📰wrzlbrmpft's cyberlights💥

cyberlights – week 24/2025

June 15, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🎭 Over 20 Malicious Crypto Wallet Apps Found on Google Play, CRIL Warns security research – More than 20 malicious apps on Google Play impersonate popular crypto wallets, tricking users into revealing their mnemonic phrases and risking their digital assets. https://thecyberexpress.com/new-crypto-phishing-campaign/

💾 US air traffic control still runs on Windows 95 and floppy disks security news – The FAA plans to replace outdated air traffic control systems still using Windows 95 and floppy disks, citing critical infrastructure needs despite skepticism about timely modernization. https://arstechnica.com/information-technology/2025/06/faa-to-retire-floppy-disks-and-windows-95-amid-air-traffic-control-overhaul/

☎️ A Researcher Figured Out How to Reveal Any Phone Number Linked to a Google Account vulnerability – A researcher exploited a vulnerability to uncover any Google account's linked phone number, raising privacy concerns for users at risk of SIM swapping. Google has since fixed the issue. https://www.wired.com/story/a-researcher-figured-out-how-to-reveal-any-phone-number-linked-to-a-google-account/

✈️ Airlines Don't Want You to Know They Sold Your Flight Data to DHS privacy – Major airlines sold U.S. travelers' flight data, including personal and financial details, to Customs and Border Protection, raising privacy concerns over surveillance and data transparency. https://www.404media.co/airlines-dont-want-you-to-know-they-sold-your-flight-data-to-dhs/

📹 40,000 cameras expose feeds to datacenters, health clinics privacy – Security researchers accessed 40,000 exposed cameras globally, including those in sensitive locations, raising privacy and espionage concerns as vulnerabilities could be exploited by both criminals and state actors. https://www.theregister.com/2025/06/10/40000_iot_cameras_exposed/

🛒 Ongoing cyberattack at US grocery distributor giant UNFI affecting customer orders cybercrime – UNFI is grappling with a cyberattack that disrupts operations and customer orders, leading to limited shipping and potential shortages in grocery stores. The company is working to restore systems. https://techcrunch.com/2025/06/10/ongoing-cyberattack-at-us-grocery-distributor-giant-unfi-affecting-customer-orders/

🛠️ Microsoft Patch Tuesday addresses 66 vulnerabilities, including an actively exploited zero-day vulnerability – Microsoft's latest security update fixed 66 vulnerabilities, including a zero-day exploited by the Stealth Falcon group for targeted attacks. Users are urged to patch systems due to widespread risks. https://cyberscoop.com/microsoft-patch-tuesday-june-2025/

🌐 DNS4EU: Die EU startet eigenen DNS-Resolver-Dienst mit optionalen Filtern privacy – Die EU hat DNS4EU eingeführt, einen eigenen DNS-Resolver-Dienst, der digitale Unabhängigkeit fördern soll. Nutzer können zwischen verschiedenen Filteroptionen wählen, während Datenschutz versprochen wird. https://www.kuketz-blog.de/dns4eu-die-eu-startet-eigenen-dns-resolver-dienst-mit-optionalen-filtern/

💼 Crooks posing as job hunters to malware-infect recruiters cybercrime – Cybercriminals from FIN6 are targeting recruiters by posing as job seekers and directing them to fake portfolio sites that deliver malware, enabling remote access and credential theft. https://www.theregister.com/2025/06/11/crooks_posing_job_hunters_target_recruiters/

🤖 AI Therapy Bots Are Conducting 'Illegal Behavior,' Digital Rights Organizations Say security news – Digital rights groups are urging the FTC to investigate Character.AI and Meta for unlicensed therapy bots misleading users about credentials and confidentiality, raising serious ethical concerns. https://www.404media.co/ai-therapy-bots-meta-character-ai-ftc-complaint/

⚠️ Angriffe mit manipulierten SVG warning – CERT.at warnt vor Phishing-Angriffen, die manipulierte SVG-Dateien als Anhänge nutzen, um JavaScript auszuführen und sensible Informationen zu stehlen. Sicherheitsmaßnahmen sind dringend erforderlich. https://www.cert.at/de/warnungen/2025/6/phishing-angriffe-mit-manipulierten-svg-dateien-vorsicht-geboten

🔒 Apple fixes new iPhone zero-day bug used in Paragon spyware hacks vulnerability – Apple has patched a zero-day vulnerability exploited by Paragon spyware to hack iPhones of two journalists, revealing the flaw was fixed in the February iOS update but not disclosed until now. https://techcrunch.com/2025/06/12/apple-fixes-new-iphone-zero-day-bug-used-in-paragon-spyware-hacks/

📢 How to Protest Safely in the Age of Surveillance privacy – With rising surveillance during protests, individuals should consider both physical and digital security. Key strategies include limiting phone use, using encrypted communication, and being cautious about online activity. https://www.wired.com/story/how-to-protest-safely-surveillance-digital-privacy/

🎣 “Anmeldung mit nicht erkanntem Gerät”: Phishing warning – Phishing attacks are using fake websites that mimic official ones, often with subtle changes in the URL, such as replacing a letter, to deceive victims into revealing sensitive information. https://www.watchlist-internet.at/news/phishing-attacke-paypal/

💻 Bert Ransomware: What You Need To Know cybercrime – Bert ransomware encrypts files and demands payment for decryption, also exfiltrating data. Victims are advised to contact hackers for recovery, emphasizing the need for strong cybersecurity measures. https://www.fortra.com/blog/bert-ransomware-what-you-need-know

👮 Dutch police identify users as young as 11-year-old on Cracked.io hacking forum security news – Dutch police identified 126 users from the dismantled Cracked.io hacking forum, including an 11-year-old, highlighting the involvement of young individuals in cybercrime. Authorities aim to educate and warn them about potential consequences. https://www.bitdefender.com/en-us/blog/hotforsecurity/dutch-police-cracked-io-hacking-forum

🎮 Exploiting Heroes of Might and Magic V vulnerability – The article discusses a vulnerability in Heroes of Might and Magic V related to how the game handles map files, allowing attackers to exploit the game's zip file processing to execute arbitrary code. https://www.synacktiv.com/publications/exploiting-heroes-of-might-and-magic-v.html

Some More, For the Curious

👾 Internet infamy drives The Com’s crime sprees cybercrime – The Com, a youth-driven cybercrime group, thrives on notoriety, engaging in serious crimes like sextortion and violence, fueled by economic pressures and a need for belonging. https://cyberscoop.com/the-com-subculture-infamy-crimes/

🔎 LinkedIn for OSINT: tips and tricks – Compass Security Blog hacking write-up – LinkedIn is a rich source for open-source intelligence, offering insights into individuals and companies. Caution is advised to maintain privacy while gathering useful data for assessments. https://blog.compass-security.com/2025/06/linkedin-for-osint-tips-and-tricks/

🏢 Breaking down ‘EchoLeak’, the First Zero-Click AI Vulnerability Enabling Data Exfiltration from Microsoft 365 Copilott vulnerability – Aim Labs discovered a zero-click AI vulnerability called EchoLeak in Microsoft 365 Copilot, enabling attackers to exfiltrate sensitive data without user interaction, highlighting critical security risks in AI applications. https://www.aim.security/lp/aim-labs-echoleak-blogpost

⚠️ High Severity Vulnerabilities in Gitlab Products vulnerability – GitLab released security updates addressing multiple high-severity vulnerabilities, including account takeover and XSS issues. Users are urged to update affected installations promptly. https://cert.europa.eu/publications/security-advisories/2025-020/

🛡️ Cyber resilience begins before the crisis security news – Microsoft's Deputy CISO emphasizes the importance of proactive planning and communication for cyber resilience, highlighting misconceptions, actionable steps, and the role of AI in improving response to cyber incidents. https://www.microsoft.com/en-us/security/blog/2025/06/12/cyber-resilience-begins-before-the-crisis/

🔐 Mitigating prompt injection attacks with a layered defense strategy cyber defense – Google addresses the rising threat of indirect prompt injection attacks on AI systems by implementing a layered defense strategy, including content classifiers, user confirmation, and URL redaction to enhance security. https://security.googleblog.com/2025/06/mitigating-prompt-injection-attacks.html

🪂 Paraguay is Being Targeted by Cybercriminals – 7.4 Million Citizen Records for Sale data breach – A significant data breach in Paraguay has exposed 7.4 million citizen records for sale on the dark web, linked to cybercriminals who demand a ransom. The incident highlights increasing cybersecurity threats in the region. https://www.resecurity.com/blog/article/paraguay-is-being-targeted-by-cybercriminals-74-million-citizen-records-for-sale

🪩 NTLM reflection is dead, long live NTLM reflection! – An in-depth analysis of CVE-2025-33073 security research – The article analyzes CVE-2025-33073, a vulnerability allowing NTLM reflection attacks, detailing its exploitation, patching process, and emphasizing the importance of SMB signing for enhanced security. https://www.synacktiv.com/en/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025.html

🔧 the Microsoft way (part 89): user group policies don't deserve tamper protection vulnerability – The article discusses vulnerabilities in user group policies on Windows, highlighting how unprivileged users can bypass restrictions by manipulating registry files. Recommendations for countermeasures are provided. https://seclists.org/fulldisclosure/2025/Jun/13

🎮 Hijacked Trust: How Malicious Actors Exploited Discord’s Invite System to Launch Global Multi-Stage Attacks cybercrime – Attackers hijacked expired Discord invite links to redirect users to malicious servers, using fake bots and phishing sites to steal credentials and deploy malware, primarily targeting cryptocurrency users. https://blog.checkpoint.com/research/hijacked-trust-how-malicious-actors-exploited-discords-invite-system-to-launch-global-multi-stage-attacks/

🏖️ Check Point Research Warns of Holiday-Themed Phishing Surge as Summer Travel Season Begins cybercrime – Phishing scams spike with over 39,000 new vacation-related domains; cybercriminals mimic trusted platforms to steal personal and payment information from travelers. https://blog.checkpoint.com/research/check-point-research-warns-of-holiday-themed-phishing-surge-as-summer-travel-season-begins/

🔌 The Growing Risk of Malicious Browser Extensions security research – Malicious browser extensions are increasingly hijacking user sessions and manipulating content, posing serious risks to privacy and security, with recent campaigns targeting sensitive data and financial information. https://socket.dev/blog/the-growing-risk-of-malicious-browser-extensions

🪞 Reflective Kerberos Relay Attack Against Domain vulnerability – The Reflective Kerberos Relay Attack allows low-privileged users to gain NT AUTHORITY\SYSTEM privileges on domain-joined Windows systems without SMB signing, posing a high security risk. A patch is available. https://www.redteam-pentesting.de/en/advisories/rt-sa-2025-002/

CISA Corner

💁 Ransomware Actors Exploit Unpatched SimpleHelp Remote Monitoring and Management to Compromise Utility Billing Software Provider security news- CISA warns that ransomware actors are exploiting unpatched vulnerabilities in SimpleHelp RMM to compromise utility billing software providers, urging immediate action for software updates and mitigations. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a

⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog warning – CISA has added two vulnerabilities in Erlang/OTP SSH Server and Roundcube Webmail to their catalog. https://www.cisa.gov/news-events/alerts/2025/06/09/cisa-adds-two-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog warning – CISA has added two vulnerabilities in Wazuh and WebDAV to its KEV Catalog. https://www.cisa.gov/news-events/alerts/2025/06/10/cisa-adds-two-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases Four Industrial Control Systems Advisories vulnerability – CISA issued four advisories addressing vulnerabilities in industrial control systems by SinoTrack, Hitachi, MicroDicom and Assured Telematics. https://www.cisa.gov/news-events/alerts/2025/06/10/cisa-releases-four-industrial-control-systems-advisories ⚙️ CISA Releases Ten Industrial Control Systems Advisories vulnerability – CISA has published ten advisories addressing vulnerabilities in various industrial control systems by Siemens, AVEVA and PTZOptics. https://www.cisa.gov/news-events/alerts/2025/06/12/cisa-releases-ten-industrial-control-systems-advisories

While my intention is to pick news that everyone should know about, it still is what I think is significant, cool, fun... Most of the articles are in English, but some current warnings might be in German.

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 23/2025

June 9, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

😩 Teachers Are Not OK security news – Teachers express frustration over AI's impact on education, revealing challenges like grading AI-generated work, maintaining academic integrity, and witnessing students' declining critical thinking skills. https://www.404media.co/teachers-are-not-ok-ai-chatgpt/

🔒 Google fixed the second actively exploited Chrome zero vulnerability – Google patched three vulnerabilities in Chrome, including one actively exploited zero-day that allows attackers to trigger heap corruption via crafted HTML. Users should update to the latest version. https://securityaffairs.com/178560/hacking/google-fixed-the-second-actively-exploited-chrome-zero-day-since-the-start-of-the-year.html

🐊 Crocodilus malware adds fake entries to victims' contact lists in new scam campaign malware – Crocodilus, an evolving Android banking trojan, now inserts fake contacts to impersonate trusted sources, facilitating scams. It's spreading through malicious ads targeting financially stable users across multiple regions. https://therecord.media/crocodilus-android-malware-banking-fraud

❎ Twitter launches 'XChat' encrypted DMs with big caveats security news – Elon Musk's X platform introduces 'XChat' with encryption and file-sharing features, but experts doubt its security claims, citing potential lack of true end-to-end encryption and centralized data control. https://www.theregister.com/2025/06/03/xs_new_encrypted_xchat_feature/

🤬 Meta and Yandex are de-anonymizing Android users’ web browsing identifiers privacy – Meta and Yandex are using tracking code to de-anonymize Android users by exploiting browser protocols, allowing them to link web activity to app identities. Google is investigating these practices. https://arstechnica.com/security/2025/06/meta-and-yandex-are-de-anonymizing-android-users-web-browsing-identifiers/

🧑‍🌾 How the Farm Industry Spied on Animal Rights Activists and Pushed the FBI to Treat Them as Bioterrorists security news – Internal documents reveal a collaboration between the agricultural industry and the FBI to surveil animal rights activists, branding them as bioterrorists while using corporate spies to infiltrate their groups. https://www.wired.com/story/fbi-wmdd-dxe-animal-agriculture-alliance/

💍 Cartier disclosed a data breach following a cyber attack data breach – Cartier reported a data breach that exposed limited customer information, including names and email addresses, following a cyberattack. The company is enhancing security and cooperating with authorities. https://securityaffairs.com/178601/data-breach/cartier-disclosed-a-data-breach-following-a-cyber-attack.html

💼 Google warns of cybercriminals targeting Salesforce app to steal data, extort companies cybercrime – Cybercriminals, known as UNC6040, are exploiting Salesforce's Data Loader tool to steal sensitive data and extort companies. The group uses vishing tactics to trick employees into granting access. https://therecord.media/google-warns-cybercriminals-targeting-salesforce-apps

🔍 Apple Gave Governments Data on Thousands of Push Notifications privacy – Apple disclosed that it provided governments with data on thousands of push notifications, revealing device identities and sometimes unencrypted content, highlighting the extent of governmental data requests. https://www.404media.co/apple-gave-governments-data-on-thousands-of-push-notifications/

💻 Feds seize 145 domains associated with BidenCash cybercrime platform cybercrime – U.S. authorities seized 145 domains and cryptocurrency funds linked to BidenCash, a cybercrime marketplace that trafficked over 15 million stolen credit card numbers, generating $17 million in illicit revenue. https://cyberscoop.com/bidencash-marketplace-domains-seized/

🎸 Musikhaus Thomann: Kriminelle locken in Fake warning – The official Thomann online store is only accessible at thomann.de, with country-specific versions available at respective domains. Any other addresses are fake sites attempting to deceive users. https://www.watchlist-internet.at/news/musikhaus-thomann-fake-shops/

💰 DOJ seizes $7.7M from crypto funds linked to North Korea’s IT worker scheme security news – Federal authorities seized $7.74 million linked to North Korean IT workers illegally employed abroad, funneling wages to the regime. The operation exploits remote contracting and cryptocurrency to evade U.S. sanctions. https://cyberscoop.com/doj-seizure-crypto-north-korea-it-workers/

