Motex on DanSec Daily

Cybersecurity Brief – 2025-11-02

Sun, 02 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The Australian Signals Directorate (ASD) has issued a bulletin regarding ongoing attacks targeting unpatched Cisco IOS XE devices in Australia. The attacks involve a previously undocumented implant referred to as BADCANDY.

Newly Discovered Vulnerabilities

A vulnerability in Motex Lanscope Endpoint Manager was exploited as a zero-day by the China-linked threat actor group Bronze Butler (Tick). The exploitation enabled deployment of an updated Gokcpdoor malware variant.

Notable Threat Actor Activity

Bronze Butler (Tick), a China-linked cyber-espionage group, has been observed exploiting the Lanscope Endpoint Manager zero-day vulnerability to facilitate cyber-espionage operations.

Trends, Tools, or Tactics of Interest

The use of an undocumented implant (BADCANDY) in ongoing campaigns targeting Cisco IOS XE devices highlights continued attacker focus on network infrastructure.
Updated versions of Gokcpdoor malware are being deployed by advanced persistent threat actors, indicating ongoing development and refinement of custom toolsets for espionage purposes.

Cybersecurity Brief – 2025-11-01

Sat, 01 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Ribbon Communications, a US telecom company, disclosed a breach attributed to suspected nation-state actors, with initial access dating back to December of the previous year. The company has not confirmed whether sensitive data was accessed.
The University of Pennsylvania experienced a cybersecurity incident in which students and alumni received offensive emails from compromised university addresses, with threats to leak data.
Open VSX (Eclipse Foundation) revoked a small number of leaked tokens after discovery by Wiz. The incident was contained, and the foundation downplayed the impact, stating it was not a self-replicating worm.
Australian authorities issued warnings regarding ongoing attacks on unpatched Cisco IOS XE devices, with routers being compromised via the BadCandy webshell.

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Motex Lanscope Endpoint Manager (CVE-2025-xxxx) is being actively exploited by the China-linked Tick group for cyber espionage and system hijacking.
An unpatched Windows shortcut vulnerability is being exploited by China-affiliated threat actors, including UNC6384 and Mustang Panda, to target European diplomatic and government entities. Attacks use spear-phishing with European Commission and NATO-themed lures to deliver malware, including PlugX.
CISA confirmed active exploitation of a high-severity Linux kernel privilege escalation flaw by ransomware groups.
Broadcom updated its advisory to confirm in-the-wild exploitation of a VMware vulnerability (CVE-2025-41244), now added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Google released a Chrome update addressing 20 security issues, including seven serious flaws that could allow remote code execution via malicious web pages.

Notable Threat Actor Activity

Nation-state threat actors are distributing new malware named Airstalk as part of a suspected supply chain attack, according to Palo Alto Networks Unit 42.
China-linked UNC6384 and Mustang Panda are conducting targeted attacks against European diplomatic entities, exploiting unpatched Windows vulnerabilities.
The China-linked Tick group is exploiting a Lanscope zero-day for corporate system compromise.
Russian authorities arrested three individuals believed to be administrators of the Meduza Stealer malware operation after attacks on Russian organizations.
A Ukrainian national was extradited from Ireland to the US on charges related to participation in the Conti ransomware group.

Trends, Tools, or Tactics of Interest

OpenAI announced Aardvark, an agentic security researcher powered by GPT-5, designed to autonomously identify and remediate code flaws.
Microsoft Edge introduced a new scareware sensor to enhance scam detection capabilities and improve Defender SmartScreen response times.
Ongoing exploitation of unpatched networking devices (notably Cisco IOS XE) continues to be leveraged for webshell deployment and persistent access.
The use of spear-phishing with themed lures (European Commission, NATO) remains prevalent in targeted attacks on diplomatic sectors.
MSPs are facing increased client expectations for cybersecurity and compliance, amid evolving threats and regulatory demands.

Regulatory or Policy Developments

The United Nations adopted a new Convention Against Cybercrime, establishing an international framework for cross-border cybercrime cooperation.
CISA and NSA, in coordination with Australian and Canadian partners, issued urgent guidance to secure on-premises WSUS and Microsoft Exchange servers.
Japan released comprehensive OT security guidance for semiconductor factories, available in both Japanese and English.
CISA added exploited XWiki and VMware vulnerabilities to the Known Exploited Vulnerabilities catalog.

