Phoenix Contact on DanSec Daily

Cybersecurity Brief – 2026-08-12

Wed, 12 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Wesco, a global supply chain and distribution company, is investigating a cybersecurity incident following claims by the ExfilSquad group of data theft from the company ^[30].
Mozilla revoked and updated the cryptographic signing key for Firefox and Thunderbird Linux releases after an unencrypted copy was accidentally committed to a private code repository, potentially impacting the integrity of downloads ^[17]^[31].
Fake CCleaner websites are distributing multi-stage malware that installs the GhostDesk spyware extension in Chrome browsers ^[54].
Attackers are using fake branded download pages to trick Windows users into installing legitimate remote-access software, which is then abused for unauthorized access ^[60].

Newly Discovered Vulnerabilities

SAP patched a maximum-severity flaw in Commerce Cloud (Data Hub Adapter) that allowed unauthenticated remote code execution ^[6]^[52].
Microsoft addressed nearly 400 vulnerabilities in its August Patch Tuesday, including a Windows kernel driver zero-day (afd.sys) under active attack for privilege escalation to SYSTEM, with three zero-days in total patched ^[9]^[28]^[37]^[40]^[42]^[48].
A proof-of-concept exploit named ShieldBreak was released, demonstrating a Microsoft Defender patch bypass that grants SYSTEM access ^[7].
Cisco Secure Firewall ASA and FTD vulnerabilities (CVE-2026-20349) are being actively exploited in the wild to trigger remote denial-of-service attacks, with patches released ^[8]^[25]^[47].
SonicWall patched critical vulnerabilities in its discontinued GMS platform that allowed unauthenticated remote code execution and data exposure ^[46].
Researchers disclosed an AI-assisted exploit chain for Microsoft SharePoint that enables unauthenticated remote code execution, now being used in ransomware attacks ^[13]^[34].
Zoom patched a vulnerability in the annotation tool that allowed meeting participants to hijack other attendees’ clients and execute code remotely ^[11]^[39]^[50].
Ivanti EPM updates addressed flaws that could leak credentials for external SQL connections or crash agent services ^[44].
Adobe released urgent patches for ColdFusion and Campaign Classic to fix critical code execution and denial-of-service vulnerabilities ^[49].
ClamAV vulnerabilities affecting Cisco Secure Endpoint Connector can be exploited for denial-of-service attacks, with public exploits available ^[35].
Siemens, Schneider, and Phoenix Contact released security updates addressing vulnerabilities in ICS and OT products ^[45].

Notable Threat Actor Activity

The Head Mare APT group is exploiting unpatched TrueConf server vulnerabilities to deliver PhantomCore and PhantomGraph backdoors to video conference participants via malicious installers ^[1].
Project CAV3RN is targeting Israeli organizations using Google Apps Script as a command-and-control relay and DNS-based channel selection, leveraging a modular .NET NativeAOT framework to evade detection ^[2].
The Russian Sandworm-linked group UAC-0145 is conducting social engineering campaigns targeting IT workers with fake job interviews, distributing a trojanized WireGuard VPN client capable of executing commands ^[12]^[24].
Researchers hired three suspected North Korean IT workers by creating a fake cryptocurrency startup, observing operational security tactics such as the use of virtual machines and attempts to exfiltrate data ^[18].
Gunra ransomware is targeting critical infrastructure globally, exploiting vulnerabilities in Fortinet and Schneider Electric products, and bypassing multi-factor authentication using leaked Conti code ^[21]^[36]^[38].
DeadLock ransomware is using decentralized, blockchain-based infrastructure (Polygon smart contracts) to facilitate victim communications and data leaks, making disruption more difficult ^[14]^[23].
Malicious SIM cards have been shown to execute attacker-controlled code within cellular IoT device modems, affecting sectors such as electric vehicle charging and industrial automation ^[16].

Trends, Tools, or Tactics of Interest

The Kimwolf v7 Android and IoT botnet has been updated to generate HTTP/2 DDoS traffic that closely mimics legitimate browsing, enhancing operational resilience and evasion ^[10].
DDoS attacks exceeding 1 Tbps increased fivefold in the last quarter, with over 800 network-layer attacks mitigated ^[33].
Malicious LiteLLM releases on PyPI, linked to the Trivy hack, carried credential-stealing code and potentially exposed sensitive data from over 2,100 organizations ^[5].
Attackers can split instructions across malicious MCP servers to covertly exfiltrate secrets from AI coding agents without triggering obvious alerts ^[20].
Researchers demonstrated that Windows Plug and Play USB auto-install can be abused to chain vendor software installation components, achieving SYSTEM-level access on fully updated Windows 11 machines ^[19].
AI tools are increasingly being used both for vulnerability discovery (e.g., in the Zoom and SharePoint exploits) and as a target for exploitation, with risks from vague task delegation and broad access in enterprise environments ^[13]^[32]^[39].
OpenAI launched GPT-5.6-Cyber, a model with reduced safeguards designed for cybersecurity tasks such as exploit development and incident response ^[15].