🚫 OpenAI takes down ChatGPT accounts linked to state-backed hacking, disinformation cybercrime – OpenAI banned accounts using ChatGPT for illicit activities, including malware refinement, social media disinformation, and employment scams tied to North Korea. The operations exploited ChatGPT for various cybercriminal purposes. https://therecord.media/openai-takes-down-chatgpt-accounts-hacking

💔 Marks & Spencer's ransomware nightmare – more details emerge cybercrime – Marks & Spencer suffered a severe ransomware attack, disrupting operations and leading to £40 million in lost sales weekly. The DragonForce group claimed responsibility, stealing customer data and highlighting M&S's cybersecurity vulnerabilities. https://www.bitdefender.com/en-us/blog/hotforsecurity/marks-spencers-ransomware-nightmare-more-details-emerge

🦠 Millions of low-cost Android devices turn home networks into crime platforms cybercrime – The FBI warns that millions of low-cost Android devices are infected with BadBox malware, turning home networks into crime platforms. Users are urged to evaluate and potentially replace suspicious devices. https://arstechnica.com/security/2025/06/millions-of-low-cost-android-devices-turn-home-networks-into-crime-platforms/

🧑‍⚖️ Italian lawmakers say Italy used spyware to target phones of immigration activists, but not against journalist privacy – An Italian parliamentary committee confirmed the government used Paragon spyware to target immigration activists but found no evidence against journalist Francesco Cancellato. The investigation raises questions about who targeted him and the use of spyware in Italy. https://techcrunch.com/2025/06/06/italian-lawmakers-say-italy-used-spyware-to-target-phones-of-immigration-activists-but-not-against-journalist/

😨 Ransomware scum leak patient data after disrupting services cybercrime – Kettering Health faces potential patient data leaks following a ransomware attack by Interlock, which disrupted services and canceled appointments. The leaked data reportedly includes sensitive information, though verification is pending. https://www.theregister.com/2025/06/04/ransomware_scum_leak_kettering_patient_data/

Some More, For the Curious

🛠️ Experts published a detailed analysis of Cisco IOS XE WLC flaw CVE vulnerability – A critical vulnerability in Cisco IOS XE WLC could allow remote attackers to upload files and execute commands. Users should disable the affected feature until a fix is applied. https://securityaffairs.com/178497/security/cisco-ios-xe-wlc-flaw-cve-2025-20188.html

💰 Illicit crypto-miners pouncing on insecure DevOps tools cybercrime – A campaign by attackers named JINX–0132 exploits misconfigured DevOps tools like HashiCorp Nomad, Consul, Docker API, and Gitea, risking theft of cloud resources for cryptocurrency mining. https://www.theregister.com/2025/06/03/illicit_miners_hashicorp_tools/

🐳 How to find container-based threats in host-based logs security research – Containers pose security risks despite their isolation, as they share the host kernel. This article outlines methods for threat hunters to analyze host logs to identify container-based threats. https://securelist.com/host-based-logs-container-based-threats/116643/

❤️‍🔥 The strange tale of ischhfd83: When cybercriminals eat their own security research – Sophos X-Ops uncovered a scheme where the Sakura RAT, designed to target cybercriminals, was itself backdoored, revealing a network of malicious repositories aimed at unsuspecting users, particularly gamers and novice hackers. https://news.sophos.com/en-us/2025/06/04/the-strange-tale-of-ischhfd83-when-cybercriminals-eat-their-own/

⚠️ HPE StoreOnce Faces Critical CVE-2025-37093 Vulnerability — Urges Immediate Patch Upgrade vulnerability – HPE disclosed eight vulnerabilities in StoreOnce, with CVE-2025-37093 being critical due to authentication bypass. Users are urged to upgrade to version 4.3.11 immediately to mitigate risks. https://thecyberexpress.com/cve-2025-37093-hits-hpe-storeonce-systems/

🗨️ The Texting Network for the End of the World security news – This article highlights key topics on online privacy protection, the Matter smart home standard, deepfake scams, Google searches in criminal cases, and updates from Google's I/O 2025 conference. https://www.wired.com/story/youre-not-ready-for-phone-dead-zones/

🔒 Critical flaw in Cisco ISE impacts cloud deployments on AWS, Microsoft Azure, and Oracle Cloud Infrastructure vulnerability – Cisco fixed a critical vulnerability (CVE-2025-20286) in its Identity Services Engine, allowing unauthenticated attackers to exploit shared credentials across cloud deployments on AWS, Azure, and OCI. Administrators are urged to implement mitigations. https://securityaffairs.com/178659/uncategorized/critical-flaw-in-cisco-ise-impacts-cloud-deployments-on-aws-microsoft-azure-and-oracle-cloud-infrastructure.html

💻 Attackers exploit Fortinet flaws to deploy Qilin ransomware security news – Qilin ransomware is exploiting Fortinet vulnerabilities, including CVE-2024-21762 and CVE-2024-55591, to gain remote code execution and target organizations, particularly in Spanish-speaking countries. The group uses double extortion tactics. https://securityaffairs.com/178736/hacking/attackers-exploit-fortinet-flaws-to-deploy-qilin-ransomware.html

⚙️ RCEs and more in the KUNBUS GmbH Revolution Pi PLC vulnerability – Four new vulnerabilities in KUNBUS GmbH's Revolution Pi PLC were discovered, two allowing unauthenticated remote code execution. Users are advised to implement mitigations and upgrade firmware to enhance security. Comment: my former colleagues should take a look at this ;) https://www.pentestpartners.com/security-blog/rces-and-more-in-the-kunbus-gmbh-revolution-pi-plc/

💳 Root Shell on Credit Card Terminal hacking write-up – The article details a security research project on the Worldline Yomani XR payment card terminal, revealing vulnerabilities, tamper protections, and an exposed root shell. The findings highlight significant security concerns in embedded systems. https://stefan-gloor.ch/yomani-hack

🎮 Blitz Malware: A Tale of Game Cheats and Code Repositories malware – Blitz malware, discovered in 2024, exploits backdoored game cheats for distribution and utilizes Hugging Face for command and control infrastructure. The malware operates in two stages: a downloader and a bot payload, with functions including keylogging and cryptocurrency mining. https://unit42.paloaltonetworks.com/blitz-malware-2025/

😱 Camera and Microphone Spying Using Chromium Browsers security research – A dangerous Chromium command allows websites to access cameras and microphones without user consent, enabling continuous recording without any visible indication. https://mrd0x.com/spying-with-chromium-browsers-camera/

CISA Corner

⚠️ CISA Adds Five Known Exploited Vulnerabilities to Catalog warning – CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, highlighting serious risks to federal networks and urging timely remediation for all organizations. https://www.cisa.gov/news-events/alerts/2025/06/02/cisa-adds-five-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has added three Qualcomm vulnerabilities to its Known Exploited Vulnerabilities Catalog, emphasizing their significant risk to federal networks and urging timely remediation. https://www.cisa.gov/news-events/alerts/2025/06/03/cisa-adds-three-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA added CVE-2025-5419, a critical out-of-bounds vulnerability in Google Chromium's V8, to its Known Exploited Vulnerabilities Catalog, urging organizations to prioritize remediation to mitigate risks. https://www.cisa.gov/news-events/alerts/2025/06/05/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ CISA Releases Three Industrial Control Systems Advisories vulnerability – CISA has issued three advisories addressing vulnerabilities in Schneider Electric and Mitsubishi Electric ICS products. Users are urged to review the advisories for security measures and technical details. https://www.cisa.gov/news-events/alerts/2025/06/03/cisa-releases-three-industrial-control-systems-advisories ⚙️ CISA Releases Seven Industrial Control Systems Advisories vulnerability – CISA has issued seven advisories detailing vulnerabilities and security issues in various Industrial Control Systems, urging users to review for necessary updates and mitigations. https://www.cisa.gov/news-events/alerts/2025/06/05/cisa-releases-seven-industrial-control-systems-advisories

🛡️ Updated Guidance on Play Ransomware security news – CISA, FBI, and ASD's ACSC released updated guidance on Play ransomware, detailing new tactics and IOCs. They recommend multifactor authentication, offline backups, and software updates for mitigation. https://www.cisa.gov/news-events/alerts/2025/06/04/updated-guidance-play-ransomware

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 22/2025

June 1, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🎭 Fake software activation videos on TikTok spread Vidar, StealC malware – Cybercriminals exploit TikTok to distribute Vidar and StealC malware through fake software activation videos, tricking users into running harmful PowerShell commands. https://securityaffairs.com/178269/cyber-crime/fake-software-activation-videos-on-tiktok-spread-vidar-stealc.html

🎀 A Starter Guide to Protecting Your Data From Hackers and Corporations privacy – With rising digital surveillance, this guide offers essential tips for enhancing personal privacy, including using multifactor authentication and privacy-focused tools. https://www.wired.com/story/guide-protect-data-from-hackers-corporations/

🦠 MathWorks’ ransomware disruptions rages on into second week cybercrime – MathWorks confirms a ransomware attack causing prolonged outages of MATLAB and other applications, disrupting users, particularly students, as recovery efforts continue with limited functionality. https://go.theregister.com/feed/www.theregister.com/2025/05/27/mathworks_ransomware_attack_leaves_ondeadline/

📝 Text-to-Malware: How Cybercriminals Weaponize Fake AI-Themed Websites cybercrime – Cybercriminals exploit AI interest by creating fake video generator websites to distribute malware like infostealers and backdoors, targeting users through malicious ads on social media. https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites/

🔂 The Privacy-Friendly Tech to Replace Your US-Based Email, Browser, and Search privacy – Amid growing concerns over US tech giants, alternatives like Mullvad and Vivaldi for browsing, Qwant and Mojeek for searching, and ProtonMail for email offer privacy-focused options. https://www.wired.com/story/the-privacy-friendly-tech-to-replace-your-us-based-email-browser-and-search/

🥺 Iranian man pleads guilty in Robbinhood ransomware scheme cybercrime – pleaded guilty to charges related to the Robbinhood ransomware scheme, which caused over $19 million in damages to Baltimore and other U.S. cities, facing up to 30 years in prison. https://cyberscoop.com/iranian-man-pleads-guilty-in-robbinhood-ransomware-scheme/

🦠 Crooks use a fake antivirus site to spread Venom RAT and a mix of malware security news – A fake Bitdefender site is distributing the Venom RAT, tricking users into downloading malware designed for password theft and remote access, targeting individuals for financial gain. https://securityaffairs.com/178366/malware/fake-antivirus-spreads-venom-rat.html

📅 Chinese hackers used Google Calendar to aid attacks on government entities security research – Google revealed that APT41, a China-backed hacker group, exploited Google Calendar for command and control in attacks on government entities, using malware dubbed TOUGHPROGRESS to blend in with legitimate activity. https://cyberscoop.com/google-calendar-apt-41-c2-winnti/

🔓 LexisNexis leaked social security numbers and other personal data of over 364,000 people data breach – LexisNexis reported a data breach exposing personal information of over 364,000 individuals, including Social Security numbers, after unauthorized access through a third-party software platform was discovered months later. https://www.theverge.com/news/675702/lexisnexis-data-broker-breach-social-security-numbers

🗺️ Oregon becomes second state to ban sale of precise geolocation data privacy – Oregon's legislature passed a law banning the sale of precise geolocation data, following Maryland's similar legislation, and strengthening protections for children's data privacy. https://therecord.media/oregon-passes-geolocation-kids-data-bill

🤏 Thousands of Asus routers are being hit with stealthy, persistent backdoors cybercrime – Thousands of Asus routers are infected with a persistent backdoor allowing unauthorized access via SSH, exploiting patched vulnerabilities, raising concerns of potential nation-state involvement in the ongoing campaign. https://arstechnica.com/security/2025/05/thousands-of-asus-routers-are-being-hit-with-stealthy-persistent-backdoors/

👙 Victoria's Secret hit by outages as it battles security incident security news – Victoria’s Secret is addressing a security incident causing website outages and disruptions to online orders, prompting precautionary measures including website takedown while in-store services remain operational. https://techcrunch.com/2025/05/28/victorias-secret-hit-by-outages-as-it-battles-security-incident/

📚 No One Knows How to Deal With 'Student-on-Student' AI CSAM security news – A Stanford report highlights the lack of preparedness among schools, parents, and law enforcement to handle cases of students using AI to create nonconsensual intimate imagery, emphasizing the normalization of such practices and the need for better training and reporting mechanisms. https://www.404media.co/no-one-knows-how-to-deal-with-student-on-student-ai-csam/

💸 US government sanctions tech company involved in cyber scams cybercrime – The U.S. government sanctioned Funnull for facilitating 'pig butchering' crypto scams, linked to $200 million in losses for victims. The company provided infrastructure for cybercriminals, including domain generation and web design templates. https://techcrunch.com/2025/05/29/us-government-sanctions-tech-company-involved-in-cyber-scams/

🏰 White House investigating how Trump's chief of staff's phone was hacked security news – The White House is investigating a hack involving chief of staff Susie Wiles' phone, where hackers accessed her contacts and impersonated her using AI to contact other officials. https://techcrunch.com/2025/05/30/white-house-investigating-how-trumps-chief-of-staffs-phone-was-hacked/

🌠 Ransomware kingpin “Stern” apparently IDed by German law enforcement cybercrime – German law enforcement has identified 'Stern,' the leader of the Trickbot ransomware group, linking him to significant cybercrime activities, including targeting hospitals and businesses. https://arstechnica.com/security/2025/05/german-police-say-theyve-identified-trickbot-ransomware-kingpin/

🔒 Chinese-Owned VPNs security news Comment: Don't really like the article, but the topic is essential. https://www.schneier.com/blog/archives/2025/05/chinese-owned-vpns.html

🪥 unlikely household item proved husband was cheating' privacy – Private investigator Paul Jones reveals how a smart toothbrush app exposed a husband's affair by tracking unusual brushing times, highlighting that digital clues can uncover infidelity beyond typical signs. https://www.mirror.co.uk/lifestyle/sex-relationships/relationships/im-private-investigator-unlikely-household-35256619

Some More, For the Curious

❄️ New Russia-affiliated actor Void Blizzard targets critical sectors for espionage security research – Void Blizzard, a new Russia-linked threat actor, targets NATO and Ukraine for espionage, using stolen credentials and spear phishing to access sensitive information across various sectors. https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/

🐻 Dutch intelligence unmasks previously unknown Russian hacking group 'Laundry Bear' security news – Dutch intelligence reveals 'Laundry Bear,' a Russian hacking group targeting organizations for espionage, notably impacting the police and NATO-related entities, using automated, stealthy techniques. https://therecord.media/laundry-bear-void-blizzard-russia-hackers-netherlands

🔗 DragonForce operator chained SimpleHelp flaws to target an MSP and its customers security research – Sophos warns that DragonForce ransomware exploited three SimpleHelp vulnerabilities to target a managed service provider, gaining unauthorized access and enabling data theft. https://securityaffairs.com/178350/cyber-crime/dragonforce-operator-chained-simplehelp-flaws-to-target-an-msp.html

🚨 Pakistan Arrests 21 in ‘Heartsender’ Malware Service – Krebs on Security cybercrime – Pakistan arrested 21 individuals linked to the 'Heartsender' malware service, which facilitated cybercrime operations resulting in over $50 million in losses, primarily targeting business email compromise schemes. https://krebsonsecurity.com/2025/05/pakistan-arrests-21-in-heartsender-malware-service/

🐍 New PumaBot targets Linux IoT surveillance devices malware – PumaBot, a new Go-based botnet, targets Linux IoT devices using SSH brute-force attacks to steal credentials, spread malware, and mine cryptocurrency while employing stealthy evasion tactics. https://securityaffairs.com/178386/malware/pumabot-targets-linux-iot-devices.html

🤔 Questions mount as Ivanti tackles another round of zero-days vulnerability – Ivanti faces multiple attacks exploiting two zero-day vulnerabilities in its Endpoint Manager Mobile software, linked to the China-backed group UNC5221. https://cyberscoop.com/ivanti-epmm-defects-exploited/

