Qualcomm on DanSec Daily

Cybersecurity Brief – 2026-03-10

Tue, 10 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Ericsson US Data Breach: Ericsson Inc. disclosed a data breach following a service provider hack, resulting in the theft of employee and customer data. The number of affected individuals has not been specified.
UNC4899 Crypto Firm Compromise: The North Korean threat actor UNC4899 breached a cryptocurrency organization in 2025, leveraging an AirDropped, trojanized file to a developer’s work device, resulting in the theft of millions of dollars.
Salesforce Experience Cloud Data Exposure: Salesforce warned customers of attacks exploiting misconfigured Experience Cloud platforms, allowing guest users to access sensitive data. The ShinyHunters group claims ongoing data theft attacks against Salesforce Aura.
AkzoNobel Compromise: AkzoNobel, a Netherlands-based paint manufacturer, was listed among top attacks and breaches in Check Point’s latest threat intelligence report.

Cybersecurity Brief – 2026-03-05

Thu, 05 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

LexisNexis has confirmed a data breach after hackers leaked files containing approximately 400,000 personal information records. Attackers claim to have stolen 2GB of data.
The University of Mississippi Medical Center (UMMC) resumed operations after a ransomware attack that disrupted access to electronic medical records and IT systems for nine days.
LeakBase, one of the largest online cybercrime forums for trading stolen data and cybercrime tools, was seized by the FBI and Europol. Data of 142,000 members was reportedly obtained.
Customers of restaurants using the HungerRush POS platform received mass extortion emails from a threat actor threatening to leak restaurant and customer data.
A significant increase in hacktivist DDoS attacks was recorded, with 149 attacks affecting 110 organisations in 16 countries, following coordinated military action in the Middle East.

Newly Discovered Vulnerabilities

Google patched 129 Android vulnerabilities, including a high-severity, actively exploited flaw in a Qualcomm component affecting Android devices.
The FreeScout helpdesk platform is affected by a maximum severity vulnerability (“Mail2Shell”) enabling unauthenticated, zero-click remote code execution on mail servers.
Cisco released patches for two maximum-severity vulnerabilities in Secure Firewall Management Center (FMC) software, which could allow remote attackers to gain root access.
VMware Aria Operations is being actively exploited via a command injection vulnerability, allowing attackers broad access to cloud environments.
Fake Laravel PHP packages on Packagist were found to deploy a cross-platform remote access trojan (RAT) affecting Windows, macOS, and Linux systems.

Notable Threat Actor Activity

The Coruna (CryptoWaters) iOS exploit kit, originally linked to Russian state actors, is now being used by multiple threat actors for targeted espionage and financially motivated attacks, including crypto theft. The kit leverages 23 exploits across five exploit chains, targeting iOS 13.0 to 17.2.1.
APT41-linked “Silver Dragon” group has been targeting government entities in Europe and Southeast Asia, using phishing for initial access and legitimate network services for command and control, including Cobalt Strike and Google Drive.
Attackers are abusing OAuth’s built-in redirect mechanisms to send users from legitimate Microsoft or Google login pages to phishing or malware sites.
XWorm malware continues to circulate with evolving delivery techniques, indicating ongoing adaptation by threat actors.
A brute force attack on RDP led to the discovery of a geo-distributed VPN-linked infrastructure supporting ransomware-as-a-service operations.

Trends, Tools, or Tactics of Interest

Mobile malware continues to evolve, with notable threats in 2025 including preinstalled Android backdoors (Keenadu, Triada), spyware trojans, the Kimwolf IoT botnet, and Mamont banking trojans.
Phishing attacks have surged 400% year over year, with corporate users increasingly targeted. Recent campaigns include SMS-based tax scams (e.g., TurboTax) and sophisticated phishing targeting LastPass users with fake support emails.
Managed Detection and Response (MDR) is highlighted as a critical tool for protecting educational institutions, which remain under-resourced but heavily targeted.
Attackers are increasingly leveraging pirated software as a vector for malware delivery, turning employees seeking free software into unwitting malware distributors.
Abuse of OAuth redirection and phishing-as-a-service platforms such as Tycoon 2FA (now dismantled) demonstrate continued innovation in phishing tactics.

