University of Pennsylvania on DanSec Daily

Cybersecurity Brief – 2025-12-03

Wed, 03 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang, a major South Korean e-commerce platform, suffered a data breach compromising the personal information (names, addresses, email addresses, and phone numbers) of 33.7 million users over a five-month period.
The University of Pennsylvania confirmed a data breach after attackers stole documents containing personal information from Oracle E-Business Suite servers in August.
Korean authorities arrested four individuals for hacking over 120,000 IP cameras and selling intimate footage to a foreign adult site.
The Shai-Hulud 2.0 npm malware attack exposed up to 400,000 developer secrets after infecting hundreds of npm packages and publishing stolen data in 30,000 GitHub repositories.
Five Chrome and Edge browser extensions, with over 4 million installs, turned malicious after years of benign operation, acting as spyware and tracking users.
Microsoft Defender XDR portal experienced a prolonged outage, disrupting access to security alerts and threat hunting capabilities for over 10 hours.
OpenAI’s ChatGPT service suffered a global outage, with users unable to access conversations.
Yearn Finance’s yETH pool on Ethereum was exploited for approximately $9 million via a critical vulnerability.

Newly Discovered Vulnerabilities

Google’s December 2025 Android security update patched 107 vulnerabilities, including two zero-days (CVE-2023-40088 and CVE-2023-40089) actively exploited in targeted attacks.
A vulnerability in OpenAI’s Codex CLI (CVE-2025-61260) could allow command execution, potentially facilitating attacks on developers using the coding agent.
Microsoft released KB5070311 for Windows 11, addressing File Explorer freezes and search issues, but also introduced a bug causing bright white flashes in dark mode.
Malicious npm package eslint-plugin-unicorn-ts was discovered using hidden prompts and scripts to evade AI-driven security scanners.
Chrome and Edge extensions were caught creating backdoors, profiling users, and reading cookie data to generate unique identifiers.
The Raptor framework, an open-source AI tool, was demonstrated to generate both vulnerability exploits and patches using agentic workflows.

Notable Threat Actor Activity

North Korean threat actors (DPRK/Lazarus) were observed luring engineers to rent their identities for fraudulent IT work and distributing over 197 malicious npm packages since October 10, targeting software developers.
The GlassWorm supply chain campaign resurfaced, infiltrating Microsoft Visual Studio Marketplace and Open VSX with 24 malicious extensions impersonating popular developer tools.
Iran-linked MuddyWater group deployed a new backdoor, MuddyViper, in targeted attacks against Israeli sectors, including academia, engineering, government, manufacturing, technology, transportation, and utilities. The new Fooder loader and memory-only tactics indicate a shift to more stealthy espionage operations.
An ongoing phishing campaign is spoofing top brands via fake Calendly invites to hijack Google Workspace and Facebook business accounts.
Researchers reported that cybercrime has shifted to a full subscription model, with phishing kits, Telegram OTP bots, infostealer logs, and RATs now offered as “crime-as-a-service”.

Trends, Tools, or Tactics of Interest

Kaspersky Security Bulletin 2025 highlighted a significant increase in AI-driven biometric attacks, with 1 in 5 biometric attacks now leveraging AI-generated deepfakes.
Researchers demonstrated that presenting prompts to AI models in poetic form increased jailbreak success rates from 8% to 43%.
Attackers are leveraging supply chain attacks via malicious npm and Visual Studio extensions targeting developers.
Crime-as-a-service offerings continue to proliferate, making advanced cybercrime tools and infrastructure more accessible.
Tools like SecAlerts are emerging to streamline vulnerability management amid increasing software sprawl.
The Raptor AI framework exemplifies the dual-use nature of generative AI in both offensive and defensive security contexts.

Regulatory or Policy Developments

India’s Department of Telecommunications mandated that messaging apps may only be used with active SIM cards linked to user identities, aiming to reduce fraud and misuse.
The US FTC reached a settlement with Illuminate Education, requiring deletion of unnecessary student data and improved security practices following allegations of inadequate data protection.
New York enacted a law requiring retailers to disclose if consumer data influences the pricing of basic goods.

Cybersecurity Brief – 2025-11-06

Thu, 06 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall confirmed that state-sponsored threat actors were responsible for the September 2025 breach, which resulted in the exposure of customers’ firewall configuration backup files.
Hyundai AutoEver America reported a data breach in which attackers accessed sensitive personal information, including Social Security numbers and driver’s license details.
The University of Pennsylvania disclosed that a cyberattack led to the compromise and theft of data from internal systems related to development and alumni activities.
Nikkei, a major Japanese media company, suffered a breach via compromised Slack credentials, impacting approximately 17,000 employees and business partners.
International law enforcement dismantled three large credit card fraud and money laundering networks, linked to losses exceeding €300 million and affecting over 4.3 million cardholders.
Check Point Research detailed an incident where an attacker exploited a rounding error in Balancer V2’s ComposableStablePool, resulting in the theft of $128 million in cryptocurrency.

Newly Discovered Vulnerabilities

A critical remote command execution vulnerability in CentOS Web Panel (CWP) is being actively exploited, according to CISA.
A critical vulnerability in the Post SMTP WordPress plugin is under active attack, allowing full compromise of affected sites and unauthorized reading of emails, including password reset messages. Approximately 400,000 WordPress sites are affected.
Researchers disclosed new vulnerabilities in OpenAI’s ChatGPT that could enable attackers to steal personal information and confidential data.
Apple released patches addressing nearly 50 security flaws across iPhones, Macs, Safari, and other products, some of which could be used to compromise user data.
A zero-day vulnerability (CVE-2025-61932) in a popular endpoint manager was exploited by the APT group Bronze Butler to backdoor Japanese organizations.

Notable Threat Actor Activity

Google identified a previously unknown threat actor deploying VB Script malware dubbed PROMPTFLUX, which uses Gemini AI to rewrite its code every hour to evade detection.
Google’s Threat Intelligence Group reported a major shift toward adversaries leveraging artificial intelligence to create and deploy new malware families with large language model (LLM) integration, including malware that mutates during execution.
The Gootloader malware loader operation has resumed after a 7-month hiatus, again using SEO poisoning to distribute malicious payloads.
A new threat cluster, codenamed UNK_SmudgedSerpent, has targeted US academics and foreign policy experts amid Iran–Israel tensions, with attribution to Iranian threat actors suspected but unconfirmed.
The Aisuru botnet was observed dominating Cloudflare’s top requested domains list, indicating significant botnet activity.
The US Treasury Department imposed sanctions on two North Korean financial institutions and eight individuals, targeting entities involved in laundering stolen cryptocurrency and conducting fraudulent IT worker schemes.

Trends, Tools, or Tactics of Interest

Multiple sources, including Malwarebytes and Google, highlight a rapid increase in AI-driven extortion, phishing, and malware campaigns, with AI being used for code mutation, data collection, and evasion.
Verizon’s Mobile Security Index and other studies reaffirm that human error remains a leading factor in successful cyberattacks, particularly in mobile security incidents.
Gootloader’s return signals ongoing use of SEO poisoning as an effective method for malware distribution.
Attackers are increasingly targeting supply chain vulnerabilities, with concerns raised about a popular software update tool presenting risks comparable to the SolarWinds incident.
There is continued exploitation of operational technology (OT) environments in manufacturing, with inherent security risks persisting despite increased awareness.

Regulatory or Policy Developments Affecting the Security Industry

UK mobile carriers, in partnership with the government, have committed to network upgrades designed to block spoofed phone numbers, aiming to reduce scam and fraud incidents.
The US Treasury Department’s new sanctions against North Korean entities underscore ongoing international efforts to disrupt cyber-enabled financial crime and fraud.

Cybersecurity Brief – 2025-11-01

Sat, 01 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Ribbon Communications, a US telecom company, disclosed a breach attributed to suspected nation-state actors, with initial access dating back to December of the previous year. The company has not confirmed whether sensitive data was accessed.
The University of Pennsylvania experienced a cybersecurity incident in which students and alumni received offensive emails from compromised university addresses, with threats to leak data.
Open VSX (Eclipse Foundation) revoked a small number of leaked tokens after discovery by Wiz. The incident was contained, and the foundation downplayed the impact, stating it was not a self-replicating worm.
Australian authorities issued warnings regarding ongoing attacks on unpatched Cisco IOS XE devices, with routers being compromised via the BadCandy webshell.

Newly Discovered Vulnerabilities

A critical zero-day vulnerability in Motex Lanscope Endpoint Manager (CVE-2025-xxxx) is being actively exploited by the China-linked Tick group for cyber espionage and system hijacking.
An unpatched Windows shortcut vulnerability is being exploited by China-affiliated threat actors, including UNC6384 and Mustang Panda, to target European diplomatic and government entities. Attacks use spear-phishing with European Commission and NATO-themed lures to deliver malware, including PlugX.
CISA confirmed active exploitation of a high-severity Linux kernel privilege escalation flaw by ransomware groups.
Broadcom updated its advisory to confirm in-the-wild exploitation of a VMware vulnerability (CVE-2025-41244), now added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Google released a Chrome update addressing 20 security issues, including seven serious flaws that could allow remote code execution via malicious web pages.

Notable Threat Actor Activity

Nation-state threat actors are distributing new malware named Airstalk as part of a suspected supply chain attack, according to Palo Alto Networks Unit 42.
China-linked UNC6384 and Mustang Panda are conducting targeted attacks against European diplomatic entities, exploiting unpatched Windows vulnerabilities.
The China-linked Tick group is exploiting a Lanscope zero-day for corporate system compromise.
Russian authorities arrested three individuals believed to be administrators of the Meduza Stealer malware operation after attacks on Russian organizations.
A Ukrainian national was extradited from Ireland to the US on charges related to participation in the Conti ransomware group.

Trends, Tools, or Tactics of Interest

OpenAI announced Aardvark, an agentic security researcher powered by GPT-5, designed to autonomously identify and remediate code flaws.
Microsoft Edge introduced a new scareware sensor to enhance scam detection capabilities and improve Defender SmartScreen response times.
Ongoing exploitation of unpatched networking devices (notably Cisco IOS XE) continues to be leveraged for webshell deployment and persistent access.
The use of spear-phishing with themed lures (European Commission, NATO) remains prevalent in targeted attacks on diplomatic sectors.
MSPs are facing increased client expectations for cybersecurity and compliance, amid evolving threats and regulatory demands.

Regulatory or Policy Developments

The United Nations adopted a new Convention Against Cybercrime, establishing an international framework for cross-border cybercrime cooperation.
CISA and NSA, in coordination with Australian and Canadian partners, issued urgent guidance to secure on-premises WSUS and Microsoft Exchange servers.
Japan released comprehensive OT security guidance for semiconductor factories, available in both Japanese and English.
CISA added exploited XWiki and VMware vulnerabilities to the Known Exploited Vulnerabilities catalog.