T-Mobile on DanSec Daily

Cybersecurity Brief – 2026-04-04

Sat, 04 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Solana-based decentralized exchange Drift confirmed a security incident on 1 April 2026, resulting in a loss of approximately $285 million. The attack, attributed to North Korean threat actors, exploited durable nonces and social engineering to compromise an admin key and drain five vaults.
Hims & Hers Health disclosed a data breach involving the theft of support tickets from a third-party customer service platform (Zendesk).
The German political party Die Linke suffered an IT systems outage and data theft, with the Qilin ransomware group claiming responsibility and threatening to leak sensitive data.
Meta paused work with data vendor Mercor after a data breach potentially exposed sensitive AI industry secrets, affecting major AI labs.
T-Mobile clarified that a recent insider-driven cybersecurity incident had a limited impact.
European Commission cloud infrastructure was breached as part of the ongoing TeamPCP supply chain campaign, with over 1,000 SaaS environments reportedly affected. Sportradar was also named among impacted organizations.
Sensitive Customs and Border Protection (CBP) facility codes leaked via publicly accessible online flashcards.
Axios npm package was compromised in a supply chain attack following a targeted social engineering campaign by North Korean threat actors (UNC1069).
ChatGPT experienced a data leak, and a water facility was hit by ransomware, according to SecurityWeek’s round-up.

Newly Discovered Vulnerabilities

Critical vulnerabilities in Citrix ShareFile could be chained to bypass authentication and achieve unauthenticated remote code execution (RCE) via arbitrary file uploads.
A zero-day vulnerability in the TrueConf video conferencing platform was exploited by a Chinese threat actor for reconnaissance, privilege escalation, and payload execution in attacks on Asian government entities.
Microsoft detailed the use of cookie-controlled PHP web shells on Linux servers, enabling persistent remote code execution via cron jobs.
A new variant of the SparkCat malware was found in iOS and Android apps on official app stores, stealing images of crypto wallet recovery phrases.
React2Shell vulnerability was exploited in a large-scale credential harvesting campaign, compromising over 750 systems.
Apple released an iOS 18 patch for the DarkSword mobile OS-cracking tool, extending protection to devices unable to upgrade to iOS 26.
Symantec vulnerability and anti-ClickFix mechanisms for macOS were also noted in recent security news.

Notable Threat Actor Activity

North Korean threat actors (UNC1069) conducted a targeted social engineering campaign against the Axios npm maintainer, resulting in a supply chain compromise.
North Korean actors were attributed to the $285 million Drift DEX heist, leveraging nonce-based transactions and admin key compromise.
China-linked TA416 resumed targeting European government and diplomatic organizations since mid-2025, using PlugX malware and OAuth-based phishing.
Chinese threat actors exploited a TrueConf zero-day in attacks against Asian governments.
TeamPCP’s supply chain campaign continues to expand, with additional attribution disputes involving ShinyHunters and Lapsus$.
Criminal threat actors increased phishing attacks by 130% by exploiting the conflict in Iran, according to Bitdefender.
Job scam campaigns impersonating Coca-Cola and Ferrari were discovered, targeting user credentials for Google and Facebook accounts.
Qilin ransomware group was responsible for the Die Linke breach and extortion.

Trends, Tools, or Tactics of Interest

Multi-extortion ransomware attacks are increasingly leveraging stolen data for public leaks, intensifying pressure on victims.
Third-party and supply chain risks remain a significant security gap, as highlighted by recent breaches and campaigns.
Mobile attack surfaces are expanding due to shadow AI in apps, outdated devices, and zero-click exploits.
Threat actors are using HTTP cookies as control channels for PHP web shells on Linux, with persistence achieved via cron jobs.
Automated credential harvesting campaigns are utilizing frameworks like Nexus Listener and large-scale scanning.
Unmanaged Windows 11 24H2 devices are being force-upgraded by Microsoft to 25H2.
LinkedIn was reported to be secretly scanning for over 6,000 Chrome extensions and collecting device data via hidden JavaScript.
Emerging research suggests “skull vibration harmonics” could be used for authentication in XR headsets.
Chainguard released Factory 2.0, a platform to automate and harden the software supply chain.
CrowdStrike’s next-gen SIEM now ingests Microsoft Defender telemetry, reflecting increased integration between major security vendors.
Outbound email security and the need for IT staff security awareness training were emphasized in recent industry commentary.
Inconsistent privacy labels for mobile apps were highlighted as inadequate for informing users of data practices.

Regulatory or Policy Developments Affecting the Security Industry

Governments are implementing varied age-based bans on social media access for children, though execution and effectiveness remain debated.
The FBI classified a recent hack as a “major incident,” indicating increased regulatory scrutiny on federal cybersecurity events.

Cybersecurity Brief – 2025-05-08

Thu, 08 May 2025 00:00:00 +0000

Major Incidents and Breaches

LockBit Ransomware Gang Breach: The LockBit ransomware group suffered a significant breach, with its dark web affiliate panels defaced and victim negotiation data exposed via a leaked MySQL database. This incident may disrupt ongoing operations and expose sensitive data related to victims and affiliates.
PowerSchool Extortion Escalates: Following a December cyberattack, the PowerSchool hacker is now directly extorting individual school districts, threatening to release stolen student and teacher data if ransoms are not paid.
Masimo Cyberattack: Medical device manufacturer Masimo reported a cyberattack that has disrupted production and caused delays in fulfilling customer orders.
South African Airways Disruption: A cyberattack temporarily disrupted operational systems at South African Airways. The company is investigating potential data theft.