Regulatory or Policy Developments Affecting the Security Industry

Europol coordinated the takedown of the Tycoon 2FA phishing-as-a-service platform, which had enabled adversary-in-the-middle credential harvesting attacks at scale, reportedly targeting over 500,000 organisations monthly.
Zurich Insurance announced the acquisition of Beazley in an $11 billion deal, positioning Zurich as a leader in the cyberinsurance market, pending regulatory approval.
Google will move Chrome to a two-week release cycle starting September 2026.
A new RFP template for AI usage control and AI governance has been released, reflecting increased focus and budget allocation for AI security in enterprises.
Reports regarding a potential UK ban on VPNs have been described as exaggerated, with technical and legal feasibility questioned.

Cybersecurity Brief – 2026-03-04

Wed, 04 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

AkzoNobel, a multinational paint company, confirmed a cyberattack that breached the network of one of its U.S. sites.
LexisNexis Legal & Professional confirmed a data breach involving unauthorized access to customer and business information, with stolen files leaked by attackers.
Cloud Imperium Games (developer of Star Citizen) disclosed a breach in January affecting systems containing user personal data.
The University of Hawaii Cancer Center reported a ransomware attack in August 2025 that compromised personal and health data of nearly 1.2 million individuals.
Amazon confirmed that drone strikes damaged three AWS data centers in the United Arab Emirates and one in Bahrain, resulting in significant outages.
Facebook experienced a worldwide outage, rendering accounts inaccessible for a period.
Interpol, with support from private threat hunters, dismantled an African cybercrime syndicate, resulting in 574 arrests and the recovery of over $3 million.

Newly Discovered Vulnerabilities

VMware Aria Operations (CVE-2026-22719): A remote code execution vulnerability is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog.
Android/Qualcomm Zero-Day (CVE-2026-21385): An actively exploited high-severity memory corruption flaw in Qualcomm display components was patched in the latest Android update.
MS-Agent AI Framework: A vulnerability in Microsoft’s AI framework allows attackers to achieve full system compromise through improper input sanitization, exploitable via the Shell tool.
Chrome Extension Flaw: A now-patched vulnerability allowed Chrome extensions to inherit Gemini’s camera, microphone, and file access permissions.
AirSnitch Wi-Fi Attack: Researchers disclosed a Wi-Fi vulnerability (“AirSnitch”) that allows nearby attackers to intercept sensitive data and perform machine-in-the-middle attacks, demonstrating that Wi-Fi client isolation may not provide adequate protection.
Honeywell IQ4 Building Controllers: Dispute over the impact of vulnerabilities in internet-exposed building management controllers, with researchers claiming thousands are at risk.
CrushFTP: Ongoing brute-force scans reported against CrushFTP instances, which have a history of serious vulnerabilities.

Notable Threat Actor Activity

Fake IT Support/Havoc C2: Threat actors are using fake tech support spam to deploy customized Havoc command-and-control (C2) frameworks inside organizations, enabling data exfiltration and persistence.
OAuth Redirect Abuse: Microsoft warned of phishing campaigns abusing OAuth URL redirection and error flows to bypass email and browser phishing protections, delivering malware to government targets.
Starkiller Phishing Suite: A new phishing toolkit, Starkiller, uses adversary-in-the-middle (AitM) reverse proxy techniques to bypass multi-factor authentication.
Compromised Site Management Panels: Sale of compromised cPanel credentials is surging in cybercrime markets, facilitating plug-and-play phishing and scam operations.
Pro-Iranian Cyber Activity: Increased hacktivist campaigns and cyberattacks attributed to pro-Iranian actors in response to US-Israeli military actions, with an emphasis on causing economic and physical disruption.
Iranian Targeting of IP Cameras: Iranian-linked cyber operations are targeting IP cameras in conjunction with physical warfare in the Middle East.
Silver Dragon: A Chinese-aligned threat group, “Silver Dragon,” is targeting organizations in Southeast Asia and Europe, demonstrating operational links to broader campaigns.
AI-Driven FortiGate Attacks: Threat actors are leveraging the open-source CyberStrikeAI platform in AI-assisted attacks targeting Fortinet FortiGate appliances across 55 countries.
Coruna iPhone Hacking Toolkit: A sophisticated iPhone exploitation toolkit, believed to have originated from a US government contract, is now in the hands of foreign spies and criminals and has likely compromised tens of thousands of devices.

