Security. In focus.

Gamaredon X Turla collab www.welivesecurity.com/en/eset-r…

In this blogpost, we uncover the first known cases of collaboration between Gamaredon and Turla, in Ukraine.

Key points of this blogpost: In February 2025, we discovered that the Gamaredon tool PteroGraphin was used to restart Turla’s Kazuar backdoor on a machine in Ukraine. In April and June 2025, we detected that Kazuar v2 was deployed using Gamaredon tools PteroOdd and PteroPaste. These discoveries lead us to believe with high confidence that Gamaredon is collaborating with Turla. Turla’s victim count is very low compared to the number of Gamaredon compromises, suggesting that Turla choose the most valuable machines. Both groups are affiliated with the FSB, Russia’s main domestic intelligence and security agency.

Also therecord.media/russian-s…

Plastic People, Plastic Cards: Synthetic Identities Plague Finance & Lending Sector www.darkreading.com/cybersecu…

“As more banking, payments, and credit processes move online, fraudsters have shifted towards more sophisticated, longer-play schemes,” [says Jackie Wylie, spokeswoman for Middesk, a business identity platform]. “Synthetic business identity fraud often means combining real or fabricated business details to form a business entity that doesn’t exist or is controlled by fraudsters … [or] ‘piggybacking’ on real but dormant companies.”

Fraudsters are also gaining experience in how to extract the most value from the synthetic identities. Now, a common tactic involves fraudsters “nurturing” their synthetic accounts by making legitimate payments for a period of time to build a positive credit history, says TransUnion’s Daughdrill.

Researchers Uncover GPT-4-Powered MalTerminal Malware Creating Ransomware, Reverse Shell thehackernews.com/2025/09/r…

“MalTerminal contained an OpenAI chat completions API endpoint that was deprecated in early November 2023, suggesting that the sample was written before that date and likely making MalTerminal the earliest finding of an LLM-enabled malware,” researchers Alex Delamotte, Vitaly Kamluk, and Gabriel Bernadett-shapiro said.

Large-Scale Attack Targeting Macs via GitHub Pages Impersonating Companies to Attempt to Deliver Stealer Malware blog.lastpass.com/posts/att…

The LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team is tracking an ongoing, widespread infostealer campaign targeting Mac users through fraudulent GitHub repositories designed to trick potential victims into installing what is presented as various companies’ software for MacOS. In the case of LastPass, the fraudulent repositories redirected potential victims to a repository that downloads the Atomic infostealer malware. The threat actors are using Search Engine Optimization (SEO) to deliver links to their malicious sites at the top of search pages, including Bing and Google. This campaign appears to be targeting a range of companies, including tech companies, financial institutions, password managers, and more.

The GoLaxy papers: Inside China’s AI persona army therecord.media/golaxy-ch…

For years, Chinese information operations had been relatively clumsy. During the 2019 protests in Hong Kong, state-backed accounts on Twitter and Facebook pushed official slogans and clunky memes. They were easy to spot, often recycling stock photos and repeating identical lines. American officials dismissed them as amateurish compared to Russia’s Internet Research Agency, which had seeded more sophisticated narratives during the 2016 election.

What the GoLaxy documents suggest is that Beijing has leapt from imitation to innovation — replacing mass-produced slogans with AI-tailored whispers, aimed at the weak spots of individual minds.

“These are fake but highly realistic AI-generated bots,” Benson explained. “It’s a made-up online profile that looks like a real person, interacts like a real person. Much more subtle than the Russian operations we saw in the 2016 election. They’re very, very tailored.”

For years, U.S. officials puzzled over China’s massive data heists — from the breach of the Office of Personnel Management in 2015 to the hack of Starwood hotels three years later. The explanation was always the same: Beijing was hoovering up all this data for a rainy day.

Benson believes the day has come.

“That was the big revelation to me … the data mining efforts paired with AI have the capacity to engage in a front of cognitive warfare that I didn’t really think about before,” he said. “I think this is the new frontier in national security.”

