Salesloft on DanSec Daily

Cybersecurity Brief – 2025-09-18

Thu, 18 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

ShinyHunters claims to have stolen over 1.5 billion Salesforce records from 760 companies via compromised Salesloft Drift OAuth tokens.
Insight Partners, a venture capital and private equity firm, has confirmed a ransomware breach impacting over 12,000 individuals, with personal information stolen.
SonicWall has warned customers to reset credentials following a breach that exposed firewall configuration backup files related to MySonicWall accounts.
A supply chain attack dubbed “Shai-Hulud” compromised over 180 NPM packages, injecting malicious code to harvest secrets, exfiltrate them to public repositories, and make private repositories public.
224 malicious apps were removed from the Google Play Store after researchers uncovered a large-scale ad fraud campaign.
Airline data broker is selling at least five billion passenger records to US government agencies through a searchable database.

Newly Discovered Vulnerabilities

Google released emergency updates for Chrome to patch four vulnerabilities, including CVE-2025-10585, a zero-day in the V8 JavaScript engine exploited in the wild. This is the sixth Chrome zero-day exploited this year.
NetRise identified that 20 device models from six vendors remain vulnerable to the decade-old Pixie Dust Wi-Fi attack, which allows attackers to recover WPS PINs and gain unauthorized network access.

Notable Threat Actor Activity

TA558 is conducting attacks targeting hotels in Brazil and Spanish-speaking markets, deploying Venom RAT and other remote access trojans using AI-generated scripts.
Chinese state-aligned TA415 has been linked to spear-phishing campaigns targeting US government, think tanks, and academic organizations focused on US-China economic and policy matters, leveraging VS Code Remote Tunnels for persistence and espionage.
Scattered Spider has resurfaced with new cyber attacks targeting the financial sector, contradicting previous claims of ceasing operations.
RaccoonO365, a large-scale phishing-as-a-service operation, was disrupted by Microsoft and Cloudflare. The service had enabled cybercriminals to steal thousands of Microsoft 365 credentials.
ClickFix threat actor has evolved tactics to distribute MetaStealer, using fake CAPTCHAs, File Explorer deception, and MSI lures.
Raven Stealer, a lightweight infostealer distributed via underground forums and cracked software, now targets Chromium-based browser data and exfiltrates it via Telegram.

Trends, Tools, or Tactics of Interest

AI-generated scripts are increasingly being used by threat actors (e.g., TA558) to automate and enhance malware deployment.
There is a rise in AI-powered sign-up fraud, with attackers exploiting enterprise sign-up funnels using advanced automation.
The use of phishing-as-a-service (PhaaS) kits, exemplified by RaccoonO365, continues to lower the barrier for cybercriminals to launch credential theft campaigns.
Supply chain attacks targeting open-source repositories (e.g., NPM) are ongoing, with attackers injecting worms to steal secrets and compromise private codebases.
Commodity infostealers are evolving in stealth and distribution, with examples like Raven Stealer using encrypted messaging platforms for exfiltration.
Security researchers are observing increased use of fake CAPTCHAs and system interface tricks in malware delivery.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft reminded customers that Office 2016 and Office 2019 will reach end of extended support on 14 October 2025, impacting security patch availability.
Multiple security startups (Irregular, RegScale, Scalekit) have raised significant funding for AI security testing, GRC platforms, and AI agent authentication, reflecting increased industry focus on AI and regulatory compliance.

Cybersecurity Brief – 2025-09-09

Tue, 09 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Multiple popular npm JavaScript packages, collectively exceeding two billion weekly downloads, were compromised in a supply chain attack after a maintainer’s account was accessed via phishing. At least 18–20 high-profile packages were affected, with attackers injecting malicious code to steal cryptocurrency and other sensitive data.
Salesloft experienced a breach beginning with the compromise of its GitHub account in March. Attackers stole Drift OAuth tokens, which were later used in widespread attacks targeting Salesforce instances in August, impacting at least 22 companies, including major cybersecurity firms such as BeyondTrust, Bugcrowd, CyberArk, Cato Networks, JFrog, and Rubrik.
A new supply chain attack, dubbed ‘GhostAction’, targeted GitHub workflows, leading to the theft of 3,325 secrets, including PyPI, npm, DockerHub, GitHub tokens, Cloudflare, and AWS keys. Hundreds of repositories were affected.
Plex, a media streaming platform, suffered a data breach in which a hacker accessed customer authentication data. Customers have been advised to reset their passwords.
Lovesac, a US-based furniture company, confirmed a data breach following ransomware attack claims, with exposure of personal data for an undisclosed number of individuals.
Wealthsimple, a Canadian fintech firm, reported a data breach resulting from a supply chain attack, impacting some customer information but not compromising accounts or funds.
In the second phase of the Nx supply chain attack, over 6,700 private repositories from hundreds of organizations were made public.
iCloud Calendar infrastructure was abused in a phishing campaign targeting PayPal users, leveraging Apple and Microsoft services to send legitimate-seeming call-back phishing emails.

Newly Discovered Vulnerabilities

Researchers observed a surge in network scans targeting Cisco ASA devices, raising concerns about a potential upcoming vulnerability or exploitation campaign against these products.

Notable Threat Actor Activity

At least 45 previously unreported domains dating back to May 2020 have been linked to China-backed threat actors Salt Typhoon and UNC4841, indicating longstanding cyber-espionage operations using undiscovered infrastructure for persistent access.
A campaign attributed to China’s APT41 involved impersonating a US lawmaker to deliver malware to US trade groups, aiming to collect intelligence ahead of trade talks.
The GPUGate malware campaign is using paid Google search ads and fake GitHub commits to distribute malware to IT firms, targeting users searching for popular tools.
‘MostereRAT’ malware, deployed by an unidentified threat actor, is designed to evade and disable endpoint detection and response (EDR) tools, enabling long-term persistence on Windows systems.

Trends, Tools, or Tactics of Interest

Multiple supply chain attacks are targeting software development ecosystems, with a focus on compromising developer accounts (notably via phishing) to inject malicious code into widely used packages and repositories.
Attackers are increasingly targeting CI/CD pipelines and GitHub workflows to steal secrets and credentials at scale.
AI-powered ransomware is emerging, with proof-of-concept tools like PromptLock demonstrating the potential for LLM-orchestrated file encryption and extortion.
Threat actors are leveraging legitimate cloud services and infrastructure (Apple, Microsoft) to increase the credibility and deliverability of phishing campaigns.
Use of HTTP request signatures in new attack traffic was observed in honeypots, indicating evolving tactics for authentication and evasion.

Regulatory or Policy Developments

CISA announced its top priorities for securing US infrastructure at the Billington CyberSecurity Summit, with a focus on operational collaboration and innovation between government and industry.
Significant cybersecurity industry M&A activity continued, with 27 deals in August involving major vendors including Accenture, CrowdStrike, F5, Okta, and SentinelOne.

Other Security Technology Developments

Signal introduced an opt-in feature for end-to-end encrypted cloud backups, enabling users to securely restore chats if devices are lost or damaged.

Cybersecurity Brief – 2025-09-05

Fri, 05 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

PowerSchool Data Breach: Texas Attorney General filed a lawsuit against PowerSchool following a December breach that exposed the personal information of 62 million students, including 880,000 Texans.
Chess.com Data Breach: Chess.com disclosed a breach after threat actors accessed a third-party file transfer application, compromising user data.
Bridgestone Cyberattack: Bridgestone confirmed a cyberattack affecting manufacturing operations in North America; details of the attack vector remain under investigation.
Wytec Website Hack: Wytec’s website was defaced twice by unknown actors and remains offline, with the company anticipating significant financial losses.
Salesloft Drift Supply Chain Attack: Multiple high-profile customers reported data breaches linked to a recent supply chain attack involving Salesloft Drift, though the full impact is still unclear.

Newly Discovered Vulnerabilities

Sitecore Zero-Day: Threat actors exploited a zero-day vulnerability in legacy Sitecore deployments, using exposed ASP.NET machine keys for ViewState deserialization attacks and deployment of WeepSteel malware.
TP-Link Router Flaws: CISA added CVE-2023-50224 and CVE-2025-9377, affecting TP-Link routers, to its Known Exploited Vulnerabilities catalog; TP-Link also confirmed a new unpatched zero-day impacting several router models.
Android Vulnerabilities: Two exploited vulnerabilities in Android-CVE-2025-48543 (Android Runtime) and CVE-2025-38352 (Linux kernel)-were patched after being leveraged in targeted attacks.

Notable Threat Actor Activity

GhostRedirector Campaign: ESET and other researchers identified a new threat actor, GhostRedirector, compromising at least 65 Windows servers (primarily in Brazil) via a passive C++ backdoor and a malicious IIS module (Gamshen), manipulating Google search results and boosting gambling sites.
APT28/NotDoor Backdoor: Russian state-sponsored group APT28 deployed a new Microsoft Outlook backdoor, NotDoor, targeting multiple companies in NATO countries.
Quad7 Botnet: The Quad7 botnet is exploiting end-of-life TP-Link routers to steal Microsoft 365 accounts.
SVG-Based Phishing: A global phishing campaign is leveraging undetected SVG files to deploy Base64-encoded phishing pages, including impersonation of the Colombian judicial system.
Phishing-as-a-Service: Researchers uncovered a long-running phishing-as-a-service operation using cloud infrastructure (Google, Cloudflare) and cloaking techniques to evade detection.
X (Twitter) Grok AI Abuse: Cybercriminals are exploiting X’s Grok AI to bypass ad protections and distribute malware via malicious links.
Model Namespace Reuse: Demonstrated AI supply chain attack method allows attackers to deploy malicious models and achieve code execution in Google and Microsoft environments.
US Rewards for Russian Hackers: The US government offered $10 million for three Russian hackers accused of targeting critical infrastructure and energy firms worldwide.

Trends, Tools, or Tactics of Interest

AI-Driven Attack Chains: Reports indicate AI tools can now automate entire attack chains, increasing operational efficiency for threat actors.
AI-Enhanced Phishing: Healthcare organisations are being warned about an anticipated surge in AI-powered phishing attacks.
Vishing Scams: Continued prevalence of vishing scams, with attackers impersonating law enforcement to issue fake arrest warrants.
Browser-Based Attacks: Security teams are advised to prepare for increasing browser-based threats, including phishing kits, malicious OAuth apps, and browser extensions.
BlockEDRTraffic Tool: Release of BlockEDRTraffic, a tool for EDR-evasive lateral movement, which uses Windows Firewall or Filtering Platform to block telemetry and create stealth windows.
VPN Security Concerns: Popular Android VPN apps found to have security flaws and undisclosed links to China, raising concerns over data privacy and exposure.
Supply Chain Security & SBOMs: US and allied nations are promoting Software Bill of Materials (SBOM) adoption to enhance supply chain transparency and reduce risk.
Incident Response Skills Gap: ISC2 launched a Threat Handling Foundations Certificate to address the digital forensics and incident response (DFIR) skills gap.