Trends, Tools, or Tactics of Interest

RMM Tool Phishing: Fake video meeting invites are being used to trick users into installing remote monitoring and management (RMM) tools, enabling unauthorized access.
AI Agent and Identity Risks: The rise of Model Context Protocol (MCP) and AI agents is introducing new, unmanaged workload identities, increasing the complexity of identity management and potential attack surfaces.
Quantum Threat to RSA: Recent developments indicate quantum decryption of RSA may be achievable sooner than previously expected, raising concerns over the security of current cryptographic standards.
AI in Security Testing: The deployment of open-source, AI-native security testing platforms is being observed in active cyberattacks, particularly against network appliances.
cPanel Marketplaces: The commoditization of compromised site management credentials is enabling scalable, automated phishing attacks.
Wi-Fi Client Isolation Limitations: AirSnitch research demonstrates that Wi-Fi client isolation may not prevent interception or manipulation of sensitive data.
Vehicle Tire Pressure Sensors: Research shows tire pressure sensors can leak data enabling silent tracking of vehicles.
Journalistic Operations in Censored Environments: Journalists in Iran are relying on satellite communications and encrypted apps to circumvent internet blackouts.

Regulatory or Policy Developments

CISA Action: The addition of VMware Aria Operations CVE-2026-22719 to CISA’s Known Exploited Vulnerabilities catalog mandates urgent mitigation for US federal agencies and highlights the vulnerability’s significance.
Pentagon AI Procurement: The US Department of Defense has dropped Anthropic AI from certain projects over security risks, with OpenAI taking over, reflecting ongoing scrutiny of AI model integration in sensitive environments.
Google Chrome Release Cycle: Google Chrome will move to a two-week release cycle, enabling faster deployment of security patches and features.

Cybersecurity Brief – 2025-08-06

Wed, 06 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Pandora, the Danish jewelry retailer, confirmed a data breach after customer information was stolen in connection with ongoing Salesforce data theft attacks. The company warned customers of potential phishing attempts using their stolen data.
Cisco disclosed a data breach affecting Cisco.com user accounts after a voice phishing (vishing) attack targeted a company representative. Stolen data includes names, email addresses, and phone numbers.
PBS suffered a data breach resulting in the exposure of corporate contact information for employees and affiliates, which was subsequently leaked on Discord servers.

Newly Discovered Vulnerabilities

Google released security updates for Android, addressing six vulnerabilities in its August 2025 update. Two patched Qualcomm vulnerabilities (including an Adreno GPU flaw) were confirmed as actively exploited in the wild.
Adobe issued emergency patches for two zero-day vulnerabilities in Adobe Experience Manager (AEM) Forms on JEE. Proof-of-concept exploit chains allowing unauthenticated remote code execution had been published.
CISA added three legacy D-Link router vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog following reports of active exploitation.
A critical vulnerability (CVE-2025-54136, “MCPoison”) was disclosed in the Cursor AI-powered code editor, enabling persistent remote code execution via malicious MCP file swaps post-approval. This flaw poses a software supply chain risk.
SonicWall warned administrators to disable SSLVPN on Gen 7 firewalls amid a surge in ransomware attacks exploiting a suspected zero-day vulnerability. The company is actively investigating.
Public exploits for Microsoft SharePoint vulnerabilities (CVE-2025-53770, CVE-2025-53771) have been observed in the wild, with attackers reportedly stealing machine keys.

