NIST on DanSec Daily

Cybersecurity Brief – 2026-10-29

Thu, 29 Oct 2026 00:00:00 +0000

Major Incidents or Breaches

Sony Network Communications, a subsidiary ISP, confirmed a data breach exposing approximately 2.5 to 2.6 million customer records, including personal information, 54,401 email account passwords, and 16 bank account records ^[22]^[29].
Over 41,000 US Department of Homeland Security (DHS) employee records, including undercover ICE agents, were leaked online by a hacktivist group, exposing names, offices, contact details, and assignments. The data was reportedly stolen from an Okta single sign-on system earlier in 2026 and published by DDoSecrets ^[28]^[43]^[66]^[72].
The Belgian Federal Public Service Finance temporarily suspended tax services following a cyberattack, which occurred just before a filing deadline ^[45].
Japan Airlines disclosed a breach affecting about 2,000 customers, with stolen passport numbers, frequent flyer numbers, email addresses, and phone numbers ^[48].
The University of New Mexico restored hospital systems after a cyberattack that forced ambulance diversions and class cancellations at its medical school ^[46].

Newly Discovered Vulnerabilities

A critical vulnerability in UEFI firmware, widely used in servers and data centers, allows attackers to execute code early in the boot process, impacting most servers globally ^[42].
Cisco released patches for a high-severity flaw in ASA and FTD VPN software that has been actively exploited to crash firewalls via remote, unauthenticated access. This marks the second exploited Cisco firewall VPN zero-day since August ^[6]^[19]^[31].
A flaw in Telegram for Android allowed attackers to execute code on a victim’s device when answering a voice call. Only an ordinary phone number was needed for exploitation ^[3].
Attackers attempted to exploit a critical GitLab vulnerability (CVE-2026-9783) on Alpine Linux’s GitLab server shortly after a patch was released ^[8].
Adobe, Veeam, and Juniper Networks issued patches for critical vulnerabilities that could lead to arbitrary code execution, authorization bypass, and privilege escalation ^[26].
Oracle E-Business Suite flaw CVE-2026-101767 is under active exploitation attempts, with decoys recording exploratory exploits ^[63]^[52].
Apple released a security update for older iPhones and iPads, backporting a fix for a CoreGraphics flaw reportedly exploited in targeted attacks ^[90].
Researchers demonstrated that logic bugs alone, without memory corruption, can be chained to escape the Microsoft Edge sandbox and execute code on Windows systems ^[14].
Researchers found vulnerabilities in the browsers built into several AI coding assistants (VS Code, Cursor, Copilot, Codex, Claude Desktop), allowing web pages to break out of the assistant’s browser sandbox ^[61].

Notable Threat Actor Activity

The China-linked APT group Volt Typhoon used a covert, ephemeral access network known as “Silent Train,” built from rapidly rotating chains of compromised devices, to conduct zero-day exploitation and strategic intrusions targeting hundreds of critical infrastructure networks ^[12]^[23]^[62]^[74]^[30].
Volt Typhoon also exploited a Cisco Catalyst SD-WAN flaw to deploy custom malware (KeyDrift) designed to steal encryption keys, with infrastructure overlapping the Silent Train network ^[9]^[30]^[87].
Chinese state-sponsored actors exploited a VMware ESX zero-day logging flaw (CVE-2026-41709) to reduce audit trail visibility, allowing operations by attackers with administrative privileges to go unlogged ^[10]^[33].
A suspected China-nexus threat actor leveraged PHP2Shell vulnerabilities to root 25 servers and breach a US government-affiliated network, including chaining with a high-severity Fragnesia Linux kernel privilege escalation bug ^[11]^[15]^[17].
The GOLD OGRE threat group used AI in the development, orchestration, and execution of Aur0ra ransomware operations ^[84].
A Ukrainian affiliate of Hive and Nefilim ransomware gangs was sentenced to 70 months in US prison for attacks targeting businesses and hospitals ^[34]^[53].
Attackers used fake ChatGPT and Claude projects to distribute Yoba malware, hiding malicious code behind signed binaries ^[60].
Malicious Firefox extensions impersonated popular crypto wallets to steal recovery phrases and private keys ^[89].
A threat actor impersonated AI bots from OpenAI, Anthropic, and Meta to scan for exposed credentials ^[39].
Attackers abused legitimate Mobile Device Management (MDM) platforms to deploy rogue remote management tools, turning device management into a pathway for remote access and persistence ^[93].
GitHub issues were weaponized in a supply chain attack campaign targeting 61 public repositories in less than an hour, exploiting vulnerable workflows ^[50].

