M&S on DanSec Daily

Cybersecurity Brief – 2025-09-29

Mon, 29 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Harrods, a British department store, has notified customers of a data breach involving the compromise of some personal details. Four individuals were arrested in July in connection with cyberattacks targeting Harrods, Marks & Spencer, and the Co-op.

Newly Discovered Vulnerabilities

Akira ransomware operators have been observed breaching SonicWall SSL VPN devices even when One-Time Password (OTP) Multi-Factor Authentication (MFA) is enabled. Attackers are successfully logging in to accounts protected by MFA, indicating a potential vulnerability or bypass method affecting SonicWall VPNs.

Notable Threat Actor Activity

Akira ransomware activity continues to evolve, with threat actors specifically targeting SonicWall SSL VPN appliances and demonstrating the capability to circumvent MFA protections.

Regulatory or Policy Developments Affecting the Security Industry

The European Commission has launched an investigation into SAP over potential anti-competitive practices related to aftermarket services for its on-premise ERP software. This regulatory action may impact support models and third-party service providers in the enterprise software sector.

Cybersecurity Brief – 2025-07-11

Fri, 11 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Four individuals were arrested in the UK for cyberattacks targeting major retailers Marks & Spencer, Co-op, and Harrods. The suspects are believed to be connected to the Scattered Spider group, which has also targeted airlines and other sectors.
Qantas confirmed a data breach affecting 5.7 million customers. Exposed information includes names, addresses, email addresses, phone numbers, and other personal data.
Nippon Steel’s NS Solutions subsidiary suffered a breach exposing customer and employee data. There is currently no evidence of the data being leaked on dark web sites.
Ingram Micro experienced a ransomware attack that disrupted online ordering for customers. The company has since restored operations.
McDonald’s suffered a data exposure incident involving its AI-powered job application bot, which allowed access to applicant data using a weak default password.

Newly Discovered Vulnerabilities

CISA added CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
A critical remote code execution vulnerability was discovered in the open-source mcp-remote project, affecting over 437,000 downloads.
Multiple critical vulnerabilities, dubbed “PerfektBlue,” were identified in the BlueSDK Bluetooth stack used by Mercedes, Volkswagen, and Skoda vehicles. These flaws could allow remote code execution and potential access to critical vehicle systems.
A high-severity flaw, CVE-2025-3648, was disclosed in the ServiceNow platform. Exploitation could lead to data exposure via misconfigured access control lists (ACLs).
AMD disclosed a new class of vulnerabilities called Transient Scheduler Attacks, impacting a wide range of its CPUs and potentially allowing information disclosure.
A 6-year-old Oracle vulnerability affecting eSIM technology was disclosed, enabling potential spying and device takeover across millions of phones.
The Model Context Protocol (MCP) ecosystem, widely adopted for integrating AI models with external data, was found to have critical security vulnerabilities opening new attack vectors.

Notable Threat Actor Activity

Scattered Spider, a data theft and extortion group, has shifted its targeting to the aviation and transportation sectors, according to warnings from the FBI and cybersecurity experts.
Kaspersky identified malicious open-source packages for Cursor AI that deploy the Quasar backdoor and a cryptocurrency stealer.
Ongoing social engineering campaigns are using fake gaming and AI startup firms on Telegram and Discord to distribute malware targeting cryptocurrency users.
A new ZuRu malware variant is propagating via trojanized versions of the Termius macOS app, targeting developers.
Deepfake attacks are being used to impersonate high-profile political figures, such as Marco Rubio, to attempt to extract government secrets.
A Russian professional basketball player was arrested in France at the request of the US for allegedly acting as a negotiator for a ransomware gang.

Trends, Tools, or Tactics of Interest

AI-driven attacks are becoming more sophisticated, faster, and pervasive, with increased use of generative AI in offensive operations.
SSH tunneling, specifically direct-tcp requests, is highlighted as an active technique.
Force Push Scanner is a new tool for red teams to identify leaked secrets in ephemeral GitHub commits.
Anubis, an open-source self-hosted firewall, is being used to block AI bots from scraping website content.
SIM swap fraud is reportedly increasing, highlighting ongoing risks to mobile-based authentication.
Microsoft replaced the default JScript engine with JScript9Legacy in Windows 11 version 24H2 and later, aiming to improve scripting security.

Regulatory or Policy Developments

The FBI issued guidance on CJIS (Criminal Justice Information Services) compliance, emphasizing password hygiene, multi-factor authentication, and access control for law enforcement data handlers.
The U.S. Department of Homeland Security is advising law enforcement to treat certain protest activities as violent tactics, including livestreaming and skateboarding, potentially affecting policing and surveillance practices.
CISA’s update to the KEV catalog with Citrix NetScaler CVE-2025-5777 signals heightened regulatory attention to actively exploited enterprise vulnerabilities.

