https://blog.dansec.red/vendors/prosper/Recent content in Prosper on DanSec DailyHugoen-gbSat, 18 Oct 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-10-18-cybersecurity-news/Sat, 18 Oct 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-10-18-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Envoy Air, a subsidiary of American Airlines, confirmed a data compromise involving its Oracle E-Business Suite application. The Clop extortion gang has claimed responsibility.</li> <li>Sotheby’s disclosed a data breach involving theft of sensitive personal information, including Social Security Numbers.</li> <li>Prosper suffered a data breach impacting 17.6 million accounts, with exposed data including names, addresses, dates of birth, email addresses, Social Security numbers, government IDs, and other sensitive information.</li> <li>Cybercriminals exploited lax authentication in Zendesk’s customer service platform to execute email bombing attacks, flooding targeted inboxes with abusive messages from legitimate Zendesk accounts.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A malicious npm package was identified delivering the AdaptixC2 post-exploitation agent, targeting Windows, Linux, and macOS platforms.</li> <li>Researchers disclosed a critical vulnerability in WatchGuard Fireware’s VPN functionality, allowing unauthenticated remote code execution. The flaw has been patched.</li> <li>ConnectWise issued a security update for its Automate product, addressing critical vulnerabilities that could allow adversary-in-the-middle (AiTM) update attacks and interception/modification of sensitive communications.</li> <li>Microsoft patched CVE-2025-55315, an HTTP request smuggling vulnerability in ASP.NET Core with the highest-ever severity score for the platform. The flaw can lead to information leaks, file tampering, and server crashes.</li> <li>Over 266,000 F5 BIG-IP instances remain exposed online following a recently disclosed security breach.</li> <li>Gladinet patched an actively exploited CentreStack vulnerability, an unauthenticated local file inclusion bug enabling remote code execution via ViewState deserialization.</li> <li>Vulnerabilities in Phoenix Contact UPS devices were disclosed, allowing attackers to trigger a permanent denial-of-service condition that prevents remote restoration.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>The Silver Fox threat group has expanded operations using the Winos 4.0 (ValleyRAT) malware, now targeting Japan and Malaysia with the HoldingHands RAT, in addition to previous campaigns in China and Taiwan.</li> <li>North Korean threat actors associated with the Contagious Interview campaign have merged BeaverTail and OtterCookie malware into an advanced JavaScript-based strain, indicating ongoing tool development.</li> <li>Microsoft disrupted a ransomware campaign abusing Azure certificates, revoking over 200 digital certificates used to sign malicious Teams binaries for Rhysida ransomware distribution.</li> <li>Europol dismantled a SIM-box operation (SIMCARTEL) that facilitated over 3,200 fraud cases and caused losses exceeding €4.5 million by renting numbers for cybercrime.</li> <li>TikTok videos are being used to promote malware installation, leveraging social engineering and new communication channels.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Phishing remains the leading initial access vector for cyberattacks across Europe, accounting for 60% of incidents between July 2024 and June 2025, per ENISA.</li> <li>Microsoft reports increasing use of AI by Russian and Chinese threat actors to escalate cyberattacks, particularly targeting the United States.</li> <li>Attackers are exploiting AI chat data as a rich source of sensitive enterprise information, raising concerns about privacy, accountability, and law enforcement access.</li> <li>Shared responsibility models for securing AI agents and agentic services are becoming more prominent, with ongoing challenges in user and team awareness.</li> <li>Social engineering tactics continue to evolve, with attackers leveraging platforms like TikTok and exploiting authentication weaknesses in SaaS products such as Zendesk.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>Capita has been fined £14 million in connection with a security incident.</li> <li>The European Union Agency for Cybersecurity (ENISA) published statistics on initial access vectors, highlighting phishing as the predominant method in Europe.</li> </ul>https://blog.dansec.red/posts/2025-10-17-cybersecurity-news/Fri, 17 Oct 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-10-17-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Sotheby’s disclosed a data breach in which threat actors accessed sensitive information, including financial details of individuals.</li> <li>Financial services company Prosper suffered a breach impacting over 17.6 million accounts, with personal information stolen.</li> <li>F5 confirmed a long-term breach of its systems, with attribution linked to Chinese threat actors. The attack exploited BIG-IP vulnerabilities, prompting patch releases and government alerts.</li> <li>Video call app Huddle01 exposed over 600,000 user logs due to a misconfigured Kafka broker.</li> <li>Fashion retailer Mango reported a data breach at a third-party marketing provider, exposing limited contact details.</li> <li>LastPass and other top password managers are being targeted by phishing campaigns aiming to exploit user trust in password vaults.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>Cisco IOS and IOS XE Software: CVE-2025-20352, a remote code execution vulnerability, is being actively exploited to deploy Linux rootkits on older networking devices.</li> <li>Gladinet CentreStack: A local file inclusion vulnerability (CVE-2025-11371) has been exploited as a zero-day since late September; security updates have been released.</li> <li>Adobe Experience Manager: A maximum-severity vulnerability in AEM Forms is being actively exploited to execute code on unpatched systems.</li> <li>Fuji Electric HMI Configurator: Multiple vulnerabilities have been disclosed and patched, with advisories issued to industrial organizations.</li> <li>Windows Kernel (Rust-based GDI component): A security vulnerability identified by Check Point Research in January 2025.</li> <li>Microsoft Windows 11: Recent updates have broken HTTP/2 connections to localhost (127.0.0.1), impacting applications relying on this functionality.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>North Korean-affiliated actors are leveraging the EtherHiding technique to distribute malware and steal cryptocurrency, using blockchain smart contracts for resilience and stealth.</li> <li>Financially motivated threat actor UNC5142 is abusing blockchain smart contracts to distribute information stealers such as Atomic (AMOS), Lumma, and RedLine via infected WordPress sites.</li> <li>Chinese threat actors have been linked to the F5 breach and are reportedly testing AI-optimized attack chains in Taiwan.</li> <li>Vanilla Tempest (aka Vice Spider/Vice Society) used over 200 fraudulent certificates to sign malicious binaries in Rhysida ransomware campaigns, targeting Microsoft Teams users. Microsoft has revoked these certificates to disrupt ongoing attacks.</li> <li>Attackers are exploiting a Cisco SNMP flaw to deploy Linux rootkits (including the newly discovered LinkPro rootkit, which uses eBPF for stealth and activates via magic TCP packets) on AWS-hosted and on-premises infrastructure.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Increased abuse of blockchain technologies (smart contracts) for malware distribution and command-and-control, notably by both state-aligned and financially motivated actors.</li> <li>Emergence of new Linux rootkits (e.g., LinkPro) employing advanced stealth techniques such as eBPF and covert activation mechanisms.</li> <li>Phishing campaigns specifically targeting users of password managers, exploiting trust in these platforms.</li> <li>Security risks in the software supply chain highlighted by the discovery of over 550 unique secrets exposed in Microsoft Visual Studio Code marketplaces.</li> <li>AI-driven security tools are gaining traction, with new products emerging to automate vulnerability remediation and enterprise data protection.</li> <li>Security Operations Centers (SOCs) are under pressure to adopt AI-based platforms for scaling detection and response capabilities.</li> <li>Ongoing concerns regarding secure coding practices in AI-generated code, with emphasis on the need for improved training and oversight.</li> </ul> <h2 id="regulatory-or-policy-developments-affecting-the-security-industry">Regulatory or Policy Developments Affecting the Security Industry</h2> <ul> <li>Microsoft Office 2016 and Office 2019 have reached end of extended support as of October 14, 2025, with implications for continued security updates and compliance.</li> <li>Regulatory scrutiny on data handling practices, as evidenced by allegations against Roku for collecting and selling children&rsquo;s data in violation of privacy laws.</li> <li>Financial institutions are facing increasing challenges in data governance and regulatory risk management amid evolving compliance requirements.</li> </ul>