Trends, Tools, or Tactics of Interest

AI is increasingly used both offensively and defensively in cybersecurity. Google introduced Gemini 4 Carbon, a frontier AI model outperforming predecessors in vulnerability discovery, exploitation, and patching ^[1]^[64].
Cisco open sourced Project Quarry, a rules language to detect AI agent attacks that emerge across sequences of benign actions ^[25].
Cisco Talos observed a new AI-enabled command-and-control framework in the wild, dubbed NIK C2 ^[86].
AI agents are now capable of controlling authenticated browsers, interacting with corporate applications, and accessing sensitive data while mimicking legitimate users ^[16].
The supply chain attack campaign “GhostAction” shifted toward targeting developer endpoints and cloud access, indicating evolving tactics among cybercrime groups ^[37].
Online scam volumes have doubled and now outpace phishing, with over six million scam detections in Q2 2026 ^[55].
Phishing remains the leading initial access technique, while ransomware and pre-ransomware cases have increased, with finance and public administration being the top-targeted industries ^[85].
Attackers are increasingly hiding malware behind signed binaries of AI tools to evade detection ^[60].
Credential exposure continues to be a significant risk, with 26,400 valid cloud and AI credentials found in public Gitee repositories ^[5].
Attackers are turning GitHub issues into attack vectors for supply chain campaigns, automating exploitation of vulnerable workflows ^[50].
The use of AI-enabled tools such as Gemini 4 Carbon and NIK C2, as well as AI-assisted attack orchestration by groups like GOLD OGRE, demonstrates the growing sophistication of threat actors ^[1]^[64]^[84]^[86].

Regulatory or Policy Developments Affecting the Security Industry

The UK released a shortlist of age verification methods for its upcoming under-16 social media ban, noting that some adults will also require verification ^[49].
The UK Information Commissioner’s Office (ICO) reprimanded Staffordshire Police following a serious breach of personal information related to domestic abuse cases ^[56].
CREST published a framework advocating a whole-ecosystem approach to strengthening cyber resilience across the financial services sector ^[54].
The US National Institute of Standards and Technology (NIST) published guidance for federal agencies on prioritizing post-quantum cryptography adoption to meet the 2031 transition deadline ^[57].
Microsoft again urged Entra ID administrators to migrate users to phishing-resistant authentication methods ahead of the planned retirement of SMS and voice authentication in February 2027 ^[24].
A federal appellate court ruled that West Virginia’s law barring disclosure of public officials’ personal data is unconstitutional ^[47].
US law enforcement seized the primary domain of Virtualine, a major bulletproof hosting provider used to facilitate cybercrime and ransomware operations ^[20]^[71].

Sources

Sony ISP subsidiary data breach exposes 2.5 million customer records - bleepingcomputer.com
Hackers Steal 2.6 Million Records From Sony’s Japanese ISP So-net - securityweek.com
Over 41,000 DHS Employee Records Leaked Online - securityweek.com
Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents - wired.com
Hacktivists leak 41,000 DHS staff records, revealing undercover ICE agents - helpnetsecurity.com
Leak site publishes data on more than 41,000 DHS employees obtained by hacktivists - cyberscoop.com
Cyberattack disrupts Belgian tax services before filing deadline - therecord.media
Japan Airlines warns of data breach as country grapples with multiple cyber incidents - therecord.media
University of New Mexico restores hospital systems, urges no contact with hackers - therecord.media
Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw - wired.com
Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls - thehackernews.com
New Cisco firewall zero-day exploited to crash SSL VPN devices - bleepingcomputer.com
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August - securityweek.com
Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls - thehackernews.com
Attacker Tried to Exploit Alpine Linux’s GitLab via CVSS 10.0 Flaw Its Ruby Left Open - thehackernews.com
Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities - securityweek.com
Exploitation attempts against recently patched Oracle EBS flaw have begun (CVE-2026-101767) - helpnetsecurity.com
Oracle celebrates end of Cybersecurity Awareness Month with quadruple trouble - theregister.com
Have an older iPhone or iPad? Apple has a security update for you - malwarebytes.com
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win - thehackernews.com
Researchers broke the browsers built into VS Code, Cursor, Copilot, Codex and Claude Desktop - helpnetsecurity.com
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns - thehackernews.com
Volt Typhoon hides zero-day attacks using 'Silent Train' framework - bleepingcomputer.com
Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network - helpnetsecurity.com
Researchers uncover Volt Typhoon’s covert, ephemeral network - cyberscoop.com
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network - securityweek.com
Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys - thehackernews.com
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN - blog.talosintelligence.com
China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility - thehackernews.com
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day - securityweek.com
Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces - thehackernews.com
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network - thehackernews.com
CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks - bleepingcomputer.com
AI used in Aur0ra ransomware testing and execution - sophos.com
Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison - securityweek.com
Serial ransomware crook gets 70 months behind bars for Nefilim, Hive roles - theregister.com
Attackers Hide Malware Behind Signed ChatGPT and Claude Binaries - infosecurity-magazine.com
Malicious Firefox extensions impersonate popular crypto wallets - malwarebytes.com
Attacker Relentlessly Scans for Credentials by Impersonating AI Bots - darkreading.com
Managed for Malice: How Attackers Turn MDM into Remote Access - huntress.com
Attackers turn GitHub issues into supply chain campaign against 61 public repos in less than an hour - theregister.com
Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities - thehackernews.com
Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws - helpnetsecurity.com
Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps - securityweek.com
NIK C2: The new AI-enabled command-and-control framework - blog.talosintelligence.com
3 Ways AI Agents Already Operate in Your Browser - bleepingcomputer.com
GhostAction Hacking Wave Fizzles, But Attackers Lurk on in GitHub - darkreading.com
Online Scam Volumes Double to Overtake Phishing - infosecurity-magazine.com
IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases - blog.talosintelligence.com
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories - thehackernews.com
Shortlist of age checks for the UK's under-16 social media ban is out, 'some' adults will need verifying - theregister.com
ICO Reprimands Staffordshire Police After Domestic Abuse Breach - infosecurity-magazine.com
CREST Urges Whole-Ecosystem Approach to Financial Cyber Resilience - infosecurity-magazine.com
NIST Publishes Guidance to Meet Federal Post-Quantum Deadlines - infosecurity-magazine.com
Microsoft urges Entra ID admins to migrate users to passkeys - bleepingcomputer.com
Court strikes down West Virginia law barring disclosure of public officials’ personal data - therecord.media
Police seize Virtualine bulletproof service tied to ransowmare, cybercrime - bleepingcomputer.com
Officials seize domain of top bulletproof hosting provider Virtualine - cyberscoop.com

Cybersecurity Brief – 2026-04-18

Sat, 18 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Grinex, a Kyrgyzstan-based cryptocurrency exchange, suspended operations following a $13.7 million hack, which it attributes to Western intelligence agencies.
A recent hack targeted Rockstar Games, attributed to the ShinyHunters group.
A new incident involving the DraftKings breach: Kamerin Stokes was sentenced to prison for selling stolen credentials related to the attack, continuing his activities even after pleading guilty.

Newly Discovered Vulnerabilities

CVE-2024-3721: Threat actors are actively exploiting this vulnerability in TBK DVRs and end-of-life TP-Link Wi-Fi routers to deploy Mirai variant ‘Nexcorium’ for DDoS botnets.
Three zero-day vulnerabilities in Microsoft Defender are being actively exploited to gain elevated privileges on compromised systems. Two of these vulnerabilities remain unpatched.
Apache ActiveMQ: A high-severity remote code execution vulnerability (CVE-2026-34197) is being actively exploited in the wild. The flaw, present for 13 years, was patched earlier this month.
ShowDoc: A vulnerability in this platform is being exploited in the wild.
Google Chrome: A security flaw in Chrome was reportedly awarded a $90,000 bug bounty.

Notable Threat Actor Activity

The Payouts King ransomware group is using QEMU virtual machines as reverse SSH backdoors to bypass endpoint security and maintain persistence.
Tycoon phishing group has shifted to device code phishing, leveraging legitimate new-device login flows to bypass two-factor authentication.
North Korean IT worker scheme: Two facilitators, Kejia Wang and Zhenxing Wang, were jailed in the US for helping North Korean workers obtain employment at over 100 US companies using stolen identities.
ZionSiphon malware is targeting industrial control systems in Israeli water treatment and desalination plants.
Underground cybercrime guides are circulating, teaching threat actors how to vet and select stolen credit card shops based on data quality, reputation, and survivability.
ShinyHunters group involved in the Rockstar Games breach.

Trends, Tools, or Tactics of Interest

Fake data breach alerts are being used as phishing lures to trick recipients into divulging sensitive information.
Old vulnerabilities are being increasingly targeted and amplified by AI-driven attack techniques.
Classic Nigerian advance-fee scams remain prevalent, with new twists keeping them effective.
Identity Management Day highlights the growing importance of identity management at the edge as a core component of digital trust.
CoChat launched an AI collaboration platform designed to combat “shadow AI” by improving visibility and governance over enterprise AI use.
Google blocked or removed 8.3 billion policy-violating ads in 2025 and announced new Play policy updates focused on privacy and fraud prevention.
Microsoft reported that some Windows domain controllers are entering reboot loops after the April 2026 security updates.

Regulatory or Policy Developments Affecting the Security Industry

NIST has reduced its enrichment of CVE data, impacting vulnerability management efforts; industry and ad-hoc coalitions are forming to address the gap.
The US Coast Guard released new cybersecurity rules under the Maritime Transportation Security Act (MTSA), requiring OT security plans, third-party audits, and hybrid OT-security roles.
The US House blocked an extension of Section 702, a surveillance program used by the FBI for warrantless searches.
The White House is engaging with AI labs, including Anthropic, to discuss the security of advanced AI technologies.
The Satellite Cybersecurity Act and increased EPA cybersecurity budget to $19 million were noted as recent legislative developments.
Lawmakers in the US held closed-door discussions about the risks and rapid advancement of AI technologies.

Cybersecurity Brief – 2025-10-11

Sat, 11 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has seized all domains associated with BreachForums, operated by the ShinyHunters group, which was used as a portal for leaking corporate data obtained through ransomware and extortion attacks, including recent Salesforce-related incidents. Despite the takedown, ShinyHunters continues to issue extortion threats against Salesforce victims.
Two AI companion applications exposed millions of private chat records from over 400,000 users due to inadequate security controls.
A critical zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox file sharing products is being actively exploited in the wild, allowing unauthenticated local attackers to access system files.
Sophisticated malware has been deployed in Oracle E-Business Suite (EBS) zero-day attacks, with exploitation believed to have started as early as July 10 and affecting dozens of organizations.
A large-scale DDoS attack was launched by the Aisuru botnet, leveraging compromised IoT devices hosted on major US ISPs.
Microsoft has observed a threat actor, Storm-2657, hijacking HR SaaS accounts to divert employee salary payments to attacker-controlled accounts; US universities have been specifically targeted in these payroll diversion attacks.

Newly Discovered Vulnerabilities

Fortra disclosed details of active exploitation of CVE-2025-10035, a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
13 unpatched vulnerabilities in Ivanti Endpoint Manager have been publicly released by the Zero Day Initiative (ZDI), permitting remote code execution and privilege escalation.
Juniper Networks released patches for over 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
175 malicious npm packages, collectively downloaded over 26,000 times, have been used in a credential phishing campaign.
Security researchers have detailed an active Stealit malware campaign abusing the Node.js Single Executable Application (SEA) feature, distributed via game and VPN installers.

Notable Threat Actor Activity

North Korean threat actors have expanded their fraudulent remote employment schemes to target nearly every industry hiring remote workers, including architectural design roles, using fake identities and documentation.
Chinese APT group Storm-2603 is abusing the Velociraptor digital forensics and incident response (DFIR) tool to gain persistent access to victim networks and facilitate ransomware deployment.
A coordinated campaign has been identified targeting Cisco, Fortinet, and Palo Alto Networks devices, with attacks originating from shared infrastructure.
The RondoDox botnet employs a “shotgun” approach, using more than 50 exploits against unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices globally.