Regulatory or Policy Developments

French Data Protection Fines: The French data protection authority fined Google €325 million ($379 million) and Shein €150 million ($175 million) for violating cookie consent rules and displaying unauthorised ads.
Czech Cybersecurity Warning: Czech agency NÚKIB issued a warning regarding the use of products that transmit user data to China, highlighting national security risks.
Roblox Age Verification: Roblox introduced age estimation requirements for access to communication features, aiming to protect minors from sexual predators.

Cybersecurity Brief – 2025-09-04

Thu, 04 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover experienced a severe cyberattack, forcing the disconnection of systems and causing significant disruption to both retail and manufacturing operations.
Workiva, a major SaaS provider, disclosed a data breach after attackers accessed customer data via a compromised third-party Salesforce CRM system.
Multiple security firms, including Cloudflare, Palo Alto Networks, and Zscaler, were impacted by a breach involving Salesforce, Salesloft, and Drift, resulting in the exposure of customer contact information and case data.
The Pennsylvania Attorney General’s office confirmed a ransomware attack that caused weeks-long outages of email, phone, and web services. No ransom was paid.
Wiz Research reported a data leak at Chinese AI company DeepSeek, exposing over 1 million sensitive log streams.
The US Department of Justice filed a lawsuit against Apitor Technology for exposing children’s geolocation data to a Chinese third party without consent.
Disney agreed to pay $10 million to settle US FTC claims regarding the improper collection of children’s data on YouTube.

Newly Discovered Vulnerabilities

Google released September 2025 Android updates addressing over 100 vulnerabilities, including at least two zero-days (CVE-2025-2355, CVE-2025-2356) that are actively exploited.
A high-severity use-after-free vulnerability in Google Chrome’s V8 JavaScript engine was patched, preventing potential remote code execution.
CISA flagged an actively exploited vulnerability in TP-Link TL-WA855RE Wi-Fi range extenders, allowing attackers to reset and hijack affected devices. CISA recommends retiring these discontinued devices.
Exploit attempts were observed for CVE-2025-5086, a vulnerability in Dassault DELMIA Apriso used in manufacturing environments.
A WhatsApp bug, in conjunction with an Apple zero-day, is being used in targeted zero-click attacks against iPhone users, potentially for spyware deployment.

Notable Threat Actor Activity

An Iran-linked group, identified as Homeland Justice APT and associated with MOIS, conducted a coordinated spear-phishing campaign targeting over 100 embassy and consulate email accounts globally, aiming to spy on diplomats and international organisations.
Russian APT28 (Fancy Bear) is leveraging new ‘NotDoor’ malware to abuse Microsoft Outlook for covert data exfiltration.
North Korean IT worker scams remain a focus of regional countermeasures, with Japan and South Korea collaborating with private sector partners to disrupt these operations.
Malicious npm packages targeting Ethereum smart contract developers were discovered, using blockchain smart contracts to perform malicious actions on compromised systems.
Automated sextortion spyware, identified as a variant of “infostealer” malware, is taking screenshots and webcam photos of victims viewing adult content for extortion purposes.
Threat actors are using X’s Grok AI assistant to bypass link posting restrictions and distribute malicious links on the platform.
PayPal users are being targeted in a sophisticated email scam with the subject “Set up your account profile.”

Trends, Tools, or Tactics of Interest

Threat actors are rapidly adopting AI-powered offensive tools, specifically HexStrike AI, to exploit newly disclosed n-day vulnerabilities, including Citrix flaws, within days of public disclosure.
Increasing use of generative AI by attackers to craft more convincing phishing emails.
Endpoint security is seeing a shift towards AI-driven solutions, as highlighted in the 2025 Gartner Magic Quadrant, with a focus on countering advanced ransomware and phishing attacks.
Research indicates that compromised routers can remain undetected and accessible on the internet for years, highlighting persistent risks to infrastructure.
Geolocation data is being increasingly weaponised in advanced persistent threat (APT) operations and malware, enabling targeted attacks based on physical location.

Regulatory or Policy Developments

CISA, NSA, and 19 international partners released a joint statement outlining a shared vision for the Software Bill of Materials (SBOM), promoting its role in securing global software supply chains.
The US Department of State announced a $10 million bounty for information on three Russian FSB officers involved in cyberattacks against US critical infrastructure.
Law enforcement, in cooperation with the Alliance for Creativity and Entertainment, disrupted Streameast, the world’s largest illegal sports streaming platform, with arrests made in Egypt.

Cybersecurity Brief – 2025-09-03

Wed, 03 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Salesloft Drift Supply Chain Attack: Multiple organizations, including Cloudflare, Palo Alto Networks, and Zscaler, were impacted by a supply chain attack stemming from the compromise of OAuth tokens via Salesloft Drift, a marketing SaaS application. Attackers leveraged the compromised tokens to access Salesforce instances, exposing customer data and support cases.
Jaguar Land Rover Cyberattack: Jaguar Land Rover reported a cyberattack that severely disrupted production and required the shutdown of certain systems.
Evertec/Sinqia Attempted Bank Heist: Hackers breached Sinqia S.A., the Brazilian subsidiary of fintech firm Evertec, and attempted to steal $130 million via unauthorized access to the central bank’s Pix real-time payment system.
Pennsylvania Attorney General’s Office Ransomware Attack: The Pennsylvania AG’s office confirmed a ransomware attack responsible for a two-week service outage.

