Hackers Target Job Recruiters Through Malicious Resumes

Russian-speaking hackers FIN6, also known as Skeleton Spider, are impersonating job seekers to phish recruiters and deploy malware through fake resumes. The malware, delivered through cloud-hosted infrastructure, evades traditional detection tools and enables credential theft, remote command execution, and potential ransomware delivery.

AI Is Your New Coworker. Does It Need a Badge?

The rise of agentic AI, capable of autonomous goal pursuit, demands updated identity and access governance models. Treating AI as a user with unique identities, least privilege, and contextual access control is crucial to prevent unintended actions and data breaches. Cybersecurity professionals must adapt their skills to manage AI identity, creating new career opportunities in machine identity governance.

Brute-force attacks target Apache Tomcat management panels www.bleepingcomputer.com/news/secu…

A coordinated campaign of brute-force attacks using hundreds of unique IP addresses targets Apache Tomcat Manager interfaces exposed online.

Tomcat is a popular open-source web server widely used by large enterprises and SaaS providers, while Tomcat Manager is a web-based administration tool that comes bundled with the Tomcat server and helps admins manage deployed web apps via a graphical interface.

Tomcat Manager is configured by default to only allow access from localhost (127.0.0.1), with no pre-configured credentials and remote access blocked. However, when exposed online, the web app can be targeted by attackers, as cybersecurity company GreyNoise observed recently.

Starting June 5th, GreyNoise analysts discovered two coordinated campaigns targeting Apache Tomcat Manager interfaces and trying to gain access to Tomcat services over the Internet.

The first used nearly 300 unique IP addresses, most tagged as malicious, which were attempting to log into exposed online, and the second employed 250 malicious IPs to target Tomcat Manager web apps in brute force attacks, where threat actors use automated tools to test thousands or even millions of possible credentials.

Operation Secure disrupts global infostealer malware operations www.bleepingcomputer.com/news/secu…

An international law enforcement action codenamed “Operation Secure” targeted infostealer malware infrastructure in a massive crackdown across 26 countries, resulting in 32 arrests, data seizures, and server takedowns.

Led by Interpol and conducted from January to April 2025, the operation focused on disrupting infostealer malware groups that steal financial and personal data through widespread infections.

The data stolen by infostealers commonly includes account credentials, browser cookies, and cryptocurrency wallet details. This data is then compiled into “logs” and sold on cybercrime markets or used in targeted attacks against high-value victims.

Microsoft slows Windows 11 24H2 Patch Tuesday due to a ‘compatibility issue’ www.theregister.com/2025/06/1…

Microsoft has set a new record with June’s security update for the time between release and an admission of borkage.

The patch Tuesday update arrived yesterday and contained a number of critical fixes. However, after trumpeting its arrival for Windows 11 24H2, Microsoft hastily followed up with a warning that: “We’ve identified a compatibility issue affecting a limited set of these devices” and, as such, the update was being throttled.

“If your device is affected, you’ll receive a revised update with all the June 2025 security improvements in the near term.”

On the Windows release health dashboard, Microsoft defined “near term” as being “by the end of the day.” It did not, however, say if the day in question was the one on its Redmond campus or the universally accepted UTC.

CISO who helped unmask Badbox warns: Version 3 is coming www.theregister.com/2025/06/1…

Badbox 2.0, the botnet that infected millions of smart TV boxes and connected devices before private security researchers and law enforcement partially disrupted its infrastructure, is readying for a third round of fraud and digital attacks, according to one of the threat hunters who uncovered the original scheme.

“We continue to try and shut them off wherever we can — that hasn’t stopped,” Human Security CISO Gavin Reid told The Register, referring to his team’s ongoing collaboration with the FBI, Google, and others to disrupt the botnet.

Found in the wild: 2 Secure Boot exploits. Microsoft is patching only 1 of them. arstechnica.com/security/…

Researchers have unearthed two publicly available exploits that completely evade protections offered by Secure Boot, the industry-wide mechanism for ensuring devices load only secure operating system images during the boot-up process. Microsoft is taking action to block one exploit and allowing the other one to remain a viable threat.

As part of Tuesday’s monthly security update routine, Microsoft patched CVE-2025-3052, a Secure Boot bypass vulnerability affecting more than 50 device makers. More than a dozen modules that allow devices from these manufacturers to run on Linux allow an attacker with physical access to turn off Secure Boot and, from there, go on to install malware that runs before the operating system loads. Such “evil maid” attacks are precisely the threat Secure Boot is designed to prevent. The vulnerability can also be exploited remotely to make infections stealthier and more powerful if an attacker has already gained administrative control of a machine.

The second publicly available Secure Boot exploit was discovered by researcher Zack Didcott. As he reported earlier this month, CVE-2025-47827 stems from IGEL, a Linux kernel module for handling their proprietary logical volume management. The initial shim, which loads GRUB and the vulnerable kernel, is signed by Microsoft.

