https://blog.dansec.red/vendors/onedrive/Recent content in OneDrive on DanSec DailyHugoen-gbSat, 21 Jun 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-06-21-cybersecurity-news/Sat, 21 Jun 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-06-21-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Iran&rsquo;s state-owned TV broadcaster was hacked mid-broadcast, with programming interrupted to air protest videos against the government.</li> <li>The Taiwanese cryptocurrency exchange BitoPro attributed a cyberattack resulting in the theft of $11 million in cryptocurrency to the North Korean Lazarus Group.</li> <li>American insurance company Aflac disclosed a breach as part of a broader campaign targeting US insurance providers, with potential theft of personal data. The campaign is linked to Scattered Spider.</li> <li>A massive distributed denial-of-service (DDoS) attack peaking at 7.3 Tbps targeted a hosting provider, with Cloudflare mitigating the incident. This is the largest DDoS attack recorded to date.</li> <li>A significant data breach exposed a plain text file containing 184 million passwords for services including Google, Microsoft, and Facebook.</li> <li>Reports surfaced regarding a leak of 16 billion passwords from various data breaches, raising concerns about widespread credential exposure.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The Qilin ransomware group has added a &ldquo;Call Lawyer&rdquo; feature to its ransomware-as-a-service offering, enabling affiliates to provide legal counsel to victims as an additional pressure tactic for ransom payment.</li> <li>The Lazarus Group was linked to the BitoPro crypto heist, continuing its focus on financial sector attacks.</li> <li>Scattered Spider was identified as the actor behind the insurance sector attacks, including the breach at Aflac.</li> <li>A new campaign targeted gamers and developers by publishing over 200 trojanized GitHub repositories, masquerading as Python-based hacking tools to deliver malware.</li> <li>Threat actors are increasingly using malicious copycat repositories on GitHub as an alternative malware distribution channel, adapting to improved security in package registries.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Threat actors are intensifying psychological pressure on ransomware victims by offering legal assistance, as observed in the Qilin ransomware campaign.</li> <li>DDoS attacks are reaching unprecedented scale, with the latest attack peaking at 7.3 Tbps and delivering 37.4 TB of data in under a minute.</li> <li>There is a notable increase in supply chain attacks targeting developers via open source platforms, particularly through malicious and copycat repositories on GitHub.</li> <li>Cyber operations and hacktivism are increasingly used as tools in geopolitical conflicts, as seen in the Iran state TV hack and broader commentary on cyberwarfare trends.</li> <li>The insurance sector is facing coordinated campaigns from advanced threat actors, with a focus on data theft and extortion.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Microsoft is investigating a OneDrive issue that causes file searches to return blank or no results, affecting user accessibility.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>Microsoft announced plans to periodically remove legacy drivers from the Windows Update catalog to reduce security and compatibility risks.</li> <li>AWS introduced enhanced visibility features for its core security products, aiming to provide improved threat context for cloud customers.</li> <li>Google released new enterprise-grade security features for Android device management, targeting organizational security needs.</li> </ul>