Trends, Tools, or Tactics of Interest

AI-generated deepfakes are proliferating, with OpenAI releasing an updated AI video and audio generation system, raising concerns about the acceleration and accessibility of deepfake creation.
The security industry is experiencing inadequate investment in deepfake detection, despite high organizational awareness and frequent encounters with AI-augmented threats.
Security Operations Centres (SOCs) are increasingly integrating AI-powered agents, with projections indicating significant transformation in SOC workflows by 2026.
Microsoft has added agentic AI capabilities to its Sentinel platform, previewing new security graph and MCP server features.
Attackers are leveraging malicious npm packages and abusing legitimate software features (e.g., Node.js SEA) to distribute malware and harvest credentials.
1Password addressed a critical security gap in its AI browser agent, which posed risks of credential leakage.
Timely patch management is highlighted as a key defense against escalating ransomware attacks on manufacturing and industrial control system (ICS) environments.

Regulatory or Policy Developments Affecting the Security Industry

Apple has expanded its bug bounty program, doubling the maximum payout to $2 million for zero-click remote code execution vulnerabilities, with potential bonuses raising the maximum to $5 million. The program now includes new research categories and a more transparent reward structure.
Microsoft reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 30 days, after which security updates will cease.
Google Chrome will automatically revoke notification permissions for inactive websites to reduce user alert fatigue.
Apple voiced concerns over proposed age-verification laws, warning that increased data collection for compliance could heighten user privacy risks.
NIST is revising password guidance, indicating that excessively complex password requirements may no longer be necessary.

Cybersecurity Brief – 2025-10-02

Thu, 02 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Motility Software Solutions suffered a ransomware attack exposing sensitive data of 766,000 dealership software clients.
WestJet confirmed that a cyberattack compromised personal information, including passport and ID documents, of 1.2 million customers.
Allianz Life announced that a July data breach impacted nearly 1.5 million individuals.
Adobe disclosed an ingestion bug in its Analytics platform that resulted in customer tracking data being exposed to other tenants for approximately one day.
Executives at multiple companies received extortion emails from the Clop ransomware group, claiming theft of sensitive data from Oracle E-Business Suite systems.
Unknown threat actors have exploited Milesight industrial cellular routers since at least February 2022 to send smishing SMS messages targeting European users.

Newly Discovered Vulnerabilities

A critical vulnerability in Red Hat OpenShift AI could allow attackers to escalate privileges and gain full control over hybrid cloud infrastructure under specific conditions.
A high-severity flaw in One Identity OneLogin IAM allowed attackers to use API keys to steal OpenID Connect (OIDC) secrets and impersonate applications.
OpenSSL patched three vulnerabilities that could allow private key recovery, code execution, and denial-of-service attacks.
Google’s Gemini AI suite contained vulnerabilities permitting attackers to embed malicious instructions in user web activity.
A bug in classic Outlook causes the client to crash on launch, with resolution only available via Microsoft Exchange Online support.
A newly demonstrated attack, dubbed “WireTap” or “Battering RAM,” enables attackers with physical access to extract Intel SGX ECDSA keys and break confidential computing protections on Intel and AMD processors via DDR4 memory-bus interposers.
Broadcom failed to disclose zero-day exploitation of a VMware vulnerability affecting Aria Operations and VMware Tools, which could allow privilege escalation on virtual machines.

Notable Threat Actor Activity

The Clop ransomware group is conducting a new extortion campaign targeting Oracle E-Business Suite users.
A previously undocumented Android banking trojan, “Klopatra,” has infected over 3,000 devices, mainly in Spain and Italy, using hidden VNC for remote control.
Chinese APT “Phantom Taurus” is targeting organisations with the Net-Star malware, focusing on espionage and using infrastructure linked to other Chinese APTs but employing distinct TTPs.
Threat group UNC6040 (ShinyHunters) has been observed using advanced social engineering tactics to breach Salesforce environments.
The Rhadamanthys malware, a complex multi-modular stealer sold on underground markets since 2022, has received notable updates.

Trends, Tools, or Tactics of Interest

Bitdefender’s 2025 Cybersecurity Assessment Report highlights increased pressure to conceal breaches, expanding attack surfaces, and rising misperceptions around AI security.
Attackers are leveraging industrial IoT devices (Milesight routers) to conduct large-scale smishing campaigns.
The Klopatra Android malware uses hidden VNC for hands-on device control, indicating a trend towards more interactive mobile banking attacks.
Research demonstrates that confidential computing protections (Intel SGX, AMD SEV) can be bypassed with low-cost hardware if physical access is obtained.
“Burp AI” is being adopted by security professionals for automated vulnerability scanning in bug bounty workflows.
Google Drive for desktop is rolling out AI-powered ransomware detection that pauses file syncing upon detecting an attack.
AmCache forensic artifact analysis is highlighted as valuable for incident investigations, with new command-line tools available for data extraction.
Undead (unsupported) operating systems, especially with Windows 10 reaching end-of-life, are set to significantly increase the vulnerable attack surface in enterprise environments.