Attackers with even brief physical access to a device can boot it up in IGEL and then modify the boot loader to install malware. Didcott said he reported the vulnerability to Microsoft and has received no indication the company has plans to revoke the signature. Microsoft didn’t respond to emails seeking confirmation and the reason for its decision.

Researchers at Eclypsium, a firm specializing in firmware security, said the module provides a near-universal means for bypassing Secure Boot protections.

“Because Microsoft’s 3rd Party UEFI CA is trusted by almost all PC-like devices, an unrevoked vulnerability in any of the components verified with that key… allows you to break Secure Boot to load an untrusted OS,” one of the researchers, Jesse Michael, wrote in an email. “Any system that trusts the Microsoft 3rd Party UEFI CA will load and run their version of the shim, which has been signed by that key. Their shim will then use its own embedded key to verify the IGEL-signed kernel+initramfs and malicious rootfs, which can be modified to chain-load another operating system such as Windows or a different version of Linux.”

Stealth Falcon APT Exploits Microsoft RCE Zero-Day in Mideast www.darkreading.com/vulnerabi…

Nation-state adversaries have been exploiting a zero-day security vulnerability in Microsoft’s Web Distributed Authoring and Versioning (WEBDAV), allowing one-click remote code execution (RCE) on target systems.

WEBDAV is a protocol that extends the functionality of HTTP, allowing users to interact with files on a Web server in a more collaborative and feature-rich way. According to Check Point Research (CPR), the important-rated bug (CVE-2025-33053, CVSS 8.8) is being used by the Stealth Falcon advanced persistent threat (APT) group to compromise high-profile defense entities in the Middle East. Hallmarks of the campaign are “deceptive URL files, WebDAV servers, and legitimate Windows tools to silently execute custom spyware, including a new [custom] implant: Horus Agent,” the researchers said, noting that Stealth Falcon’s advanced tradecraft also includes living off the land (LOLBins).

Fortunately, CVE-2025-33053 is one of 66 patched by Microsoft in its June Patch Tuesday release today. As Dustin Childs at Trend Micro’s Zero Day Initiative noted in a blog post covering the June update, the exploitation is concerning enough that the computing giant even addressed the flaw in end-of-life platforms.

Patch Tuesday, June 2025 Edition krebsonsecurity.com/2025/06/p…

The sole zero-day flaw this month is CVE-2025-33053, a remote code execution flaw in the Windows implementation of WebDAV — an HTTP extension that lets users remotely manage files and directories on a server. While WebDAV isn’t enabled by default in Windows, its presence in legacy or specialized systems still makes it a relevant target, said Seth Hoyt, senior security engineer at Automox.

Adam Barnett, lead software engineer at Rapid7, said Microsoft’s advisory for CVE-2025-33053 does not mention that the Windows implementation of WebDAV is listed as deprecated since November 2023, which in practical terms means that the WebClient service no longer starts by default.

Morning cyber summary

Incident: Microsoft confirms exploited zero-day vulnerability in WebDAV service Event Date: April 2025 Report Date: June 10, 2025, at 1 p.m. ET Summary: Microsoft disclosed an actively exploited remote code execution vulnerability (CVE-2025-33053) in WebDAV used by the APT group Stealth Falcon to attack a Turkish defence organization. Source: www.helpnetsecurity.com/2025/06/1…

Incident: Microsoft releases June 2025 Patch Tuesday addressing two zero-days Event Date: June 10, 2025 Report Date: June 10, 2025, at 1 p.m. ET Summary: Microsoft released security patches for 66 vulnerabilities, including an actively exploited WebDAV flaw and a publicly disclosed Windows SMB client remote code execution flaw (CVE-2025-33073). Source: www.crowdstrike.com/en-us/blo…

Incident: Ivanti discloses multiple high-severity vulnerabilities in Workspace Control Event Date: June 10, 2025 Report Date: June 10, 2025, at 11 a.m. ET Summary: Ivanti released security updates for three high-severity privilege escalation vulnerabilities (CVE-2025-5353, CVE-2025-22463, CVE-2025-22455) in its Workspace Control product due to hardcoded cryptographic keys. Source: www.cyber.gc.ca/en/alerts…

Incident: Advanced persistent threat group Rare Werewolf targets Russian enterprises Event Date: October 2024 to June 2025 Report Date: June 10, 2025, at 9:45 a.m. ET Summary: The advanced persistent threat group Rare Werewolf attacked hundreds of Russian industrial organizations to install cryptocurrency miners and establish remote access using legitimate third-party software tools. Source: thehackernews.com/2025/06/r…

