Proton on DanSec Daily

Cybersecurity Brief – 2026-04-16

Thu, 16 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Ukrainian government and healthcare organisations have been targeted in a data-theft malware campaign attributed to threat actor UAC-0247. The campaign utilised a new malware family, ‘AgingFly’, which steals authentication data from Chromium-based browsers and WhatsApp messenger.
Over 30 WordPress plugins within the EssentialPlugin package have been compromised, allowing unauthorized access and malware deployment on thousands of websites.
Digitally signed adware tools have been abused to deploy payloads with SYSTEM privileges, disabling antivirus protections on thousands of endpoints, including those in education, utilities, government, and healthcare sectors.
A coordinated campaign involving 100 malicious Chrome extensions has been identified, stealing user data and establishing backdoors via shared command and control infrastructure.
Sweden publicly attributed last year’s cyberattack on its energy infrastructure, specifically a heating plant, to a pro-Russian group.

Newly Discovered Vulnerabilities

A critical authentication bypass vulnerability in nginx-ui (CVE-2026-33032) is being actively exploited in the wild, enabling attackers to fully compromise Nginx servers, including restarting, creating, modifying, and deleting configuration files.
April Patch Tuesday updates addressed numerous critical vulnerabilities across Microsoft, Adobe, SAP, and Fortinet products. Notably, Microsoft patched a SharePoint zero-day and a Windows Task Host privilege escalation vulnerability, both of which have been actively exploited.
Two vulnerabilities in Ivanti Neurons for ITSM were patched, addressing risks of persistent access after account disablement and exposure of session information.
Microsoft and Salesforce patched prompt injection vulnerabilities in their AI agents (Copilot and Agentforce), which could have allowed attackers to leak sensitive data.
Researchers highlighted a ‘by design’ flaw in Anthropic’s Model Context Protocol (MCP), enabling unsanitized command execution and potential full system compromise in AI supply chains.

Notable Threat Actor Activity

UAC-0247 has been identified as responsible for recent attacks on Ukrainian clinics and government entities, deploying the ‘AgingFly’ malware for credential theft.
Pro-Russian threat actors were named by Swedish authorities as responsible for a cyberattack targeting critical energy infrastructure in Sweden.
Threat actors have weaponised n8n, an AI workflow automation platform, since October 2025 to conduct phishing campaigns and deliver malware via abused webhooks.
Mirax RAT, offered as malware-as-a-service primarily to Russian-speaking affiliates, is targeting Android users in Europe, converting devices into proxy nodes.
A Windows infostealer is being distributed through fake Proton VPN sites, malicious gaming mods, and GitHub/YouTube links, aiming to hijack accounts and drain cryptocurrency wallets.

Trends, Tools, or Tactics of Interest

Abuse of legitimate automation and workflow platforms (e.g., n8n) and signed software to bypass security controls and deliver malware is increasing.
Attackers are exploiting prompt injection vulnerabilities in AI-powered tools to exfiltrate sensitive data, highlighting the growing risks in AI agent ecosystems.
The emergence of malware campaigns using browser extensions and phishing emails (such as fake YouTube copyright notices) to compromise accounts and steal credentials.
AI-driven clickbait campaigns (e.g., Pushpaganda) are turning browser notifications into persistent scam delivery channels.
Long-running ransomware campaigns are targeting small businesses and homes, particularly in Turkey, often remaining undetected due to under-reporting.
Industrial automation systems continue to face a diverse range of infection vectors and malware types, with region- and industry-specific targeting noted in recent threat landscape reports.

Regulatory or Policy Developments Affecting the Security Industry

The US Congress is considering reauthorisation of a foreign surveillance program, with ongoing debate over privacy protections.
Regulatory complexity and differences in Asia’s digital supply chain are increasing security challenges, particularly with the integration of AI technologies.
An audit found that major technology companies, including Google, Meta, and Microsoft, often fail to comply with California privacy law opt-out requests for online tracking.