Newly Discovered Vulnerabilities

WhatsApp Zero-Day (CVE-2025-55177): A zero-day vulnerability in WhatsApp was exploited in attacks targeting Apple users, including iOS and macOS, reportedly as part of suspected spyware operations. CISA added this flaw to its Known Exploited Vulnerabilities catalog.
TP-Link TL-WA855RE Flaw: CISA added a high-severity vulnerability affecting TP-Link TL-WA855RE Wi-Fi Range Extender devices to its KEV catalog amid reports of active exploitation.
Sangoma FreePBX Zero-Day (CVE-2025-57819): Sangoma patched a critical zero-day vulnerability (CVSS 10.0) in FreePBX servers involving insufficient sanitization of user-supplied data, which had been exploited in the wild.
WatchDog Anti-malware Driver Vulnerability: The Silver Fox threat actor exploited a previously unknown vulnerability in a Microsoft-signed WatchDog Anti-malware driver as part of a Bring Your Own Vulnerable Driver (BYOVD) attack to deploy ValleyRAT malware.
Azure Active Directory Credential Exposure: Researchers highlighted risks from leaked JSON configuration files containing Azure Active Directory credentials, potentially allowing attackers to authenticate via Microsoft OAuth 2.0 endpoints and infiltrate Azure environments.

Notable Threat Actor Activity

Lazarus Group: North Korea-linked Lazarus Group expanded its malware arsenal, distributing cross-platform malware strains PondRAT, ThemeForestRAT, and RemotePE via social engineering campaigns.
Silver Fox: This threat actor abused a vulnerable WatchDog driver to deploy ValleyRAT malware, leveraging BYOVD techniques.
Midnight Blizzard/APT29: Russian state-linked group APT29 conducted a credential theft campaign by redirecting victims to fake Cloudflare verification pages and exploiting Microsoft’s device code authentication flow. Amazon disrupted this campaign.
Ukrainian Network FDN3: Researchers observed FDN3 launching massive brute-force and password spraying attacks against SSL VPN and RDP devices between June and July 2025.
MystRodX Backdoor: Researchers disclosed a new backdoor, MystRodX, capable of using DNS and ICMP triggers for stealthy command and control, with features for capturing sensitive data.

Trends, Tools, or Tactics of Interest

Large-Scale DDoS Attacks: Cloudflare mitigated the largest recorded volumetric DDoS attack, peaking at 11.5 Tbps, part of a broader wave of UDP flood attacks originating from IoT and cloud infrastructure.
Supply Chain Risk: The Salesloft Drift incident demonstrates ongoing risks associated with SaaS supply chain dependencies and OAuth token abuse.
WordPress Threat Landscape: Continued exploitation of vulnerable and malicious WordPress plugins enables attackers to compromise sites and leverage them for further cyber threats and scams.
Shadow AI Usage: MIT’s State of AI in Business report revealed that while 40% of organizations have enterprise LLM subscriptions, over 90% of employees are using AI tools outside sanctioned platforms, increasing shadow AI risks.
TagNabIt Tool: TagNabIt released as an offensive security tool enabling enumeration of AWS cloud resources via metadata tags, exposing potential attack surfaces.
Cookie & Session Hijacking Risks: Kaspersky highlighted risks associated with improper cookie management and session hijacking, underscoring the need for secure configuration.

Regulatory or Policy Developments Affecting the Security Industry

NIST Security Controls Update: NIST released Security and Privacy Control version 5.2.0, introducing enhancements to help organizations improve patch management practices.
CISA Leadership Change: CISA announced Nicholas Andersen as the new Executive Assistant Director for Cybersecurity.
UAE Cyber Education Initiative: The United Arab Emirates launched a cyber education initiative aimed at improving cybersecurity preparedness among students.
Varonis Acquisition: Varonis announced the acquisition of email security firm SlashNext for up to $150 million, expanding its security offerings.

Cybersecurity Brief – 2025-09-02

Tue, 02 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Zscaler experienced a data breach after threat actors accessed its Salesforce instance via compromised third-party platforms (Salesloft and Drift), resulting in the exposure of customer information, including support case contents.
The breach at AI chatbot maker Salesloft continues to have repercussions, with mass theft of authentication tokens affecting numerous organisations that integrate Salesloft with Salesforce.
Amazon researchers disrupted an operation by Russian state-sponsored threat group Midnight Blizzard (APT29), who were targeting Microsoft 365 accounts and data.
American consumer credit reporting agency TransUnion was listed among the week’s top attacks and breaches.

Newly Discovered Vulnerabilities

WhatsApp patched a vulnerability that enabled zero-click attacks, which was exploited in conjunction with an Apple vulnerability.

Notable Threat Actor Activity

North Korea-linked group ScarCruft (APT37) is conducting a phishing campaign targeting South Korean academics, delivering RokRAT malware.
Russian APT29 (Midnight Blizzard) was actively targeting Microsoft 365 environments before their operation was disrupted by Amazon.
Sextortion campaigns continue at scale, with analysis of 1,900 messages and 205 Bitcoin addresses over four years providing insights into threat actor behaviour and tactics.

Trends, Tools, or Tactics of Interest

A malicious npm package, nodejs-smtp, was discovered mimicking Nodemailer and targeting cryptocurrency wallets (Atomic and Exodus) by injecting malicious code into desktop applications.
Android malware droppers are shifting from delivering primarily banking trojans to distributing a broader range of threats, including SMS stealers and spyware.
Over 80% of security incidents now originate from web applications, with browsers increasingly becoming a primary attack surface for enterprise environments.
Ongoing scams are targeting travellers to the UK, with fraudsters offering fake Electronic Travel Authorisation (ETA) documents for inflated prices or to harvest personal and financial data.

Regulatory or Policy Developments Affecting the Security Industry

No significant regulatory or policy developments were reported in the covered period.

Cybersecurity Brief – 2025-08-31

Sun, 31 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion Data Breach: TransUnion disclosed a data breach affecting 4.4 million US consumers. The incident stemmed from a compromise of a third-party application used for consumer support operations.
Nevada Ransomware Attack: The State of Nevada confirmed a ransomware incident that led to widespread service disruptions, office closures, and data theft. The state is collaborating with CISA and law enforcement to restore services.
Google Workspace Accounts Compromised: Google confirmed that the OAuth token compromise involved in the Salesforce–Salesloft Drift data theft campaign also allowed unauthorized access to a small number of Google Workspace accounts.
VerifTools Fake ID Marketplace Seized: US and Dutch authorities dismantled the VerifTools marketplace, which sold fraudulent identity documents enabling bypass of KYC checks and access to online accounts. Operators relaunched the service on a new domain shortly after the seizure.
Iranian Ships Hacked: Communications of dozens of Iranian ships were disrupted in a targeted cyberattack.
TamperedChef Infostealer Campaign: Threat actors distributed the TamperedChef infostealer via fraudulent PDF editor websites promoted through Google ads.
Sogou Zhuyin Update Server Hijacked: An abandoned update server for the Sogou Zhuyin IME was hijacked and used to deliver multiple malware families in an espionage campaign targeting Taiwan.

Newly Discovered Vulnerabilities

WhatsApp Zero-Click Exploit: WhatsApp patched a security vulnerability in its iOS and macOS clients that was exploited in targeted zero-day attacks, reportedly in conjunction with a recently disclosed Apple flaw.
Sitecore Experience Platform Flaws: Three new vulnerabilities were disclosed in Sitecore Experience Platform, enabling cache poisoning, information disclosure, and remote code execution.
FreePBX Zero-Day Flaw: Sangoma issued an emergency patch for a zero-day vulnerability in FreePBX, which was being actively exploited on systems with exposed administrator control panels.
Passwordstate Authentication Bypass: Click Studios released security updates to address an authentication bypass vulnerability in the emergency access page of its Passwordstate password manager.

Notable Threat Actor Activity

APT29 Watering Hole Campaign: Amazon disrupted a watering hole campaign conducted by Russia-linked APT29, which abused Microsoft device code authentication for intelligence gathering.
Storm-0501 Ransomware Group: Storm-0501 exploited hybrid cloud security gaps to gain full Azure control in enterprise attacks, focusing on data exfiltration and deletion rather than deploying file-encrypting ransomware.
North Korean IT Worker Operation: US Treasury sanctioned a Russian national and a Chinese firm for facilitating North Korean IT workers who used stolen identities, AI, and malware to generate revenue for North Korea.
TamperedChef Distribution Tactics: Threat actors used Google ads and fraudulent PDF editor websites to distribute the TamperedChef infostealer.
Sogou Zhuyin Espionage: Threat actors weaponized an abandoned update server to deliver malware as part of an espionage campaign in Taiwan.

Trends, Tools, or Tactics of Interest

Abuse of Forensic Tools: Attackers deployed the open-source Velociraptor forensic tool for malicious purposes, including using Visual Studio Code for command and control tunneling.
AI-Driven Exploitation: Security researchers noted that AI and large language models are accelerating exploit development, enabling proof-of-concept code to be generated within minutes.
Cloud-Native Ransomware Tactics: Ransomware actors are increasingly leveraging cloud-native capabilities for data exfiltration and deletion, rather than traditional file encryption.
Generative AI Platform Risks: Increased use of generative AI platforms (e.g., ChatGPT, Gemini, Copilot, Claude) in enterprises is raising concerns about data leakage and the need for improved network visibility.
macOS Attack Adaptation: Analysis shows attackers are adapting to macOS built-in protections by employing techniques to bypass or deceive users and evade detection.
OAuth Token Abuse: The Salesforce–Salesloft Drift campaign demonstrates continued threat actor focus on OAuth token compromise for lateral movement across cloud services.

Regulatory or Policy Developments

Microsoft Azure MFA Enforcement: Microsoft will enforce multi-factor authentication for all Azure resource management actions starting October, aiming to mitigate unauthorized access risks.
US Sanctions on North Korean IT Worker Facilitators: The US Treasury imposed sanctions on entities supporting North Korean IT workers involved in cyber operations.
Android Developer Verification: Only apps from verified developers will be allowed to run on Android devices, as part of measures to improve platform security.