Unmasking Akira: The ransomware tactics you can’t afford to ignore zensec.co.uk/blog/unma…

The ransomware group Akira has been ravaging UK businesses since at least 2023. This brief goes over what ZenSec (formerly Solace Cyber) have seen in the past two years. ZenSec have seen devastating impacts to UK businesses from the same group affecting the industries of retail, finance, manufacturing and medical organisations. ZenSec have encountered over 30 businesses impacted by Akira during digital forensics and incident response (DFIR) engagements.

European airports struggle to fix check-in glitch after cyberattack www.reuters.com/business/…

Some of Europe’s biggest airports battled to restore normal operations on Sunday after hackers disrupted automatic check-in systems, with Brussels asking airlines to cancel half of Monday’s flight departures due to persistent problems.

Hackers on Friday targeted check-in and boarding systems provider Collins Aerospace, owned by RTX (RTX.N), opens new tab, disrupting operations at London’s Heathrow - Europe’s busiest airport, Berlin Airport and in Brussels.

An analysis by aviation data provider Cirium, opens new tab said delays at Heathrow were “low”, Berlin had “moderate” delays, while Brussels had “significant” delays.

Regional regulators said they were investigating the source of the hacking

Cyber Threat Intelligence — 19 Sept. 2025

A concise, fact-checked roundup of material changes in the threat landscape affecting enterprise defenders over the past 24–48 hours.

CISA: Malware deployed after Ivanti EPMM zero-day exploits (CVE-2025-4427, CVE-2025-4428)

Incident date (ET): Primarily May 2025 Disclosure (ET): Sept. 18–19, 2025 Why it matters: Post-exploitation tradecraft and IOCs for Ivanti EPMM give blue teams concrete detection and hardening steps. Summary: CISA’s Malware Analysis Report details two malware sets observed after exploitation of Ivanti EPMM CVE-2025-4427/-4428, with detection artefacts and guidance. Source: www.cisa.gov/news-even…

www.cisa.gov/news-even…

WatchGuard: Critical Firebox/Fireware OS RCE patched (CVE-2025-9242)

Incident date (ET): Not stated Disclosure (ET): Sept. 17 (vendor) / Sept. 18–19, 2025 (coverage) Why it matters: Unauthenticated RCE on edge appliances warrants accelerated patch cycles and compensating controls. Summary: Out-of-bounds write in IKEv2/iked enables RCE; fixes released; CVSS 9.3. Source: www.scworld.com/news/watc…

www.bleepingcomputer.com/news/secu…

www.watchguard.com/wgrd-psir…

Gamaredon & Turla collaboration targeting Ukraine (ESET)

Incident date (ET): Ongoing (activity traced to at least Feb. 2025) Disclosure (ET): Sept. 19, 2025 Why it matters: Coordinated Russian APT operations raise the bar for detection and attribution across NATO-aligned networks. Summary: Evidence of infrastructure interplay and Kazuar backdoor deployment indicates operational coordination between Gamaredon and Turla. Source: thehackernews.com/2025/09/r…

www.globenewswire.com/news-rele…

Novakon HMIs: Multiple unpatched vulnerabilities

Incident date (ET): Not stated Disclosure (ET): Sept. 19, 2025 Why it matters: Unpatched ICS HMI flaws increase operational risk where compensating controls are weak. Summary: RCE and information-exposure issues remain unpatched; users should apply network isolation, access control, and monitoring. Source: www.securityweek.com/unpatched…

Google Chrome: Exploited zero-day patched (CVE-2025-10585)

Incident date (ET): Exploitation prior to patch Disclosure (ET): Sept. 18, 2025 Why it matters: Widely deployed browser; rapid enterprise roll-out is required to reduce exposure. Summary: Type-confusion flaw in V8 confirmed exploited in the wild; addressed in an out-of-band update. Source: thehackernews.com/2025/09/g…