Cybersecurity Brief – 2025-08-05

Tue, 05 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Chanel has suffered a data breach as part of a broader wave of attacks targeting Salesforce data, joining other organisations affected by this campaign.
Northwest Radiologists disclosed a data breach impacting 350,000 individuals, with personal information stolen in an incident dating back to January 2025.
Russia’s largest airline, Aeroflot, was reportedly attacked, according to Check Point’s latest threat intelligence report.

Newly Discovered Vulnerabilities

SonicWall is investigating a potential zero-day vulnerability in its SSL VPN devices after a surge in targeted attacks, notably by the Akira ransomware group.
NVIDIA patched multiple critical vulnerabilities in its Triton Inference Server for Windows and Linux. These flaws could allow unauthenticated remote code execution, model theft, data leaks, and response manipulation on AI servers.
A previously undocumented Linux backdoor, dubbed “Plague,” was discovered. The malware, implemented as a malicious PAM module, enables persistent SSH access, bypasses authentication, and removes traces of SSH sessions. It is reported to have evaded detection for over a year.
Proton fixed a vulnerability in its Authenticator iOS app where TOTP secrets were logged in plaintext, potentially exposing multi-factor authentication codes.
Several vulnerabilities were patched in the AI code editor Cursor, which previously allowed attackers to modify sensitive MCP files and execute arbitrary code without user approval.

Notable Threat Actor Activity

Vietnamese threat actors are distributing a Python-based information stealer known as PXA Stealer. The campaign has compromised over 4,000 IP addresses and stolen 200,000 passwords globally.
Akira ransomware operators have escalated attacks using SonicWall SSL VPN devices, leveraging a suspected zero-day for initial access.
Ransomware gangs are exploiting a Microsoft SharePoint vulnerability chain, resulting in breaches of at least 148 organisations.
North Korean IT workers continue to seek fraudulent employment at Western companies, as highlighted in a new FBI advisory.
The “ClickTok” campaign is targeting TikTok Shop users with phishing and trojanised apps, leading to crypto wallet theft and spyware infections.
Mozilla warned of an ongoing phishing campaign targeting add-on developers via its official AMO repository.

Trends, Tools, or Tactics of Interest

Attackers are leveraging Microsoft Teams calls for social engineering, convincing users to install the Matanbuchus malware loader, which is often a precursor to ransomware deployment.
Threat actors are increasingly utilising generative AI tools to enhance offensive cyber operations, including social engineering and malware development.
Recent malware campaigns are adopting advanced evasion techniques, such as blending into legitimate developer workflows and documenting themselves to appear benign.
The proliferation of shadow IT remains a concern, with employees installing unauthorised plugins and tools, increasing organisational risk.
Cisco demonstrated that AI guardrails can be bypassed, allowing sensitive data to be extracted from chatbots trained on proprietary content.

Regulatory or Policy Developments Affecting the Security Industry

CISA and FEMA announced over $100 million in grants to help US states, tribes, and localities enhance cybersecurity resilience.
Illumina agreed to a $9.8 million settlement over allegations that its gene sequencing products supplied to the US government contained cybersecurity vulnerabilities.
Sean Cairncross has been confirmed by the US Senate as National Cyber Director.
Darktrace has acquired Mira Security, contributing to ongoing consolidation in the cybersecurity sector, with 44 M&A deals announced in July 2025.

Cybersecurity Brief – 2025-08-01

Fri, 01 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

A Florida correctional institution inadvertently leaked the names, email addresses, and telephone numbers of all facility visitors to every inmate.
North Korea-linked threat actor UNC4899 targeted two organizations to steal millions in cryptocurrency by luring employees via LinkedIn and Telegram, leveraging cloud account access and malware.
Financially motivated threat actor UNC2891 breached ATM networks using a 4G-equipped Raspberry Pi device and attempted to deploy the CAKETAP rootkit for fraudulent activity.