🏞️ ConnectWise says nation-state attack targeted multiple ScreenConnect customers security news – ConnectWise is investigating a nation-state attack affecting a small number of its ScreenConnect customers, involving suspicious activity linked to sophisticated threat actors. https://therecord.media/connectwise-nation-state-attack-targeted-some-customers

⏳ Why Take9 Won’t Improve Cybersecurity security news – The Take9 campaign urging a nine-second pause before online actions is criticized for being unrealistic and ineffective, as it fails to address deeper issues in cybersecurity awareness and places undue blame on users for attacks. https://www.schneier.com/blog/archives/2025/05/why-take9-wont-improve-cybersecurity.html

⚠️ New Apache InLong Vulnerability (CVE-2025-27522) Exposes Systems to Remote Code Execution Risks vulnerability – A new vulnerability (CVE-2025-27522) in Apache InLong allows for remote code execution due to insecure deserialization of data during JDBC processing. Users are urged to upgrade to version 2.2.0 or apply the necessary patch. https://thecyberexpress.com/apache-inlong-cve-2025-27522/

🚨 Top counter antivirus service disrupted in global takedown security news – Law enforcement seized the AVCheck service, used by cybercriminals to test malware against antivirus tools, as part of a global crackdown on cybercrime, disrupting operations of malicious tool providers. https://cyberscoop.com/avcheck-global-takedown/

🦆 Two Linux flaws can lead to the disclosure of sensitive data vulnerability – Qualys warns of two vulnerabilities in Ubuntu's Apport and systemd-coredump that allow local attackers to access sensitive data from core dumps. https://securityaffairs.com/178464/hacking/two-linux-flaws-can-lead-to-the-disclosure-of-sensitive-data.html

🥽 Deep Dive into a Dumped Malware without a PE Header malware – The article details the analysis of malware without a PE header, revealing its capabilities for remote access, data exfiltration, and communication with a C2 server. https://www.fortinet.com/blog/threat-research/deep-dive-into-a-dumped-malware-without-a-pe-header

⚠️ Researchers Drop PoC for Fortinet CVE-2025-32756, Urging Quick Patching vulnerability – A critical vulnerability (CVE-2025-32756) in Fortinet products allows unauthenticated remote code execution and is actively exploited. Researchers released a proof of concept, urging users to patch immediately. https://hackread.com/researchers-poc-fortinet-cve-2025-32756-quick-patch/

🖼️ SANS Internet Storm Center security news – The article discusses the use of steganography in SVG images, highlighting their advantages over bitmap formats for data hiding, while emphasizing the importance of encryption and potential risks from compression. https://isc.sans.edu/diary/rss/31978

🥃 FiberGateway GR241AG – Full Exploit Chain hacking write-up – The article details the discovery of vulnerabilities in the FiberGateway GR241AG router, allowing root access through physical and remote exploitation methods, impacting over 1.6 million households in Portugal. https://r0ny.net/FiberGateway-GR241AG-Full-Exploit-Chain/

CISA Corner

🛡️ New Guidance for SIEM and SOAR Implementation security news – CISA and international partners released guidance for implementing SIEM and SOAR platforms, aiming to enhance cybersecurity through improved threat detection, incident response, and log prioritization. https://www.cisa.gov/news-events/alerts/2025/05/27/new-guidance-siem-and-soar-implementation

⚙️ CISA Releases One Industrial Control Systems Advisory vulnerability – CISA issued an advisory on the Johnson Controls iSTAR Configuration Utility tool, highlighting current security issues and vulnerabilities in Industrial Control Systems. Users are urged to review for mitigations. https://www.cisa.gov/news-events/alerts/2025/05/27/cisa-releases-one-industrial-control-systems-advisory ⚙️ CISA Releases Five Industrial Control Systems Advisories vulnerability – CISA issued five advisories regarding security vulnerabilities in various Industrial Control Systems, urging users to review the advisories for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/05/29/cisa-releases-five-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 21/2025

May 25, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🚨 UK government confirms massive data breach following hack of Legal Aid Agency data breach – A major data breach at the Legal Aid Agency may expose sensitive information of legal aid applicants, affecting millions. Security measures are being intensified to prevent further incidents. https://therecord.media/uk-legal-aid-agency-data-breach

🧬 Pharma giant Regeneron to buy 23andMe and its customers' data for $256M privacy – Regeneron plans to purchase 23andMe, including sensitive genetic data from 15 million customers, raising privacy concerns after a previous data breach. Compliance with privacy laws is promised. https://techcrunch.com/2025/05/19/pharma-giant-regeneron-to-buy-23andme-and-its-customers-data-for-256m/

🔒 days demonstrated at Pwn2Own Berlin 2025 vulnerability – Mozilla patched two critical zero-day vulnerabilities in Firefox that could allow sensitive data access or code execution. Users are urged to update their browsers immediately. https://securityaffairs.com/178064/security/mozilla-fixed-zero-days-demonstrated-at-pwn2own-berlin-2025.html

💁 Russia-linked disinformation floods Poland, Romania as voters cast ballots security news – Ahead of presidential elections, Romania and Poland report increased Russian disinformation efforts aiming to sway voters. Authorities warn of impersonation tactics and funded campaigns on social media. https://therecord.media/russia-disinformation-poland-presidential-election

👁️ Cocospy stalkerware apps go offline after data breach security news – Cocospy, Spyic, and Spyzie, stalkerware apps spying on millions, have gone offline following a significant data breach exposing user emails. Users are advised to remove any remaining spyware from their devices. https://techcrunch.com/2025/05/19/cocospy-stalkerware-apps-go-offline-after-data-breach/

🚪 DoorDash Hack security research https://www.schneier.com/blog/archives/2025/05/doordash-hack.html

🛒 Consumer Reports: Kroger using loyalty program to package, sell customer data privacy – Kroger allegedly sells detailed consumer data from its loyalty program, creating potentially inaccurate profiles of shoppers for marketing. Consumer Reports urges stronger privacy protections against such practices. https://therecord.media/kroger-using-loyalty-program-to-sell-customer-data

📚 Chicago Sun-Times prints summer reading list full of fake books security news – The Chicago Sun-Times published a summer reading list with fake books generated by AI, prompting backlash from readers and staff. The publication is investigating the incident and terminating its relationship with the creator. https://arstechnica.com/ai/2025/05/chicago-sun-times-prints-summer-reading-list-full-of-fake-books/

🔍 3 Teens Almost Got Away With Murder. Then Police Found Their Google Searches privacy – Three teens set a house fire that killed five people, but police traced their Google searches for the address to solve the case. The investigation raises concerns about privacy and law enforcement's use of digital data. https://www.wired.com/story/find-my-iphone-arson-case/

💬 Researchers Scrape 2 Billion Discord Messages and Publish Them Online privacy – A database of over 2 billion Discord messages scraped from 3,167 servers has been published online, raising privacy concerns despite claims of anonymization. A separate tool reveals non-anonymized chat histories. https://www.404media.co/researchers-scrape-2-billion-discord-messages-and-publish-them-online/

📸 Signal says no to Windows 11’s Recall screenshots privacy – Signal has implemented screen security in its Windows 11 client to prevent Microsoft’s Recall feature from capturing secured chats. This move highlights concerns over user privacy and accessibility issues. https://www.theverge.com/news/672210/signal-desktop-app-microsoft-recall-block-windows-11-ai

🐒 Kids Say They're Using Photos of Trump and Markiplier to Bypass 'Gorilla Tag' Age Verification security news – Players of the VR game Gorilla Tag are reportedly using images of Trump and Markiplier to circumvent age verification measures. https://www.404media.co/kids-say-theyre-using-photos-of-trump-and-markiplier-to-bypass-gorllia-tag-age-verification/

🤖 Should Children Use AI Chatbots? Google Thinks So, Critics Strongly Disagree privacy – Google's rollout of its AI chatbot Gemini for children under 13 has sparked backlash from privacy advocates, who argue it may violate COPPA and poses risks to kids' mental health and well-being. https://thecyberexpress.com/google-gemini-ai-for-kids/

📱 Russia to pass law to track migrants using their smartphone privacy – A new Russian law will require migrants in Moscow to use a smartphone app for tracking and reporting their location. Critics raise concerns about privacy and potential abuse of power. https://www.theregister.com/2025/05/22/russia_expected_to_pass_experimental/

🔓 Trojanized KeePass Used to Deploy Cobalt Strike and Steal Credentials malware – A malware campaign has trojanized the KeePass password manager to deliver Cobalt Strike and exfiltrate credentials. The compromised installer mimicked the real one, making detection difficult. https://securityonline.info/trojanized-keepass-used-to-deploy-cobalt-strike-and-steal-credentials/

Some More, For the Curious

🔑 OpenPGP.js bug enables encrypted message spoofing vulnerability – A critical vulnerability in OpenPGP.js allows spoofing of signed and encrypted messages, undermining public key cryptography. Users are urged to upgrade to patched versions to mitigate risks. https://www.theregister.com/2025/05/20/openpgp_js_flaw/

🌃 Does ENISA EUVD live up to all the hype? cyber defense – The article critically examines the effectiveness and impact of the European Union Agency for Cybersecurity (ENISA) in relation to the EU's cybersecurity directives, questioning if it meets expectations. https://vulncheck.com/blog/enisa-euvd

📊 CISA, NIST Researchers Develop Metric to Determine Likelihood of Vulnerability Exploitation security research – NIST and CISA researchers have created a new metric, Likely Exploited Vulnerabilities (LEV), to better predict which vulnerabilities may be exploited, enhancing existing systems like EPSS and KEV. https://thecyberexpress.com/cisa-nist-vulnerability-exploit-metric/

🔒 Lumma Stealer toppled by globally coordinated takedown cybercrime – Lumma Stealer, a notorious infostealer malware, was dismantled in a global operation that seized its core infrastructure, blocking 2,300 malicious domains. Microsoft and law enforcement aim to disrupt cybercrime operations. https://cyberscoop.com/lumma-stealer-infostealer-takedown/

⚠️ Active Directory dMSA Privilege Escalation Attack Detailed by Researchers vulnerability – Akamai researchers discovered a privilege escalation vulnerability in Windows Server 2025's dMSA feature, allowing attackers to compromise any Active Directory user with minimal permissions. Microsoft acknowledges the issue but rates it as moderate severity. https://thecyberexpress.com/active-directory-dmsa-attack/

📂 Mysterious Database of 184 Million Records Exposes Vast Array of Login Credentials cybercrime – A recent indictment highlights how a Russian malware operation facilitates both criminal activities and state-sponsored hacking, with various cybersecurity issues and incidents, including a breach involving the Signal clone TeleMessage. https://www.wired.com/story/mysterious-database-logins-governments-social-media/

💻 Oops: DanaBot Malware Devs Infected Their Own PCs cybercrime – The U.S. government has charged 16 individuals linked to DanaBot malware, which has infected over 300,000 systems. Developers accidentally infected their own PCs, revealing their identities and leading to their arrest. https://krebsonsecurity.com/2025/05/oops-danabot-malware-devs-infected-their-own-pcs/

💰 Decentralized crypto platform Cetus hit with $223 million hack security news – Cetus, a decentralized cryptocurrency exchange, was hacked for $223 million. The platform paused operations and secured $162 million of the stolen funds, while investigations into the attack continue. https://therecord.media/decentralized-crypto-platform-cetus-theft

🐩 Mysterious hacking group Careto was run by the Spanish government, sources say cybercrime – Research indicates that Careto, a sophisticated hacking group targeting various nations, was operated by the Spanish government. Initially identified in 2014, the group has resurfaced with advanced malware capabilities. https://techcrunch.com/2025/05/23/mysterious-hacking-group-careto-was-run-by-the-spanish-government-sources-say/

🚔 Operation RapTor led to the arrest of 270 dark web vendors and buyers cybercrime – Operation RapTor resulted in the arrest of 270 individuals involved in dark web trafficking across 10 countries, seizing over €184M in assets, drugs, and weapons. Law enforcement continues to target dark web activities. https://securityaffairs.com/178221/deep-web/operation-raptor-arrest-270-dark-web-vendors-and-buyers.html

🔒 Large-scale sting tied to Operation Endgame disrupts ransomware infrastructure cybercrime – Law enforcement from Europe and North America dismantled key ransomware infrastructure in Operation Endgame, taking down 300 servers and 650 domains, disrupting malware tools like Qakbot and Trickbot, and issuing arrest warrants for 20 suspects. https://cyberscoop.com/operation-endgame-ransomware-infrastructure-takedown-europol/

⚙️ Researchers cause GitLab AI developer assistant to turn safe code malicious vulnerability – Researchers demonstrated how GitLab's AI assistant, Duo, could be manipulated into inserting malicious code through prompt injections, exposing private data. GitLab has since implemented measures to mitigate this vulnerability. https://arstechnica.com/security/2025/05/researchers-cause-gitlab-ai-developer-assistant-to-turn-safe-code-malicious/

🦠 Compromised RVTools Installer Spreading Bumblebee Malware malware – A compromised RVTools installer was found spreading Bumblebee malware, detected by security researcher Aidan Leon. The malicious file originated from the official website, which has since been taken offline temporarily. https://hackread.com/compromised-rvtools-installer-drop-bumblebee-malware/

🔓 Bypass SharePoint Restricted View to exfiltrate data using Copilot AI and more… hacking writeup – Red Teamers demonstrate methods to circumvent SharePoint's Restricted View, allowing data exfiltration through techniques like screenshots, OCR, and using AI tools like Microsoft Copilot. The findings highlight the inadequacy of relying on Restricted View for data security. https://www.pentestpartners.com/security-blog/bypass-sharepoint-restricted-view-to-exfiltrate-data-using-copilot-ai-and-more/

🔑 Passwords are okay, impulsive Internet isn't security news – The article criticizes the push for passwordless authentication, arguing that passkeys create vendor lock-in and compromise user security. It emphasizes that the real issue lies in human behavior and impulse control, rather than technology itself. Comment: missed this one. thankfully cert.at pushed it this week. https://www.dedoimedo.com/life/passwords-passkeys.html

😡 Red Team Gold: Extracting Credentials from MDT Shares hacking write-up – The article explores how Microsoft Deployment Toolkit (MDT) can be targeted during Red Team engagements to extract credentials. It discusses misconfigurations in MDT shares that can lead to unauthorized access to sensitive information. https://trustedsec.com/blog/red-team-gold-extracting-credentials-from-mdt-shares

CISA Corner

⚠️ CISA Adds Six Known Exploited Vulnerabilities to Catalog warning – CISA has added six vulnerabilities to its catalog due to active exploitation, highlighting serious risks to federal systems. Agencies are required to remediate these vulnerabilities promptly. https://www.cisa.gov/news-events/alerts/2025/05/19/cisa-adds-six-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added a new vulnerability, CVE-2025-4632, related to Samsung MagicINFO 9 Server, to its Known Exploited Vulnerabilities Catalog, urging organizations to prioritize remediation efforts. https://www.cisa.gov/news-events/alerts/2025/05/22/cisa-adds-one-known-exploited-vulnerability-catalog

⚙️ CISA Releases Thirteen Industrial Control Systems Advisories vulnerability – CISA issued thirteen advisories on May 20, 2025, addressing security vulnerabilities in various Industrial Control Systems. Users are urged to review these advisories for important technical details and mitigations. https://www.cisa.gov/news-events/alerts/2025/05/20/cisa-releases-thirteen-industrial-control-systems-advisories ⚙️ CISA Releases Two Industrial Control Systems Advisories vulnerability – CISA has issued two advisories on security vulnerabilities affecting Lantronix Device Installer and Rockwell Automation FactoryTalk Historian. Users are urged to review the advisories for details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/05/22/cisa-releases-two-industrial-control-systems-advisories