Cybersecurity Brief – 2025-07-09

Wed, 09 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

M&S confirmed a significant ransomware attack by DragonForce, initiated via a sophisticated social engineering/impersonation attack.
Qantas experienced a data breach resulting in an extortion demand after customer data was stolen from a contact centre.
South Korean telecommunications provider SK Telecom suffered a breach exposing 27 million records; the government imposed a monetary penalty and new regulatory requirements.
Over 17,000 fake news websites were uncovered globally as part of a large-scale investment fraud campaign (“BaitTrap”).
More than 1.7 million installations of malicious Chrome extensions were identified, capable of tracking users, stealing browser activity, and redirecting to unsafe sites.
The Anatsa Android banking trojan was distributed via a fake PDF viewer app on Google Play, impacting over 90,000 users, primarily targeting US banks.
Russian organisations were targeted by a new Windows spyware dubbed Batavia, used in ongoing espionage campaigns.
A supply chain attack compromised the Ethcode Visual Studio Code extension, exposing over 6,000 developers to malicious pull requests.
The RondoDox botnet exploited vulnerabilities in TBK DVRs and Four-Faith routers to conscript devices for DDoS attacks.

Newly Discovered Vulnerabilities

Microsoft’s July 2025 Patch Tuesday addressed 130–137 vulnerabilities, including a publicly disclosed zero-day in SQL Server. Seventeen bugs are considered high risk, including multiple remote code execution vulnerabilities in Office and SharePoint.
Adobe released patches for critical code execution vulnerabilities affecting several products, including After Effects, Audition, Illustrator, and others.
SAP patched critical insecure deserialization vulnerabilities in NetWeaver, which could allow remote code execution and full system takeover.
Technical details and exploit code for CitrixBleed2 (CVE-2025-5777) in Citrix NetScaler have been released, increasing the risk of exploitation.
A new Android “TapTrap” attack was disclosed, using invisible UI tricks to bypass permission systems and trick users into granting sensitive access.

Notable Threat Actor Activity

Threat actors repurposed the legitimate Shellter red teaming tool to distribute Lumma Stealer, SectopRAT, Arechclient2, and Rhadamanthys malware, leveraging its AV/EDR evasion features.
A suspected Chinese state-sponsored hacker linked to Silk Typhoon (Hafnium) was arrested in Milan, facing charges including wire fraud and unauthorized computer access.
Russian organisations faced an ongoing campaign involving the newly identified Batavia Windows spyware.
A large-scale operation using Baiting News Sites (BNS) was uncovered, leveraging fake news for investment fraud.
RondoDox botnet activity increased, exploiting IoT device vulnerabilities for DDoS.

Trends, Tools, or Tactics of Interest

Malicious open source packages increased by 188% year-over-year, with data exfiltration as the most common malware function.
Threat actors continue to exploit legitimate security and pen-testing tools (e.g., Shellter) for malware delivery and AV/EDR evasion.
Supply chain attacks targeting development environments (e.g., VS Code extensions) remain a significant threat vector.
Identity-based attacks in the retail sector are exploiting overprivileged admin roles and neglected vendor tokens.
Agentic AI is emerging as a growing attack surface, with increased risk from invisible threats and novel vectors.
Human risk management and measurement in security awareness programs remain a focus area for evaluating organisational resilience.

Regulatory or Policy Developments Affecting the Security Industry

South Korea imposed regulatory requirements on SK Telecom following a major data breach, in addition to a monetary penalty.
SSL/TLS certificate lifespan reduction to 47 days by 2029 is prompting organisations to prepare for operational changes in certificate management.
Samsung announced major security and privacy enhancements for its upcoming One UI 8 release on Galaxy smartphones.
Microsoft clarified options for extended Windows 10 security updates through October 2026, including free alternatives with certain conditions.

Cybersecurity Brief – 2025-06-22

Sun, 22 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The April 2025 cyberattacks on UK retailers Marks & Spencer and Co-op have been attributed to the threat group Scattered Spider. The incidents have been classified as a “single combined cyber event,” with estimated damages reaching up to $592 million.
The UK Information Commissioner’s Office (ICO) has imposed a significant fine on 23andMe following its 2023 data breach.

Notable Threat Actor Activity

Scattered Spider has been identified as the group behind the coordinated attacks on Marks & Spencer and Co-op.
Israeli authorities have accused Iranian state-linked actors of hacking security cameras in Israel for espionage purposes.
Ukrainian hackers have reportedly disrupted a major Russian internet provider.
China’s Salt Typhoon threat group has claimed responsibility for another cyberattack, details of which were not specified.

Trends, Tools, or Tactics of Interest

Alternate Data Streams (ADS) are being highlighted as a method for adversary defense evasion, with recent discussions focusing on detection techniques using Python tools.

Regulatory or Policy Developments

The UK has levied a substantial fine against 23andMe in response to its 2023 data breach, indicating ongoing regulatory scrutiny of data protection practices.