Cybersecurity Brief – 2025-08-30

Sat, 30 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion Data Breach: TransUnion reported a data breach impacting 4.4 million individuals. The breach was linked to a third-party application used for US consumer support operations. No further details on the application were disclosed.
Nevada Ransomware Attack: The state of Nevada confirmed a ransomware attack that resulted in office closures, service disruptions, and data theft. Nevada is working with CISA and law enforcement to restore affected systems.
Google Workspace Accounts Compromised: Google confirmed that the OAuth token compromise, previously associated with Salesforce data theft, also enabled attackers to access a limited number of Google Workspace accounts via the Salesloft Drift integration.
VerifTools Marketplace Takedown: US and Dutch authorities dismantled the VerifTools marketplace, which sold fraudulent identity documents used to bypass KYC checks and facilitate online fraud. Operators relaunched the service on a new domain after the takedown.
Sogou Zhuyin Update Server Hijack: An abandoned update server for the Sogou Zhuyin IME was hijacked and weaponised in a Taiwan-focused espionage campaign, delivering multiple malware families.
Iranian Ships Hacked: Communications for dozens of Iranian ships were disrupted in a cyber operation, details of which were not attributed to any specific actor.

Newly Discovered Vulnerabilities

WhatsApp Zero-Click Vulnerability: WhatsApp patched a security vulnerability in its iOS and macOS clients, reportedly exploited in zero-day attacks in conjunction with a recently disclosed Apple flaw.
FreePBX Zero-Day: Sangoma issued an emergency patch for an actively exploited zero-day vulnerability in FreePBX systems with exposed administrator control panels.
Sitecore Experience Platform Flaws: Three new vulnerabilities in the Sitecore Experience Platform were disclosed, enabling cache poisoning, information disclosure, and remote code execution.
Passwordstate Authentication Bypass: Click Studios released a security update for Passwordstate to address an authentication bypass vulnerability affecting the emergency access page.

Notable Threat Actor Activity

APT29 Watering Hole Campaign: Amazon identified and disrupted a watering hole campaign by Russia-linked APT29 actors, which abused Microsoft device code authentication for intelligence gathering.
Storm-0501 Ransomware Tactics: Storm-0501 exploited hybrid cloud environments to gain full Azure control in enterprise attacks, focusing on data exfiltration and deletion without deploying file-encrypting malware.
North Korean IT Worker Facilitation: The US Treasury sanctioned a Russian national and a Chinese company for assisting North Korean IT workers in exploiting stolen identities, AI, and malware to generate illicit funds for North Korea.

Trends, Tools, or Tactics of Interest

AI-Driven Exploit Generation: Security researchers noted the increasing use of AI and large language models to rapidly generate proof-of-concept exploits, significantly reducing the time required to weaponise vulnerabilities.
Attacker Adaptation to macOS Protections: Analysis revealed how threat actors are bypassing or deceiving users to circumvent macOS built-in security mechanisms, including social engineering and exploiting user trust.
Cloud-Native Ransomware Tactics: Ransomware groups are leveraging cloud-native features for attack operations, including data exfiltration and deletion, rather than traditional file encryption.
Generative AI Data Leak Risks: The proliferation of generative AI platforms (e.g., ChatGPT, Gemini, Copilot, Claude) in organisations is increasing concerns about data leakage and the need for improved network visibility and controls.
Secure Coding Gaps: Ongoing concerns were highlighted regarding the lack of secure coding education in cybersecurity curricula, despite its importance in reducing vulnerabilities.

Regulatory or Policy Developments

Microsoft Azure MFA Enforcement: Microsoft will mandate multi-factor authentication for all Azure resource management actions starting in October, aiming to enhance protection against unauthorised access.
US Sanctions Related to North Korean Cyber Activity: The US imposed sanctions on entities facilitating North Korean cyber operations, specifically targeting those supporting illicit IT worker activities and related financial schemes.
Android Developer Verification: Only applications from verified developers will be permitted to run on Android devices, as part of Google’s efforts to improve the security of the app ecosystem.

Cybersecurity Brief – 2025-08-29

Fri, 29 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion suffered a data breach impacting over 4.4 million individuals in the US, exposing personal information but not credit reports or core credit data.
MathWorks (MATLAB developer) disclosed a ransomware attack that resulted in the theft of data belonging to over 10,000 individuals.
Google confirmed that the Salesloft breach is larger than previously reported, with attackers using stolen OAuth tokens to access both Google Workspace email accounts and Salesforce data.
The maintainers of the Nx build system reported a supply chain attack involving malicious npm packages and plugins, resulting in the leakage of over 2,300 GitHub, cloud, and AI credentials. This incident marks the first known use of AI-powered stealers in a supply chain attack.
Law enforcement agencies (FBI and Dutch Police) seized servers and domains associated with the VerifTools fake ID marketplace.
TransUnion and MathWorks incidents highlight continued targeting of large data repositories by threat actors, with significant personal data exposure.

Newly Discovered Vulnerabilities

A high-severity authentication bypass vulnerability was disclosed in Passwordstate, an enterprise password manager. Customers have been urged to patch immediately.
A flaw in the Visual Studio Code Marketplace allows attackers to republish previously deleted extensions under the same names, posing a risk to the software supply chain.
Researchers highlighted hidden vulnerabilities in popular project management tools (e.g., Trello, Asana), with risks including data exposure and insufficient backup protections.