🎯 Russian GRU Cyber Actors Targeting Western Logistics Entities and Tech Companies security news – CISA and other agencies issued a Cybersecurity Advisory on Russian GRU cyber actors targeting Western tech and logistics firms, particularly those supporting Ukraine. The advisory highlights their espionage tactics. https://www.cisa.gov/news-events/alerts/2025/05/21/russian-gru-cyber-actors-targeting-western-logistics-entities-and-tech-companies 🎯 Threat Actors Target U.S. Critical Infrastructure with LummaC2 Malware security news – CISA and the FBI issued a Cybersecurity Advisory on LummaC2 malware, which targets U.S. critical infrastructure by infiltrating networks and exfiltrating sensitive data. Organizations are urged to implement recommended mitigations. https://www.cisa.gov/news-events/alerts/2025/05/21/threat-actors-target-us-critical-infrastructure-lummac2-malware

🔐 New Best Practices Guide for Securing AI Data Released security news – CISA, NSA, and FBI released a Cybersecurity Information Sheet outlining best practices for securing AI data. It emphasizes the importance of data security throughout the AI lifecycle for accuracy and trustworthiness. https://www.cisa.gov/news-events/alerts/2025/05/22/new-best-practices-guide-securing-ai-data-released 🔒 Advisory Update on Cyber Threat Activity Targeting Commvault’s SaaS Cloud Application (Metallic) security news – Commvault is investigating potential unauthorized access to customer data in their Metallic SaaS solution on Azure. CISA urges users to apply mitigations, monitor logs, and implement security best practices. https://www.cisa.gov/news-events/alerts/2025/05/22/advisory-update-cyber-threat-activity-targeting-commvaults-saas-cloud-application-metallic

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 20/2025

May 18, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🎭 Threat actors use fake AI tools to deliver the information stealer Noodlophile cybercrime – Threat actors exploit AI trends to distribute Noodlophile, an information stealer, via fake AI tools on social media, tricking users into downloading malware disguised as legitimate applications. https://securityaffairs.com/177719/security/threat-actors-use-fake-ai-tools-to-deliver-the-information-stealer-noodlophile.html

✈️ Charter airline helping Trump's deportation campaign pwned data breach – GlobalX, a charter airline involved in deportations, reported a cybersecurity breach affecting its network. While the full impact remains unclear, it may include stolen flight records and passenger data. https://www.theregister.com/2025/05/12/globalx_security_incident/

💰 Google to pay Texas nearly $1.4 billion over alleged data privacy violations privacy – Google has agreed to a $1.37 billion settlement with Texas over lawsuits alleging illegal tracking of user data, including location and Incognito searches, without admitting wrongdoing. https://therecord.media/google-texas-privacy-violations-billions

🍏 Wide-ranging Apple security update addresses over 30 vulnerabilities vulnerability – Apple's latest security update addresses over 30 vulnerabilities across iOS, iPadOS, and macOS, including critical baseband flaws and privacy issues affecting various components. No active exploitation has been reported. https://cyberscoop.com/apple-security-update-c1-modem-privacy-fixes-may-2025/

📞 Android launches new protections against phone call scammers security news – Google is introducing features on Android to prevent phone call scams, including blocking app sideloading and accessibility permissions during calls, and warning users about likely scams when accessing banking apps. https://www.theverge.com/news/665706/google-phone-call-scam-protection-banking-apps

🔒 Zero Day Initiative — The May 2025 Security Update Review vulnerability – Adobe and Microsoft released significant security updates in May 2025, addressing numerous vulnerabilities across their software. Adobe patched 40 CVEs, while Microsoft addressed 75, including several critical flaws under active attack. https://www.thezdi.com/blog/2025/5/13/the-may-2025-security-update-review

🚫 Google Is Using On-Device AI to Spot Scam Texts and Investment Fraud security news – Google is enhancing its AI Scam Detection feature in the Messages app to identify various types of scams, running locally on devices to protect user privacy. This aims to combat the rising tide of digital fraud. https://www.wired.com/story/google-io-on-device-ai-scam-texts/

🚘 License Plate Reader Company Flock Is Building a Massive People Lookup Tool, Leak Shows privacy – Flock is developing a product called Nova that combines license plate data with personal information from data brokers, allowing law enforcement to track individuals without warrants. Employees express ethical concerns over using hacked data. https://www.404media.co/license-plate-reader-company-flock-is-building-a-massive-people-lookup-tool-leak-shows/

💻 North Korean IT Workers Are Being Exposed on a Massive Scale cybercrime – Researchers have identified North Korean IT workers infiltrating Western companies to fund the regime, revealing their lavish lifestyles and connections to cybercrime. A recent leak exposes over 1,000 email addresses linked to their activities. https://www.wired.com/story/north-korean-it-worker-scams-exposed/

⚖️ Meta's still violating GDPR rules with latest plan to train AI on EU user data, says noyb privacy – Noyb has sent a cease and desist letter to Meta, challenging its plans to use EU user data for AI training without explicit consent. The group threatens legal action if Meta does not comply with GDPR requirements. https://www.theregister.com/2025/05/14/metas_still_violating_gdpr_rules/

🛑 White House scraps plan to block data brokers from selling Americans' sensitive data privacy – The CFPB has withdrawn a plan to regulate data brokers under the Fair Credit Reporting Act, citing misalignment with current interpretations. This move follows industry lobbying against the rule, raising concerns over privacy. https://techcrunch.com/2025/05/14/white-house-scraps-plan-to-block-data-brokers-from-selling-americans-sensitive-data/

💰 Who needs VC funding? How cybercriminals spread their ill-gotten gains to everyday business ventures cybercrime – Cybercriminals are reinvesting their profits into ordinary businesses like coffee shops and real estate to launder money. An investigation reveals a network of collaboration among criminals to diversify and legitimize their income streams. https://cyberscoop.com/what-cybercriminals-do-with-their-money-sophos/

👟 Meta plans to train AI on EU user data from May 27 without consent privacy – Meta intends to train its AI models using EU user data starting May 27 without explicit consent, prompting privacy group noyb to threaten legal action for violating GDPR regulations by relying on an 'opt-out' system. https://securityaffairs.com/177920/security/meta-plans-to-train-ai-on-eu-user-data-from-may-27-without-consent.html

🔒 Google Chrome’s May Update: What You Need to Know About CVE-2025-4372 and More vulnerability – Google's latest Chrome update addresses critical vulnerabilities, including CVE-2025-4664, which is actively exploited, and CVE-2025-4372, a use-after-free flaw. Users are urged to update immediately for security. https://thecyberexpress.com/google-chrome-update-fixe-cve-2025-4372/

🚫 EU court rules that tracking-based online ads are illegal privacy – The Brussels Court of Appeal ruled that tracking for online ads violates GDPR, stating that existing consent models are inadequate. This decision significantly impacts major tech companies relying on real-time bidding. https://therecord.media/eu-court-rules-tracking-based-ads-illegal

⚖️ Bahn vor Gericht: Warum der DB Navigator ein Fall für die Justiz ist privacy – The Frankfurt court case against Deutsche Bahn focuses on the DB Navigator app, which allegedly collects and shares user data without consent, raising significant GDPR compliance issues and consumer rights concerns. https://www.kuketz-blog.de/bahn-vor-gericht-warum-der-db-navigator-ein-fall-fuer-die-justiz-ist/

👿 US Government officials targeted with texts and AI-generated deepfake voice messages impersonating senior U.S. officials security news – The FBI warns that ex-government officials are being targeted by cybercriminals using AI-generated deepfake texts and voice messages to impersonate senior U.S. officials, aiming to gain access to personal accounts. https://securityaffairs.com/177987/cyber-crime/us-government-officials-targeted-texts-and-ai-generated-deepfake.html

⚡ Experts found rogue devices, including hidden cellular radios, in Chinese security research – Investigators discovered hidden 'kill switches' and rogue cellular radios in Chinese-made power inverters used in US solar farms, raising concerns about potential remote control over critical energy infrastructure by Beijing. https://securityaffairs.com/178005/hacking/rogue-devices-in-chinese-made-power-inverters-used-worldwide.html

Some More, For the Curious

🕐 One-Click RCE in ASUS’s Preinstalled Driver Software hacking write-up – ASUS’s DriverHub software has a serious vulnerability that allows remote code execution due to weak origin checks, posing a significant security threat. https://mrbruh.com/asusdriverhub/

🤖 New 'Defendnot' tool tricks Windows into disabling Microsoft Defender security research – The 'Defendnot' tool exploits a Windows API to disable Microsoft Defender by registering a fake antivirus, showcasing vulnerabilities in system security features. https://www.bleepingcomputer.com/news/microsoft/new-defendnot-tool-tricks-windows-into-disabling-microsoft-defender/

🔐 The cryptography behind passkeys security research – Passkeys enhance authentication security by using cryptographic key pairs and the WebAuthn specification, eliminating phishing risks and password reuse while ensuring user authenticity. https://blog.trailofbits.com/2025/05/14/the-cryptography-behind-passkeys/

🚨 CVE-2024-26809: Critical nftables Vulnerability in Linux Kernel Could Lead to Root Access vulnerability – A critical double-free vulnerability in the Linux kernel's nftables subsystem allows local attackers to escalate privileges and execute arbitrary code. Users should update their systems to mitigate this risk. https://thecyberexpress.com/cve-2024-26809-nftables-vulnerability/

🔍 EU Vulnerability Database Officially Launches Amid CVE Program Concerns security news – The EU has launched its vulnerability database to improve management of cybersecurity threats, coinciding with uncertainty over MITRE's CVE Program future. It will aggregate critical vulnerability information and facilitate better transparency. https://thecyberexpress.com/eu-vulnerability-database-officially-launches-amid-cve-program-concerns/

⚠️ New VMware Tools Vulnerability Allows Attackers to Tamper with Virtual Machines, Broadcom Issues Urgent Patch vulnerability – A moderate vulnerability in VMware Tools (CVE-2025-22247) allows attackers with limited access to compromise VMs by tampering with local files. Broadcom has released patches; no workarounds are available. https://thecyberexpress.com/vmware-tools-vulnerability-cve-2025-22247/

🔧 Commvault Command Center patch incomplete: researcher vulnerability – A critical flaw in Commvault's Command Center remained exploitable for free trial users despite a patch. Following a researcher's discovery, Commvault has changed its update policy to allow immediate access for all users. https://www.theregister.com/2025/05/13/patch_commvault_cvss_10/

🌟 Zero-Day Vulnerabilities in Ivanti EPMM vulnerability – Ivanti disclosed two zero-day vulnerabilities in their Endpoint Manager Mobile (EPMM) products, allowing unauthenticated remote code execution. CERT-EU recommends immediate updates, especially for internet-facing devices. https://cert.europa.eu/publications/security-advisories/2025-018/

🔍 Intel data-leaking Spectre defenses scared off once again vulnerability – Researchers discovered a new attack vector exploiting Intel's Spectre defenses, allowing unauthenticated remote code execution via branch predictor race conditions. Intel has released a microcode update to address this vulnerability. https://www.theregister.com/2025/05/13/intel_spectre_race_condition/

💝 Spies hack high-value mail servers using an exploit from yesteryear cybercrime – Recent reports indicate that spies have successfully compromised high-value mail servers by exploiting older vulnerabilities, demonstrating the ongoing risk posed by outdated security flaws. https://arstechnica.com/security/2025/05/spies-hack-high-value-mail-servers-using-an-exploit-from-yesteryear/

💵 Coinbase flips $20M extortion demand into bounty for info on attackers cybercrime – After cybercriminals extorted Coinbase for $20 million following a data breach, the company offered the same amount as a reward for information leading to the attackers' arrest, marking a proactive response to the incident. https://cyberscoop.com/coinbase-cyberattack-extortion-counter-reward/

💻 Pwn2Own Berlin 2025 Day Two: researcher earned 150K hacking VMware ESXi security research – On day two of Pwn2Own Berlin 2025, hackers earned $435,000 for demonstrating zero-day exploits in various products, including VMware ESXi, with one researcher earning $150,000 for an integer overflow exploit. https://securityaffairs.com/177943/hacking/pwn2own-berlin-2025-day-two-researcher-earned-150k-hacking-vmware-esxi.html

🛡️ ClickFix Fixes Ranked cyber defense – The 'ClickFix' attack technique exploits user coercion to execute malicious commands via the Windows Run dialog. Mitigations are ranked by effectiveness and annoyance, highlighting the balance between security and usability. https://taggart-tech.com/clickfix/

©️ How the Signal Knockoff App TeleMessage Got Hacked in 20 Minutes security news – TeleMessage, a Signal clone used by U.S. officials, was hacked, exposing user message logs in plaintext. The app has been disabled by Customs and Border Protection amid security concerns. https://www.wired.com/story/how-the-signal-knock-off-app-telemessage-got-hacked-in-20-minutes/

CISA Corner

📢 Update to How CISA Shares Cyber-Related Alerts and Notifications security news – CISA is revamping its cybersecurity alerts by sharing updates solely through social media and email, focusing on urgent threats on its webpage to improve visibility and user experience. https://www.cisa.gov/news-events/alerts/2025/05/12/update-how-cisa-shares-cyber-related-alerts-and-notifications

⚠️ CISA Adds Five Known Exploited Vulnerabilities to Catalog warning – CISA has added five Microsoft Windows vulnerabilities to its Known Exploited Vulnerabilities Catalog due to active exploitation risks, urging federal agencies to remediate them promptly. https://www.cisa.gov/news-events/alerts/2025/05/13/cisa-adds-five-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-32756, a stack-based buffer overflow vulnerability in Fortinet products, to its Known Exploited Vulnerabilities Catalog due to active exploitation risks, urging federal agencies to remediate it promptly. https://www.cisa.gov/news-events/alerts/2025/05/14/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has included three new vulnerabilities in its Known Exploited Vulnerabilities Catalog: a command injection in DrayTek routers, an enforcement issue in Google Chromium, and a deserialization vulnerability in SAP NetWeaver, highlighting significant risks for federal agencies. https://www.cisa.gov/news-events/alerts/2025/05/15/cisa-adds-three-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases Twenty-Two Industrial Control Systems Advisories vulnerability – CISA has released twenty-two advisories regarding vulnerabilities in industrial control systems, aimed at enhancing security measures within critical infrastructure sectors. https://www.cisa.gov/news-events/alerts/2025/05/15/cisa-releases-twenty-two-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 19/2025

May 11, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🤦‍♂️ WhatsApp provides no cryptographic management for group messages security research – WhatsApp's group messaging lacks cryptographic safeguards, allowing potential unauthorized users to join chats unnoticed, raising privacy concerns for sensitive discussions. https://arstechnica.com/security/2025/05/whatsapp-provides-no-cryptographic-management-for-group-messages/

🚫 Mr. Deepfakes, the Biggest Deepfake Porn Site on the Internet, Says It’s Shutting Down for Good cybercrime – Mr. Deepfakes, notorious for nonconsensual deepfake porn, has announced its permanent shutdown due to loss of service and data, leaving users with no access. https://www.404media.co/mr-deepfakes-the-biggest-deepfake-porn-site-on-the-internet-says-its-shutting-down-for-good/

🔑 Passkeys for Normal People cyber defense – Passkeys offer a phishing-resistant alternative to traditional passwords and OTPs for secure logins, enhancing online safety, but still require careful management across devices. https://www.troyhunt.com/passkeys-for-normal-people/

🔓 The modified Signal app used by Mike Waltz was reportedly hacked data breach – A breach involving a modified Signal app used by Mike Waltz has led to the exposure of message contents and contact information of government officials. https://www.theverge.com/news/661173/telemessage-signal-clone-hacked-mike-waltz

📱 Smishing on a Massive Scale: ‘Panda Shop’ Chinese Carding Syndicate cybercrime – Resecurity has uncovered a new smishing kit, ‘Panda Shop,’ linked to a Chinese syndicate, capable of sending millions of fraudulent messages daily and targeting vast consumer data. https://securityaffairs.com/177502/cyber-crime/smishing-on-a-massive-scale-panda-shop-chinese-carding-syndicate.html