Regulatory or Policy Developments Affecting the Security Industry

U.S. and South Korean authorities issued joint warnings to government and critical infrastructure organizations regarding Gunra ransomware activity exploiting known vulnerabilities ^[21]^[36].
CISA published advisories on vulnerabilities in ICS and OT products from Siemens, Schneider, and Phoenix Contact ^[45].
Google reported that Chrome’s anti-abuse systems have reduced unwanted Android notifications by more than 7 billion per day in Q1 2026 ^[22].

Sources

Wesco confirms security incident after ExfilSquad claims data theft - bleepingcomputer.com
Mozilla Revokes Firefox and Thunderbird Linux Signing Key After Key Lands in Private Repo - thehackernews.com
Mozilla updates GPG signing key for Firefox releases after exposure - bleepingcomputer.com
Fake CCleaner installs GhostDesk Chrome spyware - malwarebytes.com
Fake popular sites offer a free app, instead take over PCs - malwarebytes.com
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code - thehackernews.com
SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities - securityweek.com
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack - thehackernews.com
Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days - bleepingcomputer.com
Microsoft's Patch Tuesday Deluge Continues With August Updates - darkreading.com
Microsoft Plugs Nearly 400 Security Holes - krebsonsecurity.com
Microsoft Patch Tuesday August 2026, (Tue, Aug 11th) - isc.sans.edu
August 2026 Patch Tuesday: Microsoft Fixes 421 CVEs, One Exploited Zero-Day - securityweek.com
ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access - thehackernews.com
Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS - thehackernews.com
Cisco warns of ASA and FTD VPN flaw exploited to crash devices - bleepingcomputer.com
Cisco Patches Firewall Zero-Day Exploited for DoS Attacks - securityweek.com
SonicWall Patches Critical Vulnerabilities in Discontinued GMS Platform - securityweek.com
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE - thehackernews.com
CISA: Microsoft SharePoint flaw now exploited in ransomware attacks - bleepingcomputer.com
Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client - thehackernews.com
A Zoom Screen-Sharing Bug Let Anyone Take Over Other Devices on a Call - wired.com
Zoom Patches Zero-Click Code Execution Vulnerability - securityweek.com
Ivanti EPM Update Patches Remotely Exploitable Flaws - securityweek.com
Adobe Urges Immediate Patching of Critical ColdFusion, Campaign Classic Flaws - securityweek.com
Cisco warns of high-severity ClamAV flaws with public exploits - bleepingcomputer.com
ICS Patch Tuesday: Vulnerabilities Fixed by Siemens, Schneider, Phoenix Contact - securityweek.com
Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants - securelist.com
Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection - securelist.com
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands - thehackernews.com
Sandworm hackers target IT pros with trojanized WireGuard VPN client - bleepingcomputer.com
Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers - thehackernews.com
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks - thehackernews.com
US and South Korea warn of Gunra ransomware targeting govt agencies - bleepingcomputer.com
Gunra Ransomware Gang Exploits Fortinet Flaws, Bypasses MFA - darkreading.com
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt - thehackernews.com
DeadLock ransomware uses blockchain to resist infrastructure takedown - bleepingcomputer.com
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices - thehackernews.com
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing - thehackernews.com
DDoS attacks over 1 Tbps surged fivefold in the second quarter - bleepingcomputer.com
Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations - thehackernews.com
Malicious MCP Servers Can Split Instructions to Make AI Coding Agents Exfiltrate Secrets - thehackernews.com
Researchers Turn USB Auto-Install Into a Full SYSTEM Takeover on Windows 11 - thehackernews.com
Vague Task, Total Access: When AI Delegation Becomes a Security Risk - bleepingcomputer.com
OpenAI Launches GPT-5.6-Cyber with Reduced Safeguards for Exploit Development - thehackernews.com
Google says Chrome cuts 7 billion unwanted Android notifications a day to fight abuse - bleepingcomputer.com

Cybersecurity Brief – 2026-04-15

Wed, 15 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Kraken Cryptocurrency Exchange Breach: Kraken confirmed a cybercrime group is attempting to extort the company by threatening to release videos showing internal systems hosting client data, following an insider breach.
McGraw-Hill Data Breach: McGraw-Hill disclosed that hackers exploited a Salesforce misconfiguration to access internal data, following an extortion threat.
Basic-Fit Data Breach: Europe’s largest gym chain, Basic-Fit, reported a breach affecting 1 million members, with stolen data including names, dates of birth, and bank account details.
RCI Hospitality Data Breach: RCI Hospitality disclosed a breach due to an IDOR vulnerability in RCI Internet Services, exposing contractor data.
Fake Ledger Live App on Apple’s App Store: A malicious Ledger Live app for macOS, distributed via Apple’s App Store, stole approximately $9.5 million in cryptocurrency from at least 50 victims.
Malicious Chrome Extensions Campaign: Researchers identified over 100 malicious Chrome extensions in the official Chrome Web Store, stealing Google OAuth2 tokens, deploying backdoors, and carrying out ad fraud. The campaign affected at least 20,000 users, with data also exfiltrated from Google and Telegram accounts.

