https://blog.dansec.red/vendors/ubisoft/Recent content in Ubisoft on DanSec DailyHugoen-gbMon, 29 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-29-cybersecurity-news/Mon, 29 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-29-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>A hacker claims to have breached Condé Nast and leaked an alleged WIRED database containing more than 2.3 million subscriber records. The attacker also stated intentions to release up to 40 million additional records.</li> <li>Ubisoft&rsquo;s Rainbow Six Siege experienced a breach where attackers abused internal systems to ban and unban players, manipulate in-game moderation feeds, and grant players large amounts of in-game currency.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A high-severity vulnerability in MongoDB, tracked as CVE-2025-14847 (&ldquo;MongoBleed&rdquo;, CVSS 8.7), allows unauthenticated attackers to read uninitialized heap memory. The flaw affects multiple MongoDB versions.</li> <li>The MongoBleed vulnerability is being actively exploited in the wild, with reports indicating over 87,000 potentially vulnerable MongoDB servers are exposed to the internet. Attackers can leverage the flaw to leak sensitive database secrets.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Threat actors are actively exploiting the MongoBleed (CVE-2025-14847) vulnerability to access sensitive information from unpatched MongoDB instances. The scale of exposed servers suggests widespread scanning and exploitation activity.</li> </ul>https://blog.dansec.red/posts/2025-12-28-cybersecurity-news/Sun, 28 Dec 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-12-28-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Ubisoft&rsquo;s Rainbow Six Siege experienced a significant breach in which attackers exploited internal systems to ban and unban players, manipulate in-game moderation feeds, and grant players billions of in-game credits. The incident exposed weaknesses in the game&rsquo;s backend infrastructure and moderation controls.</li> </ul> <h2 id="newly-discovered-vulnerabilities">Newly Discovered Vulnerabilities</h2> <ul> <li>A high-severity vulnerability in MongoDB (CVE-2025-14847, CVSS 8.7) was disclosed, allowing unauthenticated attackers to read uninitialized heap memory. This flaw could potentially expose sensitive data processed by the database.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Attackers targeting Rainbow Six Siege demonstrated the capability to access and manipulate internal moderation tools, indicating a high level of access and understanding of Ubisoft’s internal systems. The breach resulted in large-scale abuse of in-game economies and moderation functionality.</li> </ul>