Cybersecurity Brief – 2025-06-04

Wed, 04 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Victoria’s Secret has delayed its Q1 2025 earnings release due to ongoing corporate system restoration efforts following a security incident on 24 May.
A data breach at Coinbase has been attributed to bribed customer support representatives at TaskUs in India, leading to data theft from the crypto exchange.

Newly Discovered Vulnerabilities

Hewlett Packard Enterprise (HPE) released security patches for eight vulnerabilities in StoreOnce, including a critical remote authentication bypass flaw.
A critical 10-year-old vulnerability in Roundcube webmail software allows authenticated users to execute malicious code.
Google patched a new Chrome zero-day vulnerability currently being exploited in the wild; this is the third Chrome zero-day exploited this year.
Two newly disclosed vBulletin vulnerabilities (CVE-2025-48827, CVE-2025-48828) are easily exploitable and present risks to bulletin board deployments.
CISA has issued a warning regarding active exploitation of a recently patched ConnectWise ScreenConnect vulnerability that allows remote code execution.

Notable Threat Actor Activity

Scattered Spider has been linked to high-profile attacks on UK retailers Marks & Spencer and Co-op, using tactics such as vishing, adversary-in-the-middle (AiTM) phishing, and exploiting multi-factor authentication gaps to hijack cloud accounts. The group operates as an identity-first threat model rather than a single entity.
Threat actors are using fake DocuSign and Gitcode websites to distribute the NetSupport RAT via multi-stage PowerShell attacks.
The Acreed infostealer has overtaken LummaC2 as the dominant credential theft malware on the Russian Market, reflecting a shift in the threat landscape.
Malicious RubyGems packages impersonating Fastlane CI/CD plugins have been found redirecting Telegram API requests to attacker-controlled servers to steal data.

Trends, Tools, or Tactics of Interest

The Crocodilus Android banking trojan has expanded its targeting from Turkey to eight countries across Europe and South America, now incorporating tactics such as adding fake contacts to victims’ devices to spoof trusted callers.
A new unrestricted AI chatbot, Venice[.]ai, has emerged, capable of generating phishing messages and malware code to assist cybercriminal activity.
Kaspersky research highlights the challenge of determining attack origins in environments lacking container visibility, emphasizing the importance of distinguishing between host-based and container-based threats.
Mozilla has introduced a new system to detect and block Firefox add-ons that function as cryptocurrency drainers.
LayerX has launched ExtensionPedia, and TXOne Networks introduced intelligent vulnerability mitigation capabilities, both reflecting ongoing innovation in endpoint and OT security.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will distrust digital certificates issued by Chunghwa Telecom and Netlock due to compliance and conduct issues, effective from August.
Microsoft and CrowdStrike have launched a shared threat actor glossary to align their threat actor taxonomies and reduce attribution confusion.

Cybersecurity Brief – 2025-05-22

Thu, 22 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack
- Marks & Spencer, a major UK retailer, suffered a cyberattack resulting in widespread operational disruption and a projected profit loss of up to £300 million ($402 million). The company anticipates continued online disruptions until at least July.
Kettering Health Ransomware Attack
- Kettering Health, a US healthcare network, experienced a ransomware attack leading to a system-wide outage and the cancellation of both inpatient and outpatient procedures.
Coinbase Data Breach
- Cryptocurrency exchange Coinbase reported a data breach impacting 69,461 customers. Both customer and corporate data were stolen. Coinbase is offering a $20 million reward for information leading to the perpetrators.
Lumma Infostealer Disruption
- Law enforcement agencies, with support from tech companies, disrupted the Lumma infostealer malware operation, seizing over 2,300 domains and dismantling a major malware-as-a-service infrastructure used globally.

Cybersecurity Brief – 2025-05-14

Wed, 14 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer confirmed customer data was stolen in a recent cyberattack. While no account passwords were compromised, customers are being required to reset passwords as a precaution.
Dior disclosed a cybersecurity incident resulting in the exposure of customer information.
Nucor Corporation, a major steel producer, experienced network disruptions due to a cyberattack, forcing parts of its systems offline for containment.
The Australian Human Rights Commission suffered a data breach in which private documents were leaked online and indexed by search engines.
Xinbi Guarantee, a Chinese-language Telegram marketplace, has been linked to $8.4 billion in illicit transactions, including crypto crime, romance scams, and North Korean money laundering.
North Korean IT worker scams are being exposed at scale, with researchers publishing 1,000 email addresses and photos linked to infiltration of Western companies.
Kosovo extradited the admin of BlackDB, an online cybercrime marketplace, to the US to face charges.