Notable Threat Actor Activity

A widespread phishing campaign is targeting Instagram users with fake notifications about failed login attempts, aiming to harvest credentials.
A global campaign leveraging 15,000 fake TikTok Shop domains is distributing malware and stealing cryptocurrency via AI-driven scams. Threat actors are using trojanized apps and credential theft tactics.
ClickFix social engineering attacks, which employ CAPTCHAs and sophisticated narratives to evade detection, have seen increased adoption over the past year, facilitating cross-platform malware infections.
Ransomware gangs are suspected of exploiting a SonicWall firewall zero-day in recent attacks.
The cybercrime underground continues to rely heavily on traditional attack methods, including phishing and social engineering, despite increasing professionalization and organisation.

Trends, Tools, or Tactics of Interest

Automated and AI-driven adversarial testing is gaining prominence, with vendors showcasing solutions at Black Hat USA 2025 and commentary on the transformation of penetration testing through AI.
Microsoft unveiled Project Ire, an autonomous AI agent capable of reverse engineering software to detect malware.
Attackers are increasingly using vishing (voice phishing) to compromise corporate accounts, as demonstrated in the Cisco breach.
HTTP request smuggling remains a relevant attack vector, with recent educational content highlighting its exploitation potential.
The distinction between misconfigurations and vulnerabilities in SaaS environments is being emphasised, as confusion between the two can result in overlooked security risks.
Security operations centers (SOCs) continue to struggle with alert fatigue, with industry discussion focused on strategies to reduce false positives and improve incident detection.
The rapid proliferation of AI-assisted development tools is raising concerns about software supply chain security and the challenge of securing code produced by non-traditional developers.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced an increase in the prize pool for its Zero Day Quest hacking contest to $5 million, incentivizing research into high-impact vulnerabilities, particularly in cloud and AI security.

Cybersecurity Brief – 2025-06-05

Thu, 05 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The Play ransomware gang has breached approximately 900 organizations globally as of May 2025, including critical infrastructure and government entities, according to an FBI advisory.
Media giant Lee Enterprises has disclosed a data breach affecting nearly 40,000 individuals, resulting from a February 2025 ransomware attack.
Ukrainian police arrested a hacker who compromised 5,000 accounts at an international hosting company to mine cryptocurrency, causing $4.5 million in damages.
Ukrainian intelligence claims to have hacked Russian aerospace and defense company Tupolev, developers of strategic bombers.
Multiple domains of the BidenCash carding market, a dark web marketplace for stolen credit cards and personal data, have been seized in an international law enforcement operation.

Newly Discovered Vulnerabilities

Cisco released patches for a critical authentication bypass vulnerability (CVE-2025-20120) in Identity Services Engine (ISE), affecting cloud deployments on AWS, Azure, and OCI. Public exploit code is available.
Additional Cisco advisories address vulnerabilities in both ISE and Customer Collaboration Platform (CCP), with public exploit code circulating.
Over 35,000 solar energy devices, primarily in Europe, are exposed online and vulnerable to potential hijacking attacks.
Qualcomm has patched three security flaws that have been exploited in the wild; device manufacturers must still apply these updates to their products.
Thousands of Asus routers have been compromised and are being leveraged as part of a botnet.
Researchers have demonstrated that deepfake audio detection models can be bypassed via replay attacks, allowing rerecorded deepfake audio to evade current detection mechanisms.

Notable Threat Actor Activity

Google exposed a financially motivated threat group tracked as UNC6040, specializing in vishing (voice phishing) campaigns targeting Salesforce users. Attackers use fake Data Loader apps to steal Salesforce credentials and data.
Hackers, including those claiming to be the ShinyHunters group, are conducting social engineering and extortion attacks against multinational organizations via Salesforce platform compromise.
Ongoing open-source supply chain attacks involve malicious packages on PyPI, npm, and RubyGems. These packages drain cryptocurrency wallets, exfiltrate sensitive data, or wipe codebases after installation. Some RubyGems impersonate legitimate plugins for the Fastlane development platform in geopolitically motivated campaigns.
A hacker is distributing backdoored GitHub code, targeting other hackers, gamers, and researchers with exploits and game cheats containing hidden remote access backdoors.
Attackers are exploiting device code authentication flows (such as those used by Microsoft Teams and IoT devices) to phish for access tokens, bypassing multi-factor authentication (MFA).
The FBI has issued a warning about NFT airdrop scams on the Hedera Hashgraph network, where cybercriminals use fraudulent airdrops to steal cryptocurrency from wallets.

