Sitecore on DanSec Daily

Cybersecurity Brief – 2026-01-17

Sat, 17 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

The Canadian Investment Regulatory Organization (CIRO) suffered a data breach impacting 750,000 individuals, exposing personal information of member firms and their registered employees.
Five malicious Chrome browser extensions impersonating HR and ERP platforms such as Workday and NetSuite were discovered hijacking user accounts.
Verizon experienced a nationwide wireless outage last week and is now issuing $20 credits to affected customers.
Researchers hijacked StealC malware control panels via an XSS flaw, gaining intelligence on the info-stealing operation and active attacker sessions.

Newly Discovered Vulnerabilities

A critical command injection vulnerability (CVE-2025-64155) in Fortinet FortiSIEM is actively exploited in the wild. Public proof-of-concept code is available, and attacks from multiple IP addresses have been observed.
Cisco fixed a maximum-severity AsyncOS zero-day in Secure Email Gateway appliances that had been exploited since November 2025.
A critical vulnerability in Bluetooth audio accessories, dubbed “WhisperPair,” allows attackers to hijack, track, and eavesdrop on millions of devices using improper Google Fast Pair implementations.
Microsoft confirmed that the January Windows 11 update (KB5074109) causes Outlook to freeze for POP users and prevents some Windows 11 23H2 devices with System Guard Secure Launch enabled from shutting down.

Notable Threat Actor Activity

China-linked threat actor UAT-8837 exploited a Sitecore zero-day and other known vulnerabilities to target critical infrastructure in North America.
Chinese group UAT-9686 exploited a Cisco vulnerability to deploy the AquaShell backdoor on internet-exposed Cisco appliances.
The Black Basta ransomware gang leader’s identity has been confirmed by law enforcement in Ukraine and Germany, and the individual has been added to Europol and Interpol’s wanted lists.
A new campaign targeting U.S. government and policy entities used Venezuela-themed spear phishing to deliver the LOTUSLITE backdoor.
Russian threat actors reportedly targeted the Polish power grid, as noted in industry roundups.

Trends, Tools, or Tactics of Interest

GootLoader malware now uses malformed ZIP archives concatenating 500–1,000 ZIP files to evade detection.
Social engineering attacks are increasingly leveraging AI to enhance effectiveness.
The BodySnatcher agentic AI hijacking technique, Telegram IP exposure, and researcher-led attacks on shipping systems were noted as emerging security concerns.
Pacific Northwest National Labs introduced ALOHA, an AI system that reduces attack reconstruction time from weeks to hours.
Dutch police conducted an operation selling fake event tickets to demonstrate the prevalence and effectiveness of online scams.

Regulatory or Policy Developments Affecting the Security Industry

CISOs are increasingly joining executive suites, driven by heightened regulatory and compliance standards.
Reports indicate China is instituting a software ban, with all top 20 domestic cybersecurity firms working with the government.
Former CISA Director Jen Easterly has been appointed CEO of the RSA Conference (RSAC).
Project Eleven raised $20 million to develop post-quantum security infrastructure, and Monnai secured $12 million for identity and risk data solutions.

Cybersecurity Brief – 2025-09-06

Sat, 06 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Wealthsimple, a Canadian online investment management service, disclosed a data breach involving the theft of personal data from an undisclosed number of customers.
Multiple cybersecurity firms, including Proofpoint, SpyCloud, Tanium, and Tenable, were affected by a breach involving their Salesforce instances, with attackers accessing stored information.
Nexar’s dashcam video database was compromised, exposing video recordings from vehicle-mounted cameras.
The City of Baltimore was reported to have sent $1.5 million to a scammer in a cyber fraud incident.

Newly Discovered Vulnerabilities

A critical command injection vulnerability in SAP S/4HANA (CVE-2025-42957) is under active exploitation. This flaw allows attackers to achieve full system compromise with minimal effort.
A critical Sitecore vulnerability has been identified and is being actively exploited. CISA has ordered immediate patching of affected Sitecore instances by federal agencies.
A max-severity Argo CD API flaw allows users with low-level project permissions to access API endpoints and retrieve all repository credentials for a project.
Academics have developed an AI-powered framework (A2) for discovering and validating vulnerabilities in Android applications.

Notable Threat Actor Activity

TAG-150, a threat actor group operating a malware-as-a-service (MaaS) framework known as CastleLoader, has developed a new remote access trojan called CastleRAT, available in both Python and C variants.
North Korean hackers have targeted hundreds of individuals using fake job interview lures. The group actively monitors cyber threat intelligence to rebuild exposed infrastructure.
Scammers are abusing the Grok AI platform to distribute malicious links on X (formerly Twitter), bypassing restrictions on links in promoted posts.
A smishing campaign is targeting California taxpayers with fraudulent refund offers, as warned by the California Franchise Tax Board.
A wave of spear phishing attacks is targeting C-suite executives and senior leadership across multiple industries.

Trends, Tools, or Tactics of Interest

Q2 2025 threat reports indicate continued high volumes of mobile malware, adware, and unwanted software targeting Android, as well as persistent threats to Windows, macOS, and IoT platforms, including ransomware and cryptominers.
Automation is increasingly being adopted in penetration testing, with AI-powered offensive security platforms such as FireCompass receiving significant investment.
The use of agentic AI introduces new vulnerabilities at integration points with enterprise systems.
There is a trend towards using AI-driven tools for vulnerability discovery and validation in software development.
Smishing, spear phishing, and the abuse of AI platforms for phishing and malware distribution are prominent tactics.
Improvements in IoT security have been noted over the past five years, though significant gaps remain.

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated immediate patching of the critical Sitecore vulnerability for federal agencies.
Microsoft has enforced multifactor authentication (MFA) for Azure Portal sign-ins across all tenants since March 2025.
The European Commission fined Google €2.95 billion ($3.5 billion) for anti-competitive practices in the digital advertising market.
Federal budget cuts in the US are impacting cybersecurity funding for local and state agencies, increasing their exposure to cyber risk.

Cybersecurity Brief – 2025-09-05

Fri, 05 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

PowerSchool Data Breach: Texas Attorney General filed a lawsuit against PowerSchool following a December breach that exposed the personal information of 62 million students, including 880,000 Texans.
Chess.com Data Breach: Chess.com disclosed a breach after threat actors accessed a third-party file transfer application, compromising user data.
Bridgestone Cyberattack: Bridgestone confirmed a cyberattack affecting manufacturing operations in North America; details of the attack vector remain under investigation.
Wytec Website Hack: Wytec’s website was defaced twice by unknown actors and remains offline, with the company anticipating significant financial losses.
Salesloft Drift Supply Chain Attack: Multiple high-profile customers reported data breaches linked to a recent supply chain attack involving Salesloft Drift, though the full impact is still unclear.

Newly Discovered Vulnerabilities

Sitecore Zero-Day: Threat actors exploited a zero-day vulnerability in legacy Sitecore deployments, using exposed ASP.NET machine keys for ViewState deserialization attacks and deployment of WeepSteel malware.
TP-Link Router Flaws: CISA added CVE-2023-50224 and CVE-2025-9377, affecting TP-Link routers, to its Known Exploited Vulnerabilities catalog; TP-Link also confirmed a new unpatched zero-day impacting several router models.
Android Vulnerabilities: Two exploited vulnerabilities in Android-CVE-2025-48543 (Android Runtime) and CVE-2025-38352 (Linux kernel)-were patched after being leveraged in targeted attacks.

Notable Threat Actor Activity

GhostRedirector Campaign: ESET and other researchers identified a new threat actor, GhostRedirector, compromising at least 65 Windows servers (primarily in Brazil) via a passive C++ backdoor and a malicious IIS module (Gamshen), manipulating Google search results and boosting gambling sites.
APT28/NotDoor Backdoor: Russian state-sponsored group APT28 deployed a new Microsoft Outlook backdoor, NotDoor, targeting multiple companies in NATO countries.
Quad7 Botnet: The Quad7 botnet is exploiting end-of-life TP-Link routers to steal Microsoft 365 accounts.
SVG-Based Phishing: A global phishing campaign is leveraging undetected SVG files to deploy Base64-encoded phishing pages, including impersonation of the Colombian judicial system.
Phishing-as-a-Service: Researchers uncovered a long-running phishing-as-a-service operation using cloud infrastructure (Google, Cloudflare) and cloaking techniques to evade detection.
X (Twitter) Grok AI Abuse: Cybercriminals are exploiting X’s Grok AI to bypass ad protections and distribute malware via malicious links.
Model Namespace Reuse: Demonstrated AI supply chain attack method allows attackers to deploy malicious models and achieve code execution in Google and Microsoft environments.
US Rewards for Russian Hackers: The US government offered $10 million for three Russian hackers accused of targeting critical infrastructure and energy firms worldwide.

Trends, Tools, or Tactics of Interest

AI-Driven Attack Chains: Reports indicate AI tools can now automate entire attack chains, increasing operational efficiency for threat actors.
AI-Enhanced Phishing: Healthcare organisations are being warned about an anticipated surge in AI-powered phishing attacks.
Vishing Scams: Continued prevalence of vishing scams, with attackers impersonating law enforcement to issue fake arrest warrants.
Browser-Based Attacks: Security teams are advised to prepare for increasing browser-based threats, including phishing kits, malicious OAuth apps, and browser extensions.
BlockEDRTraffic Tool: Release of BlockEDRTraffic, a tool for EDR-evasive lateral movement, which uses Windows Firewall or Filtering Platform to block telemetry and create stealth windows.
VPN Security Concerns: Popular Android VPN apps found to have security flaws and undisclosed links to China, raising concerns over data privacy and exposure.
Supply Chain Security & SBOMs: US and allied nations are promoting Software Bill of Materials (SBOM) adoption to enhance supply chain transparency and reduce risk.
Incident Response Skills Gap: ISC2 launched a Threat Handling Foundations Certificate to address the digital forensics and incident response (DFIR) skills gap.

Regulatory or Policy Developments

French Data Protection Fines: The French data protection authority fined Google €325 million ($379 million) and Shein €150 million ($175 million) for violating cookie consent rules and displaying unauthorised ads.
Czech Cybersecurity Warning: Czech agency NÚKIB issued a warning regarding the use of products that transmit user data to China, highlighting national security risks.
Roblox Age Verification: Roblox introduced age estimation requirements for access to communication features, aiming to protect minors from sexual predators.

Cybersecurity Brief – 2025-08-31

Sun, 31 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion Data Breach: TransUnion disclosed a data breach affecting 4.4 million US consumers. The incident stemmed from a compromise of a third-party application used for consumer support operations.
Nevada Ransomware Attack: The State of Nevada confirmed a ransomware incident that led to widespread service disruptions, office closures, and data theft. The state is collaborating with CISA and law enforcement to restore services.
Google Workspace Accounts Compromised: Google confirmed that the OAuth token compromise involved in the Salesforce–Salesloft Drift data theft campaign also allowed unauthorized access to a small number of Google Workspace accounts.
VerifTools Fake ID Marketplace Seized: US and Dutch authorities dismantled the VerifTools marketplace, which sold fraudulent identity documents enabling bypass of KYC checks and access to online accounts. Operators relaunched the service on a new domain shortly after the seizure.
Iranian Ships Hacked: Communications of dozens of Iranian ships were disrupted in a targeted cyberattack.
TamperedChef Infostealer Campaign: Threat actors distributed the TamperedChef infostealer via fraudulent PDF editor websites promoted through Google ads.
Sogou Zhuyin Update Server Hijacked: An abandoned update server for the Sogou Zhuyin IME was hijacked and used to deliver multiple malware families in an espionage campaign targeting Taiwan.

Newly Discovered Vulnerabilities

WhatsApp Zero-Click Exploit: WhatsApp patched a security vulnerability in its iOS and macOS clients that was exploited in targeted zero-day attacks, reportedly in conjunction with a recently disclosed Apple flaw.
Sitecore Experience Platform Flaws: Three new vulnerabilities were disclosed in Sitecore Experience Platform, enabling cache poisoning, information disclosure, and remote code execution.
FreePBX Zero-Day Flaw: Sangoma issued an emergency patch for a zero-day vulnerability in FreePBX, which was being actively exploited on systems with exposed administrator control panels.
Passwordstate Authentication Bypass: Click Studios released security updates to address an authentication bypass vulnerability in the emergency access page of its Passwordstate password manager.

Notable Threat Actor Activity

APT29 Watering Hole Campaign: Amazon disrupted a watering hole campaign conducted by Russia-linked APT29, which abused Microsoft device code authentication for intelligence gathering.
Storm-0501 Ransomware Group: Storm-0501 exploited hybrid cloud security gaps to gain full Azure control in enterprise attacks, focusing on data exfiltration and deletion rather than deploying file-encrypting ransomware.
North Korean IT Worker Operation: US Treasury sanctioned a Russian national and a Chinese firm for facilitating North Korean IT workers who used stolen identities, AI, and malware to generate revenue for North Korea.
TamperedChef Distribution Tactics: Threat actors used Google ads and fraudulent PDF editor websites to distribute the TamperedChef infostealer.
Sogou Zhuyin Espionage: Threat actors weaponized an abandoned update server to deliver malware as part of an espionage campaign in Taiwan.

Trends, Tools, or Tactics of Interest

Abuse of Forensic Tools: Attackers deployed the open-source Velociraptor forensic tool for malicious purposes, including using Visual Studio Code for command and control tunneling.
AI-Driven Exploitation: Security researchers noted that AI and large language models are accelerating exploit development, enabling proof-of-concept code to be generated within minutes.
Cloud-Native Ransomware Tactics: Ransomware actors are increasingly leveraging cloud-native capabilities for data exfiltration and deletion, rather than traditional file encryption.
Generative AI Platform Risks: Increased use of generative AI platforms (e.g., ChatGPT, Gemini, Copilot, Claude) in enterprises is raising concerns about data leakage and the need for improved network visibility.
macOS Attack Adaptation: Analysis shows attackers are adapting to macOS built-in protections by employing techniques to bypass or deceive users and evade detection.
OAuth Token Abuse: The Salesforce–Salesloft Drift campaign demonstrates continued threat actor focus on OAuth token compromise for lateral movement across cloud services.

Regulatory or Policy Developments

Microsoft Azure MFA Enforcement: Microsoft will enforce multi-factor authentication for all Azure resource management actions starting October, aiming to mitigate unauthorized access risks.
US Sanctions on North Korean IT Worker Facilitators: The US Treasury imposed sanctions on entities supporting North Korean IT workers involved in cyber operations.
Android Developer Verification: Only apps from verified developers will be allowed to run on Android devices, as part of measures to improve platform security.

Cybersecurity Brief – 2025-08-30

Sat, 30 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion Data Breach: TransUnion reported a data breach impacting 4.4 million individuals. The breach was linked to a third-party application used for US consumer support operations. No further details on the application were disclosed.
Nevada Ransomware Attack: The state of Nevada confirmed a ransomware attack that resulted in office closures, service disruptions, and data theft. Nevada is working with CISA and law enforcement to restore affected systems.
Google Workspace Accounts Compromised: Google confirmed that the OAuth token compromise, previously associated with Salesforce data theft, also enabled attackers to access a limited number of Google Workspace accounts via the Salesloft Drift integration.
VerifTools Marketplace Takedown: US and Dutch authorities dismantled the VerifTools marketplace, which sold fraudulent identity documents used to bypass KYC checks and facilitate online fraud. Operators relaunched the service on a new domain after the takedown.
Sogou Zhuyin Update Server Hijack: An abandoned update server for the Sogou Zhuyin IME was hijacked and weaponised in a Taiwan-focused espionage campaign, delivering multiple malware families.
Iranian Ships Hacked: Communications for dozens of Iranian ships were disrupted in a cyber operation, details of which were not attributed to any specific actor.

Newly Discovered Vulnerabilities

WhatsApp Zero-Click Vulnerability: WhatsApp patched a security vulnerability in its iOS and macOS clients, reportedly exploited in zero-day attacks in conjunction with a recently disclosed Apple flaw.
FreePBX Zero-Day: Sangoma issued an emergency patch for an actively exploited zero-day vulnerability in FreePBX systems with exposed administrator control panels.
Sitecore Experience Platform Flaws: Three new vulnerabilities in the Sitecore Experience Platform were disclosed, enabling cache poisoning, information disclosure, and remote code execution.
Passwordstate Authentication Bypass: Click Studios released a security update for Passwordstate to address an authentication bypass vulnerability affecting the emergency access page.

Notable Threat Actor Activity

APT29 Watering Hole Campaign: Amazon identified and disrupted a watering hole campaign by Russia-linked APT29 actors, which abused Microsoft device code authentication for intelligence gathering.
Storm-0501 Ransomware Tactics: Storm-0501 exploited hybrid cloud environments to gain full Azure control in enterprise attacks, focusing on data exfiltration and deletion without deploying file-encrypting malware.
North Korean IT Worker Facilitation: The US Treasury sanctioned a Russian national and a Chinese company for assisting North Korean IT workers in exploiting stolen identities, AI, and malware to generate illicit funds for North Korea.

Trends, Tools, or Tactics of Interest

AI-Driven Exploit Generation: Security researchers noted the increasing use of AI and large language models to rapidly generate proof-of-concept exploits, significantly reducing the time required to weaponise vulnerabilities.
Attacker Adaptation to macOS Protections: Analysis revealed how threat actors are bypassing or deceiving users to circumvent macOS built-in security mechanisms, including social engineering and exploiting user trust.
Cloud-Native Ransomware Tactics: Ransomware groups are leveraging cloud-native features for attack operations, including data exfiltration and deletion, rather than traditional file encryption.
Generative AI Data Leak Risks: The proliferation of generative AI platforms (e.g., ChatGPT, Gemini, Copilot, Claude) in organisations is increasing concerns about data leakage and the need for improved network visibility and controls.
Secure Coding Gaps: Ongoing concerns were highlighted regarding the lack of secure coding education in cybersecurity curricula, despite its importance in reducing vulnerabilities.