Regulatory or Policy Developments Affecting the Security Industry

KnowBe4 is pursuing ISO 42001 certification for AI governance as it integrates more AI into its human risk management platform.
F-Droid project warns it may cease operations due to Google’s new developer identity verification requirements.
NIST published Special Publication 1334, offering guidance on mitigating USB-borne threats in industrial control system (ICS) and OT environments.
CISA reiterates that microsegmentation is foundational, not optional, for zero trust architectures, and highlights modern, automated approaches to implementation.
Microsoft will begin automatic installation of Microsoft 365 companion apps on Windows 11 devices with existing Microsoft 365 desktop clients later this month.

Cybersecurity Brief – 2025-09-03

Wed, 03 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Salesloft Drift Supply Chain Attack: Multiple organizations, including Cloudflare, Palo Alto Networks, and Zscaler, were impacted by a supply chain attack stemming from the compromise of OAuth tokens via Salesloft Drift, a marketing SaaS application. Attackers leveraged the compromised tokens to access Salesforce instances, exposing customer data and support cases.
Jaguar Land Rover Cyberattack: Jaguar Land Rover reported a cyberattack that severely disrupted production and required the shutdown of certain systems.
Evertec/Sinqia Attempted Bank Heist: Hackers breached Sinqia S.A., the Brazilian subsidiary of fintech firm Evertec, and attempted to steal $130 million via unauthorized access to the central bank’s Pix real-time payment system.
Pennsylvania Attorney General’s Office Ransomware Attack: The Pennsylvania AG’s office confirmed a ransomware attack responsible for a two-week service outage.

Newly Discovered Vulnerabilities

WhatsApp Zero-Day (CVE-2025-55177): A zero-day vulnerability in WhatsApp was exploited in attacks targeting Apple users, including iOS and macOS, reportedly as part of suspected spyware operations. CISA added this flaw to its Known Exploited Vulnerabilities catalog.
TP-Link TL-WA855RE Flaw: CISA added a high-severity vulnerability affecting TP-Link TL-WA855RE Wi-Fi Range Extender devices to its KEV catalog amid reports of active exploitation.
Sangoma FreePBX Zero-Day (CVE-2025-57819): Sangoma patched a critical zero-day vulnerability (CVSS 10.0) in FreePBX servers involving insufficient sanitization of user-supplied data, which had been exploited in the wild.
WatchDog Anti-malware Driver Vulnerability: The Silver Fox threat actor exploited a previously unknown vulnerability in a Microsoft-signed WatchDog Anti-malware driver as part of a Bring Your Own Vulnerable Driver (BYOVD) attack to deploy ValleyRAT malware.
Azure Active Directory Credential Exposure: Researchers highlighted risks from leaked JSON configuration files containing Azure Active Directory credentials, potentially allowing attackers to authenticate via Microsoft OAuth 2.0 endpoints and infiltrate Azure environments.

Notable Threat Actor Activity

Lazarus Group: North Korea-linked Lazarus Group expanded its malware arsenal, distributing cross-platform malware strains PondRAT, ThemeForestRAT, and RemotePE via social engineering campaigns.
Silver Fox: This threat actor abused a vulnerable WatchDog driver to deploy ValleyRAT malware, leveraging BYOVD techniques.
Midnight Blizzard/APT29: Russian state-linked group APT29 conducted a credential theft campaign by redirecting victims to fake Cloudflare verification pages and exploiting Microsoft’s device code authentication flow. Amazon disrupted this campaign.
Ukrainian Network FDN3: Researchers observed FDN3 launching massive brute-force and password spraying attacks against SSL VPN and RDP devices between June and July 2025.
MystRodX Backdoor: Researchers disclosed a new backdoor, MystRodX, capable of using DNS and ICMP triggers for stealthy command and control, with features for capturing sensitive data.

