Cybersecurity Brief – 2025-06-20

Fri, 20 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Satellite communications provider Viasat was breached by China’s Salt Typhoon cyber-espionage group, which has previously targeted multiple telecom providers in the United States and abroad.
Krispy Kreme confirmed that personal information of over 160,000 individuals was stolen in a cyberattack that occurred in November 2024.
Paragon’s commercial spyware “Graphite” was used to target at least two prominent European journalists, attributed to an unnamed customer.

The Russian state-linked group APT29 has been observed exploiting Google account application-specific passwords to bypass two-factor authentication in targeted phishing campaigns.
BlueNoroff, a North Korea-aligned threat actor, targeted a Web3 sector employee using deepfaked Zoom calls impersonating company executives to deliver a macOS backdoor malware.
China’s Salt Typhoon group was responsible for the breach at Viasat, continuing their focus on telecom sector cyber-espionage.

Researchers have detailed a surge in Android malware, notably the AntiDot campaign, which compromised over 3,775 devices across 273 campaigns using overlays, virtualization fraud, and NFC theft.
A new version of the Godfather Android malware now uses virtualization to create isolated environments on mobile devices, enabling it to hijack legitimate banking apps and steal account data and transactions.

“Living Off Trusted Sites” (LOTS) attacks are increasingly common, with threat actors leveraging trusted tools and websites to evade detection and execute attacks.
Scammers are increasingly injecting false support information into legitimate websites via search parameter manipulation, tricking users into contacting fraudulent support channels.
DuckDuckGo has expanded its Scam Blocker to protect users from a wider array of online scams, including fake e-commerce stores, cryptocurrency exchanges, and scareware.
AI-generated code, referred to as “vibe coding,” is introducing new risks, including “silent knowledge gaps,” as natural language is used to create software.
There is a continued trend of credential theft being a primary vector for network breaches, as highlighted by recent webinars and the Verizon 2025 DBIR.
Reports confirm that the widely publicized “16 billion credentials leak” is not a new breach, but rather a compilation of previously leaked credentials.
Commercial spyware continues to be deployed against high-profile targets, such as journalists, raising concerns about surveillance and privacy.

Microsoft announced new security defaults for Windows 365 Cloud PCs, set to take effect in the second half of 2025 for newly provisioned and reprovisioned Cloud PCs.
The U.S. Department of Justice seized over $225 million in cryptocurrency linked to investment fraud and money laundering operations, marking the largest crypto seizure in the history of the U.S. Secret Service.
Facebook is preparing to introduce passkey support, enabling passwordless authentication for users, which could have implications for account security and user authentication practices.

Fri, 13 Jun 2025 00:00:00 +0000

Forensic investigations confirmed that Paragon’s Graphite spyware was used in zero-click attacks targeting Apple iOS devices of at least two journalists in Europe.
Google Cloud and Cloudflare experienced widespread service outages impacting access to multiple sites and services across various regions.
Over 80,000 Microsoft Entra ID accounts at hundreds of organizations were targeted in password-spraying attacks using the TeamFiltration pentesting framework.
A ransomware campaign using the Fog ransomware strain leveraged an unusual mix of legitimate and open-source tools, including the Syteca employee monitoring software, to carry out attacks.

Researchers disclosed a zero-click vulnerability in Microsoft 365 Copilot, dubbed “EchoLeak,” which permits data exfiltration via prompt injection attacks without user interaction.
Trend Micro released patches for multiple critical-severity vulnerabilities in Apex Central and Endpoint Encryption products, including remote code execution and authentication bypass flaws.
GitLab patched high-severity vulnerabilities in its DevSecOps platform, including issues enabling account takeover and malicious job injection.
ConnectWise announced the planned rotation of code signing certificates for ScreenConnect, Automate, and RMM products due to identified security risks.
Microsoft issued an emergency update for Windows 11 24H2 to resolve a blue screen of death (BSOD) issue linked to incompatibility with Easy Anti-Cheat.

Socure researchers reported an ongoing campaign of employment fraud by North Korean IT operatives seeking positions at foreign companies.
The VexTrio threat group was identified as operating a global scam network by weaponizing compromised WordPress sites and linking their Viper Traffic Distribution Service (TDS) to other TDS operations.
Kremlin-backed disinformation campaigns were found to be bypassing social media moderation through the use of malicious advertising infrastructure, including fake CAPTCHAs.
A fake cybersecurity firm, “Bastion Secure,” was revealed to have been used as a front for threat actors targeting IT professionals since 2021.
Security researchers observed a series of operational security failures among threat actors, leading to intelligence gains for defenders.

A novel attack technique called TokenBreak was discovered, enabling attackers to bypass large language model (LLM) moderation by making single-character text changes.
The Fog ransomware group demonstrated the use of both open-source pentesting tools and legitimate software in their attacks, highlighting a trend towards blending legitimate and malicious utilities.
Non-human identity management was highlighted as an expanding security risk, with current tools and frameworks lagging behind those for human identity governance.
The TeamFiltration pentesting framework was observed in use for widespread password-spraying attacks targeting Microsoft Entra ID.
Automated tools are being developed to aid DShield honeypot investigations, as discussed in recent SANS guest diaries.
Law enforcement and surveillance capabilities were noted as growing concerns for privacy, particularly in contexts such as protests and the use of consumer devices.

The US Federal Trade Commission announced new rules and compliance standards under the Children’s Online Privacy Protection Act (COPPA), updating regulations to address technological changes since 2013.