Newly Discovered Vulnerabilities

Multiple critical and high-severity vulnerabilities were patched in Honeywell Experion PKS, an industrial process control and automation product, which could have allowed manipulation of industrial processes.
Malicious connectors in Microsoft 365 were highlighted as a serious and growing email threat vector, potentially impacting hundreds of millions of users.

Notable Threat Actor Activity

The Russian state-affiliated group Secret Blizzard (also known as Turla) was observed using adversary-in-the-middle (AitM) attacks at the ISP level to deploy malware against foreign embassies in Moscow, leveraging local ISP access to intercept and manipulate web traffic.
Scattered Spider, a threat actor known for social engineering, continues to use techniques that mimic legitimate IT support to gain access to target networks, as noted in a recent CISA advisory update.
SentinelLabs reported links between Chinese state-sponsored hackers and Chinese companies developing intrusion tools used in offensive operations.

Trends, Tools, or Tactics of Interest

Researchers identified a multi-layer redirect phishing tactic targeting Microsoft 365 users, which abuses link wrapping services from Proofpoint and Intermedia to bypass security defenses and steal login credentials.
ClickFix and FileFix were profiled as social engineering attacks that start in the browser and use clipboard or File Explorer hijacking to deliver malware.
Analysis revealed that in approximately 80% of cases, spikes in malicious activity such as network reconnaissance and targeted scanning precede the public disclosure of new security vulnerabilities (CVEs).
LayerX demonstrated that browser extensions can be exploited to compromise generative AI tools via a technique dubbed ‘man-in-the-prompt’, posing a significant risk to sensitive data.
BrainDamage, a new payload generator and encrypted shell stager toolkit, was released for red team operations, focusing on stealth and remote command delivery.
Kali Linux is now supported in Apple containers on macOS Sequoia, expanding virtualization options for security professionals.
CISA released Thorium, an open-source platform for malware and forensic analysis, aimed at supporting containment and eviction during incident response.
The Gartner 2025 Magic Quadrant highlights increasing adoption of AI-driven solutions in endpoint security to address complex and growing threats.
Security Operations Centers are experiencing alert fatigue and data overload, with traditional SIEMs struggling to keep pace with increasing log volumes and complexity.
Proton launched a free, standalone, cross-platform two-factor authentication app, Proton Authenticator.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced that, between October 2025 and July 2026, it will disable external workbook links to blocked file types by default in Excel.
Microsoft expanded its .NET and ASP.NET Core bug bounty program, offering rewards of up to $40,000 for eligible vulnerabilities.
Meta is sponsoring the Pwn2Own Ireland 2025 hacking competition, offering up to $1 million for a successful WhatsApp exploit.
The Trump Administration, in collaboration with 60 companies, is developing a plan for Americans to voluntarily upload their healthcare and medical data.
Significant funding rounds were announced: Noma Security raised $100 million for AI agent security solutions, Wallarm raised $55 million for API security, and Reach Security received $10 million for AI-driven exposure management solutions.

Cybersecurity Brief – 2025-07-24

Thu, 24 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The US National Nuclear Security Administration was breached via exploitation of a Microsoft SharePoint zero-day vulnerability chain. At least three Chinese nation-state cyber-espionage groups are implicated in targeting older, on-premises SharePoint instances after a flawed patch attempt.
Clorox has filed a $380M lawsuit against Cognizant, alleging gross negligence after hackers successfully impersonated an employee and convinced the help desk to reset credentials, enabling a major August 2023 cyberattack.
Ongoing phishing campaigns are mimicking the US Department of Education’s G5 grant portal, exploiting recent layoffs and political turmoil to target users.
The npm package ‘is’, with 2.8 million weekly downloads, was compromised in a supply chain attack, injecting backdoor malware that gave attackers full device access.
npm accidentally removed the Stylus package, breaking builds and pipelines globally that depend on the library.
Ukraine arrested the suspected administrator of the Russian-language cybercrime forum XSS.is at the request of French authorities.

