Wing FTP on DanSec Daily

Cybersecurity Brief – 2026-03-18

Wed, 18 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

UK Companies House disclosed a vulnerability that exposed details of millions of firms, which could have been exploited to obtain sensitive company information and alter official records.
Robotic surgery manufacturer Intuitive confirmed a cyberattack after an employee fell victim to a phishing scheme, resulting in unauthorised access to internal business applications.
GlassWorm malware resurfaced in a supply-chain attack targeting over 400 code repositories and packages on GitHub, npm, VSCode, and OpenVSX, impacting the software supply chain.
Sears exposed AI chatbot phone calls and text chats to the public web, allowing access to customer conversations containing contact information and personal details.
LeakNet ransomware adopted the ClickFix technique via compromised websites for initial access and deployed a Deno-based in-memory loader, increasing stealth in attacks.
The RondoDox botnet escalated its activity, targeting 174 vulnerabilities with up to 15,000 exploitation attempts per day.
A phishing attack targeted cybersecurity firm Outpost24, using trusted brands and domains in an attempt to compromise C-suite credentials; the attack was unsuccessful.

Newly Discovered Vulnerabilities

Apple released its first Background Security Improvements update to patch a WebKit vulnerability (CVE-2026-20643) affecting iOS, iPadOS, and macOS, which enabled same-origin policy bypass.
A critical unpatched vulnerability (CVE-2026-32746) in the GNU InetUtils telnet daemon (telnetd) allows unauthenticated remote code execution as root via port 23.
Multiple AI platforms, including Amazon Bedrock, LangSmith, and SGLang, were found vulnerable to data exfiltration and remote code execution attacks using DNS queries.
CISA flagged the year-old Wing FTP vulnerability (CVE-2025-47813) as actively exploited, which can disclose the full local installation path of the application.
A new font-rendering attack was identified that hides malicious commands from AI tools by embedding them in HTML, evading detection by AI-based security solutions.

Notable Threat Actor Activity

North Korean threat actor group Konni was observed deploying EndRAT through phishing campaigns and leveraging the KakaoTalk desktop app to propagate malware to victims’ contacts.
LeakNet ransomware group is now using ClickFix for social engineering and Deno runtime for in-memory malware loading, enhancing stealth and evasion.
The Warlock ransomware group demonstrated augmented post-exploitation activities, including a new Bring Your Own Vulnerable Driver (BYOVD) technique and advanced cross-network movement.
Attackers are increasingly using IPv4-mapped IPv6 addresses to obfuscate attack origins, as noted in recent web scanning activity.

Trends, Tools, or Tactics of Interest

Attackers are shifting from traditional intrusion methods to credential theft, with increased use of infostealer malware and AI-enabled social engineering, leading to more incidents of attackers “logging in, not breaking in.”
Ransomware actors are moving away from Cobalt Strike in favour of native Windows tools due to declining ransom payment rates and a surge in data theft.
Akamai reported a convergence of Layer 7 DDoS, API abuse, and AI-powered attacks into highly coordinated, multi-vector campaigns that are more challenging to detect and mitigate.
Integrated Cloud Email Security (ICES) is highlighted as a recommended solution for modern email threats, as attackers continue to evolve phishing techniques.
SEO poisoning is being used to lure users searching for VPNs into downloading malicious software that steals corporate login credentials.
AI security remains a concern: studies indicate most CISOs are relying on outdated tools and skills to secure AI systems, and 90% of surveyed users do not trust AI with their data.
Use of in-memory loaders and open-source runtimes (such as Deno) is increasing in ransomware deployment for stealthier attacks.
Supply chain threats continue to target open-source repositories and extensions, as evidenced by the GlassWorm campaign.
Google is implementing stricter controls on Android apps abusing accessibility features to combat mobile malware.
A new tactic was observed where malicious commands are hidden from AI-based detection tools using font-rendering tricks in HTML.

Regulatory or Policy Developments

The European Union Council imposed sanctions on three entities and two individuals from China and Iran for involvement in cyberattacks targeting critical infrastructure.
Major tech companies including Anthropic, AWS, Google, Microsoft, and OpenAI have collectively invested $12.5 million in the Linux Foundation for open source security initiatives.
Google, Meta, and Microsoft are among the signatories of a new industry pact to combat online scams and fraud.

Cybersecurity Brief – 2026-03-17

Tue, 17 Mar 2026 00:00:00 +0000

Major Incidents or Breaches

Stryker, a medical technology company, suffered a cyberattack affecting its internal Microsoft environment. The attack remotely wiped tens of thousands of employee devices without deploying malware.
Companies House, the UK’s company registry, confirmed a security flaw in its WebFiling service that exposed business data. The service was temporarily taken offline to address the issue.
Hundreds of Python repositories were compromised in the GlassWorm campaign using stolen GitHub tokens, allowing attackers to inject malware into projects. The attack leveraged access to developer accounts obtained via previous campaigns.
Hacked WordPress sites are delivering Vidar infostealer to Windows users via fake “verify you are human” prompts.
A hacking attempt was reported at Poland’s nuclear research center, with initial evidence suggesting possible Iranian involvement, though attribution is unconfirmed.

Newly Discovered Vulnerabilities

CISA added a medium-severity Wing FTP Server vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, which leaks server paths, is being actively exploited and may be chained for remote code execution.
Researchers detailed the “Zombie ZIP” method, which can bypass antivirus detection during a first scan by manipulating ZIP file structures. There is debate over whether this constitutes a vulnerability.
Companies House addressed a security flaw that exposed business data through its WebFiling service.

Notable Threat Actor Activity

The GoPix banking Trojan, originating from Brazil, was analyzed for its complex memory-only operation, use of Proxy AutoConfig (PAC) files for man-in-the-middle attacks, and malvertising distribution tactics.
Russian-linked threat actors deployed the DRILLAPP backdoor against Ukrainian targets, abusing Microsoft Edge debugging features for stealth and persistence.
China-nexus threat actors have maintained long-term access to Southeast Asian military organizations using custom backdoors and evasion techniques, staying dormant for extended periods.
Storm-2561 is targeting VPN users by distributing fake VPN clients through SEO poisoning, resulting in credential theft via trojans.
Attackers are abusing LiveChat platforms to phish for credit card and personal data by impersonating PayPal and Amazon customer support.
Sophisticated phishing attacks have targeted security firm executives using DKIM-signed emails, trusted redirect infrastructure, compromised servers, and Cloudflare-protected phishing pages.

Trends, Tools, or Tactics of Interest

An emerging obfuscation technique is being used to evade email security solutions that rely on Natural Language Processing (NLP), making malicious emails harder to detect.
GlassWorm malware is evolving to hide in dependencies and extensions, increasing persistence and evasion capabilities within supply chain attacks.
ClickFix campaigns are distributing the MacSync macOS infostealer via fake AI tool installers, representing a shift from exploit-based to social engineering-based delivery methods.
Shadow AI adoption is proliferating in SaaS environments as employees use unapproved AI tools, increasing organizational risk and complicating security monitoring.
Attackers are scanning for proxy servers using /proxy/ URLs with IP addresses, a technique frequently detected by honeypots.
Models are being recruited via Telegram channels to serve as faces for AI scams, enabling more convincing social engineering campaigns.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued guidance for US government agencies to secure Wing FTP Server instances against active exploitation.
Companies House in the UK temporarily suspended its WebFiling service to remediate a security flaw, impacting public access to company registry services.

Cybersecurity Brief – 2025-07-13

Sun, 13 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Over 600 Laravel applications have been exposed to remote code execution (RCE) due to leaked APP_KEYs found on GitHub, enabling attackers to compromise affected deployments.
Hackers are actively exploiting a critical RCE vulnerability in Wing FTP Server, following the public release of technical details about the flaw.
Four individuals have been arrested in connection with the Scattered Spider hacking group, which has been implicated in a series of high-profile attacks.

