Cybersecurity Brief – 2025-05-21

Wed, 21 May 2025 00:00:00 +0000

Major Incidents or Breaches

Cellcom Cyberattack: Wisconsin-based mobile carrier Cellcom confirmed a cyberattack caused widespread service outages beginning 14 May 2025.
SK Telecom Data Breach: SK Telecom disclosed a malware breach lasting three years (since 2022), exposing USIM data of 27 million subscribers.
RVTools Supply Chain Attack: The official website for RVTools, a VMware management utility, was compromised in a supply chain attack. Trojanized installers delivered the Bumblebee malware loader.
PowerSchool Extortion: A 19-year-old has pleaded guilty to a cyberattack on PowerSchool, involving extortion and exposure of student data.
KrebsOnSecurity DDoS Attack: KrebsOnSecurity experienced a near-record DDoS attack peaking at 6.3 Tbps.

Newly Discovered Vulnerabilities

WordPress ‘Motors’ Theme: A critical privilege escalation vulnerability allows unauthenticated attackers to take over admin accounts on sites using the premium Motors theme.
Virgin Media O2 Location Leak: A security flaw in Virgin Media O2’s mobile network could allow attackers to pinpoint call recipient locations within 100 square meters.
AWS Default IAM Roles: Researchers identified risky default IAM roles in AWS that can enable lateral movement and cross-service exploitation if misconfigured.

Notable Threat Actor Activity

Hazy Hawk: This group has been actively hijacking abandoned cloud resources (e.g., S3 buckets, Azure endpoints) via DNS misconfigurations and CNAME hijacking, targeting high-profile organizations including the US CDC, to deliver malware and conduct scams.
Scattered Spider: The group continues to target large retailers, shifting focus from UK to US organizations, leveraging IT help desk social engineering for initial access.
SideWinder APT: Targeted ministries in Sri Lanka, Bangladesh, and Pakistan using spear phishing, exploiting old Microsoft Office vulnerabilities, and deploying custom malware.
UnsolicitedBooker (China-aligned): Deployed the new MarsSnake backdoor in a multi-year campaign against a Saudi Arabian organization.
RedisRaider: A new Go-based cryptojacking campaign targets publicly accessible Redis servers to deploy XMRig miners.
VanHelsing Ransomware: The ransomware builder, affiliate panel, and data leak blog source code were leaked online, increasing the risk of further ransomware proliferation.
Fake Chrome Extensions: Over 100 malicious Chrome extensions have been discovered since February 2024, used to hijack browser sessions, steal credentials, and inject ads.

Trends, Tools, and Tactics

Service Desk Social Engineering: Attackers are increasingly targeting IT service desks with social engineering to bypass security controls (e.g., password resets, disabling MFA).
Novel Phishing Techniques: Recent phishing campaigns combine AES encryption with malicious npm packages to evade detection.
Supply Chain Threats: The RVTools incident highlights ongoing risks in software supply chains, with attackers distributing malware via compromised legitimate utilities.
Rise in Asia-based APTs: China and North Korea-aligned groups now account for over half of global APT attacks, with expanding international focus.
Exposure Management Enhancements: Tenable has added third-party connectors (AWS, Microsoft, competitors) to its platform for improved attack surface visibility.
Security Key Solutions: Yubico has expanded its YubiKey-as-a-Service globally, supporting hardware-based authentication in 175 countries.
AI Security Impacts: Increased adoption of AI agents is driving both new security opportunities and challenges, with most security leaders anticipating compliance and threat management implications.

Regulatory or Policy Developments

Genetic Data Privacy Concerns: Regeneron’s planned acquisition of 23andMe raises privacy concerns due to the lack of comprehensive federal regulation on genetic information transfers.

