Sophos on DanSec Daily

Cybersecurity Brief – 2026-01-13

Tue, 13 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Target Corporation: Hackers claim to have stolen and are selling internal source code from Target, with samples published online. Target’s development server has been taken offline.
University of Hawaii Cancer Center: Ransomware attack in August 2025 resulted in theft of participant data, including documents with Social Security numbers dating back to the 1990s.
Endesa (Spanish Energy Provider): Data breach disclosed, with hackers accessing customer contract-related information, including personal details.
BreachForums: The notorious cybercriminal forum was breached, exposing data on 324,000 administrators and members.
Manage My Health (New Zealand): Identified as a top breach in recent threat intelligence reporting, affecting patient portals and healthcare data.
Instagram: Data leak incident where user data appeared on the dark web, coinciding with a password reset vulnerability (see below).
Apex Legends: Live matches disrupted as threat actors hijacked player characters, disconnected users, and changed nicknames.

Newly Discovered Vulnerabilities

n8n Workflow Automation Platform:
- “Ni8mare” vulnerability impacts nearly 60,000 online instances; maximum-severity flaw remains largely unpatched.
- Supply chain attack observed, with malicious npm packages masquerading as integrations to steal OAuth credentials from developers.
Gogs (Git Service): High-severity remote code execution (RCE) flaw exploited in zero-day attacks. CISA has ordered US federal agencies to patch.
Instagram: Password reset vulnerability allowed third parties to send reset emails to users, contributing to a recent data leak.
Telegram: Hidden proxy links can expose user IP addresses with a single click due to how proxy links are handled. Telegram has announced plans for a fix.

Notable Threat Actor Activity

GoBruteforcer Botnet: New campaigns target over 50,000 Linux servers, especially those supporting cryptocurrency and blockchain projects, exploiting weak credentials and AI-generated configurations.
APT28 (Russia): Targeting energy research and defense collaboration entities by impersonating webmail and VPN portals (Microsoft OWA, Google, Sophos VPN).
Kimsuky (North Korea): FBI flagged QR-code phishing (“quishing”) campaigns targeting US and foreign government agencies, NGOs, and academia.
LLM/AI Service Exploitation: Multiple campaigns targeting exposed large language model (LLM) endpoints and misconfigured proxy servers to access sensitive APIs and data.
VoidLink Malware: Discovery of a stealthy, cloud-native Linux malware framework, attributed to a Chinese threat cluster, designed for persistence and evasion in cloud environments.
Facebook Credential Theft: Increased use of “browser-in-the-browser” (BitB) phishing techniques to steal Facebook login credentials over the past six months.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks: Growing use of malicious npm packages for credential theft, specifically targeting workflow automation platforms.
Botnet Evolution: GoBruteforcer botnet demonstrates ongoing adaptation, now preying on servers with weak or AI-generated credentials.
AI and LLM Security: Surge in attacks against exposed LLM endpoints and APIs, highlighting expanding attack surfaces in organizations’ AI deployments.
Phishing Techniques: Rise in “quishing” (QR-code phishing) and “browser-in-the-browser” attacks, increasing the sophistication of credential theft campaigns.
Healthcare AI Adoption: Anthropic launched Claude AI for healthcare, introducing HIPAA-ready tools for providers and payers, reflecting broader AI integration in sensitive sectors.
Endpoint Security Expansion: Hexnode announced entry into endpoint security with its new XDR (Extended Detection and Response) platform.

Regulatory or Policy Developments Affecting the Security Industry

CISA Directive: US federal agencies ordered to patch Gogs RCE vulnerability exploited in active attacks.
EU Regulatory Review: The European Union set a February deadline for its verdict on Google’s $32B acquisition of Wiz, following US approval.
Deepfake Regulation: Global regulators are scrutinizing Grok, an AI tool, over its role in generating illegal sexual deepfake content, including child sexual abuse material.
Privacy and Cybersecurity Law Complexity: Ongoing analysis indicates compliance challenges will persist into 2026, with limited progress on comprehensive federal cybersecurity legislation.

Cybersecurity Brief – 2025-07-25

Fri, 25 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Law enforcement has seized the dark web extortion sites of the BlackSuit ransomware operation, which has breached hundreds of organizations globally.
Toptal’s GitHub organization account was compromised, with attackers publishing ten malicious npm packages to the npm registry.
Security flaws in Airportr, a luggage service used by 10 airlines, exposed user data and allowed attackers to potentially redirect or steal luggage.
A threat actor named EncryptHub compromised an early access Steam game to distribute info-stealing malware to users.
CastleLoader malware has infected 469 devices by leveraging fake GitHub repositories and phishing techniques (ClickFix) to deliver info-stealers and remote access trojans.
Multiple npm developer accounts were compromised in a phishing campaign, resulting in malware being injected into popular npm packages.

Newly Discovered Vulnerabilities

Microsoft SharePoint: Five vulnerabilities collectively known as ToolShell were detailed, including a POST request exploit that can bypass initial patches. Over 400 SharePoint servers, including US government systems, have been targeted.
Mitel MiVoice MX-ONE: A critical authentication bypass vulnerability has been disclosed and patched, allowing attackers to gain full access to affected systems.
Sophos Firewall and SonicWall SMA 100 Series: Critical remote code execution vulnerabilities have been patched. SonicWall specifically urges immediate updates due to recent malware attacks exploiting these flaws.
Airportr: Web security bugs exposed sensitive user data and allowed privilege escalation.
AI-generated image watermarks have been found to be easily removable, undermining some anti-misinformation controls.