Newly Discovered Vulnerabilities and Exploits

Microsoft Patch Tuesday (May 2025): Microsoft released fixes for 78 vulnerabilities, including five zero-days under active exploitation. Notably, a CVSS 10 vulnerability impacts Azure DevOps Server.
Samsung patched CVE-2025-4632 in MagicINFO 9 Server, a critical flaw (CVSS 9.8) exploited to deploy Mirai botnet malware.
Fortinet addressed CVE-2025-32756, a zero-day RCE flaw in FortiVoice enterprise phone systems, confirmed as exploited in the wild.
Ivanti released updates for two vulnerabilities in Endpoint Manager Mobile (EPMM) that have been chained for remote code execution in limited attacks.
SAP NetWeaver vulnerability is being actively exploited by multiple ransomware groups, including BianLian and RansomExx, to deploy malware such as PipeMagic Trojan.
Google Chrome is rolling out a security change to prevent browser launches with admin privileges on Windows, reducing attack surface.
Open redirect vulnerabilities in trusted domains (e.g., google.com) continue to be abused in phishing campaigns.
Focused phishing attacks are leveraging trusted domains, real CAPTCHAs, and server-side validation for more targeted credential theft.

Notable Threat Actor Activity

Earth Ammit, a cyber espionage group, was linked to supply chain breaches in the drone sector via ERP systems in the VENOM and TIDRONE campaigns targeting Taiwan and South Korea.
Scattered Spider (aka UNC3944) tactics, previously used against UK retail chains, are now being deployed against US retailers.
Ransomware gangs are increasingly exploiting SAP NetWeaver vulnerabilities for initial access and malware deployment.
Meta Mirage, a global phishing campaign, is targeting Meta Business Suite users to hijack high-value business accounts.
Horabot malware is being distributed through invoice-themed phishing emails, targeting Windows users across six Latin American countries.

Trends, Tools, and Tactics of Interest

Phishing campaigns are becoming more sophisticated, with increased use of trusted domains, CAPTCHAs, and real-time validation to evade detection and improve targeting.
Telegram-based black markets remain a significant vector for cybercrime, with recent enforcement actions leading to shutdowns and exposure of major illicit marketplaces.
Shadow SaaS and AI usage is an emerging risk, with new tools (e.g., LastPass SaaS monitoring) being developed to detect unauthorised employee use of unsanctioned cloud and AI services.
Supply chain attacks via ERP systems and targeting of high-value sectors (e.g., drones, retail) remain prevalent.
AI agent security: Research indicates that AI agents can be manipulated by implanting fake “memories,” raising concerns about the integrity of autonomous systems.
Device hygiene: Daily phone reboots are recommended as a practical defense against persistent zero-click mobile exploits.

Regulatory and Policy Developments

Consumer Financial Protection Bureau (CFPB) in the US has canceled plans for tighter regulation of data brokers, potentially impacting privacy and data protection standards.
Telegram enforcement: Following media inquiries, Telegram banned thousands of accounts tied to crypto scam money laundering, disrupting several major illicit marketplaces.

Cybersecurity Brief – 2025-05-02

Fri, 02 May 2025 00:00:00 +0000

Major Incidents and Breaches

Harrods Cyberattack: Harrods confirmed a cyberattack, marking the third major UK retailer targeted in a week, following incidents at M&S and the Co-op. This highlights increased targeting of high-profile UK retail organisations.
Ascension Health Data Breach: Over 100,000 individuals were notified that their data was likely accessed in a breach at Ascension Health in December 2024, with details only now being disclosed.
Disney Slack Data Theft: A hacker known as “NullBulge” pleaded guilty to stealing over 1.1TB of internal data from Disney’s Slack channels.
Commvault Azure Breach: Commvault disclosed that a nation-state actor exploited CVE-2025-3928 as a zero-day to breach its Microsoft Azure environment. No evidence of customer data compromise was found.
Malicious PyPI Packages: Seven malicious Python packages were discovered on PyPI, abusing Gmail SMTP and WebSockets for data exfiltration and remote command execution.
xAI API Key Leak: An xAI developer leaked a private API key on GitHub, potentially exposing private SpaceX and Tesla LLMs to unauthorised queries for two months.

Newly Discovered Vulnerabilities

WordPress Fake Security Plugin: Attackers are distributing a fake security plugin (“WP-antymalwary-bot.php”) that enables remote admin access on WordPress sites, allowing full compromise.
Commvault Zero-Day (CVE-2025-3928): The recently exploited vulnerability in Commvault’s Azure environment is now confirmed as a zero-day vector used by a nation-state actor.

Notable Threat Actor Activity

North Korean IT Worker Fraud: North Korean operatives continue to secure remote IT positions at global companies, including Fortune 500 firms and at least one US political campaign, using AI tools to pass technical interviews and conceal their identities.
Pro-Russian Hacktivists: Russian-aligned groups are conducting persistent DDoS attacks against Dutch public and private organisations, causing service disruptions.
Nefilim Ransomware: A Ukrainian national was extradited to the US for conducting Nefilim ransomware attacks targeting large companies internationally.
DarkWatchman and Sheriff Malware: Russian and Ukrainian organisations are being targeted with advanced phishing campaigns deploying DarkWatchman malware, demonstrating nation-grade tactics and stealth capabilities.
Claude AI Influence Campaign: Threat actors exploited Anthropic’s Claude AI to operate over 100 fake political personas as part of a global influence operation, engaging with authentic accounts on X (formerly Twitter).