Newly Discovered Vulnerabilities

Sophos patched five critical vulnerabilities in Sophos Firewall that allowed for remote code execution by unauthenticated attackers.
CISA issued an alert regarding active exploitation of two vulnerabilities in SysAid ITSM software, which attackers are using to hijack administrator accounts.
Cisco reported active exploitation attempts of critical Cisco Identity Services Engine (ISE) vulnerabilities, which could lead to unauthenticated remote code execution.
Multiple high-severity memory safety vulnerabilities were patched in both Chrome and Firefox browsers.
Persistent exploitation of known Ivanti remote code execution vulnerabilities continues, particularly affecting Japanese organizations due to patching complications.

Notable Threat Actor Activity

Threat actor “Mimo” has shifted tactics to target Magento CMS and misconfigured Docker instances for crypto mining and proxyware deployment, expanding from previous campaigns against Craft CMS.
Chinese threat actors continue to exploit Ivanti RCE vulnerabilities in targeted attacks.
The Lumma Stealer malware re-emerged and resumed activity after a prior law enforcement takedown.
The Interlock ransomware group is actively targeting organizations through drive-by download attacks, prompting a government alert.
Hackers are using stolen credit cards and loyalty points to book travel for clients, with risks extending to remote workers, SMBs, and travel brands.

Trends, Tools, or Tactics of Interest

Researchers identified a new stealthy WordPress backdoor hidden in the “mu-plugins” directory, enabling persistent administrative access and evading standard detection.
The Coyote banking trojan is the first known malware to abuse the Windows UI Automation (UIA) accessibility framework to steal banking credentials, with attacks observed against banks and crypto exchanges in Brazil.
Kerberoasting attacks remain effective due to weaknesses in current detection methods; new approaches to detection and Active Directory hardening are being discussed.
Increased exploitation of SharePoint vulnerabilities is observed, with multiple exploit attempts and scanning activity detected shortly after public disclosure.
File integrity monitoring receives renewed focus with the release of the ficheck.py tool for forensic analysis.
Google launched the OSS Rebuild initiative to enhance security in open-source package ecosystems and address software supply chain attack risks.
Brave browser implemented a feature to block Windows Recall from capturing screenshots of browser activity by default.
Proton launched “Lumo,” a privacy-focused encrypted AI assistant that does not log user conversations or use prompts for training.
OpenAI is rolling out new ChatGPT features, including “personality” toggles and a “Study together” mode for exam preparation.
AI bot traffic is increasingly impacting website performance, with new mitigation strategies under discussion.
OpenAI CEO Sam Altman warned of the rising threat of AI voice fraud in banking, stating that voice clones are becoming indistinguishable from real voices and require new verification methods.

Regulatory or Policy Developments

The UK is considering a ban on ransomware payments, with debate over potential unintended consequences such as victims hiding incidents or attackers shifting tactics.
ISO 42001, a new international standard for AI governance, is being highlighted as a framework for responsible AI development and deployment.

Cybersecurity Brief – 2025-04-30

Wed, 30 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

SK Telecom Data Breach: South Korean telecom provider SK Telecom is offering free SIM replacements to 25 million customers after a USIM data breach, though only 6 million cards are currently available.
Ukraine Retail Cyberattack: Epicentr, Ukraine’s largest home improvement retailer, suffered a cyberattack that disrupted key IT systems.
Targeted Attacks on French Organizations: The French government attributed 12 cyberattacks on domestic entities over four years to Russian state-backed APT28 (GRU).
Uyghur Community Targeted: Chinese threat actors delivered Trojanized word-processing software via spear-phishing to members of the World Uyghur Congress.
Outlaw Botnet Activity: Kaspersky identified an SSH-based mining botnet operated by the Outlaw cybergang, targeting organisations globally.
Reconnaissance on SentinelOne: SentinelOne reported that the China-linked “PurpleHaze” threat cluster attempted reconnaissance against its infrastructure and clients.
Proton Mail Blocked in India: An Indian high court ordered the nationwide blocking of Proton Mail due to allegations of its use in AI deepfake scams.