Regulatory or Policy Developments

Microsoft Azure MFA Enforcement: Microsoft will mandate multi-factor authentication for all Azure resource management actions starting in October, aiming to enhance protection against unauthorised access.
US Sanctions Related to North Korean Cyber Activity: The US imposed sanctions on entities facilitating North Korean cyber operations, specifically targeting those supporting illicit IT worker activities and related financial schemes.
Android Developer Verification: Only applications from verified developers will be permitted to run on Android devices, as part of Google’s efforts to improve the security of the app ecosystem.

Cybersecurity Brief – 2025-06-18

Wed, 18 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Scania, a major automotive manufacturer, confirmed a cybersecurity incident involving the compromise of insurance claim documents through stolen credentials. The breach was linked to an extortion attempt.
Cock.li, an email hosting provider, disclosed a data breach impacting over one million user records. Attackers exploited vulnerabilities in the now-retired Roundcube webmail platform to access the data.
Indian car-sharing firm Zoomcar reported a breach affecting more than 8 million users. Exposed data included names, phone numbers, car registration numbers, addresses, and emails.
23andMe was fined £2.31 million by the UK ICO for a data breach exposing genetic data, attributed to serious security failings.
WestJet Airlines warned customers and employees to be cautious with personal information following a cyber incident affecting its app and website, though core operations continued.
Paddle.com and its U.S. subsidiary settled with the U.S. FTC for $5 million over allegations of facilitating tech-support scams that harmed consumers.

Newly Discovered Vulnerabilities

Veeam released patches for a critical remote code execution (RCE) vulnerability (CVE-2025-23121, CVSS 9.9) in its Backup & Replication software. The flaw could allow domain users to compromise backup servers.
Researchers disclosed a chain of three vulnerabilities in Sitecore Experience Platform (XP), including a hard-coded password (“b”), allowing unauthenticated RCE on enterprise deployments.
Google Chrome addressed a zero-day vulnerability (CVE-2025-2783) exploited by the threat actor “TaxOff” to deploy the Trinper backdoor. The flaw was actively exploited in March 2025.
A critical RCE vulnerability in LangChain’s LangSmith platform was patched after researchers demonstrated it could expose OpenAI API keys and user data via malicious agents.
A critical security flaw in Langflow, a Python-based AI workflow tool, is under active exploitation to deploy the Flodrix botnet, enabling DDoS attacks and potential system compromise.
TP-Link router vulnerability CVE-2023-33538 is under active exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalog and issued an immediate alert.

Notable Threat Actor Activity

The Silver Fox APT group is conducting a sophisticated phishing campaign targeting Taiwanese organizations, deploying Gh0stCringe and HoldingHands RAT malware for information theft and persistent access.
The Scattered Spider (UNC3944) cybercrime group is targeting IT support teams at major U.S. insurance firms, expanding from previous attacks on U.K. and U.S. retailers.
The “TaxOff” threat actor exploited a Chrome zero-day to deliver the Trinper backdoor.
Attackers are exploiting the Langflow AI server RCE flaw to distribute the Flodrix botnet, primarily for DDoS operations.
Instagram ads leveraging AI deepfakes are impersonating Canadian banks (BMO and EQ Bank) to conduct phishing and investment fraud campaigns.

Trends, Tools, or Tactics of Interest

Ransomware campaigns are increasingly targeting backup infrastructure as an initial attack vector, with attackers focusing on compromising backup solutions to maximize impact.
Forgotten or unmanaged Active Directory service accounts are highlighted as a persistent risk, often remaining active with elevated privileges and lacking oversight.
Use of hard-coded credentials in enterprise software (e.g., Sitecore XP) continues to pose significant RCE risks.
Phishing campaigns are leveraging AI-generated deepfakes to enhance credibility and effectiveness, as seen in the Instagram banking scams.
There is increased exploitation of vulnerabilities in AI and workflow automation platforms (LangSmith, Langflow), indicating attackers are targeting emerging tech stacks.
SMS-based two-factor authentication is identified as insecure, with risks highlighted from third-party interception of codes.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £2.31 million fine on 23andMe for inadequate security practices resulting in a major data breach affecting genetic data.
Paddle.com agreed to a $5 million settlement with the U.S. FTC for facilitating tech-support scams, reinforcing regulatory scrutiny on payment processors involved in fraudulent activities.
Iran has implemented internet throttling to disrupt potential cyber operations by foreign adversaries, specifically in response to recent escalations with Israel.