Nucor on DanSec Daily

Cybersecurity Brief – 2025-06-25

Wed, 25 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Steel producer Nucor confirmed that data was stolen during a cyberattack first disclosed in May. Systems were taken offline to investigate and contain malicious activity.
AT&T is settling a data breach affecting millions of customers, offering compensation to those impacted.
Trezor warned users of a phishing campaign abusing its official support platform to send deceptive emails aimed at stealing cryptocurrency.
Threat actors have distributed a trojanized version of SonicWall’s NetExtender SSL VPN client, designed to steal VPN credentials.
Over 70 Microsoft Exchange servers were targeted by unidentified threat actors who injected malicious code into login pages to harvest credentials.

Newly Discovered Vulnerabilities

Misconfigured Docker APIs are being exploited in an active campaign, leveraging the Tor network to mine cryptocurrency on vulnerable environments.
Researchers detailed two new methods to disrupt cryptocurrency mining botnets by exploiting weaknesses in mining topologies, specifically using bad shares and the XMRogue technique.
A new attack method, FileFix, weaponizes Windows File Explorer’s address bar to trick users into executing stealthy PowerShell commands via social engineering.

Notable Threat Actor Activity

Russia-linked APT28 (UAC-0001) is conducting a campaign in Ukraine using Signal chat messages to deliver BEARDSHELL malware and COVENANT.
Chinese state-sponsored actor Salt Typhoon targeted a Canadian telecommunications company in February via a Cisco vulnerability, as part of a wider campaign against global telecoms.
The China-nexus “LapDogs” network is operating a large-scale cyber-espionage infrastructure using backdoored SOHO devices in the US and Southeast Asia.

Trends, Tools, or Tactics of Interest

Continuous Penetration Testing (CPT) is highlighted as an emerging model, providing ongoing security assessments that better mimic real-world attacker behavior compared to legacy, periodic pentests.
Botnets continue to evolve brute-force techniques for SSH and telnet, as evidenced by new username patterns observed in honeypot data.
Online scams, ransomware, business email compromise, and digital sextortion are surging in East and West Africa, now accounting for over 30% of all reported crime in those regions.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. House of Representatives has banned the use of WhatsApp on official devices for congressional staff, citing concerns over data security and encryption practices.
Microsoft has extended Windows 10 Extended Security Updates (ESU) for an additional year, allowing users to enroll for $30, via cloud sync, or by redeeming Microsoft Rewards points.
The United States Embassy in India now requires F, M, and J visa applicants to set their social media accounts to public for verification purposes.

Cybersecurity Brief – 2025-06-24

Tue, 24 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

McLaren Health Care reported a data breach impacting 743,000 patients following a July 2024 attack by the INC ransomware gang.
Nucor, North America’s largest steel producer, confirmed data theft in a recent cyber incident.
A database containing 184 million plaintext passwords from platforms including Facebook and Google was discovered exposed online without encryption or protection.

Newly Discovered Vulnerabilities

Citrix released patches for critical vulnerabilities in NetScaler ADC and Gateway appliances, urging customers to update to prevent exploitation.
A Windows LNK flaw was exploited by the XDigo malware in attacks against Eastern European government entities.
Scanning activity targeting Ichano AtHome IP Cameras was observed, indicating potential exploitation attempts.

Notable Threat Actor Activity

The China-linked Salt Typhoon group exploited a critical Cisco vulnerability to breach Canadian telecommunications firms, as confirmed by the Canadian Centre for Cyber Security and the FBI.
Russian state-sponsored APT28 used Signal chats to deliver two new malware strains, BeardShell and SlimAgent, in attacks targeting Ukrainian government entities.
Pro-Iranian hackers and hacktivists are assessed as likely to escalate cyberattacks against U.S. networks following recent U.S. airstrikes on Iranian nuclear sites, according to warnings from the U.S. Department of Homeland Security.
Four REvil ransomware members arrested in Russia in 2022 were released after serving time for carding and malware distribution charges.
Attackers exploited misconfigured Docker APIs and used Tor for anonymity in a cryptocurrency theft campaign, resembling tactics previously used by the Commando Cat actor.
Telegram purged Chinese crypto scam markets from its platform, but these markets quickly re-emerged under new branding.