Notable Threat Actor Activity

Storm-2603, a China-based threat actor, is actively exploiting SharePoint ToolShell vulnerabilities to deploy Warlock ransomware in ongoing campaigns.
Fire Ant, a threat actor, is targeting VMware ESXi hosts and vCenter environments in a prolonged cyber espionage campaign.
China-nexus APTs have deployed fake Dalai Lama apps to spy on the Tibetan community in multi-stage attacks.
BlackSuit ransomware infrastructure was disrupted by law enforcement following a global campaign of breaches.
High-value npm developer accounts have been targeted in phishing campaigns to distribute malicious packages.
Koske, a new Linux malware, is using steganography-hiding malicious payloads in panda JPEG images-and may have been developed with AI.

Trends, Tools, or Tactics of Interest

Ransomware groups are increasingly exploiting SharePoint ToolShell vulnerabilities, with a focus on unpatched systems.
CastleLoader demonstrates the use of fake GitHub repositories and phishing as initial infection vectors for malware distribution.
New malware delivery methods include steganography (Koske) and compromised software supply chains (npm, Steam games).
The evilreplay tool enables real-time browser session hijacking via XSS without the need for cookie theft, providing interactive post-exploitation control.
Offensive security is shifting towards continuous, proactive testing rather than annual penetration tests.
Law enforcement actions are increasing against cybercrime forums (e.g., XSS) and ransomware operations.

Regulatory or Policy Developments Affecting the Security Industry

The UK has implemented mandatory age verification for adult content access, raising privacy and security concerns about the collection and management of personal data.
New York is seeking public input on proposed cyber regulations for water systems, including incident reporting, response plans, and compliance certification.
Clorox has filed a $380 million lawsuit against Cognizant over a 2023 hack, alleging that IT provider actions enabled the breach.

Cybersecurity Brief – 2025-07-24

Thu, 24 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The US National Nuclear Security Administration was breached via exploitation of a Microsoft SharePoint zero-day vulnerability chain. At least three Chinese nation-state cyber-espionage groups are implicated in targeting older, on-premises SharePoint instances after a flawed patch attempt.
Clorox has filed a $380M lawsuit against Cognizant, alleging gross negligence after hackers successfully impersonated an employee and convinced the help desk to reset credentials, enabling a major August 2023 cyberattack.
Ongoing phishing campaigns are mimicking the US Department of Education’s G5 grant portal, exploiting recent layoffs and political turmoil to target users.
The npm package ‘is’, with 2.8 million weekly downloads, was compromised in a supply chain attack, injecting backdoor malware that gave attackers full device access.
npm accidentally removed the Stylus package, breaking builds and pipelines globally that depend on the library.
Ukraine arrested the suspected administrator of the Russian-language cybercrime forum XSS.is at the request of French authorities.

Newly Discovered Vulnerabilities

Sophos patched five critical vulnerabilities in Sophos Firewall that allowed for remote code execution by unauthenticated attackers.
CISA issued an alert regarding active exploitation of two vulnerabilities in SysAid ITSM software, which attackers are using to hijack administrator accounts.
Cisco reported active exploitation attempts of critical Cisco Identity Services Engine (ISE) vulnerabilities, which could lead to unauthenticated remote code execution.
Multiple high-severity memory safety vulnerabilities were patched in both Chrome and Firefox browsers.
Persistent exploitation of known Ivanti remote code execution vulnerabilities continues, particularly affecting Japanese organizations due to patching complications.

Notable Threat Actor Activity

Threat actor “Mimo” has shifted tactics to target Magento CMS and misconfigured Docker instances for crypto mining and proxyware deployment, expanding from previous campaigns against Craft CMS.
Chinese threat actors continue to exploit Ivanti RCE vulnerabilities in targeted attacks.
The Lumma Stealer malware re-emerged and resumed activity after a prior law enforcement takedown.
The Interlock ransomware group is actively targeting organizations through drive-by download attacks, prompting a government alert.
Hackers are using stolen credit cards and loyalty points to book travel for clients, with risks extending to remote workers, SMBs, and travel brands.

Trends, Tools, or Tactics of Interest

Researchers identified a new stealthy WordPress backdoor hidden in the “mu-plugins” directory, enabling persistent administrative access and evading standard detection.
The Coyote banking trojan is the first known malware to abuse the Windows UI Automation (UIA) accessibility framework to steal banking credentials, with attacks observed against banks and crypto exchanges in Brazil.
Kerberoasting attacks remain effective due to weaknesses in current detection methods; new approaches to detection and Active Directory hardening are being discussed.
Increased exploitation of SharePoint vulnerabilities is observed, with multiple exploit attempts and scanning activity detected shortly after public disclosure.
File integrity monitoring receives renewed focus with the release of the ficheck.py tool for forensic analysis.
Google launched the OSS Rebuild initiative to enhance security in open-source package ecosystems and address software supply chain attack risks.
Brave browser implemented a feature to block Windows Recall from capturing screenshots of browser activity by default.
Proton launched “Lumo,” a privacy-focused encrypted AI assistant that does not log user conversations or use prompts for training.
OpenAI is rolling out new ChatGPT features, including “personality” toggles and a “Study together” mode for exam preparation.
AI bot traffic is increasingly impacting website performance, with new mitigation strategies under discussion.
OpenAI CEO Sam Altman warned of the rising threat of AI voice fraud in banking, stating that voice clones are becoming indistinguishable from real voices and require new verification methods.

Regulatory or Policy Developments

The UK is considering a ban on ransomware payments, with debate over potential unintended consequences such as victims hiding incidents or attackers shifting tactics.
ISO 42001, a new international standard for AI governance, is being highlighted as a framework for responsible AI development and deployment.