Cybersecurity Brief – 2025-05-20

Tue, 20 May 2025 00:00:00 +0000

Major Incidents and Breaches

UK Legal Aid Agency Data Breach: The UK Legal Aid Agency confirmed a significant data breach, with hackers stealing a large volume of sensitive applicant data. The breach led to the shutdown of the affected online service, and warnings have been issued to lawyers and defendants.
Arla Foods Cyberattack: Arla Foods experienced a cyberattack disrupting production operations and causing delays.
RVTools Supply Chain Compromise: The official RVTools website was compromised, distributing a trojanized installer delivering Bumblebee malware to users. Both Robware.net and RVTools.com are offline pending remediation.
Fake KeePass Distributions: Threat actors have been distributing trojanized KeePass password manager installers for at least eight months, leading to credential theft, Cobalt Strike beacon deployment, and subsequent ESXi ransomware attacks.

Newly Discovered Vulnerabilities

Firefox Zero-Days Patched: Mozilla released emergency updates for two zero-day vulnerabilities exploited at the Pwn2Own Berlin 2025 competition. These flaws could lead to sensitive data exposure or code execution.
O2 UK Location Leak: O2 UK patched a vulnerability in its VoLTE and WiFi Calling implementations that allowed attackers to determine user locations and other identifiers via call metadata.
Windows 10 BitLocker Recovery Issue: Microsoft issued out-of-band patches to address a problem causing Windows 10 systems to boot into BitLocker recovery mode after the May 2025 updates.

Notable Threat Actor Activity

Ransomware Gangs Using Skitnet Malware: Multiple ransomware groups are employing Skitnet malware for post-exploitation activities, including stealthy data theft and establishing remote access.
Malicious PyPI Packages: Researchers identified malicious Python packages on PyPI that check stolen email addresses against Instagram and TikTok APIs, likely to validate credentials for further exploitation.
Operation RoundPress Targeting Ukraine: A cyber-espionage campaign is targeting Ukrainian government entities with spear-phishing attacks exploiting XSS vulnerabilities in webmail platforms.
Phishing Kit Evolution: Commodity phishing kits are increasingly capable of auto-generating tailored login pages, enhancing the effectiveness of phishing attacks.

Trends, Tools, and Tactics

Continuous Threat Exposure Management (CTEM): CTEM is increasingly adopted as a core strategy for CISOs, moving from conceptual to operational in enterprise security programs.
Zero-Day Exploitation at Scale: Pwn2Own Berlin saw researchers exploit 29 zero-day vulnerabilities, earning over $1 million in rewards, highlighting ongoing challenges in proactive vulnerability management.
AI and Deepfake Use in Scams: Criminals are leveraging AI and deepfake technologies to enhance social engineering and scam campaigns, as seen in training provided to West African scam groups.
Supply Chain Attacks via Trusted Software: The RVTools and KeePass incidents underscore the growing risk of software supply chain attacks through compromised or fake installers.

Regulatory and Policy Developments

CISA Leadership Update: Madhu Gottumukkala has been appointed as the new Deputy Director of the US Cybersecurity and Infrastructure Security Agency (CISA).
CVE System Uncertainty: Ongoing disruption and uncertainty within the Common Vulnerabilities and Exposures (CVE) system may undermine foundational defensive security efforts.
Take It Down Act Enacted in US: The new law mandates quick removal of nonconsensual intimate imagery from online platforms, raising potential free speech and censorship concerns.
23andMe Acquisition and Data Privacy: Regeneron’s acquisition of 23andMe brings increased scrutiny to the privacy and security of genetic data.
Microsoft AI and Security Initiatives: Microsoft announced support for Anthropic’s MCP standard for AI agent security, open-sourced the Windows Subsystem for Linux, and introduced Windows AI Foundry to support secure AI-powered applications.

RVTools on DanSec Daily

Cybersecurity Brief – 2025-05-21

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, and Tactics

Regulatory or Policy Developments

Cybersecurity Brief – 2025-05-20

Major Incidents and Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, and Tactics

Regulatory and Policy Developments