https://blog.dansec.red/vendors/proofpoint/Recent content in Proofpoint on DanSec DailyHugoen-gbSat, 06 Sep 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-09-06-cybersecurity-news/Sat, 06 Sep 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-09-06-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Wealthsimple, a Canadian online investment management service, disclosed a data breach involving the theft of personal data from an undisclosed number of customers.</li> <li>Multiple cybersecurity firms, including Proofpoint, SpyCloud, Tanium, and Tenable, were affected by a breach involving their Salesforce instances, with attackers accessing stored information.</li> <li>Nexar’s dashcam video database was compromised, exposing video recordings from vehicle-mounted cameras.</li> <li>The City of Baltimore was reported to have sent $1.5 million to a scammer in a cyber fraud incident.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A critical command injection vulnerability in SAP S/4HANA (CVE-2025-42957) is under active exploitation. This flaw allows attackers to achieve full system compromise with minimal effort.</li> <li>A critical Sitecore vulnerability has been identified and is being actively exploited. CISA has ordered immediate patching of affected Sitecore instances by federal agencies.</li> <li>A max-severity Argo CD API flaw allows users with low-level project permissions to access API endpoints and retrieve all repository credentials for a project.</li> <li>Academics have developed an AI-powered framework (A2) for discovering and validating vulnerabilities in Android applications.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>TAG-150, a threat actor group operating a malware-as-a-service (MaaS) framework known as CastleLoader, has developed a new remote access trojan called CastleRAT, available in both Python and C variants.</li> <li>North Korean hackers have targeted hundreds of individuals using fake job interview lures. The group actively monitors cyber threat intelligence to rebuild exposed infrastructure.</li> <li>Scammers are abusing the Grok AI platform to distribute malicious links on X (formerly Twitter), bypassing restrictions on links in promoted posts.</li> <li>A smishing campaign is targeting California taxpayers with fraudulent refund offers, as warned by the California Franchise Tax Board.</li> <li>A wave of spear phishing attacks is targeting C-suite executives and senior leadership across multiple industries.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Q2 2025 threat reports indicate continued high volumes of mobile malware, adware, and unwanted software targeting Android, as well as persistent threats to Windows, macOS, and IoT platforms, including ransomware and cryptominers.</li> <li>Automation is increasingly being adopted in penetration testing, with AI-powered offensive security platforms such as FireCompass receiving significant investment.</li> <li>The use of agentic AI introduces new vulnerabilities at integration points with enterprise systems.</li> <li>There is a trend towards using AI-driven tools for vulnerability discovery and validation in software development.</li> <li>Smishing, spear phishing, and the abuse of AI platforms for phishing and malware distribution are prominent tactics.</li> <li>Improvements in IoT security have been noted over the past five years, though significant gaps remain.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>CISA has mandated immediate patching of the critical Sitecore vulnerability for federal agencies.</li> <li>Microsoft has enforced multifactor authentication (MFA) for Azure Portal sign-ins across all tenants since March 2025.</li> <li>The European Commission fined Google €2.95 billion ($3.5 billion) for anti-competitive practices in the digital advertising market.</li> <li>Federal budget cuts in the US are impacting cybersecurity funding for local and state agencies, increasing their exposure to cyber risk.</li> </ul>https://blog.dansec.red/posts/2025-08-01-cybersecurity-news/Fri, 01 Aug 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-08-01-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>A Florida correctional institution inadvertently leaked the names, email addresses, and telephone numbers of all facility visitors to every inmate.</li> <li>North Korea-linked threat actor UNC4899 targeted two organizations to steal millions in cryptocurrency by luring employees via LinkedIn and Telegram, leveraging cloud account access and malware.</li> <li>Financially motivated threat actor UNC2891 breached ATM networks using a 4G-equipped Raspberry Pi device and attempted to deploy the CAKETAP rootkit for fraudulent activity.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Multiple critical and high-severity vulnerabilities were patched in Honeywell Experion PKS, an industrial process control and automation product, which could have allowed manipulation of industrial processes.</li> <li>Malicious connectors in Microsoft 365 were highlighted as a serious and growing email threat vector, potentially impacting hundreds of millions of users.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The Russian state-affiliated group Secret Blizzard (also known as Turla) was observed using adversary-in-the-middle (AitM) attacks at the ISP level to deploy malware against foreign embassies in Moscow, leveraging local ISP access to intercept and manipulate web traffic.</li> <li>Scattered Spider, a threat actor known for social engineering, continues to use techniques that mimic legitimate IT support to gain access to target networks, as noted in a recent CISA advisory update.</li> <li>SentinelLabs reported links between Chinese state-sponsored hackers and Chinese companies developing intrusion tools used in offensive operations.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Researchers identified a multi-layer redirect phishing tactic targeting Microsoft 365 users, which abuses link wrapping services from Proofpoint and Intermedia to bypass security defenses and steal login credentials.</li> <li>ClickFix and FileFix were profiled as social engineering attacks that start in the browser and use clipboard or File Explorer hijacking to deliver malware.</li> <li>Analysis revealed that in approximately 80% of cases, spikes in malicious activity such as network reconnaissance and targeted scanning precede the public disclosure of new security vulnerabilities (CVEs).</li> <li>LayerX demonstrated that browser extensions can be exploited to compromise generative AI tools via a technique dubbed ‘man-in-the-prompt’, posing a significant risk to sensitive data.</li> <li>BrainDamage, a new payload generator and encrypted shell stager toolkit, was released for red team operations, focusing on stealth and remote command delivery.</li> <li>Kali Linux is now supported in Apple containers on macOS Sequoia, expanding virtualization options for security professionals.</li> <li>CISA released Thorium, an open-source platform for malware and forensic analysis, aimed at supporting containment and eviction during incident response.</li> <li>The Gartner 2025 Magic Quadrant highlights increasing adoption of AI-driven solutions in endpoint security to address complex and growing threats.</li> <li>Security Operations Centers are experiencing alert fatigue and data overload, with traditional SIEMs struggling to keep pace with increasing log volumes and complexity.</li> <li>Proton launched a free, standalone, cross-platform two-factor authentication app, Proton Authenticator.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>Microsoft announced that, between October 2025 and July 2026, it will disable external workbook links to blocked file types by default in Excel.</li> <li>Microsoft expanded its .NET and ASP.NET Core bug bounty program, offering rewards of up to $40,000 for eligible vulnerabilities.</li> <li>Meta is sponsoring the Pwn2Own Ireland 2025 hacking competition, offering up to $1 million for a successful WhatsApp exploit.</li> <li>The Trump Administration, in collaboration with 60 companies, is developing a plan for Americans to voluntarily upload their healthcare and medical data.</li> <li>Significant funding rounds were announced: Noma Security raised $100 million for AI agent security solutions, Wallarm raised $55 million for API security, and Reach Security received $10 million for AI-driven exposure management solutions.</li> </ul>