reader (ALPR) surveillance is discussed as a privacy and security concern.
Ineffectiveness of AI guardrails was highlighted following an incident involving Grok generating inappropriate content.

Regulatory or Policy Developments Affecting the Security Industry

The early release of Ilya Lichtenstein, convicted for the Bitfinex cryptocurrency exchange hack, under the US First Step Act, was reported.

Cybersecurity Brief – 2025-12-31

Wed, 31 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The European Space Agency (ESA) confirmed a breach of external servers containing unclassified information related to collaborative engineering and project management activities. The compromised systems were outside ESA’s corporate network.
Korean Air reported that data belonging to approximately 30,000 employees was stolen following a breach at its former subsidiary KC&D, which was linked to an Oracle E-Business Suite (EBS) hack.
Two former employees of cybersecurity incident response firms Sygnia and DigitalMint pleaded guilty to conducting BlackCat (ALPHV) ransomware attacks against U.S. companies in 2023.

Newly Discovered Vulnerabilities

The Cyber Security Agency of Singapore (CSA) issued an alert regarding a critical remote code execution vulnerability in SmarterTools SmarterMail email software. The flaw is rated maximum severity and can be exploited for full compromise.
CISA ordered U.S. federal agencies to patch the actively exploited MongoBleed vulnerability in MongoDB, which can be used to steal credentials, API keys, and other sensitive data.

Notable Threat Actor Activity

The Chinese APT Mustang Panda was observed deploying a previously undocumented, signed kernel-mode rootkit driver to load a new variant of the TONESHELL backdoor. The driver contains user-mode shellcodes for execution.
The threat actor Silver Fox has shifted focus to India, conducting phishing campaigns using income tax-themed lures to deliver the ValleyRAT (Winos 4.0) modular remote access trojan.

Trends, Tools, or Tactics of Interest

Researchers at Push Security identified a new “ConsentFix” technique that blends OAuth consent phishing with ClickFix-style prompts, enabling attackers to trick users into handing over OAuth tokens and compromise accounts.
A new cybercrime service, ErrTraffic, is automating ClickFix attacks by generating fake browser glitches on compromised websites, luring users into downloading malicious payloads or following malicious prompts.
A campaign dubbed Zoom Stealer has been detected, in which 18 malicious browser extensions targeting Chrome, Firefox, and Edge have affected 2.2 million users. The extensions harvest online meeting data, including corporate meeting intelligence.
Analysis of cyber-insurance claims data identified six cybersecurity technologies that are most effective in reducing losses and are recommended for deployment by 2026.
The rapid deployment of artificial intelligence (AI) in security operations is exposing new risks, with practitioners struggling to consistently operationalise AI while maintaining security.

Regulatory or Policy Developments

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) lifted sanctions on three individuals previously linked to the Intellexa Consortium, the commercial spyware vendor behind Predator spyware.
The total disclosed value of cybersecurity M&A deals in 2025 exceeded $84 billion, with eight acquisitions surpassing the $1 billion mark.

Cybersecurity Brief – 2025-12-30

Tue, 30 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, South Korea’s largest retailer, will compensate 33.7 million customers with $1.17 billion following a data breach that exposed customer information.
Aflac suffered a data breach affecting 22 million individuals, with hackers stealing names, addresses, Social Security numbers, ID numbers, and medical/health insurance information.
Sax, a major US accounting firm, disclosed a 2024 data breach impacting 220,000 individuals; the investigation took over a year.
Korean Air experienced a data breach affecting thousands of employees after its in-flight catering supplier, KC&D, was hacked.
Trust Wallet reported that attackers compromised its browser extension, draining approximately $7 million from 2,596 cryptocurrency wallets.
Romanian energy provider Oltenia Energy Complex was hit by a Gentlemen ransomware attack, disrupting its IT infrastructure.
A hacker claimed theft of 40 million Condé Nast records following a Wired data leak, with 2.3 million Wired subscriber records made public.
The EmEditor website was compromised in a supply chain attack, serving a malicious installer that delivered infostealer malware.
Over 90% of parked domains now lead users to scams or malware, a significant increase from less than 5% a decade ago.
A Lithuanian national was arrested for distributing clipboard-stealing malware disguised as KMSAuto, infecting 2.8 million systems.
A former Coinbase support agent was arrested in India for assisting hackers in stealing sensitive customer information from a company database.

Newly Discovered Vulnerabilities

MongoDB vulnerability CVE-2025-14847 (“MongoBleed”) is under active exploitation, allowing unauthenticated, remote attackers to leak sensitive data. Over 87,000 potentially vulnerable instances are exposed worldwide.
Fortinet warned that the five-year-old critical FortiOS vulnerability (CVE-2020-12812), which allows 2FA bypass, is still being actively exploited in attacks against unpatched devices.

Notable Threat Actor Activity

The HoneyMyte APT (also known as Mustang Panda or Bronze President), linked to Chinese state actors, has evolved its tactics to use a kernel-mode rootkit for delivering and protecting the ToneShell backdoor in attacks against government organisations.
Researchers disclosed a spear-phishing campaign that published over two dozen malicious npm packages, used as phishing infrastructure to steal login credentials.
Chinese state-affiliated hackers are using a kernel-mode loader to hide ToneShell malware activity during cyberespionage campaigns targeting government entities.