Newly Discovered Vulnerabilities

Microsoft Patch Tuesday (April 2026): Microsoft released patches for 167 vulnerabilities, including two zero-days-one affecting SharePoint Server and another publicly disclosed flaw. Over half of the vulnerabilities were privilege escalation bugs.
PHP Composer Vulnerabilities: Two high-severity flaws in PHP Composer could allow arbitrary command execution. Patches have been released.
Adobe Vulnerabilities: Adobe issued patches for 55 vulnerabilities across 11 products, with critical ColdFusion vulnerabilities noted as especially at risk for exploitation.
SAP Critical ABAP Vulnerability: SAP released 19 new security notes addressing flaws in over a dozen products, including a critical ABAP vulnerability.
ICS Patch Tuesday: Eight major industrial vendors (Siemens, Schneider Electric, Aveva, Rockwell Automation, ABB, Phoenix Contact, Mitsubishi Electric, Moxa) published advisories and patches for newly identified vulnerabilities.
Windows and Adobe Acrobat Exploited Vulnerabilities: Organizations were warned about actively exploited vulnerabilities in Windows and Adobe Acrobat that enable privilege escalation and remote code execution.
Windows 10 and 11 Security Updates: Microsoft released cumulative and extended security updates (KB5082200, KB5083769, KB5082052) addressing vulnerabilities, including two zero-days.
Google Pixel Rust-Based DNS Parser: Google integrated a Rust-based DNS parser into Pixel 10 modem firmware to mitigate memory safety vulnerabilities.

Notable Threat Actor Activity

Mirax Android RAT: The Mirax remote access trojan has infected over 220,000 devices, primarily targeting Spanish-speaking countries via Meta platform ads. Compromised devices are being converted into SOCKS5 proxies.
AI-Driven Pushpaganda Scam: A novel ad fraud scheme leverages AI-generated content and SEO poisoning to distribute scareware and perpetrate ad fraud via Google Discover.
Triad Nexus Cybercrime Operation: Triad Nexus continues to evade international sanctions by abusing major infrastructure providers, complicating takedown efforts.
Telegram Hosting Sanctioned Crypto Scam Market: Telegram is hosting Xinbi Guarantee, a sanctioned $21 billion crypto scam operation, despite UK government designations.
Omnistealer Malware: Omnistealer is targeting password managers, saved logins, cloud storage, and crypto wallets, using blockchain-based techniques for data exfiltration.

Trends, Tools, or Tactics of Interest

AI in Cybersecurity:
- OpenAI launched GPT-5.4-Cyber, a model optimized for defensive cybersecurity applications, following Anthropic’s release of Mythos. Both models are driving increased focus on AI-powered cyber defense and accelerating the pace of vulnerability discovery and exploitation.
- The Cloud Security Alliance (CSA) is urging CISOs to prepare for high-velocity cyberattacks enabled by advanced AI models.
- KnowBe4 released Agent Risk Manager to address risks from autonomous AI agents.
- Increased scanning activity targeting AI models (e.g., Claude, OpenClaw, HuggingFace) has been observed since March 2026.
EDR-Killer Ecosystem Expansion: Threat actors are increasingly using bring-your-own-vulnerable-driver (BYOVD) techniques to bypass endpoint detection and response (EDR) solutions, necessitating stronger defensive measures.
Zero Trust Adoption: Stolen credentials remain a primary breach vector, with identity-first Zero Trust approaches being highlighted for their effectiveness in limiting privilege escalation and lateral movement.
Social Media Manipulation: Simulated wargame exercises are demonstrating the effectiveness of bot-driven influence campaigns in manipulating public opinion and elections.
Memory-Safe Programming: Google’s adoption of Rust for DNS parsing in Pixel devices reflects a growing industry trend toward memory-safe programming languages for security-critical components.

Regulatory or Policy Developments

UK Sanctions on Crypto Scammers: The UK government designated Xinbi Guarantee as a sanctioned enabler of crypto scams and human trafficking, but enforcement is hindered by continued operation on Telegram.
Microsoft’s Investment in Japan: Microsoft announced a $10 billion investment to accelerate AI adoption, workforce training, and cybersecurity partnerships in Japan.
CSA Guidance on AI Threats: The Cloud Security Alliance is advising CISOs to prepare for the accelerated threat landscape resulting from advanced AI models like Mythos.
Microsoft Hardware Developer Account Policy: Microsoft introduced a fast-track reinstatement process for Windows Hardware Program developer accounts following widespread suspensions.

Cybersecurity Brief – 2026-02-11

Wed, 11 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Warlock (Storm-2603) ransomware gang breached SmarterTools by exploiting an unpatched SmarterMail server on 29 January 2026.
Volvo Group North America reported a customer data exposure due to a breach at Conduent, an IT services provider.
Dutch Data Protection Authority and the Council for the Judiciary in the Netherlands confirmed cyberattacks exploiting Ivanti zero-day vulnerabilities, leading to exposure of employee contact data.

Newly Discovered Vulnerabilities

Microsoft’s February 2026 Patch Tuesday addressed 58–60 vulnerabilities, including six zero-days (three actively exploited security feature bypass flaws) and three publicly disclosed vulnerabilities. Updates apply to Windows, Microsoft Edge, and other Microsoft products.
Fortinet released patches for a critical SQL injection vulnerability in FortiClientEMS (CVE identifier not specified) that allows unauthenticated remote code execution.
Adobe fixed 44 vulnerabilities in its Creative Cloud applications, several of which are critical and could allow arbitrary code execution.
SAP patched 26 new and one updated vulnerability in CRM, S/4HANA, and NetWeaver products, including critical issues.
Siemens, Schneider, Aveva, and Phoenix Contact issued patches for vulnerabilities in their industrial control systems as part of ICS Patch Tuesday.
Microsoft began rolling out new Secure Boot certificates in Windows updates to replace expiring 2011 certificates, ahead of their June 2026 expiration.