Trends, Tools, and Tactics

Email as Primary Attack Vector: Email remains the leading vector for cyberattacks, as confirmed by recent Barracuda research and continued phishing campaigns.
Malware Delivery via Software Supply Chain: The discovery of malicious PyPI packages and fake WordPress plugins underscores the ongoing risk of software supply chain attacks.
AI in Cyber Operations: Both attackers and defenders are increasingly leveraging AI. Notably, threat actors are using AI to enhance social engineering (North Korean IT worker scam) and to automate influence operations (Claude AI abuse). Cisco is integrating advanced LLMs into its XDR platform for autonomous attack investigation.
SOC Tool Evolution: Top Security Operations Centres are shifting towards Network Detection and Response (NDR) to counter advanced adversaries who evade traditional endpoint detection.
Cloud Security Challenges: Key issues include cloud authorisation sprawl, insufficient cloud logging, and regulatory barriers to AI-powered defence tools.
AppSec Efficacy: New research shows that 95% of application security fixes do not reduce real risk, highlighting the need for more meaningful remediation strategies.

Regulatory and Policy Developments

US Defense Contractor Settlement: Defense contractors agreed to pay $8.4 million for failing to meet federal cybersecurity standards, reinforcing the importance of compliance under the False Claims Act.
Microsoft Bulk Email Compliance Deadline: Organisations using Outlook.com must meet new bulk email compliance requirements by 5 May 2025.
Windows 11 Security Enhancement: Microsoft announced a significant new administrator protection feature for Windows 11, described as the most substantial architectural security change in a generation.
Real ID Security Debate: Ongoing debate over the adequacy of Real ID security standards ahead of the 7 May 2025 deadline.

Other Noteworthy Observations

Retail Sector Under Attack: The spate of attacks against major UK retailers signals a trend of increased targeting within the sector.
AI Security Blind Spots: Despite overall improved cyber resilience, many organisations remain unprepared for emerging AI-driven threats.
Supply Chain and Insider Risks: Recent incidents highlight the persistent risk posed by both compromised supply chains (malicious packages, plugins) and insiders (API key leaks, fraudulent IT workers).

Cybersecurity Brief – 2025-04-29

Tue, 29 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Ransomware Attack
- Marks & Spencer experienced significant operational disruption, including outages and warehouse worker furloughs, due to a ransomware attack attributed to the “Scattered Spider” group.
Hitachi Vantara Ransomware Incident
- Hitachi Vantara took servers offline to contain an Akira ransomware attack, impacting business operations.
VeriSource Data Breach
- Employee benefits firm VeriSource confirmed that a February breach exposed personal information of 4 million individuals.
Urban One Data Breach
- Urban One, a major media company, disclosed a data breach following claims by a ransomware group.
World Uyghur Congress Targeted by Malware
- Senior members of the World Uyghur Congress were targeted in a sophisticated malware campaign via a trojanized UyghurEdit++ tool, indicating ongoing cyber-espionage efforts against exiled Uyghur groups.

Newly Discovered and Actively Exploited Vulnerabilities

SAP NetWeaver Visual Composer (CVE-2025-31324)
- Over 1,200 internet-facing SAP NetWeaver servers remain vulnerable to an actively exploited unauthenticated file upload flaw, allowing server hijacking. Attacks began before SAP released a patch.
Craft CMS Zero-Day Flaws
- Two newly disclosed critical vulnerabilities in Craft CMS are being exploited in the wild, with hundreds of servers likely compromised.
Broadcom Brocade Fabric OS and Commvault Web Server
- CISA added high-severity vulnerabilities in Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) database, indicating active exploitation.
Pymatgen 2024.1 Remote Code Execution
- A high-risk remote code execution vulnerability has been disclosed in Pymatgen 2024.1.
WooCommerce Phishing Campaign
- Attackers are distributing fake security patches to WooCommerce users, installing backdoors under the guise of critical updates.

Notable Threat Actor Activity

Earth Kurma APT
- Newly identified APT group “Earth Kurma” has targeted government and telecom sectors in Southeast Asia since June 2023, using rootkits and cloud-based data theft tools.
Scattered Spider
- Linked to the ransomware attack on Marks & Spencer, demonstrating continued targeting of UK-based large enterprises.
AI-Powered Phishing and Commodity Tools
- Increased use of AI-powered phishing kits and automated attack tools is lowering the barrier to entry for less skilled threat actors.

Trends, Tools, and Tactics

AI and Automation in Threat Landscape
- Attackers are leveraging AI, automation, and dark web resources to accelerate attack sophistication and frequency.
Record DDoS Attack Volumes
- Cloudflare reported a 358% year-over-year increase in DDoS attacks, highlighting a surge in volumetric and application-layer attacks.
Supply Chain and Update Risks
- Kali Linux users were warned of update failures due to a lost repository signing key, underscoring the importance of secure software supply chains.
Surveillance Risks in Connected Vehicles
- Law enforcement agencies are increasingly exploiting data from internet-connected vehicle features for surveillance purposes.