🎓 Fake Student Fraud in Community Colleges cybercrime – Community colleges face rising fraud from fake students using AI-generated work to exploit financial aid, challenging detection efforts and disrupting class structures. https://www.schneier.com/blog/archives/2025/05/fake-student-fraud-in-community-colleges.html

🚨 Samsung MagicINFO flaw exploited days after PoC publication vulnerability – A high-severity vulnerability (CVE-2024-7399) in Samsung MagicINFO was exploited shortly after a proof-of-concept was released, allowing unauthenticated users to execute code with system-level access. https://securityaffairs.com/177529/hacking/samsung-magicinfo-vulnerability-exploited-after-poc-publication.html

🕵️‍♂️ Meta awarded $167.25 million over Pegasus spyware attack security news – Meta has been awarded $167.25 million after suing the NSO Group for using Pegasus spyware to target over 1,400 WhatsApp users. https://www.theverge.com/news/662242/meta-nso-group-pegasus-whatsapp-hack-damages

🔑 Tulsi Gabbard Reused the Same Weak Password on Multiple Accounts for Years security news – Tulsi Gabbard reportedly used the same easily cracked password across multiple accounts for years, raising concerns about her cybersecurity practices following a sensitive incident involving a Signal group chat. https://www.wired.com/story/tulsi-gabbard-dni-weak-password/

💻 COLDRIVER Using New Malware To Steal Documents From Western Targets and NGOs cybercrime – Google's Threat Intelligence Group reports on COLDRIVER's new malware, LOSTKEYS, used to steal files from Western targets, utilizing a multi-stage infection process involving social engineering techniques. https://cloud.google.com/blog/topics/threat-intelligence/coldriver-steal-documents-western-targets-ngos/

💰 PowerSchool customers hit by downstream extortion threats cybercrime – After PowerSchool paid a ransom to delete stolen data, some of its school district customers are now facing extortion threats to leak that data, highlighting ongoing supply chain risks. https://cyberscoop.com/powerschool-customers-hit-by-downstream-extortion-threats/

🔒 Polish authorities arrested 4 people behind DDoS cybercrime – Polish police arrested four individuals operating DDoS-for-hire platforms used in global attacks, offering services for as little as €10, as part of an international crackdown on cybercrime. https://securityaffairs.com/177590/cyber-crime/polish-police-arrested-4-people-behind-ddos-for-hire-platforms.html

🎭 NCSC warns of IT helpdesk impersonation trick being used by ransomware gangs after UK retailers attacked security news – Following ransomware attacks on Marks & Spencer and Co-op, the NCSC warns that hackers are using social engineering to impersonate employees and exploit helpdesk staff for account access. https://www.exponential-e.com/blog/ncsc-warns-of-it-helpdesk-impersonation-trick-being-used-by-ransomware-gangs-after-uk-retailers-attacked

🐕‍🦺 DOGE software engineer’s computer infected by info-stealing malware security news – Kyle Schutt, a software engineer at CISA, had his login credentials exposed multiple times in public leaks from info-stealing malware, raising concerns about potential access to sensitive government information. https://arstechnica.com/security/2025/05/doge-software-engineers-computer-infected-by-info-stealing-malware/

✈️ Hackers hit deportation airline GlobalX, leak flight manifests, and leave an unsubtle message for “Donnie” Trump cybercrime – Hacktivists claiming to be part of Anonymous breached GlobalX Airlines, leaking flight records and passenger manifests related to US deportation flights while defacing the airline's website with a message targeting Trump. https://www.bitdefender.com/en-us/blog/hotforsecurity/hackers-globalx-message-trump

🛡️ FBI and Dutch police seize and shut down botnet of hacked routers cybercrime – A joint operation by the FBI and Dutch police dismantled a botnet of hacked routers used for cybercrime, indicting four individuals for running proxy services Anyproxy and 5Socks built on compromised devices. https://techcrunch.com/2025/05/09/fbi-and-dutch-police-seize-and-shut-down-botnet-of-hacked-routers/

💰 German operation shuts down crypto mixer eXch, seizes millions in assets cybercrime – German police seized over $30 million in assets from the crypto mixer eXch, which was linked to laundering funds from the $1.46 billion Bybit hack, as part of a crackdown on money laundering activities. https://therecord.media/exch-cryptocurrency-mixer-germany-takedown

🔒 How to turn on Lockdown Mode for your iPhone and Mac privacy – Apple's Lockdown Mode enhances security for those facing sophisticated threats, limiting device functionality. It can be easily enabled or disabled on iPhones, iPads, and Macs through settings. https://www.theverge.com/tech/663794/lockdown-mode-iphone-mac-how-to

💰 Google will pay Texas $1.4 billion over its location tracking practices privacy – Google will pay Texas $1.4 billion to settle lawsuits over unauthorized location tracking and biometric data retention, marking a significant victory for user privacy against Big Tech violations. https://securityaffairs.com/177683/laws-and-regulations/google-will-pay-texas-1-4-billion-over-its-location-tracking-practices.html

Some More, For the Curious

⚠️ Security Researchers Warn a Widely Used Open Source Tool Poses a 'Persistent' Risk to the US security research – Researchers highlight security concerns over easyjson, an open source tool linked to a Russian company, fearing it could be exploited for espionage or cyberattacks against the US. https://www.wired.com/story/easyjson-open-source-vk-ties/

5️⃣ 5 Common Cybersecurity Mistakes That Attackers Love cyber defense – Cybersecurity experts highlight five common mistakes—improper secrets management, excessive user privileges, lack of network segmentation, overreliance on user training, and poor security detections—that leave organizations vulnerable to attacks. https://bishopfox.com/blog/before-red-team-fix-these-5-common-mistakes

💳 Hundreds of e-commerce sites hacked in supply-chain attack security research – A supply-chain attack has compromised hundreds of e-commerce sites, injecting malware that steals payment information from visitors, linked to three software providers over six years. https://arstechnica.com/security/2025/05/hundreds-of-e-commerce-sites-hacked-in-supply-chain-attack/

⚖️ Lawmakers grill Noem over CISA funding cuts, demand Trump cyber plan security news – Homeland Security Secretary Kristi Noem faced bipartisan criticism over a proposed $491 million budget cut to CISA, with lawmakers demanding details on the Trump administration's cyber strategy amid rising threats. https://therecord.media/noem-house-hearing-proposed-cisa-funding-cuts

🛡️ New 'Bring Your Own Installer (BYOI)' technique allows to bypass EDR vulnerability – A new BYOI technique allows attackers to exploit SentinelOne's upgrade process, disabling EDR protection and enabling Babuk ransomware deployment by interrupting the installation. https://securityaffairs.com/177494/hacking/new-bring-your-own-installer-byoi-technique-allows-to-bypass-edr.html

➰ Curl takes action against time-wasting AI bug reports security news – Curl founder Daniel Stenberg implements a checkbox for bug reports to filter out AI-generated submissions, citing their overwhelming volume and lack of validity as a drain on maintainers' resources. https://www.theregister.com/2025/05/07/curl_ai_bug_reports/

🔓 Play ransomware affiliate leveraged zero cybercrime – The Play ransomware gang exploited a Windows zero-day vulnerability (CVE-2025-29824) to gain SYSTEM privileges and deploy malware, including the Grixba infostealer, in targeted attacks. https://securityaffairs.com/177573/cyber-crime/play-ransomware-affiliate-leveraged-zero-day-to-deploy-malware.html

💻 CVE-2024-44236: Remote Code Execution vulnerability in Apple macOS vulnerability – A remote code execution vulnerability in macOS allows attackers to exploit ICC Profile files, potentially executing code on victims' machines. A patch has been released, but no attacks have been detected yet. https://www.thezdi.com/blog/2025/5/7/cve-2024-44236-remote-code-execution-vulnerability-in-apple-macos

🔐 CVE-2025-20188: Cisco Fixes 10.0-Rated Wireless Controller Flaw vulnerability – Cisco has patched a critical vulnerability (CVE-2025-20188) in its IOS XE Wireless Controller software that allows unauthenticated attackers to gain root access. Administrators are urged to apply fixes and check configurations. https://thecyberexpress.com/cisco-patches-cve-2025-20188/

🫦 The LockBit ransomware site was breached, database dump was leaked online cybercrime – The LockBit ransomware group's dark web site was breached, leaking a database with victim data, negotiation logs, and configurations, revealing insights into their operations and potential decryption keys. https://securityaffairs.com/177619/cyber-crime/the-lockbit-ransomware-site-was-breached-database-dump-was-leaked-online.html

📅 A timeline of South Korean telco giant SKT's data breach data breach – SK Telecom suffered a major data breach affecting 23 million customers, prompting investigations and customer backlash, as the company works to mitigate damage and replace compromised SIM cards. https://techcrunch.com/2025/05/08/a-timeline-of-south-korean-telco-giant-skts-data-breach/

🔒 SonicWall fixed SMA 100 flaws that could be chained to execute arbitrary code vulnerability – SonicWall patched three critical vulnerabilities in SMA 100 that could allow remote attackers to chain them for arbitrary code execution, including a potential zero-day. Users are advised to update to the latest version. https://securityaffairs.com/177626/hacking/sonicwall-fixed-sma-100-flaws-that-could-be-chained-to-execute-arbitrary-code.html

🔒 CVSS 10.0 Vulnerability Found in Ubiquity UniFi Protect Cameras vulnerability – Ubiquity disclosed critical vulnerabilities in UniFi Protect, including a CVSS 10.0 flaw (CVE-2025-23123) allowing remote code execution. Users are urged to update firmware and applications immediately to mitigate risks. https://thecyberexpress.com/ubiquity-unifi-protect-flaws-cve-2025-23123/

CISA Corner

😶 Unsophisticated Cyber Actor(s) Targeting Operational Technology cyber defense – CISA warns of unsophisticated cyber actors targeting ICS/SCADA systems in U.S. critical infrastructure, urging asset owners to improve cyber hygiene to prevent potential operational disruptions and physical damage. https://www.cisa.gov/news-events/alerts/2025/05/06/unsophisticated-cyber-actors-targeting-operational-technology

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-3248, a missing authentication vulnerability in Langflow, to its catalog, highlighting its active exploitation and risks to federal networks. https://www.cisa.gov/news-events/alerts/2025/05/05/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has included CVE-2025-27363, an out-of-bounds write vulnerability in FreeType, in its catalog due to evidence of active exploitation posing risks to federal networks. https://www.cisa.gov/news-events/alerts/2025/05/06/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog warning – CISA has included two new OS command injection vulnerabilities (CVE-2024-6047 and CVE-2024-11120) in its catalog, highlighting their active exploitation and risks to federal networks. https://www.cisa.gov/news-events/alerts/2025/05/07/cisa-adds-two-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases Three Industrial Control Systems Advisories vulnerability – CISA has issued three advisories regarding vulnerabilities in industrial control systems, urging users to review the advisories for technical details and recommended mitigations. https://www.cisa.gov/news-events/alerts/2025/05/06/cisa-releases-three-industrial-control-systems-advisories ⚙️ CISA Releases Five Industrial Control Systems Advisories vulnerability – CISA has issued five advisories regarding vulnerabilities in various Industrial Control Systems, urging users to review the details and recommended mitigations for enhanced security. https://www.cisa.gov/news-events/alerts/2025/05/08/cisa-releases-five-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 17/2025

April 27, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🎣 Zoom attack tricks victims into allowing remote access to install malware and steal money cybercrime – The ELUSIVE COMET group exploits Zoom to trick victims into granting remote access, allowing malware installation and asset theft. A recent attack succeeded on one CEO but failed on another. https://www.malwarebytes.com/blog/news/2025/04/zoom-attack-tricks-victims-into-allowing-remote-access-to-install-malware-and-steal-money

💳 NFC Fraud Wave: Evolution of Ghost Tap on the Dark Web cybercrime – NFC fraud is surging as cybercriminals exploit contactless payment systems for large-scale theft. The 'Ghost Tap' technique enables remote access to stolen data, posing serious security risks. https://www.resecurity.com/blog/article/nfc-fraud-wave-evolution-of-ghost-tap-on-the-dark-web

🐡 Beware of this sneaky Google phishing scam warning – Scammers are using Google and PayPal tools to craft convincing fake emails that bypass security checks, making them harder to detect. Stay vigilant against these phishing attempts. https://www.theverge.com/news/652509/google-no-reply-dkim-phishing-scam

💂 How to Protect Yourself From Phone Searches at the US Border privacy – As border searches intensify, travelers should consider using a travel phone or modifying their primary device to minimize personal data. Simple precautions can help protect privacy during crossings. https://www.wired.com/story/how-to-protect-yourself-from-phone-searches-at-the-us-border/

🛍️ Marks & Spencer confirms cybersecurity incident amid ongoing disruption cybercrime – Marks & Spencer has confirmed a cybersecurity incident affecting its operations, causing disruptions in payment systems and order pickups. The retailer is investigating with external experts, but details on customer data impact remain unclear. https://techcrunch.com/2025/04/22/marks-spencer-confirms-cybersecurity-incident-amid-ongoing-disruption/

🎥 Beware of video call links that are attempts to steal Microsoft 365 access, researchers tell NGOs security news – Researchers warn that Russia-linked hackers are targeting NGOs with phishing attempts disguised as video call invitations to capture Microsoft 365 access tokens via OAuth. Vigilance is advised against unsolicited contacts. https://therecord.media/russia-linked-phishing-microsoft365-ukraine-ngos

⛪ The Tech That Safeguards the Conclave’s Secrecy security news – As the Vatican prepares for the conclave to elect a new pope, advanced security measures like signal jammers, opaque window films, and thorough inspections are in place to ensure secrecy and integrity. https://www.wired.com/story/technology-used-to-shield-conclave-pope-francis/

💰 EU fines Apple €500 million and Meta €200 million for breaking digital market rules security news – The European Commission fined Apple €500 million and Meta €200 million for violating the Digital Markets Act, marking the first penalties under the new regulations. Both companies plan to appeal the decisions. https://therecord.media/eu-fines-apple-steering-meta-data-privacy-dma

🧿 Blue Shield of California shared the private health data of millions with Google for years data breach – Blue Shield of California disclosed a data breach involving the sharing of sensitive health information with Google since 2021, affecting 4.7 million individuals. The data sharing ended in January 2024 due to a misconfiguration. https://techcrunch.com/2025/04/23/blue-shield-of-california-shared-the-private-health-data-of-millions-with-google-for-years/

©️ WhatsApp now lets you block people from exporting your entire chat history privacy – WhatsApp's new 'Advanced Chat Privacy' feature allows users to prevent others from exporting chat histories and automatically downloading media, enhancing privacy in conversations, although it won't stop screenshots. https://www.theverge.com/news/654592/whatsapp-advanced-chat-privacy-block-exporting-chats

⚰️ Crooks exploit the death of Pope Francis cybercrime – Cybercriminals are exploiting the death of Pope Francis to launch scams and spread malware, leveraging public emotion and curiosity. Strong security practices are essential to counter these risks. https://securityaffairs.com/176917/cyber-crime/crooks-exploit-the-death-of-pope-francis.html

🌍 Even the U.S. Government Says AI Requires Massive Amounts of Water security news – A new GAO report highlights the significant environmental costs of generative AI, emphasizing its heavy demand for power and water, raising concerns about its long-term societal impact. https://www.404media.co/even-the-u-s-government-says-ai-requires-massive-amounts-of-water/

🎮 UK bans export of video game controllers to Russia to hinder attack drone pilots security news – The UK government has banned the export of video game controllers to Russia to prevent their use in piloting drones in Ukraine. This is part of a broader sanctions package aimed at limiting Russia's war efforts. https://therecord.media/uk-bans-video-game-controllers

🤌 Gmail’s New Encrypted Messages Feature Opens a Door for Scams cybercrime – Google's new end-to-end encrypted email feature may enhance security but raises concerns about phishing scams targeting non-Gmail users, as scammers could exploit the invitation system to steal credentials. https://www.wired.com/story/gmail-end-to-end-encryption-scams/

💻 North Korean IT workers seen using AI tools to scam firms into hiring them cybercrime – North Korean IT workers are leveraging generative AI tools to secure jobs at U.S. and European tech firms, facilitating their onboarding and communication while funneling earnings back to the DPRK government. https://therecord.media/north-korean-it-workers-seen-using-ai-recruitment-scams

🥴 Government officials are kind of bad at the internet security news – U.S. officials, including Secretary of Defense Pete Hegseth, have mishandled sensitive information through tech blunders, such as sharing military plans in unsecured messaging apps, highlighting poor digital security practices. https://techcrunch.com/2025/04/26/government-officials-are-kind-of-bad-at-the-internet/

🎒 Storm-1977 targets education sector with password spraying security news – Microsoft reports that the threat actor Storm-1977 is conducting password spraying attacks on the education sector, using AzureChecker.exe to validate credentials and create resources for cryptomining. https://securityaffairs.com/177067/hacking/storm-1977-targets-education-sector-with-password-spraying-microsoft-warns.html

🔑 Who needs phishing when your login's already in the wild? security news – Mandiant's report reveals that stolen credentials have become a major infection vector, surpassing email phishing. The rise in infostealers and cloud attacks emphasizes the need for multi-factor authentication. https://www.theregister.com/2025/04/23/stolen_credentials_mandiant/

🥏 A Look at a Novel Discord Phishing Attack cybercrime – Researchers from Binary Defense investigated MalenuStealer, an infostealer exploiting compromised Discord accounts to distribute malware disguised as a beta game. The attack uses social engineering to trick users into downloading malicious software. https://www.binarydefense.com/resources/blog/a-look-at-a-novel-discord-phishing-attack/

Some More, For the Curious

🤬 Microsoft’s patch for CVE-2025–21204 symlink vulnerability introduces another symlink vulnerability vulnerability – A fix for a symlink vulnerability inadvertently creates another, allowing users to block future Windows updates, risking security. Microsoft has not yet addressed this issue. https://doublepulsar.com/microsofts-patch-for-cve-2025-21204-symlink-vulnerability-introduces-another-symlink-vulnerability-9ea085537741

🔍 CERT.at – DOGE, CISA, Mitre und CVE Published security news – Concerns arose when funding for the CVE system was threatened, but a solution was found. The CVE identifiers remain vital for effective vulnerability management across organizations. https://www.cert.at/de/blog/2025/4/doge-cisa-mitre-und-cve

🎭 Example of a Payload Delivered Through Steganography malware – This article illustrates how steganography conceals malicious payloads in seemingly harmless images, making detection by security tools challenging. It explores obfuscation techniques used in malware. https://isc.sans.edu/diary/rss/31892

🦠 How Lumma Stealer sneaks into organizations malware – Lumma Stealer exploits fake CAPTCHA pages and other social engineering tactics to infiltrate systems, primarily targeting individuals and organizations. Its methods include DLL sideloading and malicious payload injections. https://securelist.com/lumma-fake-captcha-attacks-analysis/116274/

⏳ Eight days from patch to exploitation for Microsoft flaw vulnerability – Just eight days after Microsoft patched CVE-2025-24054, attackers exploited it in campaigns against targets in Poland and Romania, highlighting urgent patching needs for NTLM vulnerabilities. https://www.theregister.com/2025/04/21/microsoft_apple_patch/

🏗️ Attacker Infrastructure cyber defense – The article discusses the various components and setups used by cybercriminals to conduct attacks, including servers, tools, and networks that facilitate malicious activities. https://vulncheck.com/blog/attacker-infrastructure

🃏 Attackers stick with effective intrusion points, valid credentials and exploits security news – IBM X-Force's report reveals that identity-based attacks and exploitation of public-facing applications remain the top intrusion methods. Credential theft and phishing continue to rise, particularly in critical infrastructure sectors. https://cyberscoop.com/ibm-x-force-threat-intelligence-index-2025/

🧑‍🏫 Ex-NSA boss: AI devs' lesson to learn from early infosec security news – Former NSA chief Mike Rogers urges AI developers to integrate security from the start, learning from cybersecurity's past mistakes, to avoid costly fixes later and ensure responsible use in national security. https://www.theregister.com/2025/04/23/exnsa_boss_ai/

🔮 A Vulnerable Future: MITRE’s Close Call in CVE Management cyber defense – MITRE faced a crisis regarding the CVE program's future but secured an 11-month contract extension. The incident highlights the need for robust vulnerability management practices amid uncertainty. https://jfrog.com/blog/mitres-close-call-in-cve-management/

🃏 M-Trends 2025: Data, Insights, and Recommendations From the Frontlines security news – Mandiant's M-Trends 2025 report highlights evolving attack sophistication, particularly by China-linked groups using custom malware and zero-day vulnerabilities, while also noting a rise in credential theft as a major infection vector. https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2025/

⛓️‍💥 Ripple NPM supply chain attack hunts for private keys cybercrime – Compromised versions of the Ripple NPM package, xrpl, have been found to contain malware designed to steal private keys from users, affecting developers who interact with the cryptocurrency ledger. https://www.theregister.com/2025/04/23/ripple_npm_supply_chain/

⚖️ DOGE Worker’s Code Supports NLRB Whistleblower security research – A whistleblower alleges that Elon Musk's DOGE group illegally downloaded sensitive data from the NLRB using privileged accounts, raising concerns about unfair advantages in labor disputes and data security. https://krebsonsecurity.com/2025/04/doge-workers-code-supports-nlrb-whistleblower/

🃏 VulnCheck spotted 159 actively exploited vulnerabilities in first few months of 2025 security news – In Q1 2025, VulnCheck reported that attackers exploited nearly a third of vulnerabilities within a day of disclosure, identifying 159 actively exploited vulnerabilities and highlighting the need for rapid response to emerging threats. https://cyberscoop.com/vulncheck-known-exploited-cves-q1-2025/

⛓️ Operation SyncHole: Lazarus APT targets supply chains in South Korea security research – The Lazarus Group has launched Operation SyncHole, targeting at least six South Korean firms through cyber espionage, using malware like ThreatNeedle and exploiting vulnerabilities in local software for data theft. https://securityaffairs.com/176964/apt/operation-synchole-lazarus-apt-targets-supply-chains-in-south-korea.html

⚠️ Critical Commvault Flaw Rated 10/10: CSA Urges Immediate Patching vulnerability – The CSA of Singapore warns of a critical vulnerability (CVE-2025-34028) in Commvault Command Center, rated 10/10, allowing remote code execution. Users are urged to update to patched versions immediately. https://thecyberexpress.com/commvault-vulnerability-cve-2025-34028/

🚨 SAP zero-day vulnerability under widespread active exploitation vulnerability – A critical zero-day vulnerability (CVE-2025-31324) in SAP NetWeaver systems allows unauthorized file uploads, leading to full system compromise. Active exploitation is reported, urging immediate patching for affected customers. https://cyberscoop.com/sap-netweaver-zero-day-exploit-cve-2025-31324/

📱 How to Root Android Phones hacking write-up – This guide explains rooting Android devices, detailing the process for both emulators and physical phones like the Pixel 6. It discusses the pros and cons of rooting, including the benefits for testing applications and the associated security risks. https://www.blackhillsinfosec.com/how-to-root-android-phones/

🐞 How a 20 year old bug in GTA San Andreas surfaced in Windows 11 24H2 security news – A long-standing bug in GTA San Andreas caused the Skimmer plane to disappear on Windows 11 24H2 due to changes in how the OS handles stack memory, exposing uninitialized variables and corrupting game data. https://cookieplmonster.github.io/2025/04/23/gta-san-andreas-win11-24h2-bug/

🛡️ io_uring Rootkit Bypasses Linux Security Tools security research – ARMO researchers reveal a significant security gap in Linux due to the io_uring interface, allowing rootkits to evade detection by traditional security tools. Their rootkit, Curing, exploits this blind spot, underscoring the need for improved detection methods like KRSI. https://www.armosec.io/blog/io_uring-rootkit-bypasses-linux-security/

CISA Corner

⚙️ CISA Releases Five Industrial Control Systems Advisories vulnerability – CISA issued five advisories on April 22, 2025, addressing vulnerabilities in various ICS products, including Siemens and Schneider Electric systems. Users are urged to review for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/04/22/cisa-releases-five-industrial-control-systems-advisories ⚙️ CISA Releases Seven Industrial Control Systems Advisories vulnerability – CISA issued seven advisories on April 24, 2025, addressing vulnerabilities in various ICS products, including Schneider Electric and Johnson Controls. Users are urged to review for technical details and mitigations. https://www.cisa.gov/news-events/alerts/2025/04/24/cisa-releases-seven-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 16/2025

April 20, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🕵️ Chrome extensions with 6 million installs have hidden tracking code malware – 57 risky Chrome extensions, used by 6 million, secretly track users and access sensitive data. Some have been removed, but others still pose a threat. https://www.bleepingcomputer.com/news/security/chrome-extensions-with-6-million-installs-have-hidden-tracking-code/

💻 The Most Dangerous Hackers You’ve Never Heard Of cybercrime – A roundup of recent cybersecurity incidents, including a suspected breach of 4chan, the rise of smishing scams, and vulnerabilities in government cybersecurity programs. https://www.wired.com/story/most-dangerous-hackers-youve-never-heard-of/

🎤 Silicon Valley crosswalk buttons hacked to imitate Musk, Zuckerberg's voices security news – Audio traffic crosswalk buttons in Silicon Valley were hacked to play AI-generated messages mimicking Elon Musk and Mark Zuckerberg, raising concerns over security and potential hacktivism. https://techcrunch.com/2025/04/14/silicon-valley-crosswalk-buttons-hacked-to-imitate-musk-zuckerberg-voices/

🗂️ Don't delete inetpub folder. It's a Windows security fix vulnerability – The newly created inetpub folder on Windows systems post-update is a security measure to prevent privilege escalation vulnerabilities. Users are advised to keep it intact. https://www.theregister.com/2025/04/14/windows_update_inetpub/

🕹️ Infinity Global Services’ Cyber Park Launches “Beacon in the Dark” – A New Cyber Security Escape Room Adventure security news – The new escape room 'Beacon in the Dark' challenges players to solve cyber risk puzzles, enhancing awareness about threats like credential theft. It's a fun way to learn about cybersecurity! https://blog.checkpoint.com/infinity-global-services/infinity-global-services-cyber-park-launches-beacon-in-the-dark-a-new-cyber-security-escape-room-adventure/

⚠️ Microsoft’s Recall AI Tool Is Making an Unwelcome Return privacy – A series of incidents highlight the risks of AI mismanagement, including a chatbot creating false policies and government officials exposing sensitive data on Venmo. https://www.wired.com/story/microsoft-recall-returns-privacy/

🔍 Meta will use public EU user data to train its AI models privacy – Meta plans to resume using public data from EU users to train its AI models, emphasizing user choice and transparency while addressing prior data protection concerns raised by regulators. https://securityaffairs.com/176569/digital-id/meta-will-use-public-eu-user-data-to-train-its-ai-models.html

🚗 Hertz says customers' personal data and driver's licenses stolen in data breach data breach – Hertz has notified customers of a data breach involving personal data and driver's licenses, attributed to a cyberattack on vendor Cleo. The breach affects thousands across several countries. https://techcrunch.com/2025/04/14/hertz-says-customers-personal-data-and-drivers-licenses-stolen-in-data-breach/

📱 Report: EC issues burner phones for visits to US security news – The European Commission is providing burner devices to staff visiting the US to prevent espionage, reflecting growing concerns over cybersecurity and strained transatlantic relations. https://www.theregister.com/2025/04/15/ec_burner_devices/

💸 Inside the Economy of AI Spammers Getting Rich By Exploiting Disasters and Misery cybercrime – The article explores how accounts like FutureRiderUS profit from creating AI-generated disaster content, manipulating emotions for views, while ethical concerns about misinformation and audience deception grow. https://www.404media.co/inside-the-economy-of-ai-spammers-getting-rich-by-exploiting-disasters-and-misery/

🔒 Android phones will soon reboot if they’re locked for a few days security news – Android devices will now require users to enter their PIN after three days of inactivity to enhance security, helping protect user data from unauthorized access. https://www.theverge.com/news/648757/google-android-update-automatic-reboot-phone-locked

💻 4chan’s ‘cesspool of the internet’ is down after apparently being hacked security news – 4chan's forums are currently inaccessible, leading to speculation and unverified rumors regarding potential data leaks following an apparent hack of the site. https://www.theverge.com/news/648908/4chan-hacked-down-outage-leak

📜 Here’s What Happened to Those SignalGate Messages security news – Attorneys allege that the Trump administration used disappearing Signal messages to evade transparency laws regarding military operations, with new court filings revealing inconsistent efforts to preserve these communications. https://www.wired.com/story/heres-what-happened-to-those-signalgate-messages/

🛒 Massenhaft irreführende Werbung von problematischen Online warning – Problematic online shops are using misleading advertising on social media, particularly on Meta platforms, claiming fake sales and non-existent stores, often featuring AI-generated images and deceptive return policies. https://www.watchlist-internet.at/news/irrefuehrende-werbung-auf-meta-plattformen/

🧊 ICE Just Paid Palantir Tens of Millions for ‘Complete Target Analysis of Known Populations’ security news – ICE has contracted Palantir for tens of millions to enhance its database for target analysis and enforcement priorities, raising concerns about potential rights violations and the impact on immigrant communities. https://www.404media.co/ice-just-paid-palantir-tens-of-millions-for-complete-target-analysis-of-known-populations/

🚨 Whistleblower describes how DOGE tore through NLRB IT system security news – An NLRB tech staffer alleges DOGE operatives were granted unauthorized superuser access, leading to data exfiltration attempts and a Russian IP login. Democratic lawmakers call for an investigation into potential misconduct. https://www.theregister.com/2025/04/17/whistleblower_nlrb_doge/

🔒 Apple released emergency updates for actively exploited flaws vulnerability – Apple has issued urgent updates for iOS, iPadOS, and macOS to fix two vulnerabilities, CVE-2025-31200 and CVE-2025-31201, which have been exploited in sophisticated attacks against targeted individuals. https://securityaffairs.com/176644/security/apple-emergency-updates-actively-exploited-ios-ipados-macos-bugs.html

✍️ Florida draft law mandating encryption backdoors for social media accounts billed 'dangerous and dumb' privacy – A Florida draft bill requiring social media platforms to provide encryption backdoors for law enforcement has passed a committee vote. Critics argue it undermines user security and compromises private communications. https://techcrunch.com/2025/04/17/florida-draft-law-mandating-encryption-backdoors-for-social-media-accounts-billed-dangerous-and-dumb/

💳 New payment-card scam involves a phone call, some malware and a personal tap cybercrime – A new scam targets Android users, using social engineering and NFC-enabled malware called SuperCard X to steal payment card information by tricking victims into sharing details and bringing cards near infected devices. https://therecord.media/new-payment-card-scam-involves-malware-tap

Some More, For the Curious

🐎 How I Got Hacked: A Warning about Malicious PoCs hacking write-up – After running a seemingly legitimate PoC exploit, the author unwittingly installed malware that stole sensitive data. A cautionary tale highlighting the risks of unverified code. https://chocapikk.com/posts/2025/s1nk/

🦸‍♂️ PowerShell for Hackers: Exploitation Essentials hacking write-up – PowerShell is a powerful tool for attackers, blending in with normal operations and allowing stealthy post-exploitation activities. Defenders must enhance their security measures against its misuse. https://hetmehta.com/posts/powershell-for-hackers/

🔍 iDRAC to Domain Admin security research – A penetration tester shares a method for escalating privileges to domain admin via iDRAC, highlighting vulnerabilities like default credentials and IPMI hash disclosure. https://infosecwriteups.com/idrac-to-domain-admin-4acb89391070

🔧 p0dalirius/FindUnusualSessions: A tool to remotely detect unusual sessions opened on windows machines using RPC cyber defense – FindUnusualSessions is a Python tool that detects unusual remote sessions on Windows machines using RPC, offering various authentication methods and output formats for analysis. Comment: TOOL https://github.com/p0dalirius/FindUnusualSessions