SilentSync RAT via malicious PyPI packages

Incident date (ET): Not stated Disclosure (ET): Sept. 18, 2025 Why it matters: Software-supply-chain abuse in popular registries continues to deliver initial access at scale. Summary: Two PyPI packages (“sisaws”, “secmeasure”) dropped SilentSync RAT enabling command execution, data theft, and screen capture on Windows. Source: thehackernews.com/2025/09/s…

www.zscaler.com/blogs/sec…

SonicWall: Password resets after firewall backup preferences exposed

Incident date (ET): Not stated Disclosure (ET): Sept. 18, 2025 Why it matters: Configuration artefact exposure can enable downstream compromise if credentials or tokens are reused. Summary: Breach exposed firewall configuration backup files in MySonicWall; resets urged. Trade press cites impact under five per cent of customers. Source: www.securityweek.com/sonicwall…

thehackernews.com/2025/09/s…

U.K. charges two teenagers over 2024 Transport for London cyberattack

Incident date (ET): Aug. 2024 Disclosure (ET): Sept. 18–19, 2025 Why it matters: Legal follow-through provides precedent and deterrence; attribution in media differs from official filings. Summary: Charges announced in relation to the 2024 TfL incident; reports note ~£39M financial impact and that core transport operations were not affected. Media mention links to “Scattered Spider”; official charging materials do not name a group. Source: www.theguardian.com/uk-news/2…

One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens dirkjanm.io/obtaining…

While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. This vulnerability could have allowed me to compromise every Entra ID tenant in the world (except probably those in national cloud deployments1). If you are an Entra ID admin reading this, yes that means complete access to your tenant. The vulnerability consisted of two components: undocumented impersonation tokens, called “Actor tokens”, that Microsoft uses in their backend for service-to-service (S2S) communication. Additionally, there was a critical flaw in the (legacy) Azure AD Graph API that failed to properly validate the originating tenant, allowing these tokens to be used for cross-tenant access.

Effectively this means that with a token I requested in my lab tenant I could authenticate as any user, including Global Admins, in any other tenant. Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants.

New attack on ChatGPT research agent pilfers secrets from Gmail inboxes arstechnica.com/informati…

The face-palm-worthy prompt injections against AI assistants continue. Today’s installment hits OpenAI’s Deep Research agent. Researchers recently devised an attack that plucked confidential information out of a user’s Gmail inbox and sent it to an attacker-controlled web server, with no interaction required on the part of the victim and no sign of exfiltration.

Deep Research is a ChatGPT-integrated AI agent that OpenAI introduced earlier this year. As its name is meant to convey, Deep Research performs complex, multi-step research on the Internet by tapping into a large array of resources, including a user’s email inbox, documents, and other resources. It can also autonomously browse websites and click on links.

A user can prompt the agent to search through the past month’s emails, cross-reference them with information found on the web, and use them to compile a detailed report on a given topic. OpenAI says that it “accomplishes in tens of minutes what would take a human many hours.”

CopyCop Deepens Its Playbook with New Websites and Targets www.recordedfuture.com/research/…

Since March 2025, Insikt Group has observed CopyCop (also known as Storm-1516), a Russian covert influence network, creating at least 200 new fictional media websites targeting the United States (US), France, and Canada, in addition to websites impersonating media brands and political parties and movements in France, Canada, and Armenia. CopyCop has also established a regionalized network of websites posing as a fictional fact-checking organization publishing content in Turkish, Ukrainian, and Swahili, languages never featured by the network before. Including the 94 websites targeting Germany reported by Insikt Group in February 2025, this amounts to over 300 websites established by CopyCop’s operators in the year to date, marking a significant expansion from our initial reporting on the network in 2024, and with many yet to be publicly documented.

These websites are very likely operated by John Mark Dougan with support from the Moscow-based Center for Geopolitical Expertise (CGE) and the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). CopyCop uses these websites as infrastructure to disseminate influence content targeting pro-Western leadership and publish artificial intelligence (AI)-generated content with pro-Russian and anti-Ukrainian themes in support of Russia’s offensive operations in the global information environment.

