Cybersecurity Brief – 2025-06-09

Mon, 09 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

A supply chain attack targeting npm and PyPI ecosystems has been identified, affecting over a dozen packages associated with GlueStack. The attack delivers malware via a change to “lib/commonjs/index.js,” potentially impacting millions globally.
Over 700 users across Latin America, primarily in Brazil, have been infected since early 2025 through a campaign distributing malicious Chromium-based browser extensions designed to steal user data.

A command injection vulnerability in TBK DVR-4104 and DVR-4216 digital video recording devices is being actively exploited by a new Mirai botnet variant, enabling attackers to hijack vulnerable devices.

Cybercriminals are leveraging software supply chain attacks by compromising widely used npm and PyPI packages to distribute malware at scale.
Threat actors are targeting Latin American users with malicious browser extensions, focusing on Chromium-based browsers to exfiltrate sensitive information.
Mirai botnet operators have adapted their malware to exploit vulnerabilities in digital video recorders, expanding their botnet infrastructure through IoT device compromise.

Increased targeting of software supply chains, particularly open-source package repositories (npm, PyPI), as a vector for widespread malware distribution.
Use of browser extensions as a method for credential and data theft, specifically targeting users in Latin America.
Continued adaptation of IoT botnets (Mirai) to exploit newly discovered vulnerabilities in networked devices, maintaining persistence and expanding reach.

Sat, 07 Jun 2025 00:00:00 +0000

Optima Tax Relief, a U.S. tax resolution firm, suffered a Chaos ransomware attack, resulting in the leakage of stolen data.
Kettering Health, a healthcare provider managing 14 medical centers in Ohio, confirmed a May cyberattack by the Interlock ransomware group, with data exfiltration.
Ukrainian critical infrastructure was targeted by a new data wiper malware, PathWiper, in a disruptive attack attributed to previously unseen malware.
86 million AT&T customer records, including names, dates of birth, phone numbers, email addresses, street addresses, and social security numbers, are reportedly being sold on the dark web.

A critical vulnerability, CVE-2024-3721, affecting TBK DVR devices is being actively exploited by a new Mirai botnet variant.
Two critical Fortinet vulnerabilities, enabling authentication bypass and remote code execution, are now being exploited by the Qilin ransomware operation.

The Qilin ransomware group is actively exploiting Fortinet vulnerabilities in ongoing attacks.
The Interlock ransomware group was responsible for the Kettering Health breach.
A new Mirai botnet variant is targeting TBK DVR devices via CVE-2024-3721.
The BADBOX 2.0 botnet continues to target home networks and connected Android devices, despite partial disruption earlier this year.
Cybercriminals are increasingly leveraging residential proxy services to disguise malicious web traffic as legitimate user activity.
A new campaign deploying Atomic macOS Stealer malware is exploiting “ClickFix” social engineering tactics to target Apple users.
Multiple widespread phishing campaigns are utilizing ClickFix tactics to deliver malware to business targets.
Indian authorities, with support from Microsoft, dismantled two illegal call centers and arrested six individuals involved in a transnational tech support scam targeting Japanese users.

ClickFix social engineering tactics are gaining traction in phishing campaigns, enhancing the sophistication and success rate of malware delivery.
Use of residential proxy services by cybercriminals is growing, complicating detection and attribution of malicious web traffic.
Data wiper malware, such as PathWiper, is being deployed in targeted attacks against critical infrastructure, notably in Ukraine.
The ongoing exploitation of IoT and DVR devices by Mirai variants highlights continued targeting of networked hardware.
The FBI warns that the BADBOX 2.0 botnet remains active, targeting home networks through compromised Android devices.
Synthetic data is being adopted to support AI development and privacy compliance, but introduces risks of re-identification and model integrity.

Microsoft and CrowdStrike have announced a joint initiative to standardize naming conventions for APT (Advanced Persistent Threat) groups, aiming to reduce confusion in threat intelligence reporting.
Law enforcement agencies from over a dozen countries conducted an international operation arresting 20 suspects involved in the production and distribution of child sexual abuse material.
F5 has acquired agentic AI security startup Fletch, with plans to integrate its technology into the F5 Application Delivery and Security Platform.