Notable Threat Actor Activity

North Korea-linked UNC1069 targeted cryptocurrency organizations using AI-generated lures and new malware for Windows and macOS, including the ClickFix technique and tailored AI-generated video content.
DPRK (North Korean) IT operatives are impersonating professionals on LinkedIn, applying for remote jobs using hijacked LinkedIn accounts to infiltrate organizations.
Transparent Tribe (APT36), a Pakistan-linked group, is conducting a three-pronged cyber espionage campaign against Indian defense and government sectors, deploying GETA, ARES, and Desk RAT malware.
A newly documented Linux botnet, SSHStalker, is leveraging IRC for command-and-control communications.
A malicious 7-Zip website is distributing a trojanized installer that converts infected devices into residential proxy nodes.

Trends, Tools, or Tactics of Interest

Reynolds ransomware incorporates a bring-your-own-vulnerable-driver (BYOVD) technique to disable EDR (Endpoint Detection and Response) security tools during attacks.
Ransomware actors are shifting from simple encryption to maintaining persistent, “resident” access within victim environments.
ZeroDayRAT, a commercial spyware kit marketed on Telegram, enables full compromise of Android and iOS devices, granting access to SIM, location data, SMS, and facilitating MFA bypass and account takeover.
Surge in AI-enabled social engineering: AI-generated romance scams and “pig butchering” investment frauds are increasingly difficult to detect, as highlighted by recent law enforcement action against a $73M scheme.
Phishing attacks are increasingly leveraging trusted platforms, with LinkedIn direct messages being used to target executives.
Tax-related phishing and scams are prevalent during the tax season, with attackers impersonating IRS communications.
Operational Technology (OT) attacks are employing “living-off-the-plant” techniques, using native tools and protocols to evade detection.
Cloud incident response is being streamlined through automation and AI-driven tools, such as Tines, to reduce mean time to resolution (MTTR).

Regulatory or Policy Developments Affecting the Security Industry

The European Commission unconditionally approved Google’s $32B acquisition of Wiz, a major cloud security provider.
Discord will restrict user profiles to teen-appropriate mode by default unless age is verified, to enhance child safety on the platform.
Microsoft announced plans to introduce mobile-style app permission prompts in Windows 11, requiring explicit user consent before apps can access sensitive resources such as files, cameras, and microphones.

Cybersecurity Brief – 2026-01-16

Fri, 16 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Grubhub confirmed a data breach involving unauthorised access to its systems, with reports of extortion demands from attackers.
Central Maine Healthcare suffered a breach impacting 145,000 individuals, with theft of patient personal, treatment, and health insurance data.
Eurail reported a breach in which hackers stole personal and reservation information of travellers.
Microsoft, in coordination with US and UK authorities, disrupted the RedVDS cybercrime infrastructure, which was used for large-scale online fraud.

Newly Discovered Vulnerabilities

Cisco patched a maximum-severity zero-day remote code execution vulnerability in Cisco AsyncOS Software for Secure Email Gateway and Secure Email and Web Manager. The flaw was exploited in the wild by a China-linked APT.
A critical misconfiguration in AWS CodeBuild was discovered, exposing AWS’s own GitHub repositories-including the AWS JavaScript SDK-to potential supply chain attacks.
A critical vulnerability (CVE-2026-23550, CVSS 10.0) in the WordPress Modular DS plugin is under active exploitation, allowing attackers to bypass authentication and gain admin-level access.
Palo Alto Networks released patches for a high-severity DoS vulnerability in GlobalProtect Gateway and Portal, which can allow unauthenticated attackers to crash firewalls without needing to log in.
A critical vulnerability in Google’s Fast Pair Bluetooth protocol (“WhisperPair”) allows attackers to hijack, track, and eavesdrop on Bluetooth audio devices. Hundreds of millions of devices are impacted.
Researchers disclosed “StackWarp,” a new attack affecting AMD processors that can enable remote code execution inside confidential VMs.
Three critical vulnerabilities were identified in Delta Industrial PLCs, with debate among experts regarding their severity.
Siemens, Schneider, Aveva, and Phoenix Contact released advisories addressing vulnerabilities in their industrial control products as part of ICS Patch Tuesday.

Notable Threat Actor Activity

China-linked APT groups exploited the Cisco Secure Email Gateway zero-day prior to patch release.
Gootloader malware is now using malformed ZIP archives split into up to 1,000 parts to evade detection during delivery.
Researchers highlighted the VoidLink Linux malware framework, which targets cloud and container environments for long-term persistence using loaders, implants, and rootkits.
Intellexa’s Predator spyware was observed using vendor-controlled command-and-control (C2) infrastructure, with failed deployments and thwarted infections used to refine attack methods.
Threat actors are increasingly exploiting network misconfigurations to spoof internal emails for phishing campaigns, as observed by Microsoft.