SystemBC – Bringing the Noise blog.lumen.com/systembc-…

The Black Lotus Labs team at Lumen Technologies has uncovered new infrastructure behind the “SystemBC” botnet, a network composed of over 80 C2s with a daily average of 1,500 victims, nearly 80% of which are compromised VPS systems from several large commercial providers. The victims are made into proxies that enable high volumes of malicious traffic for use by a host of criminal threat groups. By manipulating VPS systems instead of devices in residential IP space as is typical in malware-based proxy networks, SystemBC can offer proxies with massive amounts of volume for longer periods of time. Similar, high-bandwidth proxies in residential IP space would alert and disrupt users of smaller, lower bandwidth devices.

Black Lotus Labs has observed these proxies in use by multiple networks in the criminal ecosystem; including at least two different Russia-based proxy services, one Vietnamese proxy service, and a Russian parsing service. While selling the same bots on multiple platforms, the service generates very large amounts of traffic without regard to the attention it draws – nearly 100% of the bots are eventually listed on “block list” sites for mass scanning, exploitation, and brute forcing.

Update your Chrome today: Google patches 4 vulnerabilities including one zero-day www.malwarebytes.com/blog/news…

Google has released an update for its Chrome browser to patch four security vulnerabilities, including one zero-day. A zero-day vulnerability refers to a bug that has been found and exploited by cybercriminals before the vendor even knew about it (they have “zero days” to fix it).

This update is crucial since it addresses one vulnerability which is already being actively exploited and, reportedly, can be abused when the user visits a malicious website. It probably doesn’t require any further user interaction, which means the user doesn’t need to click on anything in order for their system to be compromised.

The Chrome update brings the version number to 140.0.7339.185/.186 for Windows, Mac and 140.0.7339.185 for Linux. The easiest way to update Chrome is to allow it to update automatically, but you can end up lagging behind if you never close your browser or if something goes wrong—such as an extension stopping you from updating the browser.

Russland und China nehmen deutsche Wirtschaft ins Visier | CSO Online

Russia and China Target German Economy • German companies are facing a rising number of cyberattacks, both digital and physical, with estimated damages totalling €289 billion. • 87% of surveyed companies reported at least one attack in the past twelve months, while another 10% suspect they were attacked. • 28% of companies suspect foreign intelligence agencies were involved, up from 20% the previous year and 7% in 2023. • China and Russia are cited by 46% of companies as the primary regions for espionage, sabotage, or data theft. • Artificial intelligence (AI) was used in half of the attacks, including the creation of fake damage reports. • Cyberattacks are becoming increasingly indistinguishable from other attacks as they can disrupt both digital and physical systems. • German companies are heavily reliant on IT services and products from non-EU countries, particularly China and the United States. • Digital sovereignty means companies can independently decide which technology partners they collaborate with. • Germany is not expected to become self-sufficient or largely sovereign in key technologies within the next ten years. • The Bitkom president urges companies and government agencies to also use German IT products to strengthen digital sovereignty.

Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine

Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine

• Two Russian hacking groups, Gamaredon and Turla, are collaborating to target Ukrainian entities, deploying the Kazuar backdoor.
• ESET observed Gamaredon’s tools PteroGraphin and PteroOdd being used to execute Turla’s Kazuar backdoor on a Ukrainian endpoint in February 2025.
• PteroGraphin was likely used by Turla as a recovery method to restart the Kazuar v3 backdoor.
• In separate instances in April and June 2025, ESET detected the deployment of Kazuar v2 through Gamaredon’s malware families PteroOdd and PteroPaste.
• Both Gamaredon and Turla are affiliated with the Russian Federal Security Service (FSB) and have a history of targeting Ukraine.
• Gamaredon has been active since at least 2013, primarily attacking Ukrainian governmental institutions.
• Turla, also known as Snake, has been active since at least 2004, focusing on high-profile targets like governments and diplomatic entities.
• Russia’s full-scale invasion of Ukraine in 2022 likely fueled the collaboration between Gamaredon and Turla, with recent attacks focusing on the Ukrainian defense sector.
• Kazuar is a frequently updated malware used by Turla, with versions dating back to 2016.
• Gamaredon’s tools, including PteroGraphin, PteroOdd, and PteroPaste, are used to deliver additional payloads and maintain persistence on targeted systems.

