Cybersecurity Brief – 2025-05-10

Sat, 10 May 2025 00:00:00 +0000

Major Incidents or Breaches

Ascension Healthcare Breach: Ascension, a major US healthcare provider, disclosed a data breach affecting over 430,000 patients, exposing personal and healthcare information.
Insight Partners Data Breach: Ongoing investigation reveals the impact of the breach at venture capital firm Insight Partners is larger than initially anticipated, with affected customers being notified incrementally.
Japanese Financial Account Compromise: Hackers breached nearly 5,000 Japanese financial accounts in April, conducting almost $2 billion in fraudulent trades across nine securities firms.
LockBit Ransomware Gang Breach: LockBit’s affiliate panel was compromised, leaking sensitive operational data including Bitcoin addresses, private victim chats, and user credentials.

Firefox ESR 115.11 PDF.js Vulnerability: High-risk arbitrary JavaScript execution vulnerability identified in PDF.js within Firefox ESR 115.11, enabling potential remote code execution.
Apache ActiveMQ 6.1.6 Denial of Service: Medium-risk vulnerability in Apache ActiveMQ 6.1.6 allows attackers to trigger denial of service conditions.

Proxy Botnet Takedown: US and Dutch authorities dismantled a botnet of over 7,000 IoT and end-of-life devices used as residential proxies (Anyproxy and 5socks). Four foreign nationals (three Russian, one Kazakhstani) have been charged.
Chinese APT Targeting SAP NetWeaver: Ongoing exploitation of a critical SAP NetWeaver vulnerability has been linked to a Chinese threat actor, according to Forescout Vedere Labs.
North Korean OtterCookie Campaign: Updated OtterCookie v4 malware, used by North Korean actors, now features enhanced VM detection and capabilities for Chrome and MetaMask credential theft.
Initial Access Brokers in Brazil: Campaigns targeting Brazilian executives leverage NF-e-themed spam and trial versions of legitimate remote monitoring and management (RMM) tools to gain initial access.
Hacktivist Campaigns (#OpIndia): Following the Pahalgam attack, hacktivists have united under the #OpIndia banner, escalating cyber activity in the India-Pakistan conflict context.

Malicious npm Packages: Over 3,200 users of the macOS version of the Cursor AI code editor were infected with backdoored npm packages designed for credential theft.
Phishing Kit Sophistication: Emergence of advanced phishing kits capable of auto-generating customised login pages to evade detection and increase success rates.
Password and Passkey Risks: Even with passkey adoption, residual password vulnerabilities persist, highlighting the need for comprehensive credential management.
Polymorphic Browser Extension Threats: New threats targeting password managers via polymorphic browser extensions pose significant risks to credential security.
Vulnerability Management Challenges: Security teams continue to struggle with the reactive nature of vulnerability management and patching delays due to policy constraints.
AI Security Risks: Increased deployment of AI agents introduces new attack surfaces, including risks of data leaks and identity theft.

German Law Enforcement Action: German authorities shut down the eXch cryptocurrency mixer, seizing assets linked to cybercrime proceeds and laundering activities.
US Border Surveillance Expansion: US Customs and Border Protection plans to expand facial recognition for vehicle exits, while the US surveillance watchdog recommends transparency and voluntary participation for airport facial recognition programmes.
Google AI Countermeasures: Google is rolling out on-device AI protections (Gemini Nano LLM) in Chrome and Android to detect and block scams, including tech support scams, enhancing user protection through automated detection.

Rapid7 MDR Launch: Rapid7 has introduced a new Managed Detection & Response (MDR) service for enterprise customers.