Regulatory and Policy Developments

CISA KEV Updates
- The U.S. CISA’s addition of new vulnerabilities to its KEV database may prompt UK organisations to review their own exposure and patch management processes.
US DoJ Data Security Program
- New compliance rules from the US Department of Justice will require organisations to reassess data sharing practices, with potential implications for multinational firms operating in or with the US.
Windscribe Legal Precedent
- Windscribe VPN was acquitted on charges regarding user data collection, reinforcing the legal standing of privacy-first service providers.

Other Notable Developments

Operational Disruptions
- Ukrainian state and banking services were temporarily disrupted due to a data centre power outage, affecting government and corporate customers.
Security Tooling
- Malwarebytes highlighted as a tool for combating online scams, reflecting ongoing emphasis on endpoint protection and anti-fraud solutions.

Summary of Key Risks

Ransomware remains a significant threat to large enterprises, with notable UK impact.
Actively exploited vulnerabilities in widely used enterprise software (SAP, Craft CMS, Broadcom, Commvault) require urgent attention.
AI-driven attack automation and phishing are reshaping the threat landscape, enabling more actors to launch sophisticated campaigns.
Regulatory changes and legal rulings are influencing data security and privacy practices globally.

Cybersecurity Brief – 2025-04-28

Mon, 28 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

M&S Cyberattack: Marks & Spencer (M&S), a major UK retailer, experienced a cyberattack that disrupted warehouse operations, resulting in approximately 20% of logistics workers being told not to report to work. The incident highlights ongoing threats to supply chain and logistics infrastructure.
Ukrainian Service Outage: A Ukrainian cloud provider restored state and banking services following a data centre power outage that impacted government agencies and major companies.
WooCommerce Phishing Campaign: A large-scale phishing campaign is targeting WooCommerce users with fake security alerts, tricking them into installing backdoors under the guise of a “critical patch.”
Craft CMS Zero-Day Exploits: Attackers are actively exploiting two newly disclosed critical vulnerabilities in Craft CMS, compromising hundreds of servers to gain unauthorized access.
SAP NetWeaver Exploitation: Over 1,200 internet-facing SAP NetWeaver servers remain vulnerable to a maximum severity, unauthenticated file upload flaw that is being actively exploited to hijack servers.

Notable Threat Actor Activity

Earth Kurma APT Campaign: A newly identified APT group, Earth Kurma, has been conducting sophisticated attacks against government and telecommunications sectors in Southeast Asia since June 2023. Tactics include rootkit deployment and cloud-based data theft tools.
Uyghur Cyber-Espionage: Researchers identified a highly targeted spearphishing campaign deploying custom malware against senior members of the exiled World Uyghur Congress, indicative of ongoing cyber-espionage activities against dissident groups.
Iran Infrastructure Attack Claims: Iranian officials reported repelling “widespread and complex” cyberattacks targeting national infrastructure, though details remain unspecified.

Newly Discovered Vulnerabilities

Craft CMS: Two critical, newly disclosed vulnerabilities are being exploited in the wild in Craft CMS installations, enabling attackers to breach servers.
SAP NetWeaver: An unauthenticated file upload vulnerability (maximum severity) is under active exploitation, affecting over 1,200 exposed SAP NetWeaver instances.
Vulnerability Chaining: Analysis of five real-world vulnerabilities demonstrates that even lower-risk flaws can be chained or escalated by advanced threat actors to achieve significant breaches.

Trends, Tools, and Tactics

AI-Powered Phishing & Automation: Attackers are increasingly leveraging AI-driven phishing kits and automation, lowering the technical barrier to launching sophisticated attacks and exploiting commodity tools and credentials available on the dark web.
DDoS Attack Surge: Cloudflare reported a record number of DDoS attacks in 2024, with a 358% year-over-year increase, reflecting a significant escalation in volumetric and application-layer attack activity.
Forensic Tooling: Release of DataSurgeon, an open-source Linux tool for fast data extraction and transformation, enhances forensic investigation capabilities.
SRUM-DUMP v3: Updated forensic tools like SRUM-DUMP v3 are being used to uncover malware activity through advanced system resource usage monitoring.
Security Tooling: Ongoing development of anti-scam and anti-phishing features in security products such as Malwarebytes to counter evolving online fraud methods.

Regulatory and Policy Developments

US DoJ Data Security Program: The US Department of Justice announced new compliance rules for its Data Security Program, requiring organisations to reassess data sharing practices and business relationships.
Connected Vehicle Surveillance Risks: Reports indicate increased law enforcement interest in exploiting data generated by internet-connected vehicle features, raising privacy and surveillance concerns.