FileFix Campaign Uses Facebook Suspension as Bait

FileFix Campaign Uses Facebook Suspension as Bait

• A new FileFix social engineering campaign tricks users into loading malware by pretending to help them appeal a Facebook account suspension.
• The campaign is more sophisticated than typical ClickFix attacks, with the attacker demonstrating significant investment in tradecraft.
• Victims are lured through a phishing email that leads to a fake ‘Meta Help Support’ message warning of account suspension.
• The phishing site prompts users to open File Explorer to view a supposed PDF, but it’s actually a file upload window with a malicious payload in the file path.
• The attack executes a PowerShell script that downloads an image containing a steganographic payload, which is then parsed to extract and execute hidden code.
• The campaign uses a loader written in Go that performs sandbox checks, encrypts strings, and drops StealC, an infostealer capable of raiding various sensitive data.
• StealC is a top-advertised infostealer on darkweb forums, known for its rapid evolution and advanced features like multi-monitor screenshots and a unified file grabber.
• The campaign employs phishing lures in multiple languages and uses varying obfuscation methods to evade detection.
• Indicators of compromise suggest the campaign targets users in various countries, including the United States, Germany, China, and Bangladesh, indicating opportunistic targeting.
• The attack covers its tracks by running malicious executables through conhost.exe and deleting them afterward to avoid leaving traces.

KnowBe4 Report Reveals UK Retail Sector on High Alert for Cyber Scams - IT Security Guru

KnowBe4 Report Reveals UK Retail Sector on High Alert for Cyber Scams

• The UK retail sector is experiencing a significant increase in cyber threats, with 99.6% of surveyed IT security professionals reporting heightened risks.
• Helpdesk/IT support scams are a major concern, with 58% of respondents noting an increase in such attacks targeting frontline workers.
• Retailers are responding by increasing investment in cybersecurity, with 72% reporting greater executive attention and 58% increasing security budgets.
• Security awareness training is the top investment area, with 74% of retailers focusing on human-centric controls to mitigate risks.
• Third-party suppliers are identified as a significant security gap, with 46% of respondents citing them as their biggest vulnerability.
• While 91% of retailers have conducted audits and 96% have incident response plans, only 65% have tested these plans.
• Ransomware is a major concern, with 71% of retailers having a dedicated budget for potential ransom payments.
• Phishing, credential theft, and helpdesk scams are the most frequent and growing threats, highlighting the human dimension of cyber risk.
• The recent breach at Marks & Spencer, traced back to a phished third-party vendor, underscores the importance of securing supply chains.
• Effective cybersecurity requires more than just technical solutions; it necessitates cultural change, behavioral initiatives, and well-tested response plans.

Tiffany Data Breach Impacts Thousands of Customers - SecurityWeek

Tiffany Data Breach Impacts Thousands of Customers

• Tiffany and Company has notified customers in the U.S. and Canada that their personal information was stolen by hackers.
• The breach occurred on or around May 12, 2025, with hackers gaining unauthorized access to Tiffany’s systems.
• Stolen information includes names, email addresses, postal addresses, phone numbers, sales data, gift card numbers, and PINs.
• Over 2,500 individuals in Maine are confirmed to be impacted, with the number of affected Canadian customers unclear.
• Tiffany is owned by LVMH, a French luxury conglomerate that also owns brands like Louis Vuitton, Dior, and Givenchy.
• Several LVMH brands, including Louis Vuitton and Dior, were recently targeted by the cybercrime group Scattered Spider.
• It is unclear if the Tiffany breach is related to the Salesforce attacks or if it is a separate incident.
• Tiffany’s disclosure states that hackers accessed its own systems, with no mention of a third-party service.
• No ransomware group has claimed responsibility for the Tiffany breach by listing it on their leak website.
• SecurityWeek has reached out to Tiffany for further clarifications and will update the article if the company responds.

LinkedIn now uses your data for AI by default, opt out now! - Help Net Security

LinkedIn now uses your data for AI by default, opt out now! - Help Net Security

• LinkedIn is updating its User Agreement and Privacy Policy to allow the use of member data for AI model improvement by default, effective November 3, 2025.
• Users must manually opt out if they do not want their data used for AI training.
• The changes reflect LinkedIn’s increased reliance on AI-powered features to enhance content generation and user experience.
• LinkedIn will share more data with Microsoft for advertising services in some regions, with new opt-out options available.
• U.S. members can find updated details on targeted advertising in the U.S. State Regional Privacy Notice.
• EU, EEA, Switzerland, and UK members can review the European Regional Privacy Notice for details on data processing for AI training.
• LinkedIn has clarified its data-sharing practices with affiliates, including LinkedIn Ireland, LinkedIn Corp., Microsoft, and its subsidiaries.
• The updated User Agreement includes new terms on deepfakes, wrongful impersonations, and the use of secondary payment methods.
• LinkedIn may not provide advance notice of changes to terms in cases of legal changes or new product launches.
• Members can appeal decisions affecting their account or service access, with new information provided in the updated agreement.

Google Chrome security advisory (AV25-600) - Canadian Centre for Cyber Security

HPE security advisory (AV25-601) - Canadian Centre for Cyber Security

ChatGPT Targeted in Server-Side Data Theft Attack - SecurityWeek

ChatGPT Targeted in Server-Side Data Theft Attack

• Researchers at Radware discovered a server-side data theft attack method targeting ChatGPT’s Deep Research capability, dubbed ShadowLeak.
• ShadowLeak allowed attackers to silently collect and exfiltrate valuable data without user interaction by sending a specially crafted email.
• Unlike client-side attacks, ShadowLeak operated on the server side, making it harder to detect and trace.
• The attack involved hidden instructions in emails that triggered data exfiltration when the user interacted with ChatGPT.
• Data was exfiltrated through request parameters to an attacker-controlled URL, originating directly from OpenAI’s servers.
• The attack was cleverly designed to bypass security checks by convincing the AI that the exfiltrated data was public and the URL was safe.
• Deep Research can access various enterprise services, including Gmail, Google Drive, Dropbox, and Microsoft Teams, making it a broad target.
• OpenAI was notified of the vulnerability on June 18 and fixed it by early August, with Radware confirming the attack no longer works.
• Radware believes there is still a significant undiscovered threat surface for similar attacks.
• The security firm recommends continuous agent behavior monitoring to mitigate such attacks by ensuring alignment with user intent.

Study Finds 1.2 Million Medical Devices Exposed on Internet

Study Finds 1.2M Medical Devices Exposed on Internet

• Over 1.2 million medical devices are exposed on the internet due to security shortcomings.
• Default credentials and weak passwords are common security issues in these devices.
• Easy passwords are often used to streamline access for healthcare professionals.
• Security inadequacies make it easier for attackers to exploit these systems.
• Exposed devices include MRI scans, X-ray systems, optician systems, and dentist systems.
• Modat’s research initially examined about 70 products but plans to expand its study.
• More healthcare systems and devices are being exposed to the internet over time.
• Improperly secured medical devices expose various types of sensitive data.
• Exposed devices pose risks of data compromises and other security threats.
• Healthcare security and biomedical teams should take critical steps to prevent these exposures.

Incident: Google patches sixth Chrome zero-day of 2025 (CVE-2025-10585) exploited in the wild
Date of Incident (ET): Unknown
Date of Disclosure/Publication (ET): Sept. 18, 2025
Summary: Google released Chrome 140.0.7339.185/.186 for Windows and macOS (140.0.7339.185 for Linux) to fix CVE-2025-10585, a V8 type confusion zero-day under active exploitation; immediate enterprise updates are recommended.
Source: chromereleases.googleblog.com/2025/09/s…

Incident: WatchGuard patches critical Firebox RCE (CVE-2025-9242)
Date of Incident (ET): Unknown
Date of Disclosure/Publication (ET): Sept. 18, 2025
Summary: WatchGuard disclosed an out-of-bounds write in Fireware OS iked enabling unauthenticated remote code execution when IKEv2 VPN features are exposed; updates and mitigations are available via PSIRT advisory.
Source: www.bleepingcomputer.com/news/secu…

Incident: Medical Associates of Brevard breach impacts 246,711 individuals; BianLian claimed January attack
Date of Incident (ET): Jan. 16, 2025
Date of Disclosure/Publication (ET): Sept. 18, 2025
Summary: Florida provider reported to authorities that nearly 250,000 people were affected by a January intrusion attributed to BianLian, with potential exposure of personal and protected health information.
Source: www.securityweek.com/nearly-25…

Incident: Insight Partners confirms ransomware data breach; 12,000+ notified
Date of Incident (ET): Jan. 16, 2025
Date of Disclosure/Publication (ET): Sept. 18, 2025
Summary: Venture capital firm Insight Partners said a ransomware incident resulted in data theft affecting over 12,000 people; notification letters and regulator filings are underway.
Source: www.securityweek.com/insight-p…

Incident: SilentSync RAT delivered via malicious PyPI packages targeting developers
Date of Incident (ET): Aug. 4, 2025
Date of Disclosure/Publication (ET): Sept. 18, 2025
Summary: Zscaler reported two typosquatted PyPI packages that install the SilentSync remote access trojan on Windows systems, enabling data exfiltration and backdoor access; package tokens should be rotated.
Source: thehackernews.com/2025/09/s…

Incident: ShinyHunters claims theft of 1.5 billion Salesforce records using Drift OAuth tokens
Date of Incident (ET): Aug. 8–18, 2025
Date of Disclosure/Publication (ET): Sept. 17, 2025
Summary: ShinyHunters posted samples allegedly from hundreds of Salesforce instances after intrusions abusing OAuth tokens tied to Salesloft Drift; prior advisories linked activity to UNC6395.
Source: www.bleepingcomputer.com/news/secu…

Incident: SonicWall breach exposed firewall configuration backups; customer credential resets urged
Date of Incident (ET): Unknown
Date of Disclosure/Publication (ET): Sept. 17, 2025
Summary: SonicWall confirmed attackers accessed its MySonicWall cloud backup service for firewalls, exposing configuration files; customers are advised to reset passwords, rotate keys and tokens, and review device settings.
Source: www.bleepingcomputer.com/news/secu…

Incident: “Shai-Hulud” self-replicating worm compromises 180+ npm packages in active supply chain attack
Date of Incident (ET): Sept. 16, 2025
Date of Disclosure/Publication (ET): Sept. 16, 2025
Summary: Unit 42 and others detailed a worm that steals developer credentials and republishes tainted npm packages, briefly impacting packages from multiple maintainers; enterprises should audit dependencies and rotate tokens.
Source: krebsonsecurity.com/2025/09/s…

Incident: Microsoft and Cloudflare disrupt RaccoonO365 phishing-as-a-service; 338 domains seized
Date of Incident (ET): Sept. 16, 2025
Date of Disclosure/Publication (ET): Sept. 16, 2025
Summary: Microsoft’s Digital Crimes Unit, with Cloudflare and a U.S. court order, dismantled infrastructure for RaccoonO365 used to steal Microsoft 365 credentials at scale across 94 countries.
Source: blogs.microsoft.com/on-the-is…

Compiled and verified by Generative AI.

North Korean operation uses ChatGPT to forge military IDs as part of cyberattack therecord.media/north-kor…

North Korean hackers exploited OpenAI’s ChatGPT to generate deepfake military ID cards in a phishing campaign against South Korean defense-related institutions, researchers have found.

The July attack was attributed to the Kimsuky group, also known as APT43, which has been sanctioned by Washington and its allies for supporting Pyongyang’s foreign policy and sanctions-evasion efforts through intelligence-gathering operations.

According to South Korean cybersecurity firm Genians, the hackers used ChatGPT to create sample images of South Korean government and military employee ID cards. The images were embedded in phishing emails crafted to appear as if they came from a legitimate South Korean defense agency handling identification services for military officials.

The emails delivered a fake ID card alongside malware that enabled data theft and remote access to victims’ systems.