Newly Discovered Vulnerabilities

Apple AirPlay Zero-Click RCE (“AirBorne”): Multiple vulnerabilities in Apple’s AirPlay protocol and SDK allow remote code execution on unpatched Apple and third-party devices via Wi-Fi, requiring no user interaction.
Broadcom Fabric OS and Commvault Flaws: CISA warned of active exploitation of vulnerabilities in Broadcom Brocade Fabric OS, Commvault web servers, and Qualitia Active! Mail clients.
Fuel Tank Monitoring System Exposure: Thousands of automatic tank gauge (ATG) devices are accessible online and vulnerable to disruption, posing risks to critical infrastructure.
Ongoing SonicWall CVE-2021-20016 Scanning: Increased scanning activity for this older SonicWall vulnerability suggests continued exploitation risk.

Notable Threat Actor Activity

APT28 (Russian GRU): Publicly attributed by France for a series of cyberattacks on French organizations.
Chinese Espionage (PurpleHaze): Ongoing reconnaissance and spear-phishing campaigns against Western targets, including SentinelOne and the Uyghur diaspora.
Outlaw Mining Botnet: Continues to leverage SSH-based infection chains for cryptomining operations worldwide.
Increased Scanning for Secrets: Threat actors are intensifying scans for leaked Git tokens, configuration files, and SMS gateways/APIs to compromise cloud services and send unauthorised messages.

Trends, Tools, and Tactics

Zero-Day Exploitation:
- Google reported 75 zero-days exploited in 2024, with 44–50% targeting enterprise security products and spyware-linked attacks.
- Exploitation is increasingly affecting enterprise and security technologies rather than general consumer software.
Device Code Phishing: Russian state actors are leveraging “device code phishing” techniques to bypass multi-factor authentication, as highlighted by recent Microsoft and KnowBe4 reports.
Generative AI Security Risks:
- Multiple GenAI platforms are susceptible to jailbreaks, unsafe code generation, and data theft.
- Google DeepMind introduced CaMeL, a new approach to mitigating prompt injection in large language models.
- WhatsApp launched “Private Processing” to enable AI features while maintaining message privacy, though experts caution about residual risks.
Cryptocurrency Exchange Rebranding: Grinex is suspected to be a rebrand of the sanctioned Russian exchange Garantex, indicating ongoing evasion of regulatory actions.
Social Engineering Scams: Threat actors are exploiting current events (e.g., the death of Pope Francis) for phishing and social engineering campaigns.

Regulatory and Policy Developments

India Blocks Proton Mail: Legal action taken against end-to-end encrypted email services over deepfake-related abuse, highlighting growing regulatory scrutiny of privacy-focused platforms.
Microsoft Windows Server Hotpatching: Starting with Windows Server 2025, hotpatching will require a paid subscription, impacting patch management strategies for enterprise clients.
US Cyber Policy: Calls for reauthorisation of cyberthreat information sharing laws and review of CISA funding and structure were raised during the RSA Conference.
France’s Public Attribution: France’s rare public attribution of cyberattacks to APT28 signals a more assertive posture in state-level cyber diplomacy.

Summary of Key Risks and Recommendations

Heightened threat from state-backed APTs (Russia, China) targeting critical infrastructure, enterprises, and dissident communities.
Ongoing exploitation of zero-day and legacy vulnerabilities, especially in enterprise and security products.
Increased risk from generative AI systems, both as attack vectors (prompt injection, jailbreaks) and as privacy concerns for end-users.
Regulatory shifts may impact encrypted communications and patch management practices.
Continued vigilance is recommended for SSH exposure, Git/secrets management, and rapid patching of high-profile vulnerabilities.