⏰ Analysis of Threat Actor Activity warning – Fortinet reports a threat actor exploiting known vulnerabilities to maintain read-only access to FortiGate devices. They have implemented mitigations and urged customers to update their systems promptly. https://www.fortinet.com/blog/psirt-blogs/analysis-of-threat-actor-activity

🔍 Chinese espionage group leans on open-source tools to mask intrusions security research – The Chinese hacking group UNC5174 is using open-source tools like VShell and WebSockets to blend in with cybercriminal activity while targeting Western entities, indicating a shift in their tactics. https://cyberscoop.com/chinese-espionage-group-unc5174-open-source-tools/

⚔️ China accuses NSA of launching cyberattacks on Asian Winter Games security news – China has accused three alleged NSA employees of conducting cyberattacks during the Asian Winter Games, claiming they targeted critical infrastructure and event management systems. https://therecord.media/china-accuses-nsa-hack-asian-winter-games

🧟 LLMs Create a New Supply Chain Threat: Code Package Hallucinations vulnerability – Code-generating LLMs can create non-existent package references, leading to security risks as attackers exploit these 'hallucinations' to distribute malicious code. Researchers emphasize the need for detection and mitigation strategies. https://thecyberexpress.com/genai-llm-code-package-hallucinations/

🏢 The Sophos Annual Threat Report: Cybercrime on Main Street 2025 cyber defense – The report highlights the continued threat of ransomware to small and midsized businesses, noting a rise in attacks, evolving tactics, and the importance of securing network edge devices and adopting defense-in-depth strategies. https://news.sophos.com/en-us/2025/04/16/the-sophos-annual-threat-report-cybercrime-on-main-street-2025/

🤯 Researchers claim breakthrough in fight against AI’s frustrating security hole security research – Google DeepMind introduces CaMeL, a new method to combat prompt injection attacks in AI by treating language models as untrusted components and applying established security principles to ensure safe data handling. https://arstechnica.com/information-technology/2025/04/researchers-claim-breakthrough-in-fight-against-ais-frustrating-security-hole/

🛡️ Former CISA director Chris Krebs vows to fight back against Trump-ordered federal investigation security news – Chris Krebs, former CISA director, plans to resign from SentinelOne to contest a federal investigation ordered by Trump, which accuses him of falsely denying election fraud and stripped him of his security clearance. https://techcrunch.com/2025/04/16/former-cisa-director-chris-krebs-vows-to-fight-back-against-trump-ordered-federal-investigation/

⚠️ ‘Stupid and Dangerous’: CISA Funding Chaos Threatens Essential Cybersecurity Program security news – CISA renewed funding for the CVE Program amid concerns over its sustainability, as it plays a critical role in tracking software vulnerabilities. Future independence from government funding is uncertain. https://www.wired.com/story/cve-program-cisa-funding-chaos/

📠 Age Verification Using Facial Scans privacy – Discord is testing facial scansprivacy for age verification, claiming no biometric data is stored. https://www.schneier.com/blog/archives/2025/04/age-verification-using-facial-scans.html

CISA Corner

🔑 CISA Releases Guidance on Credential Risks Associated with Potential Legacy Oracle Cloud Compromise warning – CISA warns of potential unauthorized access to a legacy Oracle cloud environment, highlighting risks related to exposed credentials that could lead to unauthorized access across systems and long-term security threats. https://www.cisa.gov/news-events/alerts/2025/04/16/cisa-releases-guidance-credential-risks-associated-potential-legacy-oracle-cloud-compromise

⚙️ CISA Releases Nine Industrial Control Systems Advisories vulnerability – CISA has issued nine advisories detailing vulnerabilities and security issues for various Industrial Control Systems, urging users to review the advisories for mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/04/15/cisa-releases-nine-industrial-control-systems-advisories ⚙️ CISA Releases Six Industrial Control Systems Advisories vulnerability – CISA has issued six advisories detailing vulnerabilities in various Industrial Control Systems, urging users to review them for important security information and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/04/17/cisa-releases-six-industrial-control-systems-advisories

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2021-20035, a SonicWall SMA100 Appliances OS command injection vulnerability, to its Known Exploited Vulnerabilities Catalog, highlighting its active exploitation and risk to federal networks. https://www.cisa.gov/news-events/alerts/2025/04/16/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds Three Known Exploited Vulnerabilities to Catalog warning – CISA has added three vulnerabilities, including two Apple memory corruption issues and a Microsoft NTLM hash disclosure vulnerability, to its Known Exploited Vulnerabilities Catalog due to active exploitation concerns. https://www.cisa.gov/news-events/alerts/2025/04/17/cisa-adds-three-known-exploited-vulnerabilities-catalog

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 15/2025

April 13, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

Highlight

🔍 Regierung will Messenger-Überwachung vor dem Sommer beschließen privacy – Die österreichische Regierung plant, die Überwachung von Messenger-Diensten zur Bekämpfung von Terrorismus einzuführen, trotz Bedenken über mögliche Massenüberwachung und verfassungsrechtliche Fragen. https://futurezone.at/netzpolitik/messenger-ueberwachung-whatsapp-oesterreich-regierung-chat-staatstrojaner-oevp-spoe-neos-pegasus/403030634

News For All

🎨 Social Media Flooded with Ghibli AI Images—But What Are We Really Feeding the Algorithms? privacy – The viral trend of AI-generated Ghibli-style portraits raises privacy concerns as users unknowingly share sensitive facial data, potentially fueling identity theft and misuse of personal information. https://thecyberexpress.com/social-media-flooded-with-ghibli-ai-images/

🙈 UK's demand for Apple backdoor should not be heard in secret, says court privacy – The UK government lost its attempt to keep secret a surveillance order against Apple, allowing parts of the case to be public despite national security concerns over accessing encrypted data. https://techcrunch.com/2025/04/07/uk-demand-for-apple-backdoor-should-not-be-heard-in-secret-says-court/

😶‍🌫️ Oracle tells customers its public cloud was compromised data breach – Oracle has admitted to a data breach of its public cloud, revealing the theft of client data, including security keys, after initially denying the incident amid claims of exploitation of unpatched vulnerabilities. https://www.theregister.com/2025/04/08/oracle_cloud_compromised/

🤖 Russian bots hard at work spreading political unrest on Romania's internet security news – An investigation reveals a surge in pro-Russian propaganda on Romanian social media, inciting anti-EU sentiment and support for Putin, with bots promoting divisive messages and false narratives. https://www.bitdefender.com/en-us/blog/hotforsecurity/russian-bots-hard-at-work-spreading-political-unrest-on-romanias-internet

🔒 Google fixed two actively exploited Android zero vulnerability – Google's April 2025 security update fixed 62 vulnerabilities, including two actively exploited zero-days affecting the Linux kernel and ALSA USB audio, highlighting ongoing security risks in Android. https://securityaffairs.com/176337/hacking/google-fixed-two-actively-exploited-android-zero-days.html

🔍 To tackle espionage, Dutch government plans to screen university students and researchers security news – The Dutch government plans to vet university students and researchers accessing sensitive technology to combat espionage, assessing backgrounds amid rising concerns over foreign threats, particularly from China. https://therecord.media/netherlands-plan-vetting-researchers-students-espionage

🔧 WhatsApp fixed a spoofing flaw that could enable Remote Code Execution vulnerability – WhatsApp patched CVE-2025-30401, a spoofing vulnerability in Windows versions before 2.2450.6, allowing attackers to execute remote code by sending files with misleading MIME types. https://securityaffairs.com/176357/security/whatsapp-fixed-a-spoofing-flaw-that-could-enable-remote-code-execution.html

🗼 Governments identify dozens of Android apps bundled with spyware malware – A coalition of governments has revealed that numerous legitimate-looking Android apps, identified as spyware families BadBazaar and Moonshine, were used to target civil society groups opposing Chinese state interests. https://techcrunch.com/2025/04/09/governments-identify-dozens-of-android-apps-bundled-with-spyware/

👁️‍🗨️ Spyware Maker NSO Group Is Paving a Path Back Into Trump’s America cybercrime – NSO Group is shifting lobbying strategies to regain access to US markets under a new administration, raising concerns about surveillance and human rights abuses. https://www.wired.com/story/nso-group-the-vogel-group-lobbying-trump-administration/

🛡️ Cyber experts offer lukewarm praise for voluntary code governing use of commercial hacking tools security news – Cybersecurity professionals gave mixed reviews to a new voluntary code for using commercial hacking tools, expressing cautious optimism while noting concerns over human rights and the absence of the U.S. as a signatory. https://cyberscoop.com/pall-mall-process-global-cybersecurity-code-conduct-commercial-hacking-tools/

🩻 Researcher uncovers dozens of sketchy Chrome extensions with 4 million installs malware – A researcher discovered 35 suspicious Chrome extensions, collectively installed on over 4 million devices, that exhibit spyware-like behavior, including excessive permissions and obfuscated code, raising concerns about their safety. https://arstechnica.com/security/2025/04/researcher-uncovers-dozens-of-sketchy-chrome-extensions-with-4-million-installs/

💔 Lab provider for Planned Parenthood discloses breach affecting 1.6 million people data breach – Laboratory Services Cooperative reported a data breach affecting 1.6 million individuals, revealing sensitive medical and personal information after a cyberattack discovered in October. Victims are offered credit monitoring services. https://therecord.media/lab-provider-planned-parenthood-breach

📨 That groan you hear is users’ reaction to Recall going back into Windows security news – Microsoft is reintroducing Recall, an AI tool in Windows 11 that screenshots and indexes user activity, prompting privacy concerns despite opt-in features. Critics warn it could expose sensitive information and be exploited by malicious actors. https://arstechnica.com/security/2025/04/microsoft-is-putting-privacy-endangering-recall-back-into-windows-11/

⚠️ Attackers are exploiting recently disclosed OttoKit WordPress plugin flaw vulnerability – Attackers are actively exploiting a critical vulnerability (CVE-2025-3102) in the OttoKit WordPress plugin, allowing unauthorized admin account creation on unconfigured sites. Immediate updates are advised to mitigate risks. https://securityaffairs.com/176461/security/ottokit-wordpress-plugin-flaw-exploitation.html

💻 Back in the Game: Privacy Concerns of Second-Hand Game Consoles security research – Game consoles have been able to store personally identifiable information for years; what is less well known is what remains when they are bought or sold on the second-hand market. We share the results of two case studies on Nintendo devices: the Switch and the 3DS. https://www.computer.org/csdl/magazine/sp/5555/01/10960377/25LWluDWP8A

Some More, For the Curious

🛞 The Renaissance of NTLM Relay Attacks: Everything You Need to Know hacking write-up – NTLM relay attacks, once thought outdated, are resurging as a serious threat, allowing attackers to easily compromise systems through lateral movement without needing to crack passwords. https://posts.specterops.io/the-renaissance-of-ntlm-relay-attacks-everything-you-need-to-know-abfc3677c34e

🎣 VibeScamming — From Prompt to Phish: Benchmarking Popular AI Agents’ Resistance to the Dark Side security research – A new benchmark reveals how generative AI can easily facilitate phishing scams, with different AI platforms showing varied levels of resistance to misuse, raising urgent security concerns. https://labs.guard.io/vibescamming-from-prompt-to-phish-benchmarking-popular-ai-agents-resistance-to-the-dark-side-1ec2fbdf0a35

🤔 The controversial case of the threat actor EncryptHub cybercrime – EncryptHub, a conflicted figure in cybersecurity, reported two Windows vulnerabilities while also engaging in cybercrime, highlighting the balance between ethical research and criminal activity. https://securityaffairs.com/176251/cyber-crime/the-controversial-case-of-the-threat-actor-encrypthub.html

🐈 APT group ToddyCat exploits a vulnerability in ESET for DLL proxying security research – The ToddyCat APT group exploited a vulnerability in ESET's Command Line Scanner to execute malware stealthily, utilizing DLL proxying and an old malicious tool modified for their purposes. https://securelist.com/toddycat-apt-exploits-vulnerability-in-eset-software-for-dll-proxying/116086/

🏔️ Someone hacked ransomware gang Everest’s leak site security news – The Everest ransomware gang's leak site was hacked and defaced with a message against crime, though it remains unclear if a data breach occurred. https://techcrunch.com/2025/04/07/someone-hacked-everest-ransomware-gang-dark-web-leak-site/

💻 Windows Remote Desktop Protocol: Remote to Rogue cyber defense – A phishing campaign attributed to UNC5837 exploited RDP by using signed .rdp files to access victim systems, allowing file exfiltration and clipboard capture, underscoring RDP's security risks. https://cloud.google.com/blog/topics/threat-intelligence/windows-rogue-remote-desktop-protocol/

🛡️ Server in der EU und eigene Schlüssel: Schützt das vor US-Zugriffen? privacy – Despite claims from US cloud providers about data security in EU data centers, physical server locations and encryption measures do not guarantee protection from US government access due to laws like the CLOUD Act. https://www.kuketz-blog.de/server-in-der-eu-und-eigene-schluessel-schuetzt-das-vor-us-zugriffen/

🔒 Zero Day Initiative — The April 2025 Security Update Review security news – In April 2025, Adobe and Microsoft released updates addressing multiple vulnerabilities, including critical flaws in Adobe products and 124 CVEs from Microsoft, with a focus on security risks and active exploits. https://www.thezdi.com/blog/2025/4/8/the-april-2025-security-update-review

👧 “The girl should be calling men.” Leak exposes Black Basta’s influence tactics. security research – A leak of 190,000 messages from the Black Basta ransomware group reveals their structured operations, including social engineering tactics, vulnerability exploitation, and negotiation strategies during ransom demands. https://arstechnica.com/security/2025/04/leaked-messages-expose-trade-secrets-of-prolific-black-basta-ransomware-group/

🔑 Critical Fortinet FortiSwitch flaw allows remote attackers to change admin passwords vulnerability – Fortinet has patched a critical vulnerability (CVE-2024-48887) in FortiSwitch devices, allowing remote attackers to change admin passwords. Users are advised to disable HTTP/HTTPS access as a temporary measure. https://securityaffairs.com/176380/security/fortinet-fortiswitch-flaw.html

🐛 How cyberattackers exploit domain controllers using ransomware cyber defense – Cyberattackers are increasingly targeting domain controllers in ransomware attacks, leveraging high-privilege accounts and centralized network access to inflict widespread damage, necessitating enhanced security measures. https://www.microsoft.com/en-us/security/blog/2025/04/09/how-cyberattackers-exploit-domain-controllers-using-ransomware/

🩼 Tainted drive appears to be source of malware attack on Western military mission in Ukraine security research – The Russia-backed group Gamaredon exploited an infected removable drive to deploy updated GammaSteel malware against a Ukraine-based military mission, showcasing increased sophistication in their cyberespionage tactics. https://therecord.media/gamaredon-removable-drive-malware-western-military-mission-ukraine

🖖 AI Vulnerability Finding security news – Microsoft's AI has identified multiple vulnerabilities in GRUB2 and U-Boot, which could potentially allow attackers to bypass security on devices using UEFI Secure Boot. https://www.schneier.com/blog/archives/2025/04/ai-vulnerability-finding.html

🧧 China Secretly (and Weirdly) Admits It Hacked US Infrastructure security news – In a rare admission, Chinese officials acknowledged hacking U.S. infrastructure during a secret meeting, attributing the attacks to U.S. policies on Taiwan. The disclosure adds tension amid ongoing cybersecurity concerns. https://www.wired.com/story/china-admits-hacking-us-infrastructure/

🚧 STRIDE GPT cyber defense – STRIDE GPT is an AI-driven threat modeling tool that generates threat models and attack trees based on the STRIDE methodology, allowing users to input application details and providing various features such as risk scoring and customizable reports. https://github.com/mrwadams/stride-gpt

CISA Corner

🗞️ Fortinet Releases Advisory on New Post-Exploitation Technique for Known Vulnerabilities security news – Fortinet issued an advisory regarding a threat actor exploiting vulnerabilities in FortiGate products to create a malicious file that grants read-only access to device files. Users are advised to upgrade their systems and reset credentials. https://www.cisa.gov/news-events/alerts/2025/04/11/fortinet-releases-advisory-new-post-exploitation-technique-known-vulnerabilities

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-31161, an authentication bypass vulnerability in CrushFTP, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation, emphasizing the risk to federal networks. https://www.cisa.gov/news-events/alerts/2025/04/07/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog warning – CISA has added two vulnerabilities to its Known Exploited Vulnerabilities Catalog: CVE-2025-30406 related to Gladinet CentreStack and CVE-2025-29824 affecting Microsoft Windows, highlighting risks to federal networks. https://www.cisa.gov/news-events/alerts/2025/04/08/cisa-adds-two-known-exploited-vulnerabilities-catalog ⚠️ CISA Adds Two Known Exploited Vulnerabilities to Catalog warning – CISA has included two Linux kernel vulnerabilities, CVE-2024-53197 and CVE-2024-53150, in its Known Exploited Vulnerabilities Catalog due to active exploitation, highlighting risks to federal networks. https://www.cisa.gov/news-events/alerts/2025/04/09/cisa-adds-two-known-exploited-vulnerabilities-catalog

⚙️ CISA Releases Ten Industrial Control Systems Advisories vulnerability – CISA issued ten advisories on April 10, 2025, addressing vulnerabilities in various Industrial Control Systems, including Siemens and Rockwell Automation products, urging users to review for mitigations. https://www.cisa.gov/news-events/alerts/2025/04/10/cisa-releases-ten-industrial-control-systems-advisories

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub

cyberlights – week 14/2025

April 6, 2025

A weekly shortlist of cyber security highlights. The short summaries are AI generated! If something is wrong, please let me know!