Operational and Platform Updates

Kali Linux Repository Signing Key: Offensive Security warned Kali Linux users to manually update their repository signing key to prevent update failures, following the loss of the previous key.
Microsoft Outlook & SharePoint Online: Microsoft is addressing ongoing issues with Outlook on the web and SharePoint Online, where users have experienced search delays and failures.
Coinbase 2FA Log Bug: Coinbase resolved an error in its 2FA activity logs that caused users to mistakenly believe their accounts had been compromised.

Cybersecurity Brief – 2025-04-26

Sat, 26 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack
- Marks & Spencer, a major UK retailer, has suspended online orders following a cyberattack. Recovery efforts are ongoing, with continued disruption to online shopping services.
MTN Group Data Breach
- African telecom giant MTN disclosed a cybersecurity incident resulting in unauthorised access to personal information of subscribers in certain countries. The breach is attributed to an unknown third party.
Baltimore City Public Schools Data Breach
- Over 31,000 individuals have been notified of a data breach after attackers compromised the network in February, exposing employee and student information.
Craft CMS Zero-Day Exploitation
- Ongoing zero-day attacks are targeting Craft CMS servers via a chained remote code execution exploit, resulting in data theft. CERT Orange Cyberdefense reports active exploitation.
Physical Cryptocurrency Theft
- A recent case highlights the physical risks associated with cryptocurrency, involving a $250 million theft that escalated to kidnapping.

Cybersecurity Brief – 2025-04-24

Thu, 24 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Blue Shield of California Data Breach: The health data of 4.7 million members was exposed to Google’s analytics and ad platforms due to a misconfiguration, affecting sensitive personal and medical information. Additional healthcare sector breaches have been reported to regulators, indicating a concerning trend.
National Labor Relations Board (NLRB) Data Exfiltration: A whistleblower alleges that significant volumes of sensitive agency data were siphoned by individuals associated with the Department of Government Efficiency (DOGE).
Marks & Spencer Cyber Incident: Marks & Spencer is investigating a cyber incident that has impacted some customer operations.
FBI Cybercrime Losses: The FBI reported $16.6 billion in cybercrime-related losses in 2024, a 33% increase year-over-year, marking the highest annual losses recorded.

Newly Discovered Vulnerabilities

ASUS Server Vulnerability (CVE-2024-54085): ASUS released patches for a critical AMI bug that could allow attackers to hijack and potentially brick servers.
Kubernetes Permissions Risk: Research highlights that Kubernetes pods are often provisioned with excessive permissions, increasing risk of lateral movement and privilege escalation.

Notable Threat Actor Activity

Lazarus Group (North Korea): Operation SyncHole is a new campaign using watering hole attacks to exploit vulnerabilities in South Korean software, targeting specific user groups.
DPRK Crypto Theft: North Korean threat actors stole $137 million from TRON blockchain users in a single-day phishing attack, reflecting ongoing targeting of Web3 and cryptocurrency sectors.
North Korean Deepfakes in Recruitment: North Korean operatives are using deepfake technology to impersonate IT job candidates and infiltrate Western organisations.
Iran-Linked UNC2428: Deployed MURKYTOUR backdoor via fake job-themed social engineering campaigns targeting Israeli entities.
Russian State-Linked Activity:
- Microsoft OAuth Abuse: Russian actors are exploiting Microsoft OAuth to target Ukraine allies and human rights organisations, aiming for unauthorised Microsoft 365 access via messaging apps like Signal and WhatsApp.
- Android Malware Targeting Russian Military: New spyware-laden versions of the Alpine Quest mapping app are being distributed to Russian military personnel, likely for intelligence gathering.
Asian Organised Crime: ‘Industrial-scale’ scam centres in Asia are expanding globally, blending cybercrime with financial fraud and traditional organised crime tactics.
Japan Credential Theft: Attackers are using phishing sites mimicking securities firms to steal credentials and conduct unauthorised stock trades.

Trends, Tools, and Tactics

Ransomware Evolution:
- Ransomware remains the dominant threat for SMBs, responsible for over 90% of incident response cases for medium businesses and 70% for small businesses in 2024.
- Groups such as DragonForce and Anubis are innovating with new affiliate business models and ransomware-as-a-service offerings to scale operations and profits.
Phishing Tactics:
- Phishing detection is increasingly ineffective, with attacks often evading traditional filters, proxies, and even MFA, making each incident akin to a zero-day.
- Attackers are shifting towards identity-based phishing rather than exploiting software vulnerabilities.
- Browser-based, real-time detection is emerging as a more effective countermeasure.
- Employee awareness training, particularly phishing simulations, is widely recognised (90% approval in surveys) as improving security posture.
Privacy and Security Enhancements:
- WhatsApp introduced Advanced Chat Privacy, preventing chat exports and auto-downloads to better protect sensitive conversations.
AI Security: Research proposes using hypervisors to isolate and regulate the behaviour of potentially malicious AI systems in critical sectors.

