Cybersecurity Brief – 2025-07-29

Tue, 29 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Toptal suffered a breach of its GitHub organization account, which was used to publish 10 malicious npm packages. These packages were downloaded approximately 5,000 times, constituting a significant software supply chain attack.
France’s state-owned defense firm Naval Group is investigating a cyberattack after 1TB of allegedly stolen data was leaked on a hacking forum.
Allianz Life confirmed a data breach impacting the majority of its 1.4 million US customers, including compromised information of customers, financial professionals, and employees.
NASCAR disclosed that personal information, including names and Social Security numbers, was stolen in an April 2025 ransomware attack.
The Tea app breach expanded, with a second database leak exposing 1.1 million private user messages and data being circulated on hacking forums.
Lovense’s connected sex toy app is vulnerable to a flaw that exposes user email addresses, putting users at risk of doxxing.
Endgame Gear’s OP1w 4k v2 mouse configuration tool was infected with malware and distributed via the official website between June 26 and July 9, 2025.
The US Energy Department, including its National Nuclear Security Administration, was listed among recent high-profile attacks according to threat intelligence bulletins.

Newly Discovered Vulnerabilities

A critical unauthenticated remote code execution vulnerability (CVE-2025-20281) in Cisco Identity Services Engine (ISE) has a complete public exploit chain and is being actively exploited.
Multiple vulnerabilities in PaperCut NG/MF print management software, including a remote code execution vulnerability via cross-site request forgery (CSRF), have been added to CISA’s Known Exploited Vulnerabilities catalog amid active exploitation.
A vulnerability in Google’s Gemini CLI AI coding assistant allowed silent execution of malicious code and data exfiltration via allowlisted programs.
Microsoft disclosed a macOS vulnerability (“Sploitlight”) that could bypass Transparency, Consent, and Control (TCC) checks, exposing sensitive user data, including Apple Intelligence cache.
The Post SMTP WordPress plugin (400,000+ installations) is affected by a critical flaw allowing website takeover; approximately half of affected sites remain unpatched.

Notable Threat Actor Activity

The BlackSuit ransomware group has been disrupted by law enforcement, with former members forming a new double-extortion group under the name Chaos ransomware.
Scattered Spider, a financially motivated threat actor, is shifting tactics to target VMware vSphere environments directly, deploying ransomware from the hypervisor rather than through Active Directory.
Ukrainian and Belarusian hacker groups claimed responsibility for a cyberattack on Russian airline Aeroflot, resulting in the cancellation of over 100 flights.
A new infostealer malware, Shuyal Stealer, is targeting credentials and system data from 19 different browsers, including privacy-focused options, and demonstrates advanced evasion techniques.

Trends, Tools, or Tactics of Interest

Software supply chain attacks remain prevalent, as demonstrated by the Toptal npm incident and malware distribution via legitimate software tools (Endgame Gear).
Exposed API documentation continues to be a significant risk; the free Autoswagger tool was released to help identify and remediate API endpoint flaws.
Agentic AI and deepfake creation are rapidly advancing, increasing risks for identity fraud, disinformation, and targeted attacks.
The use of ransomware from virtualisation platforms (VMware vSphere) is an emerging tactic among financially motivated groups.
A trend of exploiting vulnerabilities in widely used plugins and platforms (WordPress, PaperCut, SharePoint) is ongoing, with rapid exploitation following disclosure.
The prevalence of data breaches involving large user databases highlights ongoing risks associated with third-party applications and cloud-based services.

Regulatory or Policy Developments

CISA updated its Known Exploited Vulnerabilities catalog to include actively exploited flaws in PaperCut NG/MF.
Microsoft announced end of support for Windows 11 22H2 editions effective 14 October 2025.
The Internet Archive has become an official US federal depository library, expanding public access to government documents.
Adobe appointed Aanchal Gupta as Chief Security Officer.

Cybersecurity Brief – 2025-07-25

Fri, 25 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Law enforcement has seized the dark web extortion sites of the BlackSuit ransomware operation, which has breached hundreds of organizations globally.
Toptal’s GitHub organization account was compromised, with attackers publishing ten malicious npm packages to the npm registry.
Security flaws in Airportr, a luggage service used by 10 airlines, exposed user data and allowed attackers to potentially redirect or steal luggage.
A threat actor named EncryptHub compromised an early access Steam game to distribute info-stealing malware to users.
CastleLoader malware has infected 469 devices by leveraging fake GitHub repositories and phishing techniques (ClickFix) to deliver info-stealers and remote access trojans.
Multiple npm developer accounts were compromised in a phishing campaign, resulting in malware being injected into popular npm packages.

Newly Discovered Vulnerabilities

Microsoft SharePoint: Five vulnerabilities collectively known as ToolShell were detailed, including a POST request exploit that can bypass initial patches. Over 400 SharePoint servers, including US government systems, have been targeted.
Mitel MiVoice MX-ONE: A critical authentication bypass vulnerability has been disclosed and patched, allowing attackers to gain full access to affected systems.
Sophos Firewall and SonicWall SMA 100 Series: Critical remote code execution vulnerabilities have been patched. SonicWall specifically urges immediate updates due to recent malware attacks exploiting these flaws.
Airportr: Web security bugs exposed sensitive user data and allowed privilege escalation.
AI-generated image watermarks have been found to be easily removable, undermining some anti-misinformation controls.

Notable Threat Actor Activity

Storm-2603, a China-based threat actor, is actively exploiting SharePoint ToolShell vulnerabilities to deploy Warlock ransomware in ongoing campaigns.
Fire Ant, a threat actor, is targeting VMware ESXi hosts and vCenter environments in a prolonged cyber espionage campaign.
China-nexus APTs have deployed fake Dalai Lama apps to spy on the Tibetan community in multi-stage attacks.
BlackSuit ransomware infrastructure was disrupted by law enforcement following a global campaign of breaches.
High-value npm developer accounts have been targeted in phishing campaigns to distribute malicious packages.
Koske, a new Linux malware, is using steganography-hiding malicious payloads in panda JPEG images-and may have been developed with AI.

Trends, Tools, or Tactics of Interest

Ransomware groups are increasingly exploiting SharePoint ToolShell vulnerabilities, with a focus on unpatched systems.
CastleLoader demonstrates the use of fake GitHub repositories and phishing as initial infection vectors for malware distribution.
New malware delivery methods include steganography (Koske) and compromised software supply chains (npm, Steam games).
The evilreplay tool enables real-time browser session hijacking via XSS without the need for cookie theft, providing interactive post-exploitation control.
Offensive security is shifting towards continuous, proactive testing rather than annual penetration tests.
Law enforcement actions are increasing against cybercrime forums (e.g., XSS) and ransomware operations.

Regulatory or Policy Developments Affecting the Security Industry

The UK has implemented mandatory age verification for adult content access, raising privacy and security concerns about the collection and management of personal data.
New York is seeking public input on proposed cyber regulations for water systems, including incident reporting, response plans, and compliance certification.
Clorox has filed a $380 million lawsuit against Cognizant over a 2023 hack, alleging that IT provider actions enabled the breach.

Toptal on DanSec Daily

Cybersecurity Brief – 2025-07-29

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2025-07-25

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry