Security. In focus.

Exploits, Technical Details Released for CitrixBleed2 Vulnerability - SecurityWeek

Technical details and exploit code for the CitrixBleed2 vulnerability (CVE-2025-5777) have been released. The vulnerability, impacting Citrix NetScaler, allows memory leaks through HTTP requests and can be exploited to retrieve user session tokens. NetScaler users are advised to update to the latest version to address this and other critical vulnerabilities.

SAP Patches Critical Flaws That Could Allow Remote Code Execution, Full System Takeover - SecurityWeek

SAP released 31 security notes, including six critical vulnerabilities. The most critical, CVE-2025-30012, allows unauthenticated attackers to execute arbitrary OS commands with administrative privileges. SAP users are advised to update their deployments as soon as possible.

Employee arrested after Brazil’s central bank service provider hacked for US $140 million www.bitdefender.com/en-us/blo…

On 30 June 2025, C&M Software, a Brazilian company that provides a “bridge” helping the country’s central bank connect to local banks, revealed that it had been hacked.

800 Brazilian reals (approximately US $140 million) was stolen from the reserve accounts of six financial institutions as a result of the security breach.

In the wake of the attack, which made massive news headlines in Brazil, the country’s Banco Central suspended access to C&M Software’s platform for all local banks and institutions while it investigated what had gone wrong, and to contain the damage.

Then, on Friday 4 July, the news desk of São Paulo’s TV Globo reported that the city’s police had arrested an employee of C&M Software.

48-year-old IT worker João Roque, who worked on backend systems at C&M Software, is alleged to have assisted hackers by selling them login credentials for approximately US $2,700 - granting them unauthorised access to sensitive critical systems.

According to police, Roque created the mechanism for the hackers to divert funds. According to TV Globo Roque claims to have only communicated with the cybercriminals via cellphone, and did not known personally. He is said to have changed his mobile phone every 15 days in an attempt - clearly futile - to avoid being tracked.

In a police statement, Roque reportedly claimed that he had first been approached in March by cybercriminals as he was leaving a São Paulo bar. He claims that later he received instructions via WhatsApp, and received payments for his services via a motorcycle courier.

The money ultimately stolen by the hackers was from reserve accounts, used by financial institutions to exchange funds between themselves, rather than those belonging to customers - meaning that members of the public should not be directly impacted by the attack.

Further investigations into the attack are ongoing. Brazilian authorities have since frozen US $50 million linked to the incident, and C&M Software says that it is co-operating with the investigation and that it has now brought its platform back online.

Cyberattack deals blow to Russian firmware used to repurpose civilian drones for Ukraine war therecord.media/cyberatta…

Russian developers behind a custom firmware used to convert consumer drones for military use in Ukraine have reported a cyberattack on their infrastructure, disrupting the system that distributes the software.

According to a statement posted on the Telegram channel Russian Hackers – To the Front, unidentified hackers breached servers responsible for delivering the “1001” firmware, displayed false messages on operator terminals, and then disabled the system.

The developers said the firmware itself was not compromised, calling the risk of backdoors or malicious code “extremely low.” However, drone operators were advised to disconnect their terminals as a precaution.

The firmware, used to modify certain DJI drone models, is not available for public download and is distributed through a network of drone service centers equipped with pre-configured laptops, known as “terminals,” that receive updates from a remote server. Independent Russian cybersecurity expert Oleg Shakirov said on Telegram the attackers likely targeted this server.

“No one has claimed responsibility for the attack so far, but it’s clear the perpetrators knew exactly what they were doing — the target was highly specialized,” he said.

The developers claim around 200,000 drones had been updated with the 1001 firmware as of March. While not widely known, the software removes manufacturer-imposed flight limits, improves resistance to GPS spoofing, and enables the use of high-capacity batteries, all of which makes them more suitable for military missions.

The extent of the impact of the cyberattack remains unclear. Without functioning terminals, drones cannot be reflashed with the firmware, potentially limiting Russia’s ability to deploy modified drones on the battlefield, Shakirov said.

Russia’s St. Petersburg hit by major internet outage amid drone strike warnings therecord.media/russia-sa…

Residents of St. Petersburg, Russia, experienced a widespread mobile internet outage over the weekend — the latest in a series of shutdowns that may be linked to the Kremlin’s efforts to protect critical infrastructure from Ukrainian drone attacks.

The disruptions affected both consumers and businesses, with some cafes, shops and gas stations switching to cash transactions because they couldn’t process card or QR-code payments, according to media reports. Passengers at the city’s train station were told to purchase tickets onboard after service counters and terminals went offline, while carsharing vehicles reportedly stalled mid-drive after losing connectivity.

Telecom providers denied responsibility for the outage, and local authorities have not commented.

Chrome Store Features Extension Poisoned With Sophisticated Spyware www.darkreading.com/endpoint-…

Google has inadvertently been promoting sophisticated spyware that can hijack browser sessions with malicious redirects hidden in a legitimate Chrome extension. The extension, which offers a legitimate color picker, was poisoned with the malware via an update at the end of June.