Trends, Tools, or Tactics of Interest

SparkKitty, a new Trojan spyware for iOS and Android, was found distributed via the App Store, Google Play, and untrusted websites. It steals images, including cryptocurrency wallet seed phrases, from device galleries.
The XDigo malware, written in Go, was used in targeted attacks on Eastern European governments, leveraging the Windows LNK flaw for initial access.
A new jailbreaking technique, “Echo Chamber,” enables attackers to bypass guardrails in large language models (LLMs) like OpenAI and Google Gemini, prompting the generation of harmful content.
Attackers are increasingly using encrypted messaging apps (e.g., Signal) for malware delivery in targeted campaigns.
Google announced new multi-layered defences for its generative AI systems to address risks such as indirect prompt injection attacks.
SOCs are exploring AI-enabled workflow automation to address analyst burnout and improve operational efficiency.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of Homeland Security and FBI issued advisories regarding increased cyber threats from Iranian and pro-Iranian actors in response to geopolitical events.
The Canadian Centre for Cyber Security released guidance following state-sponsored intrusions into national telecom infrastructure via Cisco vulnerabilities.

Cybersecurity Brief – 2025-05-16

Fri, 16 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach: Coinbase disclosed a breach affecting approximately 1% of its users. Cybercriminals bribed customer support agents to steal customer data, including government-issued IDs. Attackers attempted to extort $20 million, but the attempt failed.
Nova Scotia Power Data Breach: Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data.
Steel Manufacturer Cyber Incident: Nucor, a major steelmaker, halted operations due to a cyber incident. Details on the nature and scope of the breach remain undisclosed.
Breachforums Settlement: The former administrator of Breachforums agreed to pay nearly $700,000 to settle a civil lawsuit related to a healthcare data breach.

Newly Discovered Vulnerabilities

Google Chrome Zero-Day: Google patched a high-severity Chrome vulnerability (with a public exploit in the wild) that enables cross-origin data leaks via Loader Referrer Policy. Emergency updates have been released.
Samsung MagicInfo Server (CVE-2025-4632): Threat actors are actively exploiting a patch bypass for a previously disclosed vulnerability in Samsung MagicInfo 9 Server.
SAP NetWeaver (CVE-2025-31324): Ongoing exploitation of a critical SAP NetWeaver vulnerability is being observed. Administrators are urged to patch immediately.
Windows 10 KB5058379 Update Issue: The latest Windows 10 update is triggering unexpected BitLocker recovery prompts on some devices after installation.

Notable Threat Actor Activity

APT28 Cyber Espionage: Russia-linked APT28 exploited a zero-day in MDaemon and other webmail servers (Roundcube, Horde, Zimbra) via XSS vulnerabilities in a global campaign (“RoundPress”) targeting government organizations.
Malicious npm Package: Researchers identified a malicious npm package (“os-info-checker-es6”) using Unicode steganography to hide its payload and Google Calendar links as command-and-control infrastructure.

Trends, Tools, or Tactics of Interest

Industrial Automation Threats: Kaspersky ICS CERT reported a continued high threat landscape for industrial automation systems in Q1 2025, with increased targeting of critical infrastructure and persistent OT security gaps.
Ransomware Evolution: Ransomware actors are leveraging legitimate IT tools and increasingly sophisticated tactics to evade detection and disrupt business continuity.
AI-Driven Voice Deepfakes: The FBI warned of ongoing voice phishing attacks against US officials using AI-generated audio deepfakes since April.
Anonymity Tools: Tor released Oniux, a command-line tool enabling any Linux application to route network traffic through the Tor network for enhanced anonymity.
Penetration Testing Practices: Industry discussion highlights the inadequacy of compliance-only penetration testing, emphasizing the need for continuous and adaptive security assessments.
Pwn2Own Berlin 2025: Security researchers demonstrated successful zero-day exploits against Windows 11, Red Hat Linux, Docker Desktop, and Oracle VirtualBox on the first day, earning $260,000 in rewards.

Regulatory or Policy Developments

Meta AI Data Use Controversy: Meta plans to use E.U. user data for AI training without explicit consent from May 27. The Austrian privacy group noyb has issued a cease-and-desist letter and is threatening a class action lawsuit if Meta proceeds.
Critical Infrastructure Security Warnings: Federal agencies continue to warn that OT security in critical infrastructure remains inadequate amid persistent and sophisticated cyber threats.