Cybersecurity Brief – 2025-10-24

Fri, 24 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Toys “R” Us Canada has notified customers of a data breach involving leaked customer records previously stolen from its systems.
Collin’s Aerospace suffered a cyberattack impacting check-in and passenger systems at several European airports in late September 2025, resulting in significant delays and flight cancellations.
The Universe Browser, downloaded millions of times, has been identified as behaving like malware, with links to Asian cybercrime and illegal gambling networks.
Jingle Thief, a cybercriminal group, has been observed exploiting cloud infrastructure in the retail and consumer services sectors to steal millions in gift cards.
WIRED reported that hacked Deckmate 2 card shufflers enabled a mob-related poker scam that resulted in millions of dollars in losses.

Newly Discovered Vulnerabilities

Microsoft released emergency out-of-band patches for a critical Windows Server Update Service (WSUS) remote code execution flaw, which has publicly available proof-of-concept exploit code.
CISA and researchers reported active exploitation of a critical zero-day vulnerability in Motex Lanscope Endpoint Manager, prompting inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog.
A critical vulnerability (CVE-2025-54236, “SessionReaper”) in Adobe Commerce (Magento) is being actively exploited to hijack user sessions on e-commerce platforms, affecting thousands of online stores.
BIND released security updates addressing high-severity cache poisoning vulnerabilities, which could allow attackers to predict source ports and query IDs and inject forged DNS records.
Microsoft has disabled File Explorer’s preview pane for downloaded files to mitigate NTLM credential theft attacks via malicious documents.
OpenAI’s Atlas and Perplexity’s Comet browsers are vulnerable to sidebar spoofing attacks, allowing malicious extensions to impersonate AI sidebar interfaces and mislead users.

Notable Threat Actor Activity

North Korean Lazarus Group targeted at least three European defense companies with Operation DreamJob, leveraging fake job offers to compromise systems and steal drone-related intellectual property.
Russian government involvement with cybercrime groups has shifted from passive tolerance to active management, according to recent security firm analysis.
The “Smishing Triad,” a Chinese cybercriminal group, has shifted tactics to lower-frequency, higher-impact government impersonation SMS phishing attacks.
Researchers identified a new infostealer targeting Android devices, as part of an ongoing expansion in the infostealer threat landscape.
YouTube continues to be leveraged by threat actors as a malware distribution network, with evolving tactics for wider reach.

Trends, Tools, or Tactics of Interest

A phishing campaign is impersonating password managers (LastPass and Bitwarden) with fake breach notifications to steal credentials.
Phishing emails targeting cloud accounts, often in French and English, have been observed, warning recipients about purported payment issues to lure credentials.
Enterprises are increasingly abandoning static secrets in favour of managed identities to address risks associated with machine identities in cloud environments.
The Verizon 2025 Mobile Security Index reports that 85% of organizations believe mobile device attacks are increasing, with AI-powered threats raising particular concern.
AI sidebar spoofing, where browser extensions imitate trusted AI interfaces, is an emerging attack vector against users of AI-enabled browsers.
Zero Trust models are facing challenges in governing AI agents, with new blind spots emerging as AI agents gain broader access and autonomy.
Security researchers at Pwn2Own Ireland 2025 exploited 73 zero-day vulnerabilities, earning over $1 million in rewards, highlighting the ongoing prevalence of unknown flaws in widely used software.
Meta has enhanced scam protection features on WhatsApp and Messenger, as part of efforts to combat impersonation and fraud, following the removal of over 21,000 fake customer support pages from Facebook.
AI coding tools are introducing security risks by generating functional but flawed code, prompting calls for embedding security checks directly into AI development workflows.

Regulatory or Policy Developments Affecting the Security Industry

The UK Competition and Markets Authority (CMA) is considering measures that may require Apple to allow rival app stores on iPhones, challenging its current “walled garden” approach.
A $14 billion cryptocurrency seizure by US authorities signals increased regulatory scrutiny on the use of cryptocurrencies by cybercrime syndicates.
HP withdrew a software update for Windows 11 AI PCs after it caused the deletion of Microsoft certificates necessary for Entra ID authentication, disrupting organizational access.

