Cybersecurity Brief – 2025-10-03

Fri, 03 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Red Hat has confirmed a breach of its private GitLab repositories, with a threat actor claiming compromise of 28,000 repositories, including data related to major clients. Red Hat has initiated remediation.
WestJet disclosed that 1.2 million individuals were impacted by a data breach resulting from a June cyberattack. Analysis of stolen information has been completed.
Dealership software provider Motility suffered a ransomware attack on August 19, impacting 766,000 individuals. Stolen data includes names, contact details, Social Security numbers, and driver’s license numbers.
Allianz Life reported a data breach in July affecting 1.5 million individuals, with hackers stealing files containing names, addresses, dates of birth, and Social Security numbers from a cloud-based CRM.
Cybercriminals have launched an extortion campaign targeting Oracle E-Business Suite customers, with executives receiving threats alleging theft of sensitive data. The campaign is possibly linked to Cl0p and FIN11 ransomware groups.

Newly Discovered Vulnerabilities

DrayTek issued an advisory for a remote code execution vulnerability affecting several Vigor router models. The flaw allows remote, unauthenticated attackers to execute arbitrary code.
A critical vulnerability, dubbed “WireTap,” has been disclosed in Intel SGX. The attack leverages a passive interposer to extract the DCAP attestation key, undermining the enclave’s security mechanism.
A malicious Python Package Index (PyPI) package named “soopsocks” was found to have infected 2,653 systems before removal. The package masqueraded as a SOCKS5 proxy tool while stealing sensitive information.
Microsoft announced that Outlook for Web and the new Outlook for Windows will stop displaying inline SVG images to mitigate attacks exploiting this feature.
Microsoft Defender for Endpoint has a bug causing erroneous BIOS update alerts, incorrectly tagging some devices’ firmware as outdated.

Notable Threat Actor Activity

The Confucius APT group has been linked to new phishing campaigns targeting Pakistan, deploying WooperStealer and Anondoor malware. The group’s tactics have evolved to include Python-based surveillance tools.
Google Mandiant and Google Threat Intelligence Group are tracking a new extortion wave targeting Oracle E-Business Suite customers, potentially linked to the Cl0p ransomware group.
Android spyware campaigns (“ProSpy” and “ToSpy”) have been discovered targeting users in the UAE, impersonating Signal and ToTok apps to steal sensitive data.
Scam Facebook groups are distributing malicious Android malware to senior users via fake community and travel groups.

Trends, Tools, or Tactics of Interest

ENISA’s 2025 Threat Landscape report highlights a significant number of attacks targeting operational technology (OT) systems within the EU.
Attackers are increasingly scanning for critical vulnerabilities in firewalls and exploiting unpatched systems, as well as employing BYOVD (Bring Your Own Vulnerable Driver) and SQL C2 (Command and Control) attack techniques.
There is a documented shift in phishing tactics from email to mobile channels, including SMS, voice, and QR-code phishing.
The “.well-known” directory continues to be exploited for hiding webshells and malicious files.
Service desks are being actively targeted for social engineering attacks, prompting recommendations for NIST-aligned, role- and points-based user verification workflows.
Automation of penetration testing delivery is highlighted as a key workflow for continuous security validation.
The bug bounty platform HackerOne reported $81 million in payouts to security researchers over the past year, reflecting sustained engagement in vulnerability disclosure.

Regulatory or Policy Developments Affecting the Security Industry

The US Federal Trade Commission (FTC) has accused the Sendit app and its CEO of illegally signing up minors, misusing their data, and engaging in deceptive practices including fake messages and hidden fees.
Meta announced it will use user interactions with its generative AI to serve targeted ads, raising privacy and data usage concerns.
Despite a record number of CVEs projected for 2025, cyber insurers are reportedly not adjusting policy terms or requirements in response to the increased vulnerability disclosures.