Artificial Intelligence Developments

OpenAI ChatGPT Integrations: Leaks confirm upcoming integration of Model Context Protocol (MCP), enabling ChatGPT to connect with third-party services. Additionally, a new feature will allow ChatGPT to record, transcribe, and summarize meetings, potentially increasing exposure of sensitive business communications.

Cybersecurity Brief – 2025-05-14

Wed, 14 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer confirmed customer data was stolen in a recent cyberattack. While no account passwords were compromised, customers are being required to reset passwords as a precaution.
Dior disclosed a cybersecurity incident resulting in the exposure of customer information.
Nucor Corporation, a major steel producer, experienced network disruptions due to a cyberattack, forcing parts of its systems offline for containment.
The Australian Human Rights Commission suffered a data breach in which private documents were leaked online and indexed by search engines.
Xinbi Guarantee, a Chinese-language Telegram marketplace, has been linked to $8.4 billion in illicit transactions, including crypto crime, romance scams, and North Korean money laundering.
North Korean IT worker scams are being exposed at scale, with researchers publishing 1,000 email addresses and photos linked to infiltration of Western companies.
Kosovo extradited the admin of BlackDB, an online cybercrime marketplace, to the US to face charges.

Newly Discovered Vulnerabilities and Exploits

Microsoft Patch Tuesday (May 2025): Microsoft released fixes for 78 vulnerabilities, including five zero-days under active exploitation. Notably, a CVSS 10 vulnerability impacts Azure DevOps Server.
Samsung patched CVE-2025-4632 in MagicINFO 9 Server, a critical flaw (CVSS 9.8) exploited to deploy Mirai botnet malware.
Fortinet addressed CVE-2025-32756, a zero-day RCE flaw in FortiVoice enterprise phone systems, confirmed as exploited in the wild.
Ivanti released updates for two vulnerabilities in Endpoint Manager Mobile (EPMM) that have been chained for remote code execution in limited attacks.
SAP NetWeaver vulnerability is being actively exploited by multiple ransomware groups, including BianLian and RansomExx, to deploy malware such as PipeMagic Trojan.
Google Chrome is rolling out a security change to prevent browser launches with admin privileges on Windows, reducing attack surface.
Open redirect vulnerabilities in trusted domains (e.g., google.com) continue to be abused in phishing campaigns.
Focused phishing attacks are leveraging trusted domains, real CAPTCHAs, and server-side validation for more targeted credential theft.

Notable Threat Actor Activity

Earth Ammit, a cyber espionage group, was linked to supply chain breaches in the drone sector via ERP systems in the VENOM and TIDRONE campaigns targeting Taiwan and South Korea.
Scattered Spider (aka UNC3944) tactics, previously used against UK retail chains, are now being deployed against US retailers.
Ransomware gangs are increasingly exploiting SAP NetWeaver vulnerabilities for initial access and malware deployment.
Meta Mirage, a global phishing campaign, is targeting Meta Business Suite users to hijack high-value business accounts.
Horabot malware is being distributed through invoice-themed phishing emails, targeting Windows users across six Latin American countries.

Trends, Tools, and Tactics of Interest

Phishing campaigns are becoming more sophisticated, with increased use of trusted domains, CAPTCHAs, and real-time validation to evade detection and improve targeting.
Telegram-based black markets remain a significant vector for cybercrime, with recent enforcement actions leading to shutdowns and exposure of major illicit marketplaces.
Shadow SaaS and AI usage is an emerging risk, with new tools (e.g., LastPass SaaS monitoring) being developed to detect unauthorised employee use of unsanctioned cloud and AI services.
Supply chain attacks via ERP systems and targeting of high-value sectors (e.g., drones, retail) remain prevalent.
AI agent security: Research indicates that AI agents can be manipulated by implanting fake “memories,” raising concerns about the integrity of autonomous systems.
Device hygiene: Daily phone reboots are recommended as a practical defense against persistent zero-click mobile exploits.

Regulatory and Policy Developments

Consumer Financial Protection Bureau (CFPB) in the US has canceled plans for tighter regulation of data brokers, potentially impacting privacy and data protection standards.
Telegram enforcement: Following media inquiries, Telegram banned thousands of accounts tied to crypto scam money laundering, disrupting several major illicit marketplaces.