Cybersecurity Brief – 2025-10-23

Thu, 23 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Over 250 Magento and Adobe Commerce stores were compromised overnight through active exploitation of the critical “SessionReaper” vulnerability (CVE-2025-54236), with hundreds of attack attempts recorded.
FinWise suffered a data breach attributed to insider threat activity, exposing sensitive data.
Jewett-Cameron, a fencing and pet company, was hit by ransomware, with attackers exfiltrating sensitive information and threatening to release it unless a ransom is paid.
More than 100 Chrome extensions were found to be abusing WhatsApp Web for bulk messaging, violating both Chrome and WhatsApp anti-spam policies.
Ukraine war relief organizations and regional government entities were targeted in a spear-phishing campaign (“PhantomCaptcha”) delivering remote access malware via weaponized PDFs and fake Zoom meeting invitations.
Home Depot customers were targeted by a phishing campaign using fake Halloween giveaways, leveraging tracking pixels and compromised websites.
A fake Nethereum NuGet package using homoglyph attacks was discovered stealing cryptocurrency wallet keys via a supply chain attack.
The North Korean Lazarus Group is conducting cyber-espionage campaigns targeting European drone manufacturing data.
The Iranian MuddyWater APT group targeted over 100 global government and private organizations with the Phoenix backdoor, leveraging compromised mailboxes and phishing with macro-enabled documents.

Newly Discovered Vulnerabilities

Critical “SessionReaper” vulnerability (CVE-2025-54236) in Adobe Commerce and Magento Open Source is being actively exploited for unauthorized access and session hijacking.
A high-severity remote code execution vulnerability (“TARmageddon”) was identified in the abandoned async-tar Rust library and its forks, potentially affecting any dependent software.
Critical vulnerabilities in TP-Link’s Omada Gateways were patched, including a flaw allowing remote unauthenticated arbitrary command execution.
Zero-click Dolby audio bug (CVE-2025-54957) allows code execution via audio files on Android and Windows devices.
Motex Lanscope Endpoint Manager has a critical security flaw now listed in CISA’s Known Exploited Vulnerabilities catalog, confirmed to be under active attack.
Oracle released its October 2025 Critical Patch Update addressing 374 vulnerabilities across its product suite.
Microsoft SharePoint’s ToolShell vulnerability (CVE-2025-53770) is being exploited by Chinese threat actors even after public disclosure and patch release.

Notable Threat Actor Activity

Iranian APT MuddyWater used the Phoenix backdoor in a global espionage campaign, targeting government, financial, and industrial organizations, primarily in the Middle East and Africa.
Chinese threat actors associated with the ToolShell campaign exploited a SharePoint vulnerability to compromise organizations across government, telecom, and education sectors on four continents.
Russian APT Star Blizzard shifted to new backdoors (NoRobot/BaitSwitch and MaybeRobot/SimpleFix) after their previous malware, LostKeys, was exposed by researchers.
Lazarus Group (North Korea) is actively seeking sensitive data from European drone manufacturers.
APT group PassiveNeuron, identified by Kaspersky, is targeting government, financial, and industrial entities in Asia, Africa, and Latin America using custom malware (Neursite, NeuralExecutor).

Trends, Tools, or Tactics of Interest

Attackers are abusing X’s generative AI bot Grok to spread phishing links by manipulating the AI into responding with malicious URLs.
Threat actors are exploiting public cloud outages (e.g., AWS) to launch themed phishing attacks against affected users.
Researchers demonstrated that poisoning large language models (LLMs) can be achieved with as few as 250 documents, significantly lowering the barrier for AI model manipulation.
Data sprawl and the prevalence of hardcoded credentials, access tokens, and API keys are increasing the risk of data breaches due to over-privileged secrets.
Burp Suite’s new agentic Burp AI capabilities were tested for automated vulnerability discovery, showing notable effectiveness in identifying web application flaws.
Meta introduced new anti-scam tools for WhatsApp and Messenger to enhance user protection against scams.
Over 100 Chrome extensions are circumventing anti-spam controls on WhatsApp Web, indicating ongoing abuse of browser platforms for message automation.
Supply chain attacks continue to target package managers, as evidenced by the malicious Nethereum NuGet package.
Pwn2Own Ireland 2025 saw researchers exploit 90 previously unknown vulnerabilities across two days, earning over $1.3 million in rewards, highlighting the ongoing discovery of zero-days in widely used devices and platforms.

Regulatory or Policy Developments

Canada fined Cryptomus, a digital payments platform, $176 million for facilitating transactions with Russian cryptocurrency exchanges and cybercrime-linked websites.
WhatsApp secured a permanent ban on NSO Group after a six-year legal battle, with NSO ordered to pay $4 million in damages and prohibited from reverse-engineering WhatsApp or creating new accounts.
Russia is increasing enforcement actions against domestic hackers, reassessing its approach to providing safe haven in response to Western law enforcement pressure.