Regulatory and Policy Developments

FTC on AI Regulation: The US Federal Trade Commission signals a cautious approach, aiming to avoid excessive regulation that could hinder AI innovation.
CISA Energy Sector Collaboration: CISA, DHS S&T, INL, and LSU are working with the energy industry to bolster incident response and operational technology (OT) cybersecurity.
Cloudflare Internet Shutdown Trends: Government-imposed internet shutdowns dropped to zero in Q1 2025, indicating a shift in government tactics for information control.

Industry Developments

Microsoft Security Culture: Microsoft reports ongoing efforts to prioritise and embed security within its corporate culture, including linking security to employee performance reviews.

Cybersecurity Brief – 2025-04-23

Wed, 23 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Cyberattack: The UK retailer confirmed a cyberattack affecting operations, including delayed Click and Collect orders. The company implemented temporary operational changes and is responding to the incident.
DeepSeek Breach: An AI-focused organisation suffered a significant breach, with sensitive data appearing on dark web forums, highlighting ongoing risks to AI platforms.
SK Telecom Data Exposure: South Korea’s largest mobile operator disclosed a malware attack that exposed sensitive USIM-related customer data.
Healthcare Ransomware Attacks: Three additional healthcare organisations-DaVita, Bell Ambulance, and Alabama Ophthalmology Associates-were impacted by ransomware, continuing the trend of targeting healthcare.
Baltimore Public Schools Data Breach: A February ransomware attack resulted in the theft of personal information belonging to thousands of students, teachers, and administrators.
City of Abilene Cyberattack: The Texas municipality went offline following a cyberattack, with incident response and investigation ongoing.

Newly Discovered Vulnerabilities

GCP Cloud Composer Privilege Escalation: A now-patched vulnerability in Google Cloud Platform’s Cloud Composer could have allowed attackers to escalate privileges via malicious PyPI packages.
Active! Mail RCE Zero-Day: A remote code execution vulnerability in Active! Mail is being actively exploited in attacks against large Japanese organisations.
Ripple’s xrpl.js Library Compromised: The widely used Ripple cryptocurrency JavaScript library “xrpl.js” was compromised, enabling theft of XRP wallet seeds and private keys.
Cookie-Bite Attack PoC: A proof-of-concept demonstrates how a malicious Chrome extension can steal Azure Entra ID session tokens, bypassing MFA and maintaining access to Microsoft 365 services.
Docker Malware Targeting Teneo Web3 Node: A new malware campaign exploits Docker environments using a previously undocumented technique to mine cryptocurrency by faking heartbeat signals.

Notable Threat Actor Activity

Russian Organisations Targeted by Sophisticated Backdoor: A new backdoor, disguised as secure networking software updates, is being used to target Russian entities.
China-Linked Billbug Group: The Billbug APT (aka Lotus Panda/Blossom, Bronze Elgin) breached multiple organisations in a Southeast Asian country, continuing its targeting of government and telecom sectors.
Russia-Linked Phishing on NGOs: Russian threat actors are conducting phishing campaigns against NGOs connected to Ukraine, using video call lures to compromise Microsoft 365 accounts.
Russian Sabotage Against Dutch Critical Infrastructure: Dutch intelligence reported Kremlin-backed attempts to sabotage critical infrastructure, underlining ongoing state-sponsored cyber risk.
Elusive Comet Hacking Group: This group is exploiting Zoom’s remote control feature in social engineering attacks to steal cryptocurrency from users.

Trends, Tools, and Tactics

Increasing Abuse of AI in Cybercrime: Threat actors are leveraging AI tools to assist in social engineering, phishing, and scam campaigns, as highlighted in Microsoft’s latest Cyber Signals report.
Phishing via Google Sites and DKIM Replay: Sophisticated phishing attacks are abusing Google Sites and DKIM replay to send signed emails that redirect to credential harvesting pages.
Browser Security Concerns: The browser is increasingly the primary endpoint in cloud-native workplaces, yet remains largely unmonitored, presenting a growing attack surface.
Microsoft Secure Future Initiative: In response to the Storm-0558 breach, Microsoft has migrated MSA signing services to Azure confidential VMs and is purging millions of legacy cloud tenants, as part of broader security enhancements.
Android and Chrome Security Updates: Android will introduce auto-reboot after three days of inactivity, and Chrome is dropping third-party cookie prompts while adding IP protection in Incognito mode.
Sensitive Content Protection: Google Messages is rolling out a feature to warn users about potentially explicit images and allow easy blocking, improving user safety.

Regulatory and Policy Developments

Zambia’s New Cyber Laws: Recently signed cyber security and cyber crime acts in Zambia have raised concerns among international observers regarding increased surveillance and potential suppression of dissent.

Other Notable Observations

Edge Vulnerabilities and SMB Threats: Verizon’s report notes a surge in edge-related vulnerabilities, persistent ransomware threats, and ongoing challenges for small and medium businesses (SMBs).
Legal Debates on Device Search Protections: Ongoing discussions about the comparative legal protections of biometrics vs. passcodes for device searches, relevant for privacy and compliance considerations.