Cybersecurity Brief – 2025-10-02

Thu, 02 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Motility Software Solutions suffered a ransomware attack exposing sensitive data of 766,000 dealership software clients.
WestJet confirmed that a cyberattack compromised personal information, including passport and ID documents, of 1.2 million customers.
Allianz Life announced that a July data breach impacted nearly 1.5 million individuals.
Adobe disclosed an ingestion bug in its Analytics platform that resulted in customer tracking data being exposed to other tenants for approximately one day.
Executives at multiple companies received extortion emails from the Clop ransomware group, claiming theft of sensitive data from Oracle E-Business Suite systems.
Unknown threat actors have exploited Milesight industrial cellular routers since at least February 2022 to send smishing SMS messages targeting European users.

Newly Discovered Vulnerabilities

A critical vulnerability in Red Hat OpenShift AI could allow attackers to escalate privileges and gain full control over hybrid cloud infrastructure under specific conditions.
A high-severity flaw in One Identity OneLogin IAM allowed attackers to use API keys to steal OpenID Connect (OIDC) secrets and impersonate applications.
OpenSSL patched three vulnerabilities that could allow private key recovery, code execution, and denial-of-service attacks.
Google’s Gemini AI suite contained vulnerabilities permitting attackers to embed malicious instructions in user web activity.
A bug in classic Outlook causes the client to crash on launch, with resolution only available via Microsoft Exchange Online support.
A newly demonstrated attack, dubbed “WireTap” or “Battering RAM,” enables attackers with physical access to extract Intel SGX ECDSA keys and break confidential computing protections on Intel and AMD processors via DDR4 memory-bus interposers.
Broadcom failed to disclose zero-day exploitation of a VMware vulnerability affecting Aria Operations and VMware Tools, which could allow privilege escalation on virtual machines.

Notable Threat Actor Activity

The Clop ransomware group is conducting a new extortion campaign targeting Oracle E-Business Suite users.
A previously undocumented Android banking trojan, “Klopatra,” has infected over 3,000 devices, mainly in Spain and Italy, using hidden VNC for remote control.
Chinese APT “Phantom Taurus” is targeting organisations with the Net-Star malware, focusing on espionage and using infrastructure linked to other Chinese APTs but employing distinct TTPs.
Threat group UNC6040 (ShinyHunters) has been observed using advanced social engineering tactics to breach Salesforce environments.
The Rhadamanthys malware, a complex multi-modular stealer sold on underground markets since 2022, has received notable updates.

Trends, Tools, or Tactics of Interest

Bitdefender’s 2025 Cybersecurity Assessment Report highlights increased pressure to conceal breaches, expanding attack surfaces, and rising misperceptions around AI security.
Attackers are leveraging industrial IoT devices (Milesight routers) to conduct large-scale smishing campaigns.
The Klopatra Android malware uses hidden VNC for hands-on device control, indicating a trend towards more interactive mobile banking attacks.
Research demonstrates that confidential computing protections (Intel SGX, AMD SEV) can be bypassed with low-cost hardware if physical access is obtained.
“Burp AI” is being adopted by security professionals for automated vulnerability scanning in bug bounty workflows.
Google Drive for desktop is rolling out AI-powered ransomware detection that pauses file syncing upon detecting an attack.
AmCache forensic artifact analysis is highlighted as valuable for incident investigations, with new command-line tools available for data extraction.
Undead (unsupported) operating systems, especially with Windows 10 reaching end-of-life, are set to significantly increase the vulnerable attack surface in enterprise environments.

Regulatory or Policy Developments Affecting the Security Industry

KnowBe4 is pursuing ISO 42001 certification for AI governance as it integrates more AI into its human risk management platform.
F-Droid project warns it may cease operations due to Google’s new developer identity verification requirements.
NIST published Special Publication 1334, offering guidance on mitigating USB-borne threats in industrial control system (ICS) and OT environments.
CISA reiterates that microsegmentation is foundational, not optional, for zero trust architectures, and highlights modern, automated approaches to implementation.
Microsoft will begin automatic installation of Microsoft 365 companion apps on Windows 11 devices with existing Microsoft 365 desktop clients later this month.

Motility on DanSec Daily

Cybersecurity Brief – 2025-10-03

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-10-02

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry