Cybersecurity Brief – 2025-06-18

Wed, 18 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Scania, a major automotive manufacturer, confirmed a cybersecurity incident involving the compromise of insurance claim documents through stolen credentials. The breach was linked to an extortion attempt.
Cock.li, an email hosting provider, disclosed a data breach impacting over one million user records. Attackers exploited vulnerabilities in the now-retired Roundcube webmail platform to access the data.
Indian car-sharing firm Zoomcar reported a breach affecting more than 8 million users. Exposed data included names, phone numbers, car registration numbers, addresses, and emails.
23andMe was fined £2.31 million by the UK ICO for a data breach exposing genetic data, attributed to serious security failings.
WestJet Airlines warned customers and employees to be cautious with personal information following a cyber incident affecting its app and website, though core operations continued.
Paddle.com and its U.S. subsidiary settled with the U.S. FTC for $5 million over allegations of facilitating tech-support scams that harmed consumers.

Newly Discovered Vulnerabilities

Veeam released patches for a critical remote code execution (RCE) vulnerability (CVE-2025-23121, CVSS 9.9) in its Backup & Replication software. The flaw could allow domain users to compromise backup servers.
Researchers disclosed a chain of three vulnerabilities in Sitecore Experience Platform (XP), including a hard-coded password (“b”), allowing unauthenticated RCE on enterprise deployments.
Google Chrome addressed a zero-day vulnerability (CVE-2025-2783) exploited by the threat actor “TaxOff” to deploy the Trinper backdoor. The flaw was actively exploited in March 2025.
A critical RCE vulnerability in LangChain’s LangSmith platform was patched after researchers demonstrated it could expose OpenAI API keys and user data via malicious agents.
A critical security flaw in Langflow, a Python-based AI workflow tool, is under active exploitation to deploy the Flodrix botnet, enabling DDoS attacks and potential system compromise.
TP-Link router vulnerability CVE-2023-33538 is under active exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalog and issued an immediate alert.

Notable Threat Actor Activity

The Silver Fox APT group is conducting a sophisticated phishing campaign targeting Taiwanese organizations, deploying Gh0stCringe and HoldingHands RAT malware for information theft and persistent access.
The Scattered Spider (UNC3944) cybercrime group is targeting IT support teams at major U.S. insurance firms, expanding from previous attacks on U.K. and U.S. retailers.
The “TaxOff” threat actor exploited a Chrome zero-day to deliver the Trinper backdoor.
Attackers are exploiting the Langflow AI server RCE flaw to distribute the Flodrix botnet, primarily for DDoS operations.
Instagram ads leveraging AI deepfakes are impersonating Canadian banks (BMO and EQ Bank) to conduct phishing and investment fraud campaigns.

Trends, Tools, or Tactics of Interest

Ransomware campaigns are increasingly targeting backup infrastructure as an initial attack vector, with attackers focusing on compromising backup solutions to maximize impact.
Forgotten or unmanaged Active Directory service accounts are highlighted as a persistent risk, often remaining active with elevated privileges and lacking oversight.
Use of hard-coded credentials in enterprise software (e.g., Sitecore XP) continues to pose significant RCE risks.
Phishing campaigns are leveraging AI-generated deepfakes to enhance credibility and effectiveness, as seen in the Instagram banking scams.
There is increased exploitation of vulnerabilities in AI and workflow automation platforms (LangSmith, Langflow), indicating attackers are targeting emerging tech stacks.
SMS-based two-factor authentication is identified as insecure, with risks highlighted from third-party interception of codes.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £2.31 million fine on 23andMe for inadequate security practices resulting in a major data breach affecting genetic data.
Paddle.com agreed to a $5 million settlement with the U.S. FTC for facilitating tech-support scams, reinforcing regulatory scrutiny on payment processors involved in fraudulent activities.
Iran has implemented internet throttling to disrupt potential cyber operations by foreign adversaries, specifically in response to recent escalations with Israel.

Cybersecurity Brief – 2025-06-17

Tue, 17 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The Washington Post disclosed a cyberattack in which email accounts of several journalists, including those covering national security, economic policy, and China, were compromised. The attack is believed to have been conducted by a foreign government and involved breaches of Microsoft accounts.
Zoomcar Holdings reported a data breach impacting 8.4 million users, as disclosed in a filing with the U.S. Securities and Exchange Commission.
Law enforcement agencies from six countries seized the Archetyp Market darknet drug marketplace and arrested its administrator. Archetyp Market had been operating since May 2020.

Newly Discovered Vulnerabilities

A high-severity vulnerability in ASUS Armoury Crate software was disclosed, allowing local attackers to escalate privileges to SYSTEM level on Windows machines.
Microsoft acknowledged that June 2025 Windows Server security updates are causing DHCP service freezes on some systems.
Microsoft also published a workaround for a known issue causing classic Outlook to crash when opening or composing messages.

Notable Threat Actor Activity

Google and external threat intelligence researchers reported that the Scattered Spider threat group has shifted focus to targeting U.S. insurance companies, employing previously observed tactics.
The U.S. Department of Justice seized $7.74 million in cryptocurrency, NFTs, and other assets tied to North Korea’s global fake IT worker network, which is used to funnel illicit funds to the regime.
An emerging threat group, dubbed “Water Curse,” is targeting cybersecurity professionals by distributing weaponized GitHub repositories masquerading as legitimate penetration testing tools, facilitating supply chain attacks.
Malicious Python packages, notably the “Chimera” tool, have been identified on PyPI. Unlike traditional malware, Chimera targets data specific to corporate and cloud infrastructures to facilitate supply chain attacks.

Trends, Tools, or Tactics of Interest

Google’s Mandiant published research on increasingly sophisticated vishing (voice phishing) attacks, which are being used as initial access vectors in recent ransomware campaigns.
Google reported a rise in travel-themed scams, with attackers leveraging the summer holiday period to target consumers.
The Anubis ransomware-as-a-service kit has added data wiper functionality, enabling affiliates to both encrypt and permanently erase files, making recovery impossible even after ransom payment.
Researchers observed the use of steganography, specifically malicious payloads hidden within JPEG images, as a technique for evading detection.
Kali Linux 2025.2 was released, introducing 13 new tools and expanding its car hacking toolkit, enhancing capabilities for penetration testing and automotive security assessments.
The ongoing increase in third-party and supply chain risks was highlighted, with recommendations for continuous monitoring of partner vulnerabilities.

Regulatory or Policy Developments

The U.S. National Institute of Standards and Technology (NIST) released SP 1800-35, providing 19 real-world examples for implementing zero-trust architecture using commercial technologies.
Meta announced the introduction of advertising on WhatsApp, stating that the ads are designed with privacy considerations.

Zoomcar on DanSec Daily

Cybersecurity Brief – 2025-06-18

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments Affecting the Security Industry

Cybersecurity Brief – 2025-06-17

Major Incidents or Breaches

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

Trends, Tools, or Tactics of Interest

Regulatory or Policy Developments