The extension, called “Color Picker, Eyedropper — Geco colorpick,” has more than 100,000 downloads, a verified Google badge, and a featured placement in the Google Chrome Web Store. Its high status in the store is because it has been a legitimate extension for years — before it received the malicious update on June 27, Idan Dardikman from Koi Security tells Dark Reading.

Batavia' Windows spyware campaign targets dozens of Russian orgs www.bleepingcomputer.com/news/secu…

A previously undocumented spyware called ‘Batavia’ has been targeting large industrial enterprises in Russia in a phishing email campaign that uses contract-related lures.

The researchers believe the operation has been active since at least last year in July and is ongoing. Based on telemetry data, the phishing emails delivering Batavia have reached employees at several dozen Russian organizations have been targeted.

Since January 2025, the campaign has increased in intensity and peaked towards the end of February.

Free certificates for IP addresses: security problem or solution? www.malwarebytes.com/blog/news…

Let’s Encrypt has announced its issued its first certificate for an IP address. Why that’s significant deserves a little explanation.

You may have run into Let’s Encrypt certificates many times without realizing it. When you see a padlock icon in your browser’s address bar, it means the site is using a certificate to secure your connection. These certificates are “digital passports” that websites use to prove their identity and to encrypt the data sent between your browser and the website.

Traditionally, these certificates have only been issued for domain names (like malwarebytes.com). Now, Let’s Encrypt has started issuing certificates for IP addresses, which are the numerical labels (like 192.0.66.233) that computers use to find each other on the internet.

The advantages of providing certificates for IP addresses are clear. Since some browsers will refuse to open sites without a certificate, it provides a safer way to access your website if you don’t have a domain name at all. It also allows you to use your browser to remotely access home devices like network-attached storage (NAS) servers and Internet-of-things (IoT) devices.

But most home users are unlikely to access a site by using the IP address. Domain names are much easier to remember (most of them anyway) and Domain Name System (DNS) translates domain names to IP addresses for us without a lot of problems.

And while IP addresses can change, DNS will make sure that our browser can still find the domain we want to visit. This is one reason why Let’s Encrypt will only issue short-term certificates for IP addresses: The certificates will be valid for just six days, a move designed to minimize the risk window in the event of a key compromise and to encourage automated certificate renewal practices.

Hijacking Ollama’s Signed Installer for Code Execution | Imperva

A command injection vulnerability in Ollama’s signed installer allows attackers to execute malicious code. The vulnerability, coupled with a logic flaw in verifying the install location, enables attackers to bypass security measures and deliver payloads disguised as legitimate Ollama updates. Despite responsible disclosure efforts, the vulnerability remains unpatched in the latest version of Ollama.

CSIS issues espionage alert about suspect seeking sensitive information for Chinese intelligence - National | Globalnews.ca

The Canadian Security Intelligence Service (CSIS) has issued an espionage advisory to federal departments and universities warning about an individual suspected of attempting to obtain sensitive Canadian information on behalf of China’s intelligence services. The advisory, shared in recent weeks, instructs recipients to exercise extreme caution when dealing with this person and to report any suspicious encounters to security officials. This development underscores ongoing concerns about foreign interference, as CSIS identifies the People’s Republic of China as Canada’s top counter-intelligence threat, particularly targeting artificial intelligence, quantum computing, biotechnology, and aerospace technologies to advance Chinese industrial and military capabilities.​​​​​​​​​​​​​​​​

A Threat Actor Claimed McDonald’s Data Leak on the Dark Web - TechNadu

A threat actor claims to have leaked 300,000 McDonald’s login credentials, including email addresses and plaintext passwords, from multiple country-specific domains. The breach, if verified, could lead to credential stuffing, account takeover, and phishing campaigns. McDonald’s has yet to confirm the breach.

Brazil’s central bank service provider hacked, $140M stolen – DataBreaches.Net

C&M Software, a Brazilian bank software vendor, was hacked after an employee sold login credentials for $2,700. The hackers stole $140 million from six institutions connected to the central bank, converting some to cryptocurrency and laundering it through Latin American exchanges.

NightEagle APT Exploits Microsoft Exchange Flaw to Target China’s Military and Tech Sectors

A previously undocumented threat actor, NightEagle, has been targeting Microsoft Exchange servers in China’s government, defense, and technology sectors. The attacks, likely originating from North America, involve a zero-day exploit chain to gather intelligence from high-tech, chip semiconductor, quantum technology, artificial intelligence, and military entities.

Technical difficulties or cyber attack? Ingram Micro’s website goes down just in time for the holiday weekend • Graham Cluley

Article claims : Ingram Micro’s website has been down since Thursday morning, with the company citing technical difficulties. There is speculation that the outage could be due to a cyber attack, possibly ransomware, timed to coincide with the holiday weekend.

Critical Sudo bugs expose major Linux distros to local Root exploits

Two critical vulnerabilities in the Sudo command-line utility for Linux and Unix-like operating systems allow local users to escalate privileges to root. The vulnerabilities, CVE-2025-32462 and CVE-2025-32463, were discovered by the Stratascale Cyber Research Unit and have been patched in Sudo version 1.9.17p1.