Trends, Tools, or Tactics of Interest

The “Reprompt” attack technique enables single-click exfiltration of sensitive data from AI chatbots, including Microsoft Copilot, bypassing existing data leak protections-even after chat sessions have ended.
AI voice cloning exploits are on the rise, with new applications emerging for the detection of deepfake voice attacks.
A surge in reported vulnerabilities has been noted, particularly in WordPress plugins, with the overall picture complicated by inconsistent reporting from different organisations.
The Gootloader malware’s adoption of multi-part ZIP archives signals a trend toward more sophisticated evasion strategies in malware delivery.
Security focus in AI is shifting from model security to workflow security, as incidents demonstrate greater risk in workflow integrations and extensions.
Vibe coding tests indicate that AI agents can effectively exploit SQL injection vulnerabilities but perform poorly in implementing security controls.
The VoidLink framework’s targeting of cloud/container environments underscores increased threat activity against cloud infrastructure.
Security leaders are prioritising supply chain security, governance, and operational efficiency over predictive approaches.

Regulatory or Policy Developments

The US Federal Trade Commission (FTC) has banned General Motors from selling drivers’ location data for five years, following findings that GM sold such data without user consent.
Microsoft’s legal action against RedVDS was coordinated in both the US and UK, demonstrating cross-jurisdictional efforts to disrupt cybercrime-as-a-service operations.
Former CISA Director Jen Easterly has been appointed to lead the RSA Conference, reflecting leadership changes at a major industry event.

Cybersecurity Brief – 2025-10-18

Sat, 18 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

Envoy Air, a subsidiary of American Airlines, confirmed a data compromise involving its Oracle E-Business Suite application. The Clop extortion gang has claimed responsibility.
Sotheby’s disclosed a data breach involving theft of sensitive personal information, including Social Security Numbers.
Prosper suffered a data breach impacting 17.6 million accounts, with exposed data including names, addresses, dates of birth, email addresses, Social Security numbers, government IDs, and other sensitive information.
Cybercriminals exploited lax authentication in Zendesk’s customer service platform to execute email bombing attacks, flooding targeted inboxes with abusive messages from legitimate Zendesk accounts.

Newly Discovered Vulnerabilities

A malicious npm package was identified delivering the AdaptixC2 post-exploitation agent, targeting Windows, Linux, and macOS platforms.
Researchers disclosed a critical vulnerability in WatchGuard Fireware’s VPN functionality, allowing unauthenticated remote code execution. The flaw has been patched.
ConnectWise issued a security update for its Automate product, addressing critical vulnerabilities that could allow adversary-in-the-middle (AiTM) update attacks and interception/modification of sensitive communications.
Microsoft patched CVE-2025-55315, an HTTP request smuggling vulnerability in ASP.NET Core with the highest-ever severity score for the platform. The flaw can lead to information leaks, file tampering, and server crashes.
Over 266,000 F5 BIG-IP instances remain exposed online following a recently disclosed security breach.
Gladinet patched an actively exploited CentreStack vulnerability, an unauthenticated local file inclusion bug enabling remote code execution via ViewState deserialization.
Vulnerabilities in Phoenix Contact UPS devices were disclosed, allowing attackers to trigger a permanent denial-of-service condition that prevents remote restoration.

Notable Threat Actor Activity

The Silver Fox threat group has expanded operations using the Winos 4.0 (ValleyRAT) malware, now targeting Japan and Malaysia with the HoldingHands RAT, in addition to previous campaigns in China and Taiwan.
North Korean threat actors associated with the Contagious Interview campaign have merged BeaverTail and OtterCookie malware into an advanced JavaScript-based strain, indicating ongoing tool development.
Microsoft disrupted a ransomware campaign abusing Azure certificates, revoking over 200 digital certificates used to sign malicious Teams binaries for Rhysida ransomware distribution.
Europol dismantled a SIM-box operation (SIMCARTEL) that facilitated over 3,200 fraud cases and caused losses exceeding €4.5 million by renting numbers for cybercrime.
TikTok videos are being used to promote malware installation, leveraging social engineering and new communication channels.

Trends, Tools, or Tactics of Interest

Phishing remains the leading initial access vector for cyberattacks across Europe, accounting for 60% of incidents between July 2024 and June 2025, per ENISA.
Microsoft reports increasing use of AI by Russian and Chinese threat actors to escalate cyberattacks, particularly targeting the United States.
Attackers are exploiting AI chat data as a rich source of sensitive enterprise information, raising concerns about privacy, accountability, and law enforcement access.
Shared responsibility models for securing AI agents and agentic services are becoming more prominent, with ongoing challenges in user and team awareness.
Social engineering tactics continue to evolve, with attackers leveraging platforms like TikTok and exploiting authentication weaknesses in SaaS products such as Zendesk.

Regulatory or Policy Developments Affecting the Security Industry

Capita has been fined £14 million in connection with a security incident.
The European Union Agency for Cybersecurity (ENISA) published statistics on initial access vectors, highlighting phishing as the predominant method in Europe.

Cybersecurity Brief – 2025-10-16

Thu, 16 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

F5 disclosed a significant breach attributed to nation-state actors, resulting in the theft of BIG-IP source code, undisclosed security vulnerabilities, and some customer information. The attack profile suggests Chinese involvement. Patches for stolen vulnerabilities have been released, and CISA has issued an emergency directive regarding F5 devices.
Capita has been fined £14 million by the UK Information Commissioner’s Office for a 2023 data breach that exposed personal data of 6.6 million people.
Harvard University suffered a breach via an Oracle zero-day exploit, with the Clop ransomware group claiming responsibility as part of a broader campaign targeting Oracle customers.
Spanish retailer MANGO disclosed a data breach affecting customer information, resulting from a compromise at a marketing vendor.
A 19-year-old individual was sentenced to four years in prison for orchestrating a major cyberattack on PowerSchool in December 2024.
Over 100 Visual Studio Code (VS Code) extensions were found to have leaked access tokens, creating supply chain risks by allowing attackers to update extensions maliciously.
Discord named customer service firm 5CA as the third-party responsible for a data breach; 5CA denies involvement.
Scientists reported ongoing leakage of unencrypted voice calls and text messages from geostationary satellites, exposing sensitive personal and business data.

Newly Discovered Vulnerabilities

Microsoft released fixes for 183 security flaws, including two new zero-days actively exploited in the wild-one affecting every version of Windows ever shipped.
A critical vulnerability in Adobe Experience Manager, rated CVSS 10.0, is under active attack and has been added to CISA’s Known Exploited Vulnerabilities catalog.
F5 released security updates for BIG-IP vulnerabilities compromised during the recent breach.
High-severity vulnerabilities have been patched by Fortinet and Ivanti in their October 2025 Patch Tuesday updates.
Siemens, Schneider, Rockwell, ABB, and Phoenix Contact published over 20 advisories addressing vulnerabilities in their industrial control systems (ICS).
Microsoft confirmed that September 2025 Windows Server updates are causing Active Directory issues on Windows Server 2025 systems.

Notable Threat Actor Activity

The Mysterious Elephant APT group has intensified operations, targeting government and diplomatic entities in South Asia with custom tools such as BabShell and MemLoader HidenDesk, and exfiltrating WhatsApp-related data.
Chinese threat group ‘Jewelbug’ conducted a five-month-long intrusion into a Russian IT service provider, indicating geographic expansion beyond Southeast Asia.
Clop ransomware group claimed responsibility for the Harvard University breach as part of a campaign exploiting Oracle zero-day vulnerabilities.
A new banking trojan, Maverick, was distributed at scale in Brazil via malicious LNK files sent over WhatsApp. The malware shares code with Coyote.
Ongoing phishing campaigns are targeting LastPass and Bitwarden users with fake breach alerts, leading to PC compromise through malicious downloads. Similar phishing tactics are being used against Robinhood users.

Trends, Tools, or Tactics of Interest

Attackers are actively bypassing synced passkeys, highlighting inherent risks in cloud-based passkey deployments.
There is an increase in supply chain risks due to compromised VS Code extensions, with over 100 leaking tokens that could allow malicious updates.
Satellite communications remain insecure, with continued leakage of unencrypted sensitive data.
Dark web threats are increasingly hiding within normal network traffic, with network detection and response (NDR) platforms being promoted as effective countermeasures.
TikTok is being used as a platform for crypto-related scams, luring victims with fraudulent paywall schemes.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £14 million fine on Capita for failing to protect personal data in a 2023 breach.
CISA issued an emergency directive mandating urgent remediation of critical vulnerabilities in F5 devices.
LevelBlue announced plans to acquire Cybereason, expanding its extended detection and response (XDR) and managed detection and response (MDR) portfolio.

Cybersecurity Brief – 2025-09-11

Thu, 11 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover (JLR) confirmed a data breach following a recent cyberattack that forced system shutdowns and operational disruptions. Some company data was stolen in the incident.
The New York Blood Center began notifying affected individuals about a data breach resulting from a ransomware attack, confirming user data was stolen.
Plex, a media streaming platform, reported a data breach and advised users to reset their passwords.
The largest known supply-chain attack in the NPM ecosystem impacted approximately 10% of all cloud environments. Despite the scale, attackers reportedly gained little financial benefit.
An open-source developer known as “qix” disclosed a compromise of their GitHub account after being socially engineered to surrender access credentials.
A DDoS mitigation service provider in Europe was targeted by a distributed denial-of-service attack peaking at 1.5 billion packets per second.

Newly Discovered Vulnerabilities

Microsoft released patches for 80 vulnerabilities, including a publicly disclosed flaw, an SMB privilege escalation vulnerability, and Azure bugs rated CVSS 10.0.
Fortinet, Ivanti, and Nvidia issued security updates addressing high-severity vulnerabilities that could allow remote code execution, privilege escalation, information disclosure, and configuration tampering.
Rockwell Automation published eight security advisories as part of ICS Patch Tuesday, with additional advisories from Siemens, Schneider Electric, Phoenix Contact, and CISA.
A weakness in the Cursor AI code editor was identified, allowing repositories to automatically execute malicious code on a developer’s device when opened.

