Cybersecurity Brief – 2025-08-15

Fri, 15 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

The House of Commons of Canada is investigating a data breach after a cyberattack resulted in the theft of employee information.
Pro-Russian hackers have been blamed for taking control of critical operation systems at a Norwegian water dam and opening outflow valves, according to the Norwegian Police Security Service.
Over $300 million in cryptocurrency linked to cybercrime and fraud schemes has been seized through two joint law enforcement and private sector operations.
The US Courts records system suffered a breach, with details about the exposure and responsible party still unclear.
Cybercriminals are auctioning live police and government email credentials on the dark web, offering access to sensitive systems and confidential intelligence.
Four individuals from Ghana have been charged with stealing over $100 million via romance scams and business email compromise (BEC) schemes.

Newly Discovered Vulnerabilities

The “MadeYouReset” vulnerability in multiple HTTP/2 implementations enables large-scale denial-of-service (DoS) attacks by exploiting how HTTP/2 handles stream resets. This vulnerability is comparable to the Rapid Reset attack vector.
Two vulnerabilities (CVE-2025-8875 and CVE-2025-8876) in N-able N-central remote monitoring and management (RMM) platform are being actively exploited as zero-days. These allow local code execution and command injection after authentication.
Xerox FreeFlow Core print orchestration software contained path traversal and XML external entity (XXE) injection flaws enabling unauthenticated remote code execution. Patches have been released.
Researchers demonstrated that passkey (FIDO/WebAuthn) authentication can be bypassed via manipulation of the WebAuthn process, allowing attackers to impersonate users.
A downgrade attack technique has been shown to allow phishing kits to bypass FIDO authentication, enabling credential theft even with strong authentication mechanisms.

Notable Threat Actor Activity

The Crypto24 ransomware group is targeting large organisations using custom utilities for endpoint detection and response (EDR) evasion, data exfiltration, and file encryption.
Threat actors are using the CrossC2 command-and-control framework to expand Cobalt Strike Beacon capabilities to Linux and macOS environments, as observed by JPCERT/CC.
A new Android banking trojan, PhantomCard, is abusing NFC relay attacks, call hijacking, and root exploits to conduct fraudulent transactions.
A phishing campaign is distributing malware by leveraging a Japanese hiragana character (“ん”) in URLs to impersonate Booking.com, making malicious links appear legitimate.
Scammers are targeting jobseekers with fake Netflix job offers to steal Facebook login credentials.

Trends, Tools, or Tactics of Interest

The Picus Blue Report 2025 notes that only 3% of data exfiltration attempts are stopped, indicating a trend toward stealthy ransomware and infostealer operations focused on data theft rather than encryption.
MailSniper, a PowerShell tool for Exchange, is being used in red team operations to search mailboxes for credentials, network intelligence, and usernames.
SNI5GECT research demonstrates the ability to sniff and inject traffic in 5G networks without rogue base stations, highlighting risks to 5G infrastructure.
Budget constraints are impacting cybersecurity teams, particularly in healthcare, professional services, retail, and hospitality, while financial services, insurance, and tech sectors see budget growth above 5%.
Google Chrome Enterprise is enhancing browser security for enterprise environments, with a focus on extending protections from browser to operating system.

Regulatory or Policy Developments

State and local leaders in the US are lobbying Congress for increased cybersecurity resources following federal funding cuts to the Multi-State Information Sharing and Analysis Center (MS-ISAC), potentially affecting over 18,000 organisations’ access to basic cybersecurity services.

Cybersecurity Brief – 2025-08-14

Thu, 14 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

The Office of the Pennsylvania Attorney General experienced a cyberattack that disrupted email, phone systems, and their website.
Manpower disclosed a data breach affecting 140,000 individuals after the RansomHub ransomware group stole sensitive information in January.
US investigators confirmed that Russian hackers breached the US court electronic filing system, accessing court records and sealed filings.
Norwegian police attributed suspected sabotage at a dam to pro-Russian hackers, who accessed and manipulated a remote valve control system.

Newly Discovered Vulnerabilities

Fortinet disclosed a critical pre-authentication remote code execution vulnerability (CVE-2025-25256) in FortiSIEM, with exploit code observed in the wild. A surge in brute-force attacks against Fortinet SSL VPNs and FortiManager was also reported.
CISA added two N-able N-central vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Zoom and Xerox released critical security updates addressing privilege escalation and remote code execution flaws in Zoom Clients for Windows and FreeFlow Core, respectively.
Microsoft’s August 2025 Patch Tuesday addressed 111 vulnerabilities, including a publicly known Kerberos zero-day and multiple high-severity flaws.
Intel, AMD, and Nvidia published advisories for numerous vulnerabilities in their products as part of their coordinated Patch Tuesday releases.
A new downgrade attack was demonstrated against Microsoft Entra ID, enabling bypass of FIDO authentication by coercing users into weaker authentication methods.
A critical vulnerability (CVSS 10) in an Erlang-based OT platform was observed being actively exploited to target operational technology networks.

Notable Threat Actor Activity

North Korean threat actors deployed a variety of malware, including stealers, backdoors, and ransomware, against South Korean targets in a multi-pronged campaign.
Pro-Russian hackers were linked to both the sabotage of a Norwegian dam and the breach of the US court system.
A significant increase in brute-force attacks targeting Fortinet SSL VPN appliances was observed, raising concerns of potential zero-day exploitation.

Trends, Tools, or Tactics of Interest

Phishing and scam campaigns are increasingly leveraging AI, deepfakes, Telegram, Google Translate, and Blob URLs, with new methods targeting biometric data.
A new malvertising campaign is distributing the modular PS1Bot malware, which uses multi-stage in-memory attack techniques.
Persistent exploitation of older vulnerabilities, such as CVE-2017-11882, continues to be reported.
AI-based tools are gaining traction in penetration testing, with an automated pen tester becoming a top bug hunter on HackerOne.
Open source AI models are reportedly less effective in vulnerability research compared to commercial and underground models.
Data brokers are facing scrutiny for hiding privacy opt-out tools from search engines, with regulatory pressure increasing for transparency.
Reports highlight the continued presence of the XZ Utils backdoor in legacy Docker images, though the risk of exploitation is considered low.

Regulatory or Policy Developments Affecting the Security Industry

CISA and partners released new asset inventory guidance aimed at improving operational technology (OT) security practices.
Increased policy attention in the US on data broker practices, with calls for improved visibility and accessibility of consumer privacy controls.
Microsoft announced the removal of PowerShell 2.0 from Windows 11 and Windows Server starting August 2025, following its long-standing deprecation.

Xerox on DanSec Daily

Cybersecurity Brief – 2025-08-15

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments

Cybersecurity Brief – 2025-08-14

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry