Interpol Targets Infostealers: 20,000 IPs Taken Down, 32 Arrested, 216,000 Victims Notified - SecurityWeek

Interpol, along with law enforcement agencies and cybersecurity firms, conducted Operation Secure to target infostealer malware in Asia. The operation resulted in the takedown of 20,000 IP addresses and domains, the seizure of servers and data, and the arrest of 32 suspects. Over 216,000 victims were notified.

Palo Alto Networks Patches Privilege Escalation Vulnerabilities - SecurityWeek

Palo Alto Networks released patches for seven vulnerabilities, including a high-severity code injection bug in GlobalProtect for macOS and a medium-severity command injection flaw in PAN-OS. The company also implemented recent Chrome fixes and addressed other vulnerabilities in various products.

Surge in Cyberattacks Targeting Journalists: Cloudflare - SecurityWeek

Cloudflare’s Project Galileo, which provides free cybersecurity protection to non-profit organizations, blocked 109 billion malicious requests targeting these organizations between May 2024 and April 2025. Journalists and news organizations faced the highest volume of attacks, with 97 billion requests blocked. The attacks included DDoS and web application firewall threats, with DDoS traffic accounting for most of the mitigated traffic.

‘EchoLeak’ AI Attack Enabled Theft of Sensitive Data via Microsoft 365 Copilot - SecurityWeek

A zero-click attack, dubbed EchoLeak, exploited a vulnerability in Microsoft 365 Copilot, enabling attackers to steal sensitive information. The attack, involving a specially crafted email, bypassed security mechanisms and triggered Copilot to exfiltrate data without user interaction. Microsoft has patched the vulnerability, CVE-2025-32711, and no customer action is required.

Hackers Target Job Recruiters Through Malicious Resumes

Russian-speaking hackers FIN6, also known as Skeleton Spider, are impersonating job seekers to phish recruiters and deploy malware through fake resumes. The malware, delivered through cloud-hosted infrastructure, evades traditional detection tools and enables credential theft, remote command execution, and potential ransomware delivery.

AI Is Your New Coworker. Does It Need a Badge?

The rise of agentic AI, capable of autonomous goal pursuit, demands updated identity and access governance models. Treating AI as a user with unique identities, least privilege, and contextual access control is crucial to prevent unintended actions and data breaches. Cybersecurity professionals must adapt their skills to manage AI identity, creating new career opportunities in machine identity governance.

Brute-force attacks target Apache Tomcat management panels www.bleepingcomputer.com/news/secu…

A coordinated campaign of brute-force attacks using hundreds of unique IP addresses targets Apache Tomcat Manager interfaces exposed online.

Tomcat is a popular open-source web server widely used by large enterprises and SaaS providers, while Tomcat Manager is a web-based administration tool that comes bundled with the Tomcat server and helps admins manage deployed web apps via a graphical interface.

Tomcat Manager is configured by default to only allow access from localhost (127.0.0.1), with no pre-configured credentials and remote access blocked. However, when exposed online, the web app can be targeted by attackers, as cybersecurity company GreyNoise observed recently.

Starting June 5th, GreyNoise analysts discovered two coordinated campaigns targeting Apache Tomcat Manager interfaces and trying to gain access to Tomcat services over the Internet.

The first used nearly 300 unique IP addresses, most tagged as malicious, which were attempting to log into exposed online, and the second employed 250 malicious IPs to target Tomcat Manager web apps in brute force attacks, where threat actors use automated tools to test thousands or even millions of possible credentials.

Operation Secure disrupts global infostealer malware operations www.bleepingcomputer.com/news/secu…

An international law enforcement action codenamed “Operation Secure” targeted infostealer malware infrastructure in a massive crackdown across 26 countries, resulting in 32 arrests, data seizures, and server takedowns.

Led by Interpol and conducted from January to April 2025, the operation focused on disrupting infostealer malware groups that steal financial and personal data through widespread infections.

The data stolen by infostealers commonly includes account credentials, browser cookies, and cryptocurrency wallet details. This data is then compiled into “logs” and sold on cybercrime markets or used in targeted attacks against high-value victims.

Microsoft slows Windows 11 24H2 Patch Tuesday due to a ‘compatibility issue’ www.theregister.com/2025/06/1…

Microsoft has set a new record with June’s security update for the time between release and an admission of borkage.

The patch Tuesday update arrived yesterday and contained a number of critical fixes. However, after trumpeting its arrival for Windows 11 24H2, Microsoft hastily followed up with a warning that: “We’ve identified a compatibility issue affecting a limited set of these devices” and, as such, the update was being throttled.

“If your device is affected, you’ll receive a revised update with all the June 2025 security improvements in the near term.”

On the Windows release health dashboard, Microsoft defined “near term” as being “by the end of the day.” It did not, however, say if the day in question was the one on its Redmond campus or the universally accepted UTC.

CISO who helped unmask Badbox warns: Version 3 is coming www.theregister.com/2025/06/1…

Badbox 2.0, the botnet that infected millions of smart TV boxes and connected devices before private security researchers and law enforcement partially disrupted its infrastructure, is readying for a third round of fraud and digital attacks, according to one of the threat hunters who uncovered the original scheme.

“We continue to try and shut them off wherever we can — that hasn’t stopped,” Human Security CISO Gavin Reid told The Register, referring to his team’s ongoing collaboration with the FBI, Google, and others to disrupt the botnet.

Found in the wild: 2 Secure Boot exploits. Microsoft is patching only 1 of them. arstechnica.com/security/…

Researchers have unearthed two publicly available exploits that completely evade protections offered by Secure Boot, the industry-wide mechanism for ensuring devices load only secure operating system images during the boot-up process. Microsoft is taking action to block one exploit and allowing the other one to remain a viable threat.

As part of Tuesday’s monthly security update routine, Microsoft patched CVE-2025-3052, a Secure Boot bypass vulnerability affecting more than 50 device makers. More than a dozen modules that allow devices from these manufacturers to run on Linux allow an attacker with physical access to turn off Secure Boot and, from there, go on to install malware that runs before the operating system loads. Such “evil maid” attacks are precisely the threat Secure Boot is designed to prevent. The vulnerability can also be exploited remotely to make infections stealthier and more powerful if an attacker has already gained administrative control of a machine.

The second publicly available Secure Boot exploit was discovered by researcher Zack Didcott. As he reported earlier this month, CVE-2025-47827 stems from IGEL, a Linux kernel module for handling their proprietary logical volume management. The initial shim, which loads GRUB and the vulnerable kernel, is signed by Microsoft.

Attackers with even brief physical access to a device can boot it up in IGEL and then modify the boot loader to install malware. Didcott said he reported the vulnerability to Microsoft and has received no indication the company has plans to revoke the signature. Microsoft didn’t respond to emails seeking confirmation and the reason for its decision.

Researchers at Eclypsium, a firm specializing in firmware security, said the module provides a near-universal means for bypassing Secure Boot protections.

“Because Microsoft’s 3rd Party UEFI CA is trusted by almost all PC-like devices, an unrevoked vulnerability in any of the components verified with that key… allows you to break Secure Boot to load an untrusted OS,” one of the researchers, Jesse Michael, wrote in an email. “Any system that trusts the Microsoft 3rd Party UEFI CA will load and run their version of the shim, which has been signed by that key. Their shim will then use its own embedded key to verify the IGEL-signed kernel+initramfs and malicious rootfs, which can be modified to chain-load another operating system such as Windows or a different version of Linux.”

Stealth Falcon APT Exploits Microsoft RCE Zero-Day in Mideast www.darkreading.com/vulnerabi…

Nation-state adversaries have been exploiting a zero-day security vulnerability in Microsoft’s Web Distributed Authoring and Versioning (WEBDAV), allowing one-click remote code execution (RCE) on target systems.

WEBDAV is a protocol that extends the functionality of HTTP, allowing users to interact with files on a Web server in a more collaborative and feature-rich way. According to Check Point Research (CPR), the important-rated bug (CVE-2025-33053, CVSS 8.8) is being used by the Stealth Falcon advanced persistent threat (APT) group to compromise high-profile defense entities in the Middle East. Hallmarks of the campaign are “deceptive URL files, WebDAV servers, and legitimate Windows tools to silently execute custom spyware, including a new [custom] implant: Horus Agent,” the researchers said, noting that Stealth Falcon’s advanced tradecraft also includes living off the land (LOLBins).

Fortunately, CVE-2025-33053 is one of 66 patched by Microsoft in its June Patch Tuesday release today. As Dustin Childs at Trend Micro’s Zero Day Initiative noted in a blog post covering the June update, the exploitation is concerning enough that the computing giant even addressed the flaw in end-of-life platforms.

Patch Tuesday, June 2025 Edition krebsonsecurity.com/2025/06/p…

The sole zero-day flaw this month is CVE-2025-33053, a remote code execution flaw in the Windows implementation of WebDAV — an HTTP extension that lets users remotely manage files and directories on a server. While WebDAV isn’t enabled by default in Windows, its presence in legacy or specialized systems still makes it a relevant target, said Seth Hoyt, senior security engineer at Automox.

Adam Barnett, lead software engineer at Rapid7, said Microsoft’s advisory for CVE-2025-33053 does not mention that the Windows implementation of WebDAV is listed as deprecated since November 2023, which in practical terms means that the WebClient service no longer starts by default.

Morning cyber summary

Incident: Microsoft confirms exploited zero-day vulnerability in WebDAV service Event Date: April 2025 Report Date: June 10, 2025, at 1 p.m. ET Summary: Microsoft disclosed an actively exploited remote code execution vulnerability (CVE-2025-33053) in WebDAV used by the APT group Stealth Falcon to attack a Turkish defence organization. Source: www.helpnetsecurity.com/2025/06/1…

Incident: Microsoft releases June 2025 Patch Tuesday addressing two zero-days Event Date: June 10, 2025 Report Date: June 10, 2025, at 1 p.m. ET Summary: Microsoft released security patches for 66 vulnerabilities, including an actively exploited WebDAV flaw and a publicly disclosed Windows SMB client remote code execution flaw (CVE-2025-33073). Source: www.crowdstrike.com/en-us/blo…

Incident: Ivanti discloses multiple high-severity vulnerabilities in Workspace Control Event Date: June 10, 2025 Report Date: June 10, 2025, at 11 a.m. ET Summary: Ivanti released security updates for three high-severity privilege escalation vulnerabilities (CVE-2025-5353, CVE-2025-22463, CVE-2025-22455) in its Workspace Control product due to hardcoded cryptographic keys. Source: www.cyber.gc.ca/en/alerts…

Incident: Advanced persistent threat group Rare Werewolf targets Russian enterprises Event Date: October 2024 to June 2025 Report Date: June 10, 2025, at 9:45 a.m. ET Summary: The advanced persistent threat group Rare Werewolf attacked hundreds of Russian industrial organizations to install cryptocurrency miners and establish remote access using legitimate third-party software tools. Source: thehackernews.com/2025/06/r…

Incident: Sensata Technologies discloses ransomware attack and data breach Event Date: May 25, 2025 Report Date: June 10, 2025, at 8:30 a.m. ET Summary: Industrial technology firm Sensata Technologies confirmed a ransomware attack resulted in a data breach exposing Social Security numbers, financial account details, and passport information for employees. Source: www.securityweek.com/sensitive…

Incident: Alabama dermatology practice discloses breach affecting 86,000 patients Event Date: March 5 to March 11, 2025 Report Date: June 9, 2025, at 4 p.m. ET Summary: Dermatologists of Birmingham began notifying 86,414 patients of a data breach involving medical and health insurance information, with the Qilin ransomware group claiming responsibility for the attack. Source: www.hipaajournal.com/data-brea…

Adobe Releases Patch Fixing 254 Vulnerabilities, Closing High-Severity Security Gaps

Adobe released security updates addressing 254 vulnerabilities, primarily in Experience Manager (AEM). The most severe flaw, CVE-2025-47110, is a reflected XSS vulnerability in Adobe Commerce and Magento Open Source, allowing arbitrary code execution. Users are advised to update their instances to the latest versions.

