Velociraptor on DanSec Daily

Cybersecurity Brief – 2026-02-10

Tue, 10 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Chinese threat actor UNC3886 breached Singapore’s four largest telecommunications providers (Singtel, StarHub, M1, Simba) in a targeted cyber espionage campaign. The intrusions were confirmed by Singapore’s Cyber Security Agency.
The European Commission disclosed a breach involving its mobile device management platform, exposing staff data. An investigation is ongoing.
SmarterTools suffered a ransomware breach by the Warlock gang, who exploited vulnerabilities in SmarterMail. The attack compromised internal systems but did not impact business applications or customer account data.
A security researcher discovered an exposed database for the Chat & Ask AI app, leaking 300 million messages linked to 25 million users due to a Firebase misconfiguration.
Two Connecticut men were charged in the US for defrauding FanDuel and other gambling sites of $3 million using the stolen identities of approximately 3,000 individuals.
Malicious actors are deploying fake 7-Zip download sites, infecting home PCs and converting them into residential proxy nodes.
Romania’s national oil pipeline operator, Conpet, was targeted in a cyberattack, as reported in Check Point’s weekly threat intelligence bulletin.

Newly Discovered Vulnerabilities

Fortinet patched a critical SQL injection vulnerability (CVE pending) in FortiClientEMS that could allow unauthenticated attackers to execute arbitrary code.
BeyondTrust released updates for a critical pre-authentication remote code execution vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw allows unauthenticated attackers to execute arbitrary code.
SolarWinds Web Help Desk (WHD) vulnerabilities have been exploited as zero-days since December 2025, enabling remote code execution on exposed servers. Attackers have used these flaws to deploy legitimate tools, such as Velociraptor, for post-exploitation activities.
SmarterMail vulnerabilities were exploited by the Warlock ransomware gang to breach SmarterTools’ network.

Notable Threat Actor Activity

UNC3886, a China-linked APT, conducted a coordinated cyber espionage campaign against Singapore’s telecommunications sector, leveraging sophisticated tactics to breach multiple major providers.
Bloody Wolf threat actor targeted Uzbekistan and Russia in a spear-phishing campaign delivering NetSupport RAT for remote access.
TeamPCP orchestrated a large-scale campaign compromising cloud-native environments through automated worm-like attacks on exposed services, establishing criminal infrastructure for further exploitation.
The Warlock ransomware group exploited SmarterMail vulnerabilities to breach SmarterTools.
Attackers are exploiting SolarWinds WHD vulnerabilities to gain initial access and deploy forensics and DFIR tools for lateral movement.
Ransomware groups, notably those distributing “Reynolds” ransomware, are embedding vulnerable drivers (BYOVD - Bring Your Own Vulnerable Driver) with their payloads to facilitate defense evasion.

Trends, Tools, or Tactics of Interest

Ransomware groups are reportedly pivoting back to encryption-based extortion as data theft-only tactics yield diminishing returns.
Attackers are leveraging targeted wordlists derived from public organizational language (using tools such as CeWL) to improve password guessing success rates, without employing AI.
Malicious RTF documents exploiting CVE-2026-21509, attributed to APT28, are in active use for initial access.
Fake software distribution sites, such as those mimicking 7-Zip, are being used to covertly turn victim PCs into proxy infrastructure.
Automated exploitation of cloud infrastructure is being used at scale (TeamPCP) to build botnets and criminal infrastructure.
The use of legitimate digital forensics tools (e.g., Velociraptor) by attackers post-exploitation is increasing, complicating detection and response.
YARA-X 1.13.0 was released, offering improvements and bugfixes for threat hunting.
RSAC released Quantickle, an open-source browser-based threat intelligence visualization tool.
New research (KEVology) and tools are available to help security teams interpret and prioritise CISA KEV catalog vulnerabilities more effectively.

Regulatory or Policy Developments Affecting the Security Industry

Initial requirements of the EU AI Act come into effect this month (February 2026), beginning with compliance around banned activities.