Incident: Sensata Technologies discloses ransomware attack and data breach Event Date: May 25, 2025 Report Date: June 10, 2025, at 8:30 a.m. ET Summary: Industrial technology firm Sensata Technologies confirmed a ransomware attack resulted in a data breach exposing Social Security numbers, financial account details, and passport information for employees. Source: www.securityweek.com/sensitive…

Incident: Alabama dermatology practice discloses breach affecting 86,000 patients Event Date: March 5 to March 11, 2025 Report Date: June 9, 2025, at 4 p.m. ET Summary: Dermatologists of Birmingham began notifying 86,414 patients of a data breach involving medical and health insurance information, with the Qilin ransomware group claiming responsibility for the attack. Source: www.hipaajournal.com/data-brea…

Adobe Releases Patch Fixing 254 Vulnerabilities, Closing High-Severity Security Gaps

Adobe released security updates addressing 254 vulnerabilities, primarily in Experience Manager (AEM). The most severe flaw, CVE-2025-47110, is a reflected XSS vulnerability in Adobe Commerce and Magento Open Source, allowing arbitrary code execution. Users are advised to update their instances to the latest versions.

Microsoft security advisory – June 2025 monthly rollup (AV25-333) - Canadian Centre for Cyber Security

Microsoft released security advisories on June 10, 2025, addressing vulnerabilities in multiple products, including critical updates for .NET, Microsoft 365 Apps, and Windows. CVE-2025-33053 has been exploited, and users are advised to apply the necessary updates.

Red Hat security advisory (AV25-334) - Canadian Centre for Cyber Security

Red Hat published security advisories between June 2 and 8, 2025, addressing vulnerabilities in multiple products, including updates for the Linux kernel. The Cyber Centre recommends reviewing the provided web link and applying the necessary updates.

Adobe security advisory (AV25-335) - Canadian Centre for Cyber Security

Adobe published security advisories on June 10, 2025, addressing vulnerabilities in multiple products including Acrobat, Adobe Commerce, Adobe Experience Manager, and Adobe InCopy. Users and administrators are advised to review the provided web link and apply the necessary updates.

Google Chrome security advisory (AV25-336) - Canadian Centre for Cyber Security

Google Chrome security advisory (AV25-336) addresses vulnerabilities in Chrome for Desktop versions prior to 137.0.7151.103/.104 (Windows/Mac) and 137.0.7151.103 (Linux). Users and administrators are advised to review the advisory and apply updates.

Stealth Falcon APT Exploits Microsoft RCE Zero-Day

Nation-state adversaries are exploiting a zero-day vulnerability in Microsoft’s Web Distributed Authoring and Versioning (WEBDAV) protocol, allowing remote code execution on target systems. The Stealth Falcon APT group is using this vulnerability to compromise high-profile defense entities in the Middle East, delivering a custom backdoor implant called Horus Agent. Microsoft has patched this vulnerability along with 65 others in its June Patch Tuesday release, emphasizing the importance of prompt patching for all affected systems.

NTLM reflection is dead, long live NTLM reflection! – An in-depth

NTLM reflection, a vulnerability where authentication is relayed back to the originating machine, was thought to be fixed. However, a recent discovery shows that Kerberos reflection is not restricted, allowing for the bypassing of mitigations. This vulnerability occurs when the target name is considered localhost, triggering NTLM local authentication and enabling privileged access.

India’s Security Leaders Struggle to Keep Up With Threats

Indian organizations are struggling to integrate AI into their security operations due to a growing attack surface, a talent gap in cybersecurity, and new data security and privacy regulations. While AI adoption is high, with 80% of businesses experimenting with autonomous agents, security concerns remain prevalent. To address these challenges, organizations should focus on modernizing their security operations centers, adopting AI, and upskilling their workforce in AI and cybersecurity.

86% of all LLM usage is driven by ChatGPT - Help Net Security

ChatGPT dominates LLM usage, accounting for over 86% of tokens processed, driven by speed, reliability, and enterprise readiness. Despite this, developers are exploring alternative models, with Meta’s Llama emerging as the second most used. AI monitoring adoption is growing as AI becomes operational, with Python dominating AI applications, followed by Node.js and Java.

New BrowserVenom malware being distributed via fake DeepSeek phishing website | Securelist

A new malicious campaign distributes BrowserVenom malware through a fake DeepSeek-R1 LLM environment installer. The malware, delivered via a phishing site disguised as the official DeepSeek homepage, reconfigures browsing instances to force traffic through a threat actor-controlled proxy. This enables data collection and network traffic manipulation.

Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053) - Help Net Security

Microsoft has fixed a zero-day vulnerability (CVE-2025-33053) exploited in the wild by the Stealth Falcon APT group to deliver espionage tools. The vulnerability, in WebDAV, was used to manipulate Windows file execution and evade detection. Adobe has also released updates for several products, prioritizing a fix for five vulnerabilities with a higher risk of being targeted.