Faster Not Bigger: New R1T2 LLM Combines DeepSeek Versions

TNG Technology Consulting released DeepSeek-TNG R1T2 Chimera, a new large language model combining three previous DeepSeek releases. The model, designed for enterprise use prioritizing reasoning and concise answers, aims to reduce costs and preserve reasoning skills. R1T2, built using the “assembly of experts” approach, achieves 90-92% of R1-0528’s performance on reasoning benchmarks while generating shorter responses, reducing inference time by 60%.

Louis Vuitton Korea suffers cyberattack as customer data leaked – DataBreaches.Net

Louis Vuitton Korea suffered a cyberattack on June 8, compromising customer data. The breach, discovered this week, is the third LVMH brand attack in recent months, following Dior and Tiffany.

Hacker leaks Telefónica data allegedly stolen in a new breach

A hacker is threatening to leak 106GB of data allegedly stolen from Telefónica in a breach the company denies. The hacker, part of the Hellcat Ransomware group, claims to have exfiltrated internal communications, purchase orders, logs, customer records, and employee data. While some of the leaked data appears to be from 2021, the hacker asserts the breach occurred in May 2023 and is leaking data as proof.

Europe’s EUVD could shake up the vulnerability database ecosystem www.reversinglabs.com/blog/euvd…

EUVD-vulnerabilitiesA new vulnerability database launched by the European Union could shake up an ecosystem long dominated by the United States. The centerpieces of that system have been the National Vulnerability Database (NVD), maintained by the U.S. National Institute of Standards and Technology (NIST), and the Common Vulnerabilities and Exposures (CVE) numbering system, maintained under cotract by U.S. corporation Mitre. Both the NVD and CVE have been plagued by problems in recent times, which has opened the door for the European offering.

Interpol identifies West Africa as potential new hotspot for cybercrime compounds therecord.media/interpol-…

West Africa could be developing into a hub for scam centers, Interpol says, and other regions also are showing an uptick in such activity, mirroring a cybercrime trend that began in Southeast Asia.

In a brief report posted this week, the international police agency says new scam centers have been identified recently in the Middle East and Central America as well as West Africa, echoing a U.N. warning from April.

Interpol did not report specific data about the trend in West Africa, but recent reports have cited crackdowns in Nigeria and elsewhere.

Pro-Russian hacktivism: Shifting alliances, new groups and risks intel471.com/blog/pro-…

This post will examine one of the top pro-Russian hacktivist groups, new ones that have entered the scene and the impact of these groups. This intelligence is drawn from Intel 471’s Cyber Geopolitical Intelligence, which monitors for geopolitical drivers of digital risk, and Adversary Intelligence, which tracks threat actors and groups using automated collection and on-the-ground human intelligence (HUMINT).

Big Tech’s Mixed Response to U.S. Treasury Sanctions krebsonsecurity.com/2025/07/b…

In May 2025, the U.S. government sanctioned a Chinese national for operating a cloud provider linked to the majority of virtual currency investment scam websites reported to the FBI. But a new report finds the accused continues to operate a slew of established accounts at American tech companies — including Facebook, Github, PayPal and Twitter/X.

Navigating Heightened Cyber Risks from Iranian Threats www.paloaltonetworks.com/blog/2025…

Palo Alto Networks Unit 42 diligently monitors and responds to campaigns orchestrated by sophisticated nation-state actors like Iran, China, Russia and North Korea. Iranian state-sponsored cyberattacks are frequently designed to achieve strategic political objectives, often employing destructive tactics and psychological operations. History shows Iran’s consistent targeting of critical infrastructure, including supply chains and sensitive industries worldwide, especially during periods of geopolitical friction.

APWG' Phishing Activity Trends Report Q1 2025 docs.apwg.org/reports/a…

Phishing Activity Trends Summary

• In the first quarter of 2024, APWG observed 1,003,924 phishing attacks, This was the largest number since late 2023. [pp. 3-4] • Criminals are sending millions of emails each day that containing QR codes. The QR codes lead consumers to phishing sites and malware. (pp.5-7) • Attacks against the online payment and financial (banking) sectors grew in 1Q 2025, together totaling 30.9 percent of all attacks [pp. 4-5] • The total number of wire transfer BEC attacks observed in Q1 2025 increased by 33 percent compared to the previous quarter. [pp. 8-10]

macOS NimDoor | DPRK Threat Actors Target Web3 and Crypto Platforms with Nim-Based Malware www.sentinelone.com/labs/maco…

In April 2025, Huntabil.IT observed a targeted attack on a Web3 startup, attributing the incident to a DPRK threat actor group. Several reports on social media at the time described similar incidents at other Web3 and Crypto organizations. Analysis revealed an attack chain consisting of an eclectic mix of scripts and binaries written in AppleScript, C++ and Nim. Although the early stages of the attack follow a familiar DPRK pattern using social engineering, lure scripts and fake updates, the use of Nim-compiled binaries on macOS is a more unusual choice. A report by Huntress in mid-June described a similar initial attack chain as observed by Huntabil.IT, albeit using different later stage payloads.