Cybersecurity Brief – 2025-10-12

Sun, 12 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall SSL VPN devices: Huntress reported a widespread compromise of SonicWall SSL VPN devices, with threat actors authenticating into over 100 customer environments to access internal systems.
Gladinet CentreStack and TrioFox: Active exploitation of a zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox products has been observed, allowing unauthenticated local file access and potential escalation to remote code execution. The flaw remains unpatched.
BreachForums Takedown: The FBI seized all domains of the BreachForums hacking forum operated by the ShinyHunters group, which was used for leaking data from ransomware and extortion attacks, including recent Salesforce-related incidents.
AI Companion Apps Data Leak: Two AI “girlfriend” apps exposed millions of private chat logs belonging to over 400,000 users.
Oracle EBS Zero-Day Attacks: Sophisticated malware was deployed in attacks exploiting a zero-day in Oracle E-Business Suite (EBS), affecting dozens of organizations since at least 10 July.
Discord Age-Verification Data Exposure: A hack exposed sensitive age-verification data of Discord users.
Manufacturing Sector Ransomware: Reports highlight continued ransomware attacks targeting the manufacturing industry, with attackers exploiting unpatched vulnerabilities.
US Universities Payroll Attacks: US universities were targeted by attackers hijacking HR SaaS accounts to divert payroll payments, attributed to the Storm-2657 threat actor.

Newly Discovered Vulnerabilities

Juniper Networks Junos Space: More than 200 vulnerabilities, including nine critical-severity flaws, were patched in Junos Space and Junos Space Security Director.
Ivanti Endpoint Manager: The Zero Day Initiative (ZDI) disclosed 13 unpatched vulnerabilities in Ivanti Endpoint Manager, enabling remote code execution and privilege escalation.
GoAnywhere MFT (CVE-2025-10035): Fortra detailed active exploitation of this critical flaw in GoAnywhere Managed File Transfer, which has since been patched.
Node.js SEA Feature Abuse: The Stealit malware campaign uses Node.js’ Single Executable Application feature to distribute payloads via trojanized game and VPN installers.
Malicious npm Packages: 175 malicious npm packages with over 26,000 downloads were found harvesting credentials as part of a phishing campaign.

Notable Threat Actor Activity

North Korean IT Worker Schemes: North Korean threat actors have expanded fraudulent remote employment operations to target a broad range of industries, including architectural design, using fake identities and documentation.
LockBit/Storm-2603: The LockBit ransomware group (Storm-2603) has been observed abusing the Velociraptor DFIR tool to maintain persistence and facilitate attacks.
Storm-2657: This actor is actively hijacking HR SaaS accounts to redirect payroll payments, targeting a variety of organizations, including universities.
Coordinated Attacks on Network Devices: Infrastructure linked to coordinated attacks is being used to exploit vulnerabilities in Cisco, Fortinet, and Palo Alto Networks devices.
RondoDox Botnet: The RondoDox botnet employs over 50 exploits in a “shotgun” approach to compromise routers, DVRs, NVRs, CCTV systems, and other edge devices globally.
Aisuru DDoS Botnet: The Aisuru botnet is responsible for record-setting DDoS attacks against US ISPs, leveraging large numbers of compromised IoT devices.

Trends, Tools, or Tactics of Interest

Abuse of Legitimate Tools: Increased weaponization of legitimate digital forensics and incident response tools (e.g., Velociraptor) by ransomware groups for persistence and post-exploitation.
AI and Deepfake Threats: OpenAI’s new video and audio generation system raises concerns about the proliferation of deepfakes. Organizations report high awareness but insufficient investment in deepfake detection capabilities.
AI in Security Operations: Advancements in AI-powered Security Operations Center (SOC) platforms, with Microsoft introducing agentic AI capabilities in Sentinel, and the emergence of AI browser agents presenting new authentication challenges.
Supply Chain Risks: Discovery of malicious packages in npm and abuse of Node.js SEA highlight ongoing supply chain threats to software development environments.
Password Guidance: NIST updates suggest a shift away from overly complex password requirements, focusing on usability and security balance.

Regulatory or Policy Developments Affecting the Security Industry

Apple Bug Bounty Expansion: Apple has doubled its maximum bug bounty payout to $2 million for zero-click RCE vulnerabilities, introduced new research categories, and increased transparency in its rewards structure. Total payouts have reached $35 million, with bonuses for iPhone exploits potentially raising rewards to $5 million.
Windows 11 23H2 End of Support: Microsoft reminded users that Home and Pro editions of Windows 11 23H2 will stop receiving security updates next month.
Chrome Notification Permissions: Google Chrome will automatically revoke notification permissions for inactive websites to reduce notification spam.
Age-Verification Law Privacy Concerns: Apple raised privacy concerns regarding proposed age-verification laws, citing risks associated with increased sensitive data collection.

Cybersecurity Brief – 2025-10-11

Sat, 11 Oct 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has seized all domains associated with BreachForums, operated by the ShinyHunters group, which was used as a portal for leaking corporate data obtained through ransomware and extortion attacks, including recent Salesforce-related incidents. Despite the takedown, ShinyHunters continues to issue extortion threats against Salesforce victims.
Two AI companion applications exposed millions of private chat records from over 400,000 users due to inadequate security controls.
A critical zero-day vulnerability (CVE-2025-11371) in Gladinet CentreStack and TrioFox file sharing products is being actively exploited in the wild, allowing unauthenticated local attackers to access system files.
Sophisticated malware has been deployed in Oracle E-Business Suite (EBS) zero-day attacks, with exploitation believed to have started as early as July 10 and affecting dozens of organizations.
A large-scale DDoS attack was launched by the Aisuru botnet, leveraging compromised IoT devices hosted on major US ISPs.
Microsoft has observed a threat actor, Storm-2657, hijacking HR SaaS accounts to divert employee salary payments to attacker-controlled accounts; US universities have been specifically targeted in these payroll diversion attacks.

Newly Discovered Vulnerabilities

Fortra disclosed details of active exploitation of CVE-2025-10035, a critical vulnerability in GoAnywhere Managed File Transfer (MFT).
13 unpatched vulnerabilities in Ivanti Endpoint Manager have been publicly released by the Zero Day Initiative (ZDI), permitting remote code execution and privilege escalation.
Juniper Networks released patches for over 200 vulnerabilities in Junos Space and Junos Space Security Director, including nine critical-severity flaws.
175 malicious npm packages, collectively downloaded over 26,000 times, have been used in a credential phishing campaign.
Security researchers have detailed an active Stealit malware campaign abusing the Node.js Single Executable Application (SEA) feature, distributed via game and VPN installers.

Notable Threat Actor Activity

North Korean threat actors have expanded their fraudulent remote employment schemes to target nearly every industry hiring remote workers, including architectural design roles, using fake identities and documentation.
Chinese APT group Storm-2603 is abusing the Velociraptor digital forensics and incident response (DFIR) tool to gain persistent access to victim networks and facilitate ransomware deployment.
A coordinated campaign has been identified targeting Cisco, Fortinet, and Palo Alto Networks devices, with attacks originating from shared infrastructure.
The RondoDox botnet employs a “shotgun” approach, using more than 50 exploits against unpatched routers, DVRs, NVRs, CCTV systems, servers, and other network devices globally.

Trends, Tools, or Tactics of Interest

AI-generated deepfakes are proliferating, with OpenAI releasing an updated AI video and audio generation system, raising concerns about the acceleration and accessibility of deepfake creation.
The security industry is experiencing inadequate investment in deepfake detection, despite high organizational awareness and frequent encounters with AI-augmented threats.
Security Operations Centres (SOCs) are increasingly integrating AI-powered agents, with projections indicating significant transformation in SOC workflows by 2026.
Microsoft has added agentic AI capabilities to its Sentinel platform, previewing new security graph and MCP server features.
Attackers are leveraging malicious npm packages and abusing legitimate software features (e.g., Node.js SEA) to distribute malware and harvest credentials.
1Password addressed a critical security gap in its AI browser agent, which posed risks of credential leakage.
Timely patch management is highlighted as a key defense against escalating ransomware attacks on manufacturing and industrial control system (ICS) environments.

Regulatory or Policy Developments Affecting the Security Industry

Apple has expanded its bug bounty program, doubling the maximum payout to $2 million for zero-click remote code execution vulnerabilities, with potential bonuses raising the maximum to $5 million. The program now includes new research categories and a more transparent reward structure.
Microsoft reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 30 days, after which security updates will cease.
Google Chrome will automatically revoke notification permissions for inactive websites to reduce user alert fatigue.
Apple voiced concerns over proposed age-verification laws, warning that increased data collection for compliance could heighten user privacy risks.
NIST is revising password guidance, indicating that excessively complex password requirements may no longer be necessary.