China-linked hackers target cybersecurity firms, governments in global espionage campaign | CSO Online

China-linked hackers, specifically groups associated with PurpleHaze and ShadowPad, targeted over 70 organizations globally, including government and critical infrastructure entities, between June 2024 and March 2025. The campaigns involved sophisticated reconnaissance and intrusion efforts, utilizing tools like ShadowPad and GOREshell. SentinelOne, a cybersecurity firm, detected and mitigated these attacks, highlighting the ongoing threat posed by these actors.

Afternoon update

ncident: FBI Warns of BADBOX 2.0 Botnet Surge in Chinese IoT Devices Incident Date: June 7, 2025 Article Date: June 7, 2025 Summary: FBI alerts indicate BADBOX 2.0, a Chinese-linked botnet, has infected over one million budget Android smart devices globally, now being used in illicit schemes; networks should be audited and sanitized. Reference: www.databreachtoday.com/fbi-warns…‑2‑0‑botnet-surge-in‑chinese‑devices

Incident: New RustStealer Info-Stealer Targets Chromium Browsers Incident Date: June 7, 2025 Article Date: June 7, 2025 Summary: Security researchers identified “RustStealer”, a Rust-based credential stealer for Chromium browsers on Windows and macOS, which harvests login credentials, cookies and other sensitive browser data. Reference: social.cyware.com/cyber-sec…

Incident: Optima Tax Relief Hit by Chaos Ransomware, Data Leaked Incident Date: June 7, 2025 Article Date: June 9, 2025 Summary: Chaos ransomware stalled Optima Tax Relief’s business by encrypting systems and publicly leaking stolen data as part of a double-extortion campaign. Reference: social.cyware.com/cyber-sec…

Incident: Cumberland County Hospital Ransomware Affects 36,600 Patients Incident Date: June 8, 2025 Article Date: June 9, 2025 Summary: Cumberland County Hospital confirmed ransomware impacted its systems, affecting 36,600 patients, and threatening to publicly release stolen data if ransom was not paid. Reference: www.hipaajournal.com/cumberlan…

Incident: CISA Warns of Erlang/OTP SSH Server RCE Vulnerability Exploited Incident Date: June 10, 2025 Article Date: June 10, 2025 Summary: CISA issued an urgent alert warning that a critical remote code execution flaw in Erlang/OTP SSH servers (CWE‑306) is being actively exploited in the wild, allowing unauthenticated command execution. Reference: cybersecuritynews.com/cisa-erla…

Incident: Rare Werewolf APT Employs Legitimate Tools for Credential Theft and Mining Incident Date: June 10, 2025 Article Date: June 10, 2025 Summary: Kaspersky reports the APT group Rare Werewolf is using benign tools (PowerShell, command files) and phishing operations to steal credentials and deploy crypto-miners across hundreds of targets in Russia and CIS states. Reference: thehackernews.com/2025/06/r…

Algerian group Jabaroot claims hack of Morocco’s Justice Ministry

The Algerian hacker group Jabaroot claims to have breached Morocco’s Ministry of Justice, obtaining sensitive data on Justice Minister Abdellatif Ouahbi and the judiciary. The group alleges access to a database containing personal information on magistrates and employees, escalating concerns about Morocco’s digital infrastructure security.

Morning update

Incident: Ransomware Attack on YES24 in South Korea Incident Date: June 9, 2025 Article Date: June 9, 2025 Summary: YES24, a major South Korean online bookstore, suffered a ransomware attack beginning around 4 a.m. KST (ET: June 8, 3 p.m. ET), disrupting services and prompting incident response from their security team. Reference: www.reddit.com/r/CyberIn…

Incident: Cyberattack on British Horseracing Authority (BHA) Incident Date: June 6, 2025 Article Date: June 9, 2025 Summary: The British Horseracing Authority experienced a cyberattack detected in early June, prompting police involvement; core racing event systems were restored, though root cause and data impact remain under investigation. Reference: www.reddit.com/r/CyberIn…

Incident: Cyberattack on Excellence Optoelectronics Inc (Taiwan) Incident Date: June 5, 2025 Article Date: June 6, 2025 Summary: Excellence Optoelectronics in Taiwan was targeted by a cyberattack affecting intranet and information systems; mitigation systems activated quickly, and operations remain mostly unaffected, though detailed impact is still under review. Reference: www.reddit.com/r/CyberIn…

Incident: Jenkins Gatling Plugin Vulnerability Advisory Incident Date: June 6, 2025 Article Date: June 7, 2025 Summary: Jenkins issued an advisory (AV25‑321) for a high‑severity vulnerability in its Gatling plugin; the Canadian Centre for Cyber Security (CCCS) recommends prompt patching to prevent exploitation. Reference: social.cyware.com/cyber-sec…