Notable Threat Actor Activity

Chinese APT groups have been linked to multiple high-profile incidents:
- A Chinese APT deployed the previously undocumented EggStreme fileless malware framework to compromise a Philippines-based military company.
- APT41, a China-linked group, is conducting ongoing cyber espionage campaigns targeting U.S. trade officials amid 2025 negotiations, as formally warned by the U.S. House Select Committee on China.
- Chinese state-backed actors have been observed posing as a U.S. congressman in spear-phishing attacks.
AsyncRAT is being distributed via compromised ConnectWise ScreenConnect installations to steal credentials and cryptocurrency.
Hacktivist and APT groups targeting Russian organizations have been analyzed and classified into three clusters based on their tactics, techniques, and procedures (TTPs).
The U.S. announced a $10 million reward for information leading to the arrest of Volodymyr Tymoshchuk, accused of deploying LockerGoga, MegaCortex, and Nefilim ransomware against hundreds of organizations.

Trends, Tools, or Tactics of Interest

The use of “shadow AI”-unauthorized or unmanaged AI tools by employees-is highlighted as an increasing security risk for organizations.
A new Phishing-as-a-Service kit, Salty2FA, has emerged, targeting U.S. and EU enterprises and focusing on bypassing two-factor authentication.
Two new malware families were identified:
- CHILLYHELL, a modular macOS backdoor with multiple persistence mechanisms, password brute-forcing, payload dropping, and multi-protocol communication.
- ZynorRAT, a Go-based remote access trojan capable of targeting macOS, Windows, and Linux systems.
BASE64 encoding over DNS is being used as a data exfiltration technique by certain backdoors.
Google is implementing C2PA Content Credentials in the Pixel 10 camera and Google Photos to verify image authenticity and counter AI-generated fakes.
Students are increasingly posing insider threats within the education sector, often unintentionally but at a scale challenging for security teams.
Social engineering remains a significant vector, as demonstrated by the Scattered Spider group breaching Clorox through phone-based help desk manipulation, leading to $380 million in damages.

Regulatory or Policy Developments Affecting the Security Industry

CISA presented its vision for the Common Vulnerabilities and Exposures (CVE) program, indicating ongoing evolution in vulnerability management and disclosure processes.
Apple introduced Memory Integrity Enforcement (MIE) in new iPhone models, providing always-on memory safety protections for the kernel and over 70 userland processes.
The U.S. is increasing scrutiny and financial incentives related to ransomware operators, exemplified by the $10 million reward targeting a Ukrainian ransomware actor.
The number of U.S. investors in commercial spyware companies increased sharply in 2024, with new countries identified as linked to the proliferation of such tools.

Cybersecurity Brief – 2025-08-13

Wed, 13 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers leaked data stolen from Allianz Life in ongoing Salesforce data theft campaigns, exposing 2.8 million records containing sensitive information on business partners and customers.
Over 275 million patient records were breached in the healthcare sector in 2024, primarily due to weak or stolen passwords.
Researchers identified Docker images on Docker Hub still containing the XZ Utils backdoor, more than a year after its public disclosure. At least 35 Linux images remain affected, posing ongoing supply chain risks.
The U.S. Department of Justice seized approximately $1 million in cryptocurrency from the BlackSuit ransomware gang.
Over 3,300 Citrix NetScaler devices remain unpatched against the actively exploited “CitrixBleed 2” vulnerability, leaving organisations at risk of authentication bypass attacks.

Newly Discovered Vulnerabilities

Microsoft’s August 2025 Patch Tuesday addressed 107–111 vulnerabilities, including 13–17 rated as critical. One publicly disclosed zero-day vulnerability in Windows Kerberos was patched, alongside several elevation-of-privilege flaws.
Adobe released security updates fixing over 60 vulnerabilities across 13 products, including Commerce, Substance, InDesign, FrameMaker, and Dimension.
SAP patched a critical vulnerability in S/4HANA as part of its August 2025 security notes.
Major industrial control system (ICS) vendors (Siemens, Schneider, Aveva, Honeywell, ABB, Phoenix Contact) issued advisories for code execution vulnerabilities.
Citrix NetScaler ADC products are being actively exploited via CVE-2025-6543, a critical security flaw confirmed by the Dutch National Cyber Security Centre (NCSC-NL).
A vulnerability in Erlang/OTP (CVE-2025-32433) has been widely exploited in operational technology (OT) networks since early May.
A now-patched WinRAR vulnerability has been exploited by at least two separate threat groups.

Notable Threat Actor Activity

The Charon ransomware family, employing APT-level evasion tactics, has been deployed in targeted attacks against public sector and aviation organisations in the Middle East. The campaign may be linked to China’s state-sponsored Earth Baxia group.
Cybercrime groups ShinyHunters and Scattered Spider have joined forces in data extortion campaigns, initially targeting Salesforce customers, with indications of expansion towards financial services and technology providers. ShinyHunters’ tactics now mirror those of Scattered Spider.
The newly identified Curly COMrades APT group has targeted government entities in Georgia and Moldova using custom backdoor malware and NGEN COM hijacking for persistent access.
Fortinet SSL VPN devices experienced a significant spike in brute-force attacks globally, with attackers later shifting focus to FortiManager.
Researchers report ongoing exploitation of Microsoft Teams in social engineering attacks to facilitate credential theft and malware delivery.