Trends, Tools, or Tactics of Interest

A new Chaos RAT variant is targeting both Windows and Linux systems through fake network tool downloads.
Traditional Data Loss Prevention (DLP) tools are being outpaced by the growth of SaaS applications, resulting in increased risk of SaaS data leakage.
AS-REP roasting attacks against Kerberos/Active Directory are resurging, exploiting accounts without Kerberos pre-authentication to obtain password hashes.
Phishing campaigns are using techniques to hide malicious links from Outlook users, evading detection.
Increased GPS jamming and spoofing attacks are raising concerns about the resilience of global navigation systems.
The use of AI for code generation at scale is emerging as a threat, with potential for advanced automated cyberattacks (“vibe hacking”).
Cybersecurity training initiatives in Africa are being expanded by international organizations to increase the number of skilled professionals and disrupt cybercrime recruitment pipelines.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of State is offering up to $10 million for information on state-sponsored hackers linked to the RedLine infostealer malware operation.
Microsoft has launched a new European Security Program, providing free cybersecurity resources and support to European governments.
Law enforcement has undertaken international action to disrupt dark web markets, as evidenced by the BidenCash domain seizures.

Cybersecurity Brief – 2025-06-03

Tue, 03 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Cartier disclosed a data breach after its systems were compromised, exposing customers’ personal information.
The North Face warned customers of a credential stuffing attack in April that resulted in theft of personal information from its website.
SentinelOne experienced a seven-hour outage due to a software flaw.
A significant phishing campaign is targeting users in France, using leaked personal data to craft convincing emails.
The “Russian Market” cybercrime marketplace has become a major platform for trading credentials stolen by information stealer malware.

Newly Discovered Vulnerabilities

Google released an emergency out-of-band patch for Chrome to address three security issues, including a high-severity zero-day vulnerability under active exploitation.
Qualcomm issued security updates for three zero-day vulnerabilities in its Adreno GPU driver, which have been exploited in targeted attacks.
Three vulnerabilities in preinstalled Android apps on Ulefone and Krüger&Matz smartphones could allow any installed app to reset devices or steal PINs.
New details have emerged about a critical Cisco IOS XE vulnerability, increasing the risk of exploitation by attackers.
Unpatched vulnerabilities in Consilium Safety’s CS5000 Fire Panel could allow takeover of the OT/ICS platform, creating serious safety risks.

Notable Threat Actor Activity

Researchers identified a cryptojacking campaign targeting publicly accessible DevOps web servers (including Docker, Gitea, and HashiCorp Consul), using off-the-shelf tools from GitHub.
An anonymous whistleblower leaked substantial data connected to the alleged operator behind Trickbot and Conti ransomware operations.
Ongoing APT intrusions, AI-powered malware, and zero-click exploits were highlighted in recent threat activity recaps.

Trends, Tools, or Tactics of Interest

Threat actors are increasingly leveraging leaked personal data to enhance the effectiveness of phishing campaigns.
Living-off-the-land techniques and the use of easily accessible tools continue to feature in sophisticated cyber attacks.
The value of all data types is being emphasised in the context of data breaches, not just financial or credential data.
There is a notable trend towards credential theft and resale, as evidenced by the rise of platforms like Russian Market.
Organizations are being encouraged to move from perimeter-based security to data-centric protection strategies.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will distrust root CA certificates from Chunghwa Telecom and Netlock in August 2025 due to compliance failures.
Australia has introduced new ransomware payment disclosure rules, requiring certain organizations to report ransomware payments and related communications within 72 hours or face civil penalties.
Microsoft and CrowdStrike have partnered to align hacking group aliases, improving clarity while not standardizing nomenclature.
The Emergency Management and Response – Information Sharing and Analysis Center (EMR-ISAC) has shut down, impacting information sharing for the emergency services sector.