Notable Threat Actor Activity

The China-linked APT group Salt Typhoon has exploited vulnerabilities in Cisco, Ivanti, and Palo Alto devices to breach over 600 organizations globally, including critical infrastructure in telecom, government, and military sectors. The group maintains persistent access for espionage purposes.
Cybercriminals are actively recruiting social engineering talent with fluent English skills, according to a new report on the cybercriminal recruitment ecosystem.
A new phishing-as-a-service (PhaaS) platform named “Salty 2FA” is being used to bypass MFA and steal Microsoft 365 credentials, targeting organizations across North America and Europe.
The TamperedChef malware campaign uses malvertising and fake PDF editor sites to deliver an information stealer that exfiltrates credentials and cookies.
North Korean IT worker schemes were targeted by new US Treasury sanctions, exposing $600K in crypto transfers and over $1M in profits for DPRK-linked threat actors.
Threat actors have abused Anthropic’s Claude AI to develop ransomware and automate data extortion campaigns.
Akira and Cl0p remain among the most active ransomware-as-a-service groups, with reports noting increased use of AI by both established and emerging gangs.

Trends, Tools, or Tactics of Interest

First documented AI-weaponized supply chain attack occurred via the Nx build system, where AI-powered stealers were used to rapidly exfiltrate developer secrets.
There is a notable rise in requests for ZIP files in web honeypot logs, indicating a possible trend in attackers seeking to exploit ZIP-based delivery or exfiltration methods.
Shadow IT continues to expand organizational attack surfaces, with researchers finding widespread exposed backups, open Git repositories, and accessible admin panels containing sensitive data.
RedExt, a browser extension-based C2 framework, has been released for red team operations, enabling data collection and command-and-control via Chromium-based browsers.
Meta reported shutting down millions of WhatsApp accounts linked to scam centers, reflecting ongoing large-scale anti-fraud operations.
Increasing use of malvertising and fake software download sites to deliver malware, as seen in the TamperedChef campaign.
Affiliates are flocking to scam gambling sites that lure victims with free credits and steal cryptocurrency deposits.
Microsoft Word for Windows will soon autosave and default to cloud storage for new documents.
CISA, FBI, and NSA issued a global advisory on the widespread espionage activities of Chinese nation-state actors targeting network devices.

Regulatory or Policy Developments

The US Treasury’s Office of Foreign Assets Control (OFAC) imposed new sanctions on individuals and entities associated with North Korean IT worker schemes.
The FCC disconnected over a thousand voice operators from the public telephone network for failing to combat robocalling.
CISA released updated Software Bill of Materials (SBOM) guidelines, receiving mixed industry reviews regarding their effectiveness and practical utility.

Cybersecurity Brief – 2025-08-28

Thu, 28 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

A cyberattack on Swedish IT systems supplier Miljödata has disrupted services across more than 200 municipalities, impacting approximately 80% of Sweden’s municipal systems.
Nevada state agencies experienced a disruptive cyberattack, leading to the shutdown of in-person services and state websites; emergency services reportedly remain unaffected.
Healthcare Services Group (HSGI) disclosed a data breach affecting 624,000 individuals, exposing personal information.
Hundreds of Salesforce customers were affected by a widespread data theft campaign, traced to compromised OAuth tokens associated with the Drift AI chat agent via the Salesloft platform. Attackers exported corporate data, including AWS and Snowflake keys.
TheTruthSpy stalkerware suffered a new vulnerability, exposing all user records to compromise.
77 malicious apps, including adware and advanced banking trojans, were removed from the Google Play Store following researcher discovery.

Newly Discovered Vulnerabilities

Over 28,000 Citrix NetScaler devices remain vulnerable to a critical remote code execution flaw (CVE-2025-7775), which is actively being exploited in the wild. Citrix and CISA have issued emergency patch deadlines.
Sangoma FreePBX issued an emergency fix for a zero-day vulnerability in its Administrator Control Panel, which has been actively exploited on internet-exposed systems.
A new vulnerability in TheTruthSpy Android stalkerware allows attackers to compromise any record in the system.

Notable Threat Actor Activity

The financially motivated Storm-0501 group has shifted tactics, exploiting Microsoft Entra ID to conduct data exfiltration and extortion attacks targeting hybrid and cloud environments, moving away from traditional ransomware to cloud-based encryption and data theft.
ShadowSilk, a threat cluster, targeted 35 government organizations in Central Asia and APAC using Telegram bots for command and control.
Blind Eagle, linked to five distinct activity clusters, targeted Colombia with RATs, phishing lures, and dynamic DNS infrastructure between May 2024 and July 2025.
China-linked actors, including Salt Typhoon and Mustang Panda, have been attributed to global espionage campaigns. Salt Typhoon operations were linked to Chinese tech firms and targeted networks worldwide. Mustang Panda hijacked captive portals to redirect Asian diplomats’ browsers to phishing sites.
UNC6395 engaged in widespread data theft, exploiting OAuth tokens from the Salesloft Drift app to compromise Salesforce customers.
UNC6384, another China-linked group, used social engineering, signed malware, and adversary-in-the-middle attacks to hijack web traffic and deliver backdoors.
“ZipLine” phishing campaign employed a novel technique where victims initiate email contact, affecting organizations across multiple sectors.
The Purgatory group has been identified as responsible for swatting attacks against US universities, offering such services for payment.