News For All

🚗 Europcar GitLab breach exposes data of up to 200,000 customers data breach – A breach of Europcar's GitLab exposed source code and personal data of up to 200,000 customers, with no financial information compromised. The company is assessing the damage and notifying affected users. https://www.bleepingcomputer.com/news/security/europcar-gitlab-breach-exposes-data-of-up-to-200-000-customers/

📱 Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon security research – Phishing attacks are evolving with QR codes that disguise malicious URLs, using legitimate redirection techniques and human verification to enhance deception. This trend highlights the need for improved security awareness. https://unit42.paloaltonetworks.com/qr-code-phishing/

💸 £3 million fine for healthcare MSP with sloppy security after it was hit by ransomware attack security news – Advanced Computer Software Group was fined £3 million for inadequate security measures, leading to a ransomware attack that compromised personal data of over 79,000 individuals and disrupted NHS services. https://www.exponential-e.com/blog/3-million-fine-for-healthcare-msp-with-sloppy-security-after-it-was-hit-by-ransomware-attack

🛡️ Flirts: Was tun, wenn ich mit Nacktfotos erpresst werde? privacy – The Take It Down service helps individuals under 18 report and prevent the unwanted spread of intimate images on various platforms, ensuring their photos remain secure. https://www.watchlist-internet.at/news/online-flirts-was-tun-wenn-ich-mit-nacktfotos-erpresst-werde/

🚨 An AI Image Generator’s Exposed Database Reveals What People Really Used It For data breach – An exposed database from AI image generator GenNomis revealed over 95,000 explicit images, including AI-generated child sexual abuse material. This incident underscores the urgent need for better controls and regulations on AI-generated content. https://www.wired.com/story/genomis-ai-image-database-exposed/

📩 The Weaponization of PDFs: 68% of Cyber attacks begin in your inbox, with 22% of these hiding in PDFs cybercrime – PDFs are increasingly used in cyber attacks, with 22% of malicious email attachments hiding threats. Their complexity allows attackers to bypass security measures, making them a significant risk. https://blog.checkpoint.com/research/the-weaponization-of-pdfs-68-of-cyberattacks-begin-in-your-inbox-with-22-of-these-hiding-in-pdfs/

🧬 Open Source Genetic Database Shuts Down to Protect Users From 'Authoritarian Governments' security news – OpenSNP founder Bastian Greshake Tzovaras has shut down the genetic database due to concerns over its potential misuse by authoritarian governments, prioritizing user safety over scientific data preservation. https://www.404media.co/open-source-genetic-database-opensnp-shuts-down-to-protect-users-from-authoritarian-governments/

🐨 The North Korea worker problem is bigger than you think cybercrime – North Korean nationals have infiltrated global businesses, gaining high-level access and performing roles beyond IT. Their presence raises significant security concerns as they could exploit their positions for espionage or sabotage. https://cyberscoop.com/north-korea-technical-workers-full-time-jobs/

🔥 Oracle under fire for its handling of separate security incidents security news – Oracle faces backlash for its management of two data breaches, one involving patient data at Oracle Health and another regarding alleged Oracle Cloud server breaches, as transparency remains lacking. https://techcrunch.com/2025/03/31/oracle-under-fire-for-its-handling-of-separate-security-incidents/

⚖️ France’s antitrust authority fines Apple €150M for issues related to its App Tracking Transparency security news – France fines Apple €150M for abusing its market dominance in App Tracking Transparency practices, found to disadvantage third-party apps and distort competition, despite the framework's intended privacy goals. https://securityaffairs.com/176092/laws-and-regulations/frances-antitrust-authority-fines-apple-e150m.html

🔍 Cybersecurity Professor Mysteriously Disappears as FBI Raids His Homes security news – Professor Xiaofeng Wang, a prominent cybersecurity expert, has gone missing following FBI raids on his homes. Indiana University has erased his and his wife's profiles amid an unexplained investigation. https://www.wired.com/story/cybersecurity-professor-mysteriously-disappears-as-fbi-raids-his-homes/

🔐 European Commission takes aim at end-to-end encryption and proposes Europol become an EU FBI security news – The European Commission unveiled its ProtectEU strategy, aiming to enhance internal security and establish Europol as a robust police agency, while seeking lawful access to encrypted data amidst ongoing security challenges. https://therecord.media/european-commission-takes-aim-encryption-europol-fbi-proposal

🪱 Apple issues fixes for vulnerabilities in both old and new OS versions vulnerability – Apple released security updates addressing 62 vulnerabilities in iOS and iPadOS, 131 in macOS, and two zero-day vulnerabilities in older OS versions, including risks to sensitive data and unauthorized actions. https://cyberscoop.com/apple-security-update-march-2025/

📧 Trump adviser reportedly used personal Gmail for ‘sensitive’ military discussions security news – A Washington Post report raises concerns about US National Security Advisor Michael Waltz using personal Gmail for sensitive military discussions, following a recent Signal leak. https://www.theverge.com/news/641144/michael-waltz-gmail-national-security-signal

🚨 T-Mobile Shows Users the Names, Pictures, and Exact Locations of Random Children privacy – T-Mobile's SyncUP GPS tracker malfunctioned, displaying the real-time locations of random children instead of users' own kids, raising serious privacy concerns among parents. https://www.404media.co/t-mobile-shows-users-the-names-pictures-and-exact-locations-of-random-children/

🚫 CSAM platform Kidflix shut down by international operation cybercrime – A major international operation led to the shutdown of the CSAM platform Kidflix, resulting in 79 arrests and the protection of 39 children, with authorities seizing 72,000 illegal videos. https://therecord.media/csam-platform-kidflix-shut-down-europol

⚠️ AI bots strain Wikimedia as bandwidth surges 50% security news – Wikimedia Foundation reports a 50% increase in bandwidth usage due to AI bots scraping data for training models, straining resources and impacting service for human users. The organization calls for responsible use of infrastructure and better coordination with AI developers. https://arstechnica.com/information-technology/2025/04/ai-bots-strain-wikimedia-as-bandwidth-surges-50/

📱 New Triada Trojan comes preinstalled on Android devices malware – A new variant of the Triada trojan has been found preinstalled on counterfeit Android devices, enabling extensive data theft. Kaspersky reports over 2,600 infections in Russia, urging users to buy from authorized distributors. https://securityaffairs.com/176143/malware/new-triada-comes-preinstalled-on-android-devices.html

🦠 This sneaky Android spyware needs a password to uninstall. Here's how to remove it without one. security research – A stealthy Android spyware app blocks uninstallation with a password set by the installer. Users can remove it by rebooting into safe mode, which disables the app, allowing for its uninstallation. https://techcrunch.com/2025/04/03/this-sneaky-android-spyware-needs-a-password-to-uninstall-heres-how-to-remove-it-without-one/

🔐 Gmail unveils end-to-end encrypted messages. Only thing is: It’s not true E2EE. privacy – Google's new 'end-to-end encryption' for Gmail is criticized as not being true E2EE, as keys are managed by organizations, allowing potential access to messages. The feature simplifies compliance for businesses but may not ensure privacy for individual users. https://arstechnica.com/security/2025/04/are-new-google-e2ee-emails-really-end-to-end-encrypted-kinda-but-not-really/

💰 Threat actors leverage tax season to deploy tax-themed phishing campaigns warning – As Tax Day approaches, Microsoft warns of phishing campaigns using tax themes to steal credentials and deploy malware, leveraging tactics like URL shorteners and QR codes. Various malware, including BRc4 and Latrodectus, are being used to exploit users during this period. https://www.microsoft.com/en-us/security/blog/2025/04/03/threat-actors-leverage-tax-season-to-deploy-tax-themed-phishing-campaigns/

📱 White House reportedly blames auto-suggested iPhone contact for Signal scandal security news – An internal investigation revealed that National Security Adviser Mike Waltz accidentally added Atlantic editor Jeffrey Goldberg to a Signal group chat due to an iPhone auto-suggestion. https://techcrunch.com/2025/04/06/white-house-reportedly-blames-auto-suggested-iphone-contact-for-signal-scandal/

🖨️ Canon CVE-2025-1268 Vulnerability: A Buffer Overflow Threatening Printer Security vulnerability – Canon has issued a security update for CVE-2025-1268, a critical buffer overflow vulnerability in certain printer drivers that could allow unauthorized code execution. Users are advised to update their drivers to mitigate risks. https://thecyberexpress.com/canon-printer-vulnerability-cve-2025-1268/

Some More, For the Curious

🦊 PhaaS actor uses DoH and DNS MX to dynamically distribute phishing cybercrime – A phishing-as-a-service platform named Morphing Meerkat uses DNS techniques to create targeted phishing campaigns, dynamically serving fake login pages for over 100 brands, enhancing the threat landscape. https://blogs.infoblox.com/threat-intelligence/a-phishing-tale-of-doh-and-dns-mx-abuse/

📈 Heightened In-The-Wild Activity On Key Technologies Observed On March 28 security research – A significant increase in attacks targeting technologies like SonicWall and Zoho suggests threat actors are actively probing for vulnerabilities. Security teams must enhance monitoring and patch systems promptly. https://www.greynoise.io/blog/heightened-in-the-wild-activity-key-technologies

🦮 New guidance on securing HTTP-based APIs cyber defense – With increasing API use, security breaches are rising. New guidance addresses vulnerabilities like poor authentication and insufficient monitoring to help organizations protect their systems and customer data. https://www.ncsc.gov.uk/blog-post/new-guidance-on-securing-http-based-apis

🧑‍🏫 Mark of the Web (MoTW) Bypass Vulnerability security research – Recent vulnerabilities in the Mark of the Web (MoTW) feature allow attackers to bypass security warnings and execute malware without detection, highlighting the need for updated security measures. https://asec.ahnlab.com/en/87091/

🚨 CrushFTP CVE-2025-2825 flaw actively exploited in the wild vulnerability – A critical authentication bypass vulnerability, CVE-2025-2825, in CrushFTP is being actively exploited, allowing unauthenticated access to vulnerable devices. Users are urged to patch immediately or implement temporary security measures. https://securityaffairs.com/176097/hacking/crushftp-cve-2025-2825-flaw-actively-exploited.html

🏔️ Spike in Palo Alto Networks scanner activity suggests imminent cyber threats warning – Researchers at GreyNoise report a surge in scanning activity targeting Palo Alto Networks GlobalProtect portals, with over 24,000 unique IPs probing for vulnerabilities, indicating potential preparations for targeted attacks. https://securityaffairs.com/176108/hacking/spike-in-palo-alto-networks-scanner-activity-suggests-imminent-cyber-threats.html

🏫 Getting Started with AI Hacking: Part 1 security research – Brian Fehrman from BHIS introduces AI hacking, focusing on classifier models and adversarial examples. The post covers image classification hacking, malware classifiers, model extraction, and data poisoning attacks, highlighting vulnerabilities in AI systems. https://www.blackhillsinfosec.com/getting-started-with-ai-hacking-part-1/

🌏 Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457) security research – Ivanti disclosed a critical buffer overflow vulnerability (CVE-2025-22457) in Ivanti Connect Secure VPN appliances, with evidence of active exploitation by suspected China-nexus actor UNC5221, leading to the deployment of various malware families. https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability/

⚠️ NSA warns “fast flux” threatens national security. What is fast flux anyway? security news – The NSA warns that 'fast flux' techniques, used by cybercriminals and nation-state actors, complicate detection of malicious operations by rapidly changing IP addresses and DNS records, posing significant threats to national security. https://arstechnica.com/security/2025/04/nsa-warns-that-overlooked-botnet-technique-threatens-national-security/

🪪 Expert used ChatGPT-4o to create a replica of his passport in just 5 minutes bypassing KYC security research – A Polish researcher used ChatGPT-4o to generate a realistic replica of his passport in five minutes, exposing vulnerabilities in KYC systems that rely on photo verification. The incident raises concerns about identity theft and calls for stronger digital verification methods. https://securityaffairs.com/176224/security/chatgpt-4o-to-create-a-replica-of-his-passport-in-just-five-minutes.html

🤫 39M secrets exposed: GitHub rolls out new security tools security news – GitHub revealed that 39 million secrets were leaked in 2024, prompting the launch of new security tools, including standalone Secret Protection and enhanced scanning features to help developers secure sensitive data. https://securityaffairs.com/176170/security/39m-secrets-exposed-github-rolls-out-new-security-tools.html

CISA Corner

⚙️ CISA Releases Two Industrial Control Systems Advisories vulnerability – CISA issued two advisories on April 1, 2025, addressing security vulnerabilities in Rockwell Automation and Hitachi Energy ICS. Users are urged to review the advisories for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/04/01/cisa-releases-two-industrial-control-systems-advisories ⚙️ CISA Releases Five Industrial Control Systems Advisories vulnerability – On April 3, 2025, CISA released five advisories addressing security vulnerabilities in various Industrial Control Systems, urging users to review the advisories for technical details and mitigation strategies. https://www.cisa.gov/news-events/alerts/2025/04/03/cisa-releases-five-industrial-control-systems-advisories

⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has included CVE-2024-20439, a vulnerability in Cisco's Smart Licensing Utility, in its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation, emphasizing the need for federal agencies to address it. https://www.cisa.gov/news-events/alerts/2025/03/31/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ CISA Adds One Known Exploited Vulnerability to Catalog warning – CISA has added CVE-2025-24813, a vulnerability in Apache Tomcat, to its Known Exploited Vulnerabilities Catalog due to evidence of active exploitation, highlighting risks to federal networks. https://www.cisa.gov/news-events/alerts/2025/04/01/cisa-adds-one-known-exploited-vulnerability-catalog ⚠️ Ivanti Releases Security Updates for Connect Secure, Policy Secure & ZTA Gateways Vulnerability (CVE-2025-22457) vulnerability – Ivanti has released security updates for CVE-2025-22457, a vulnerability that could allow cyber attackers to take control of affected systems. CISA has added this vulnerability to its Known Exploited Vulnerabilities Catalog and urges users to patch their systems and conduct threat hunting actions. https://www.cisa.gov/news-events/alerts/2025/04/04/ivanti-releases-security-updates-connect-secure-policy-secure-zta-gateways-vulnerability-cve-2025

(by @wrzlbrmpft@infosec.exchange) Obviously, the opinions inside these articles are not my own. No guarantee for correct- or completeness in any way.

theme: https://write.as/themes/fosstodon-hub