Newly Discovered Vulnerabilities

A new attack variant, GPUHammer, targets NVIDIA GPUs by exploiting a RowHammer-style vulnerability, potentially degrading the performance of AI models. NVIDIA has advised customers to enable System-level Error Correction Codes (ECC) to mitigate risk.

Notable Threat Actor Activity

Arrests have been made relating to the Scattered Spider group, known for sophisticated cyber intrusions and extortion campaigns.
A Russian professional basketball player has been arrested on ransomware-related charges.

Trends, Tools, or Tactics of Interest

The Grok-4 large language model (LLM) by xAI was successfully jailbroken within two days of release, highlighting ongoing challenges in securing generative AI models against prompt injection and bypass techniques.
There is a reported surge in AI-generated child abuse imagery circulating online, indicating increased abuse of generative AI tools for illicit content production.

Cybersecurity Brief – 2025-07-12

Sat, 12 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

A vulnerability in McHire, McDonald’s chatbot job application platform, exposed chat histories and personal data of over 64 million job applicants in the United States due to weak authentication (“123456” password) and insecure API design.
The developer account for the WordPress Gravity Forms plugin was compromised, leading to backdoored plugin installers being distributed via the official website in a supply-chain attack.
A critical vulnerability (CVE-2025-47812) in Wing FTP Server is being actively exploited in the wild, allowing attackers to execute arbitrary commands with root or system privileges.

Newly Discovered Vulnerabilities

Fortinet patched a critical SQL injection vulnerability (CVE-2025-25257) in FortiWeb that allows unauthenticated attackers to execute arbitrary database commands. Proof-of-concept exploits for this vulnerability have been publicly released.
Security researchers disclosed four vulnerabilities in OpenSynergy’s BlueSDK Bluetooth stack (“PerfektBlue”), which could allow remote code execution on millions of vehicles (including Mercedes, Skoda, and Volkswagen) and over a billion industrial, medical, mobile, and consumer devices.
The U.S. CISA confirmed active exploitation of the CitrixBleed 2 vulnerability (CVE-2025-5777) in Citrix NetScaler ADC and Gateway, mandating federal agencies to patch within 24 hours.
A zero-day vulnerability in OpenVSX, a popular extension marketplace, was discovered and patched. The flaw could have enabled attackers to compromise millions of developer machines via a supply chain attack.
Microsoft disclosed new attack techniques targeting AMD CPUs.
NVIDIA issued guidance recommending activation of System Level Error-Correcting Code (ECC) to mitigate Rowhammer attacks on GPUs with GDDR6 memory. Researchers demonstrated Rowhammer-based “GPUHammer” attacks that can degrade machine learning model accuracy.

Notable Threat Actor Activity

The Iranian-backed Pay2Key ransomware-as-a-service operation has resurfaced, offering affiliates an increased profit share (80%) for attacks targeting Western organisations, particularly in the US and Israel. This follows recent geopolitical tensions involving Iran, Israel, and the US.
The Indian APT group DoNot is actively targeting government entities.

Trends, Tools, or Tactics of Interest

Researchers at Netcraft highlighted that AI-generated search engine summaries are inadvertently directing users to phishing sites when queried for legitimate login pages, posing a new phishing risk vector.
SentinelOne reported evolution in the ZuRu macOS malware family.
The 2025 Data Risk Report notes heightened data loss risks from AI-powered tools, with calls for unified, AI-driven data security strategies.
Cyber-insurance premiums are declining from previous highs, though comprehensive coverage remains vital for risk management.
There is increased emphasis on integrating cybersecurity into financial sector digital transformation strategies.
Discussion of passwordless authentication mechanisms-specifically passkeys using public key cryptography-to address the inherent risks of shared secrets in traditional password systems.

Regulatory or Policy Developments

The European Union unveiled a voluntary AI Code of Practice to help businesses comply with the phased rollout of the EU AI Act.
The Irish Data Privacy Commission opened a new investigation into TikTok regarding the transfer of user data to China under EU privacy regulations.
Google did not release a scheduled July 2025 Android security patch, breaking a ten-year streak of monthly updates.