Vulnerability in DanaBot Malware C2 Server Leaks Threat Actor Usernames and Crypto Keys

A vulnerability in the DanaBot malware’s command-and-control (C2) server has been discovered, potentially exposing threat actor usernames and cryptographic keys. This breach could provide valuable insights into DanaBot operations and enable defenders to disrupt the malware’s campaigns. The leaked data may also be linked to cryptocurrency wallets used for illicit activities.

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets | SentinelOne

The article describes a series of cyberattacks targeting organizations, including a South Asian government entity and a European media organization. The attacks are attributed to China-nexus threat actors, particularly APT15 and UNC5174. The article also highlights the use of the ShadowPad malware and the GOREshell backdoor in these attacks.

Stolen Ticketmaster data from Snowflake attacks briefly for sale again

The article describes how stolen Ticketmaster data from Snowflake attacks was briefly listed for sale again. The data, initially stolen in 2024, was being resold by the Arkana Security extortion group. The article also mentions that the Arkana Security group is known for its association with the ShinyHunters threat actors.

Horse racing’s governing body hit by cyber attack

The British Horseracing Authority (BHA) experienced a ransomware attack, temporarily closing its London office and prompting remote work. The incident is being investigated, with the BHA confirming that raceday operations continue as normal.

Trump Cybersecurity Order Reverses Biden, Obama Priorities

A recent cybersecurity executive order from the Trump White House aims to adapt the US to emerging threats from AI, post-quantum computing, and a vulnerable software supply chain. The order eliminates a Biden-era mandate for a government-issued digital ID program, citing concerns about potential abuse. It also focuses on bolstering the software supply chain, enhancing IoT security, and implementing post-quantum cryptography.

AI threats leave SecOps teams burned out and exposed - Help Net Security

A recent survey of 500 senior cybersecurity professionals reveals that while AI is helping with tasks like threat detection and data analysis, it is also contributing to burnout due to the rapid pace of technological change. The surge in AI usage by attackers, who are automating and scaling up their efforts, is exacerbating the problem, with nearly 40% of organizations reporting falling victim to AI-powered cyberattacks in the past year. Despite the benefits of AI, the imbalance in cybersecurity favors attackers, leaving defenders struggling to keep up with the evolving threat landscape.

China-linked threat actor targeted +70 orgs worldwide, SentinelOne warns

A China-linked threat actor, tracked as PurpleHaze, targeted over 70 global organizations, including governments and media, in cyber-espionage attacks from July 2024 to March 2025. The group used extensive infrastructure and malware, showing strong links to APT15, a known China-linked cyberespionage group. SentinelOne warns of the persistent targeting of high-value entities and the need for vigilance and shared threat intelligence to counter evolving threats.

Rare Werewolf APT Uses Legitimate Software in Attacks on Hundreds of Russian Enterprises

The Rare Werewolf APT group, active since at least 2019, has been linked to cyber attacks targeting Russia and CIS countries. The attacks, which use legitimate third-party software, aim to establish remote access, steal credentials, and deploy cryptocurrency miners. The group’s tactics, including the use of phishing emails and legitimate tools, make detection and attribution challenging.

The Evolution of Linux Binaries in Targeted Cloud Operations

Threat actors are developing Linux Executable and Linkage Format (ELF) files to target cloud infrastructure, including backdoors, droppers, remote access Trojans (RATs), data wipers, and vulnerability-exploiting binaries. Five ELF-based malware families, NoodleRAT, Winnti, SSHdInjector, Pygmy Goat, and AcidPour, are actively updated and used in attacks. Palo Alto Networks Cortex Cloud’s machine learning module successfully detected 92% of these malware samples, highlighting the need for enhanced detection and prevention capabilities in cloud workloads and containers.

Researcher Found Flaw to Discover Phone Numbers Linked to Any Google Account

A security flaw in Google’s account recovery feature allowed attackers to brute-force phone numbers linked to Google accounts. The vulnerability, discovered by a Singaporean researcher, was addressed by Google, who removed the non-JavaScript username recovery form. The researcher received a $5,000 bug bounty for the responsible disclosure.

Russia-linked PathWiper malware hits Ukrainian infrastructure | CSO Online

A new malware, PathWiper, has struck Ukraine’s critical infrastructure, erasing data and disabling essential systems. Attributed to a Russia-linked APT group, the cyberattack leverages a compromised administrative framework, marking a significant escalation in Moscow’s cyber warfare capabilities. PathWiper’s ability to infiltrate trusted systems and cripple vital services highlights an intensifying digital offensive with far-reaching implications for global cybersecurity.

Sensitive Information Stolen in Sensata Ransomware Attack - SecurityWeek

Sensata Technologies, a sensor manufacturer, disclosed that a ransomware group accessed its network for over a week, stealing sensitive employee information including personal details and financial information. The company, which operates in 14 countries, is investigating the extent of the breach and has not disclosed whether a ransom was paid.

Critical Vulnerability Patched in SAP NetWeaver - SecurityWeek

SAP released 14 security patches, including a critical fix for a NetWeaver vulnerability (CVE-2025-42989) allowing attackers to bypass authorization checks and escalate privileges. The patch day also addressed high, medium, and low-severity flaws in various SAP products.

Incident: United Natural Foods (UNFI) Distributor Hit by Cyberattack Incident Date: June 6, 2025 Article Date: June 9, 2025 Summary: UNFI, the primary distributor for Whole Foods and over 30,000 retail locations across North America, experienced a cyberattack on June 6 that prompted shutdown of IT systems and engagement of law enforcement and cybersecurity experts. The disruption may temporarily affect grocery order fulfilment. Reference: www.axios.com/2025/06/0…

iMessage Zero-Click Attacks Suspected in Targeting of High-Value Individuals - SecurityWeek

iVerify, a mobile EDR firm, suspects zero-click attacks targeting an iMessage vulnerability, called Nickname, on iPhones belonging to high-value individuals in the EU and US. The attacks, observed in late 2024 and early 2025, involved exploiting a race condition in the imagent process, potentially leading to device compromise. Apple, however, denies the claims, stating the issue was a conventional software bug fixed in iOS 18.3.

Vulnerability Summary for the Week of June 2, 2025 | CISA

Ubuntu security advisory (AV25-323) - Canadian Centre for Cyber Security

IBM security advisory (AV25-324) - Canadian Centre for Cyber Security

Dell security advisory (AV25-325) - Canadian Centre for Cyber Security

New AI tool targets critical hole in thousands of open source apps | InfoWorld

The article describes a new AI tool that can scan open source repositories for vulnerabilities and automatically generate patches. The tool has already identified and patched over 60 projects, but the researchers highlight the need to address concerns about the tool’s potential to introduce new vulnerabilities and the responsibility of developers and project maintainers in ensuring the tool’s effectiveness.

Chinese-Linked Hackers Targeted 70+ Global Organizations

SentinelLABS uncovered a widespread cyber espionage campaign targeting over 70 global organizations between July 2024 and March 2025. The attacks, linked to China-nexus threat actors, utilized advanced tools and techniques, including the ShadowPad backdoor platform and GOREshell variants. The campaign impacted various sectors, including government, media, manufacturing, finance, telecommunications, and research.

Limited Canva Creator Data Exposed Via AI Chatbot Database

A Chroma database operated by Russian AI chatbot startup My Jedai was found exposed online, leaking survey responses from over 500 Canva Creators. The exposed data included email addresses and detailed feedback on Canva’s Creator Program. The incident highlights the risks of data exposure through AI technologies and the need for proper data protection measures.

Chinese Hackers and User Lapses Turn Smartphones Into a ‘Mobile Security Crisis’ - SecurityWeek

Chinese hackers have been targeting smartphones of individuals in government, politics, tech, and journalism, exploiting vulnerabilities in mobile devices and apps. This highlights the growing risk of cyberattacks on sensitive information and American interests. While most smartphones have robust security, apps and connected devices often lack these protections, making them potential footholds for hackers.

SentinelOne Sees No Breach After Hardware Supplier Hacked

SentinelOne reported a breach of a logistics firm supplying hardware to its employees, involving the ShadowPad malware. The breach did not compromise SentinelOne’s network. The same hackers, possibly APT41, targeted other organizations, including a South Asian government entity and a European media organization, using similar techniques.

Morning cyber security summary

Incident: FBI Warns of BADBOX 2.0 Botnet Surge in Chinese IoT Devices Incident Date: June 7, 2025 Article Date: June 7, 2025 Summary: The FBI alerted that BADBOX 2.0, a China‑based botnet, has infected over one million low-cost Android smart devices worldwide. Infected devices are being used in criminal schemes, prompting warnings for network audits and device sanitisation. Reference: www.databreachtoday.com/fbi-warns…‑2‑0‑botnet-surge-in‑chinese‑devices

Incident: New RustStealer Info‑Stealer Targets Chromium Browsers Incident Date: June 7, 2025 Article Date: June 7, 2025 Summary: Security researchers disclosed “RustStealer,” a Rust‑based info‑stealer targeting Chromium browsers on Windows/macOS. It harvests login credentials, cookies and browser data, posing a significant risk to enterprise credential security. Reference: social.cyware.com/cyber-sec… (item dated June 7, 2025)

Incident: Optima Tax Relief Hit by Chaos Ransomware, Data Leaked Incident Date: June 7, 2025 Article Date: June 9, 2025 Summary: Optima Tax Relief was targeted by the Chaos ransomware gang using a double‑extortion tactic; encrypted servers and stolen data are now being leaked on dark‑web forums. Reference: social.cyware.com/cyber-sec… (item dated June 9, 2025)

Incident: Sensata Technologies Ransomware Breach Exposes SSNs and Medical Data Incident Date: June 7, 2025 Article Date: June 7, 2025 Summary: Sensata, an industrial tech firm, disclosed a ransomware breach exposing personal data—including Social Security and medical records—of unknown quantity, with confirmation to affected individuals underway. Reference: social.cyware.com/category/… (item dated June 7, 2025)

Incident: Cumberland County Hospital Cyberattack Affects 36,600 Patients Incident Date: June 8, 2025 Article Date: June 9, 2025 Summary: Cumberland County Hospital confirmed a ransomware incident impacting 36,600 patients, threatening to publish stolen data on June 8 if ransom wasn’t paid. Reference: www.hipaajournal.com/cumberlan…

Incident: Cisco Talos Reports Roundcube XSS Attack on Infrastructure Incident Date: June 6, 2025 Article Date: June 9, 2025 Summary: Cisco Talos revealed attackers exploited an XSS flaw in Roundcube webmail, harvesting credentials from a critical infrastructure entity during active exploitation. Reference: gbhackers.com/hackers-e…