Trends, Tools, or Tactics of Interest

Large-Scale DDoS Attacks: Cloudflare mitigated the largest recorded volumetric DDoS attack, peaking at 11.5 Tbps, part of a broader wave of UDP flood attacks originating from IoT and cloud infrastructure.
Supply Chain Risk: The Salesloft Drift incident demonstrates ongoing risks associated with SaaS supply chain dependencies and OAuth token abuse.
WordPress Threat Landscape: Continued exploitation of vulnerable and malicious WordPress plugins enables attackers to compromise sites and leverage them for further cyber threats and scams.
Shadow AI Usage: MIT’s State of AI in Business report revealed that while 40% of organizations have enterprise LLM subscriptions, over 90% of employees are using AI tools outside sanctioned platforms, increasing shadow AI risks.
TagNabIt Tool: TagNabIt released as an offensive security tool enabling enumeration of AWS cloud resources via metadata tags, exposing potential attack surfaces.
Cookie & Session Hijacking Risks: Kaspersky highlighted risks associated with improper cookie management and session hijacking, underscoring the need for secure configuration.

Regulatory or Policy Developments Affecting the Security Industry

NIST Security Controls Update: NIST released Security and Privacy Control version 5.2.0, introducing enhancements to help organizations improve patch management practices.
CISA Leadership Change: CISA announced Nicholas Andersen as the new Executive Assistant Director for Cybersecurity.
UAE Cyber Education Initiative: The United Arab Emirates launched a cyber education initiative aimed at improving cybersecurity preparedness among students.
Varonis Acquisition: Varonis announced the acquisition of email security firm SlashNext for up to $150 million, expanding its security offerings.

Cybersecurity Brief – 2025-06-17

Tue, 17 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The Washington Post disclosed a cyberattack in which email accounts of several journalists, including those covering national security, economic policy, and China, were compromised. The attack is believed to have been conducted by a foreign government and involved breaches of Microsoft accounts.
Zoomcar Holdings reported a data breach impacting 8.4 million users, as disclosed in a filing with the U.S. Securities and Exchange Commission.
Law enforcement agencies from six countries seized the Archetyp Market darknet drug marketplace and arrested its administrator. Archetyp Market had been operating since May 2020.

Newly Discovered Vulnerabilities

A high-severity vulnerability in ASUS Armoury Crate software was disclosed, allowing local attackers to escalate privileges to SYSTEM level on Windows machines.
Microsoft acknowledged that June 2025 Windows Server security updates are causing DHCP service freezes on some systems.
Microsoft also published a workaround for a known issue causing classic Outlook to crash when opening or composing messages.

Notable Threat Actor Activity

Google and external threat intelligence researchers reported that the Scattered Spider threat group has shifted focus to targeting U.S. insurance companies, employing previously observed tactics.
The U.S. Department of Justice seized $7.74 million in cryptocurrency, NFTs, and other assets tied to North Korea’s global fake IT worker network, which is used to funnel illicit funds to the regime.
An emerging threat group, dubbed “Water Curse,” is targeting cybersecurity professionals by distributing weaponized GitHub repositories masquerading as legitimate penetration testing tools, facilitating supply chain attacks.
Malicious Python packages, notably the “Chimera” tool, have been identified on PyPI. Unlike traditional malware, Chimera targets data specific to corporate and cloud infrastructures to facilitate supply chain attacks.

Trends, Tools, or Tactics of Interest

Google’s Mandiant published research on increasingly sophisticated vishing (voice phishing) attacks, which are being used as initial access vectors in recent ransomware campaigns.
Google reported a rise in travel-themed scams, with attackers leveraging the summer holiday period to target consumers.
The Anubis ransomware-as-a-service kit has added data wiper functionality, enabling affiliates to both encrypt and permanently erase files, making recovery impossible even after ransom payment.
Researchers observed the use of steganography, specifically malicious payloads hidden within JPEG images, as a technique for evading detection.
Kali Linux 2025.2 was released, introducing 13 new tools and expanding its car hacking toolkit, enhancing capabilities for penetration testing and automotive security assessments.
The ongoing increase in third-party and supply chain risks was highlighted, with recommendations for continuous monitoring of partner vulnerabilities.

Regulatory or Policy Developments

The U.S. National Institute of Standards and Technology (NIST) released SP 1800-35, providing 19 real-world examples for implementing zero-trust architecture using commercial technologies.
Meta announced the introduction of advertising on WhatsApp, stating that the ads are designed with privacy considerations.