Cybersecurity Brief – 2025-05-07

Wed, 07 May 2025 00:00:00 +0000

Major Incidents or Breaches

UK Legal Aid Agency (LAA) Incident: The LAA, part of the UK’s Ministry of Justice, is investigating a cybersecurity incident that may have exposed law firm data. The agency has warned impacted firms of potential data access by attackers.
T-Mobile Data Breach Settlement: Payments to victims of T-Mobile’s 2021 data breach (which exposed data of 76 million customers) have begun distribution after previous delays.
Langflow AI App Servers Compromised: A critical remote code execution (RCE) vulnerability in Langflow has been exploited in the wild, with CISA urging immediate patching.
Samsung MagicINFO 9 Server Exploits: Active exploitation of an unauthenticated RCE flaw in Samsung MagicINFO 9 Server has been observed, leading to device hijacking and malware deployment.
GeoVision IoT Devices Used in Mirai Botnet: Threat actors are exploiting vulnerabilities in end-of-life GeoVision IoT devices to conscript them into Mirai botnets for DDoS attacks.
Commvault Vulnerability Still Exploitable: Despite prior patches, CVE-2025-34028 affecting Commvault remains exploitable and is under active attack.
SonicWall SMA Devices Under Attack: Two vulnerabilities in SonicWall’s Secure Mobile Access (SMA) devices are being actively exploited by threat actors.
Linux Supply Chain Attack: Malicious Go modules uploaded to GitHub have been used to deliver disk-wiping malware targeting Linux servers.

Newly Discovered or Actively Exploited Vulnerabilities

Apache Parquet CVE-2025-30065: A proof-of-concept exploit for this maximum severity vulnerability has been released, increasing the risk to unpatched servers.
Google Android FreeType Flaw: Google patched an actively exploited, zero-click FreeType 2 code execution vulnerability in Android as part of its May 2025 security updates.
Langflow Critical RCE: The Langflow platform is subject to an easily exploitable RCE vulnerability (CVSS 9.8), now under active exploitation.
Samsung MagicINFO 9 Server RCE: Ongoing exploitation of the unauthenticated RCE flaw is resulting in widespread device compromise.
SonicWall SMA Device Vulnerabilities: CISA has highlighted two actively exploited vulnerabilities affecting SonicWall’s SMA remote access devices.
Commvault CVE-2025-34028: Despite being previously patched, this vulnerability remains exploitable and is being leveraged in attacks.

Notable Threat Actor Activity

Mirai Botnet Expansion: Threat actors are leveraging vulnerabilities in Samsung MagicINFO and GeoVision IoT devices to expand Mirai botnet operations, primarily for DDoS attacks.
Investment Scam Operations: Two threat actor groups are running investment scams using Facebook ads, RDGA domains, and IP filtering to target victims and evade detection.
Device Code Phishing: Attackers are employing “device code phishing” tactics to bypass multi-factor authentication, targeting users with social engineering campaigns that exploit device enrolment flows.

Trends, Tools, or Tactics of Interest

Modular Malware: Continued evolution in malware development with increased use of modular architectures, allowing threat actors to rapidly adapt and repurpose code.
Machine Credentials and Third-Party Risk: The Verizon 2025 DBIR highlights that third-party access and compromised machine credentials are leading drivers behind major breaches, surpassing ransomware and zero-day exploits.
External Attack Surface Management (EASM): Growing emphasis on EASM as organisations struggle to maintain visibility and control over sprawling digital assets and shadow IT.
Kubernetes Security Risks: Microsoft warns that default Helm chart configurations in Kubernetes deployments may lead to data leaks due to insecure defaults and misconfigurations.
Supply Chain Attacks via Open-Source Modules: The attack on Linux servers via malicious Go modules underscores ongoing risks in the open-source software supply chain.

Regulatory or Policy Developments

NSO Group Fined for Pegasus Spyware Attacks: A US federal jury ordered NSO Group to pay $168 million to WhatsApp (Meta) for facilitating Pegasus spyware attacks against 1,400 users, setting a significant legal precedent for spyware vendors.
California Privacy Enforcement: The California Privacy Protection Agency issued a six-figure fine and mandated business practice changes for a national clothing retailer over privacy violations, reinforcing active regulatory oversight.
US CISA Funding and Policy Scrutiny: US lawmakers are questioning proposed cuts to CISA funding and demanding a comprehensive national cybersecurity plan.
DOD Cyber Policy Review: The US Department of Defense’s nominee for cyber policy has pledged to re-evaluate guardrails for offensive cyber operations, signalling potential policy shifts.

Other Noteworthy Items

Signal Clone Security Issue: Analysis of TM Signal, a Signal clone, revealed that it sends user message logs in plaintext, raising concerns over secure messaging app clones.
Credential Hygiene in Public Figures: Reports indicate poor password practices among high-profile individuals, including the US Director of National Intelligence, highlighting ongoing issues with credential reuse at senior levels.