Trends, Tools, or Tactics of Interest

Supply chain risks persist as malicious Docker images with the XZ Utils backdoor remain available on Docker Hub.
Threat actors continue to abuse business logic flaws and leverage dark web marketplaces to sell enterprise network access, streamlining cybercrime operations.
Social engineering remains a prominent attack vector, with attackers exploiting communication platforms (e.g., Microsoft Teams) and using tactics such as tax office or Amazon recall impersonation scams.
APT actors are leveraging advanced persistence techniques, such as NGEN COM hijacking and scheduled tasks, to maintain long-term access in targeted environments.
The debate between enterprise browsers and secure browser extensions is highlighted as a key consideration for mitigating browser-based risks.
Elevation-of-privilege vulnerabilities dominated Microsoft’s August 2025 Patch Tuesday, reflecting ongoing attacker interest in privilege escalation.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced end-of-support for Windows 11 23H2 Home and Pro editions in November 2025.
Android’s protected Kernel-based Virtual Machine (pKVM) achieved SESIP Level 5 security certification, the highest level for IoT and mobile platforms.
The Dutch NCSC issued an alert regarding active exploitation of Citrix NetScaler CVE-2025-6543 in critical sectors.
Chinese authorities have publicly questioned the security of AI chips from Nvidia and AMD, citing concerns about potential backdoors.

Cybersecurity Brief – 2025-07-10

Thu, 10 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas confirmed a data breach affecting 5.7 million customers, with threat actors exfiltrating customer data.
Bitcoin Depot reported a data breach impacting nearly 27,000 cryptocurrency users, exposing sensitive customer information.
Ingram Micro is restoring operations after a ransomware attack by the SafePay group, which disrupted systems and business services.
McDonald’s AI hiring platform, operated by Paradox.ai, exposed the personal information of tens of millions of job applicants due to basic security flaws, including the use of the password ‘123456’.
Nippon Steel Solutions disclosed a data breach following exploitation of a zero-day vulnerability in network equipment.
Nova Scotia Power, a Canadian electric utility, reported disruption of power meters and a data breach affecting individuals in both Canada and the United States.
Researchers identified millions of users being spied on via malicious browser extensions available in the Chrome and Edge web stores.

Newly Discovered Vulnerabilities

Microsoft released patches for 130 vulnerabilities, including critical flaws in SPNEGO and SQL Server. One of the patched vulnerabilities was publicly known prior to remediation.
A new vulnerability in ServiceNow, dubbed “Count(er) Strike,” allows low-privileged users to enumerate and extract restricted data from tables they should not access.
Multiple severe vulnerabilities remain unpatched in Ruckus Wireless management products, allowing attackers to fully compromise managed network environments.
A container escape vulnerability in the NVIDIA Container Toolkit could allow attackers to access AI datasets across Kubernetes tenants.
Ivanti, Fortinet, and Splunk released security updates addressing critical and high-severity vulnerabilities in their respective products.
Siemens, Schneider Electric, and Phoenix Contact issued July 2025 ICS Patch Tuesday advisories, addressing vulnerabilities in industrial control systems.

Notable Threat Actor Activity

The Initial Access Broker (IAB) Gold Melody has been linked to campaigns exploiting leaked ASP.NET machine keys to gain unauthorized access to organizations and sell that access.
APT group DoNot, with suspected ties to India, expanded operations targeting European foreign ministries using the LoptikMod malware for data harvesting.
The U.S. Department of the Treasury sanctioned a North Korean hacker affiliated with the Andariel group for involvement in remote IT worker schemes and malware campaigns.
Xu Zewei, a Chinese national, was arrested in Milan for alleged involvement with the Silk Typhoon state-sponsored group and cyberattacks against U.S. organizations.
Researchers reported a North American APT exploiting a Microsoft Exchange zero-day to target a Chinese entity.
The SatanLock ransomware group has shut down its operations but plans to leak additional files stolen from victims.

Trends, Tools, or Tactics of Interest

Attackers are bypassing legacy MFA solutions using real-time phishing and fake websites, highlighting the limitations of traditional authenticator apps.
A proof-of-concept AI malware using reinforcement learning was demonstrated to reliably evade Microsoft Defender.
Deepfake technology was used to impersonate a government official, successfully deceiving diplomats and politicians, exemplifying the growing national security threat from AI-generated impersonations.
Malicious browser extensions continue to be distributed via official Chrome and Edge stores, enabling large-scale user surveillance.
The open-source bot blocker “Anubis” was introduced to prevent AI scrapers from accessing website content using a proof-of-work firewall.
SSH tunneling and direct-tcp requests were highlighted as active techniques for covert network access.
Security automation platforms like Tines are offering extensive libraries of pre-built workflows for ticketing, device identification, and threat triage.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s OFAC imposed sanctions on a North Korean cyber actor for their role in IT worker schemes supporting the Andariel group.
Microsoft confirmed a widespread issue with Windows Server Update Services (WSUS) preventing synchronization and deployment of Windows updates.
Microsoft announced that Windows 10 Extended Security Updates (ESU) will be available for consumers and businesses post-October 2025, with varying pricing models.
Microsoft Authenticator on iOS will transition backups to iCloud, removing the requirement for a Microsoft personal account.
Google disclosed further details on Android’s Advanced Protection for Chrome, emphasizing enhanced security measures.
Samsung announced new security features for Galaxy smartphones, including on-device AI protections, cross-device threat detection, and quantum-resistant encryption for network security.