Microsoft security advisory – June 2025 monthly rollup (AV25-333) - Canadian Centre for Cyber Security

Microsoft released security advisories on June 10, 2025, addressing vulnerabilities in multiple products, including critical updates for .NET, Microsoft 365 Apps, and Windows. CVE-2025-33053 has been exploited, and users are advised to apply the necessary updates.

Red Hat security advisory (AV25-334) - Canadian Centre for Cyber Security

Red Hat published security advisories between June 2 and 8, 2025, addressing vulnerabilities in multiple products, including updates for the Linux kernel. The Cyber Centre recommends reviewing the provided web link and applying the necessary updates.

Adobe security advisory (AV25-335) - Canadian Centre for Cyber Security

Adobe published security advisories on June 10, 2025, addressing vulnerabilities in multiple products including Acrobat, Adobe Commerce, Adobe Experience Manager, and Adobe InCopy. Users and administrators are advised to review the provided web link and apply the necessary updates.

Google Chrome security advisory (AV25-336) - Canadian Centre for Cyber Security

Google Chrome security advisory (AV25-336) addresses vulnerabilities in Chrome for Desktop versions prior to 137.0.7151.103/.104 (Windows/Mac) and 137.0.7151.103 (Linux). Users and administrators are advised to review the advisory and apply updates.

Stealth Falcon APT Exploits Microsoft RCE Zero-Day

Nation-state adversaries are exploiting a zero-day vulnerability in Microsoft’s Web Distributed Authoring and Versioning (WEBDAV) protocol, allowing remote code execution on target systems. The Stealth Falcon APT group is using this vulnerability to compromise high-profile defense entities in the Middle East, delivering a custom backdoor implant called Horus Agent. Microsoft has patched this vulnerability along with 65 others in its June Patch Tuesday release, emphasizing the importance of prompt patching for all affected systems.

NTLM reflection is dead, long live NTLM reflection! – An in-depth

NTLM reflection, a vulnerability where authentication is relayed back to the originating machine, was thought to be fixed. However, a recent discovery shows that Kerberos reflection is not restricted, allowing for the bypassing of mitigations. This vulnerability occurs when the target name is considered localhost, triggering NTLM local authentication and enabling privileged access.

India’s Security Leaders Struggle to Keep Up With Threats

Indian organizations are struggling to integrate AI into their security operations due to a growing attack surface, a talent gap in cybersecurity, and new data security and privacy regulations. While AI adoption is high, with 80% of businesses experimenting with autonomous agents, security concerns remain prevalent. To address these challenges, organizations should focus on modernizing their security operations centers, adopting AI, and upskilling their workforce in AI and cybersecurity.

86% of all LLM usage is driven by ChatGPT - Help Net Security

ChatGPT dominates LLM usage, accounting for over 86% of tokens processed, driven by speed, reliability, and enterprise readiness. Despite this, developers are exploring alternative models, with Meta’s Llama emerging as the second most used. AI monitoring adoption is growing as AI becomes operational, with Python dominating AI applications, followed by Node.js and Java.

New BrowserVenom malware being distributed via fake DeepSeek phishing website | Securelist

A new malicious campaign distributes BrowserVenom malware through a fake DeepSeek-R1 LLM environment installer. The malware, delivered via a phishing site disguised as the official DeepSeek homepage, reconfigures browsing instances to force traffic through a threat actor-controlled proxy. This enables data collection and network traffic manipulation.

Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053) - Help Net Security

Microsoft has fixed a zero-day vulnerability (CVE-2025-33053) exploited in the wild by the Stealth Falcon APT group to deliver espionage tools. The vulnerability, in WebDAV, was used to manipulate Windows file execution and evade detection. Adobe has also released updates for several products, prioritizing a fix for five vulnerabilities with a higher risk of being targeted.