Trends, Tools, or Tactics of Interest

AI-powered ransomware has emerged with the discovery of PromptLock, a cross-platform strain using OpenAI’s gpt-oss:20b model and Lua scripts to encrypt and steal data on Windows, macOS, and Linux. PromptLock dynamically generates attack scripts in real time.
Anthropic disrupted an operation in which its Claude AI chatbot was weaponized for large-scale theft and extortion, automating reconnaissance, credential harvesting, and intrusions across critical sectors.
AI-generated phishing campaigns are increasingly sophisticated, with attackers crafting emails to deploy tools such as ConnectWise ScreenConnect for remote access.
Malware-as-a-service competition has led to more refined and accessible infostealers, driving modern cybercrime.
The Q2 2025 vulnerabilities and exploits report noted a significant number of published vulnerabilities and increased use of command-and-control frameworks.
Zero trust is highlighted as an ongoing, adaptive process in response to evolving threats, including supply chain attacks and policy drift.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. NSA, UK NCSC, and international partners issued a joint advisory attributing global hacking campaigns to Chinese state-sponsored actors, specifically Salt Typhoon, and provided guidance on countering such threats.
CISA and partners are providing real-time incident response support for the Nevada state cyberattack.
Google announced new developer verification requirements aimed at reducing harmful apps on Android, enhancing platform security.

Cybersecurity Brief – 2025-08-27

Wed, 27 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Nevada State Government: A cyberattack has disrupted Nevada state IT systems, forcing the closure of all state offices and impacting government websites, phone systems, and online platforms.
Farmers Insurance: Data breach affecting 1 million customers; details of the compromised data have not been publicly disclosed.
Nissan Japan: Confirmed a data breach at subsidiary Creative Box Inc. (CBI), with Qilin ransomware claiming responsibility.
Healthcare Services Group: Data breach impacted 624,000 individuals, with theft of personal information.
Auchan: Data breach resulted in theft of personal information from hundreds of thousands of customers.
Data I/O: Ransomware attack caused operational outages; the full scope of the breach is not yet known.
Salesloft: Breach led to theft of OAuth and refresh tokens via its Drift chat agent integration, enabling attackers to access Salesforce customer environments and exfiltrate data.

Newly Discovered Vulnerabilities

Citrix NetScaler: Three vulnerabilities patched in NetScaler ADC and NetScaler Gateway, including CVE-2025-7775, a critical remote code execution flaw actively exploited as a zero-day.
Git: CISA warns of an actively exploited arbitrary code execution vulnerability, urging immediate patching to prevent remote code execution.
Docker Desktop: Critical vulnerability enables attackers to modify the filesystem of Windows hosts and escalate privileges to administrator.
5G Mobile Networks: Researchers disclosed the “Sni5Gect” attack, which can crash phones and downgrade 5G connections to 4G without a rogue base station.
AI Systems: New research demonstrates that prompt injection attacks can be performed via malicious instructions hidden in images, exploiting image scaling processes.

Notable Threat Actor Activity

Silk Typhoon (Mustang Panda): State-sponsored group hijacked network captive portals to redirect diplomats’ web traffic to malware-serving sites.
Qilin Ransomware: Claimed responsibility for the Nissan Japan design studio breach.
MixShell Malware: Sophisticated social engineering campaign targeting U.S. supply chain manufacturing firms via contact forms, delivering in-memory malware.
ShadowCaptcha Campaign: Large-scale exploitation of over 100 compromised WordPress sites to redirect users to fake CAPTCHA pages, distributing ransomware, information stealers, and crypto miners.
HOOK Android Trojan: Newly identified variant adds ransomware-style overlay screens and supports 107 remote commands; now being distributed via GitHub.
ZipLine Phishing Campaign: Persistent and sophisticated phishing attacks targeting U.S. companies, leveraging advanced social engineering tactics.

Trends, Tools, or Tactics of Interest

Endpoint Security: AI-driven detection and response capabilities highlighted as key trends in the 2025 Gartner Magic Quadrant, reflecting the increasing sophistication and volume of endpoint threats, especially ransomware.
Remote Desktop Services: Surge in coordinated malicious scanning of Microsoft RDP services, potentially indicating a new or undisclosed vulnerability.
Legal Botnets: Discussion of DSLRoot proxies and the emergence of “legal botnets” that exploit residential IP addresses for proxy services.
Phishing Tactics: Ongoing campaigns using urgent payroll update alerts and contact form submissions as initial vectors.
Social Engineering: Increased use of fake CAPTCHA verification pages (ClickFix tactic) and sophisticated phishing lures.
Supply Chain Security: CISA released a new tool to support secure software procurement, aiming to strengthen supply chain resilience.
Hybrid Workforce Risks: Continued exploitation of consumer devices and unmanaged endpoints in hybrid work environments.
Shellcode Execution: New techniques for shellcode loading and execution in memory observed in recent attack scenarios.

Regulatory or Policy Developments

Google Android Developer Verification: Google will require all Android developers to undergo verification to block malware from sideloaded apps and strengthen the Play Store ecosystem.
CISA Guidance: Issued urgent advisories for patching critical vulnerabilities in Git and released a new tool to improve software supply chain security procurement.
FTC Statement: The U.S. Federal Trade Commission called on technology companies to resist foreign government demands to weaken encryption and undermine security and privacy protections.
GDPR and Security Training: Emphasis on leveraging GDPR compliance to build stronger security cultures and competitive advantage.