Cybersecurity Brief – 2025-12-12

Fri, 12 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

The Pierce County Library suffered a data breach in April 2025, resulting in the theft of personal information belonging to 340,000 patrons, employees, and their family members.
The UK Information Commissioner’s Office fined LastPass £1.2 million over the 2022 data breach that impacted 1.6 million users, citing failure to implement adequate security measures.
Over 700 internet-facing Gogs servers have been compromised via an unpatched zero-day vulnerability, with attackers exploiting the flaw for remote code execution and file overwrites outside repositories.
Hackers exploited an undocumented cryptographic vulnerability in Gladinet CentreStack and Triofox products, enabling remote code execution attacks.
Multiple malware campaigns have been observed:
- Malicious Visual Studio Code Marketplace extensions (19 identified) have been distributing trojans hidden in fake PNG files since February, targeting developers.
- React2Shell attacks are delivering a range of malware, including cryptocurrency miners, Linux backdoors, botnet malware, and post-exploitation implants.
- DroidLock Android malware is locking users out of their devices and demanding ransom for file and device access restoration.

A high-severity, actively exploited XXE (XML External Entity) vulnerability has been flagged in OSGeo GeoServer and added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
An unpatched zero-day in Gogs, a self-hosted Git service, allows attackers to overwrite files outside repositories, leading to remote code execution. The vulnerability is a bypass for a previously disclosed RCE flaw.
An undocumented cryptographic flaw in Gladinet CentreStack and Triofox enables remote code execution and is being actively exploited.
Notepad++ released version 8.8.9 to address a security weakness in its WinGUp update mechanism, which allowed attackers to push malicious update files.
Google released emergency patches for a new Chrome zero-day (the eighth in 2025), described as a V8 type-confusion issue already being exploited in the wild. The specific CVE and affected component remain undisclosed.
IBM patched over 100 vulnerabilities this week, including several critical issues in third-party dependencies.

The WIRTE APT group is targeting government and diplomatic entities in the Middle East using a new malware suite named AshTag, installed via AshenLoader DLL sideloading.
Hamas-linked hackers are conducting espionage campaigns against Middle Eastern diplomats, deploying increasingly sophisticated malware.
Researchers detailed NANOREMOTE, a backdoor for Windows that uses the Google Drive API for covert command-and-control communications.

AI-driven cyberattacks are automating reconnaissance, generating malware variants, and evading detection at speeds that challenge traditional network defenses.
Attackers are leveraging trusted platforms for C2 communications, such as NANOREMOTE’s use of Google Drive API.
The Mythic post-exploitation framework’s network traffic and agent-to-C2 communication patterns have been analyzed, resulting in new detection rules for network defense.
ConsentFix, a new attack variant, abuses the Azure CLI OAuth app to hijack Microsoft accounts, bypassing passwords and, in some cases, multi-factor authentication.
Browser add-ons, software updates, and developer tool ecosystems (e.g., VSCode Marketplace) are increasingly being used as vectors for malware distribution.
DLL sideloading continues to be a favored technique for malware delivery, as seen in recent WIRTE activity.
Doxers are impersonating law enforcement to trick tech firms into handing over private user data using spoofed emails and falsified documents.

The UK ICO imposed a £1.2 million fine on LastPass for inadequate security leading to the 2022 breach.
In the US, President Trump signed an executive order blocking individual states from enacting their own AI regulations, centralizing AI policy at the federal level.
Microsoft expanded its bug bounty program to reward reports of critical vulnerabilities in any of its online services, including those built on third-party code.