Trends, Tools, or Tactics of Interest

Malware in 2025 increasingly targeted platforms beyond Windows, including Android, macOS, and cross-platform environments.
OWASP’s Agentic AI Top 10 highlights real-world attacks on autonomous AI systems, including goal hijacking and malicious MCP servers.
Supply chain attacks remain prominent, as evidenced by the EmEditor installer compromise and malicious npm package campaigns.
There is a significant rise in malicious use of parked domains, now serving as a major vector for scams and malware distribution.
2025 saw a shift from singular large incidents to widespread smaller breaches and attacks, with trusted tools being abused and old vulnerabilities resurfacing.

Regulatory or Policy Developments Affecting the Security Industry

Debate continues over the utility of Software Bill of Materials (SBOMs), with industry experts expressing mixed views on their practical effectiveness as regulatory and compliance requirements evolve.

Cybersecurity Brief – 2025-12-29

Mon, 29 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

A hacker claims to have breached Condé Nast and leaked an alleged WIRED database containing more than 2.3 million subscriber records. The attacker also stated intentions to release up to 40 million additional records.
Ubisoft’s Rainbow Six Siege experienced a breach where attackers abused internal systems to ban and unban players, manipulate in-game moderation feeds, and grant players large amounts of in-game currency.

Newly Discovered Vulnerabilities

A high-severity vulnerability in MongoDB, tracked as CVE-2025-14847 (“MongoBleed”, CVSS 8.7), allows unauthenticated attackers to read uninitialized heap memory. The flaw affects multiple MongoDB versions.
The MongoBleed vulnerability is being actively exploited in the wild, with reports indicating over 87,000 potentially vulnerable MongoDB servers are exposed to the internet. Attackers can leverage the flaw to leak sensitive database secrets.

Notable Threat Actor Activity

Threat actors are actively exploiting the MongoBleed (CVE-2025-14847) vulnerability to access sensitive information from unpatched MongoDB instances. The scale of exposed servers suggests widespread scanning and exploitation activity.

Cybersecurity Brief – 2025-12-28

Sun, 28 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Ubisoft’s Rainbow Six Siege experienced a significant breach in which attackers exploited internal systems to ban and unban players, manipulate in-game moderation feeds, and grant players billions of in-game credits. The incident exposed weaknesses in the game’s backend infrastructure and moderation controls.

Newly Discovered Vulnerabilities

A high-severity vulnerability in MongoDB (CVE-2025-14847, CVSS 8.7) was disclosed, allowing unauthenticated attackers to read uninitialized heap memory. This flaw could potentially expose sensitive data processed by the database.

Notable Threat Actor Activity

Attackers targeting Rainbow Six Siege demonstrated the capability to access and manipulate internal moderation tools, indicating a high level of access and understanding of Ubisoft’s internal systems. The breach resulted in large-scale abuse of in-game economies and moderation functionality.

Cybersecurity Brief – 2025-12-25

Thu, 25 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The U.S. FBI seized the ‘web3adspanels.org’ domain and its database, which were used by cybercriminals to host and distribute stolen bank login credentials obtained in account takeover attacks targeting U.S. victims.
The French national postal service, La Poste, experienced a Distributed Denial-of-Service (DDoS) attack that knocked central computer systems offline. Pro-Russian hacker groups have claimed responsibility.
The U.S. Securities and Exchange Commission (SEC) filed charges against multiple companies involved in a cryptocurrency scam that used fake AI-themed investment tips to defraud victims of over $14 million.
ESET reported a 62% surge in the Nomani investment scam, which now leverages AI-generated deepfake advertisements and has expanded distribution beyond Facebook to other social media platforms.

Newly Discovered Vulnerabilities

MongoDB issued an urgent advisory for IT administrators to patch a high-severity remote code execution (RCE) vulnerability affecting its servers.

Notable Threat Actor Activity

Researchers identified a new variant of the macOS information stealer “MacSync,” which is distributed via a digitally signed and notarized Swift application designed to bypass Apple Gatekeeper protections.
A typosquatted domain impersonating the Microsoft Activation Scripts (MAS) tool was found distributing malicious PowerShell scripts, leading to Windows infections with the ‘Cosmali Loader’ malware.

Trends, Tools, or Tactics of Interest

The Nomani investment scam’s increased use of AI-generated deepfake content and expanded social media targeting reflects a trend toward more sophisticated and widespread social engineering campaigns.
Attackers are leveraging digitally signed and notarized applications on macOS to circumvent built-in security controls, as demonstrated by the new MacSync stealer variant.
The use of typosquatted domains to distribute malware via widely recognized tools continues to be a prevalent tactic.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced that Teams administrators will soon have the ability to block external users from sending messages, calls, or meeting invitations via the Microsoft Defender portal, enhancing organizational control over external communications.