Hewlett Packard Enterprise warns of critical StoreOnce auth bypass www.bleepingcomputer.com/news/secu…

Hewlett Packard Enterprise (HPE) has issued a security bulletin to warn about eight vulnerabilities impacting StoreOnce, its disk-based backup and deduplication solution.

Among the flaws fixed this time is a critical severity (CVSS v3.1 score: 9.8) authentication bypass vulnerability tracked under CVE-2025-37093, three remote code execution bugs, two directory traversal problems, and a server-side request forgery issue.

The flaws impact all versions of the HPE StoreOnce Software before v4.3.11, which is now the recommended upgrade version.

morning summary

Incident: Lee Enterprises Cyberattack Exposes 39,779 Social Security Numbers Incident Date: February 2025 Article Date: June 4, 2025 Summary: Lee Enterprises confirmed that a ransomware attack in February 2025 compromised the personal information of 39,779 individuals, including names and Social Security numbers. The breach primarily affected current and former employees, with notifications sent to regulators and affected parties. Reference: therecord.media/newspaper…

Incident: Cisco Patches Critical Vulnerabilities in ISE and CCP Platforms Incident Date: June 4, 2025 Article Date: June 4, 2025 Summary: Cisco released patches addressing three vulnerabilities in its Identity Services Engine (ISE) and Customer Collaboration Platform (CCP), including a critical static credential flaw (CVE-2025-20286). The vulnerabilities, which had public proof-of-concept exploit code, could allow unauthorized access and were urged to be patched immediately. Reference: sec.cloudapps.cisco.com/security/…

Incident: New Chaos RAT Variant Targets Windows and Linux Systems Incident Date: June 4, 2025 Article Date: June 4, 2025 Summary: A new variant of the Chaos Remote Access Trojan (RAT) has been identified, targeting both Windows and Linux systems. The malware is distributed through fake network troubleshooting utilities, enabling attackers to execute commands, steal data, and potentially deploy ransomware. Reference: thehackernews.com/2025/06/c…

Incident: Malicious GitHub Repositories Distribute Backdoors via Impersonated Tools Incident Date: June 4, 2025 Article Date: June 4, 2025 Summary: Researchers uncovered over 130 malicious GitHub repositories impersonating malware tools and game cheats to distribute backdoors. The campaign, attributed to the threat actor “ischhfd83,” targets developers and gamers by embedding hidden backdoors in the code. Reference: news.sophos.com/en-us/202…

Incident: Everest Ransomware Leaks Data from Abu Dhabi’s Department of Culture and Tourism Incident Date: May 26, 2025 Article Date: June 4, 2025 Summary: The Everest ransomware group claimed responsibility for an attack on Abu Dhabi’s Department of Culture and Tourism, leaking approximately 1,500 personal records and sensitive internal documents. The breach has raised concerns over the targeting of government entities in the Middle East. Reference: www.cyfirma.com/news/week…

Incident: Gateway Community Services Data Breach Affects 34,498 Individuals Incident Date: May 16, 2025 Article Date: June 4, 2025 Summary: Gateway Community Services announced a data breach involving a mismailing incident that compromised personal information of 34,498 individuals, including names, addresses, Social Security numbers, and medical treatment details. The organization is providing affected individuals with credit monitoring services. Reference: www.claimdepot.com/investiga…

Incident: Google Warns of Hackers Stealing Salesforce Data via IT Impersonation Incident Date: June 4, 2025 Article Date: June 4, 2025 Summary: Google’s Threat Intelligence Group reported that hackers are impersonating IT personnel to trick employees into installing a malicious version of Salesforce’s Data Loader tool. The attackers, identified as group UNC6040, have targeted approximately 20 organizations, leading to data theft and extortion attempts. Reference: fortune.com/2025/06/0…

Incident: FBI Reports 900 Organizations Affected by Play Ransomware Exploiting SimpleHelp Vulnerabilities Incident Date: May 2025 Article Date: June 4, 2025 Summary: The FBI disclosed that approximately 900 organizations have been affected by Play ransomware attacks exploiting vulnerabilities in SimpleHelp remote access software. The ransomware group has developed new techniques in their double-extortion campaigns, including exploiting security flaws in remote-access tools. Reference: www.theregister.com/2025/06/0…

Incident: Honeywell Reports 46% Surge in Ransomware Attacks Targeting Industrial Sectors Incident Date: Q1 2025 Article Date: June 4, 2025 Summary: Honeywell’s 2025 Cybersecurity Threat Report revealed a 46% increase in ransomware attacks on industrial sectors between Q4 2024 and Q1 2025. The report highlights rising threats to operational technology systems and emphasizes the need for enhanced cybersecurity measures in industrial environments. Reference: www.cyfirma.com/news/week…

Amazon to invest $10B in North Carolina to expand cloud infrastructure and advance AI

The article describes Amazon’s 10 billion investment in North Carolina to expand its cloud computing infrastructure and advance AI innovation. The investment will create 500 new high-skilled jobs and support thousands of other jobs in the AWS data center supply chain. Additionally, Amazon will support education and skills training programs to prepare the next generation of workers for the cloud computing industry.

Attackers Impersonate Ruby Packages to Steal Telegram Data

Malicious RubyGems, posing as Fastlane plugins, were discovered on the RubyGems project site. The gems redirect Telegram API requests to servers controlled by attackers, enabling the theft of sensitive data from Telegram chats. The campaign, likely geopolitically motivated, targets developers seeking Telegram workarounds, highlighting the importance of API security and software supply chain trust.

Google Exposes Vishing Group UNC6040 Targeting Salesforce with Fake Data Loader App

Google’s Threat Intelligence Group (GTIG) is tracking a vishing group, UNC6040, that targets Salesforce instances for data theft and extortion. The group impersonates IT support personnel to trick employees into authorizing a modified version of Salesforce’s Data Loader, granting unauthorized access to customer environments. This access allows data exfiltration and potential lateral movement to other platforms like Okta, Workplace, and Microsoft 365.

Lumma Stealer Malware Resurgence Challenges Global Takedown

The Lumma Stealer malware, a popular tool for cybercriminals to steal credentials and financial data, resurfaced just days after an international takedown. The malware’s modular design and tooling allow operators to quickly reassemble key components, making it difficult to permanently disrupt sophisticated malware-as-a-service operations. While the takedown disrupted Lumma’s command-and-control network, the malware’s primary developer was able to restore functionality and add more logging.

Rajkot civic body’s GIS website hit by cyber attack, over 400 GB data feared stolen – DataBreaches.Net

A suspected cyber attack targeted the Rajkot Municipal Corporation’s GIS website, potentially compromising over 400 GB of data. The BSNL cyber security team is investigating the breach.

450M records allegedly stolen in Dubai hospital hack | Cybernews

A ransomware gang claims to have stolen 450 million patient records from American Hospital Dubai and is threatening to leak the data on June 8th. The stolen data includes sensitive customer information, financial records, and clinical records. The gang, known as Gunra, is a new threat actor that emerged in April 2025 and has claimed 12 victims since then.

Code Bug at Compliance Firm Vanta Leaks Customer Data to Other Clients

A software bug at Vanta, a compliance automation provider, exposed private customer data to other clients. The issue, caused by a product code change, affected hundreds of organizations and involved sensitive employee data, account setup details, and MFA information. Vanta is working to fix the problem and complete remediation by June 4.

Host-based logs, container-based threats: How to tell where an attack began securelist.com/host-base…

Although containers provide an isolated runtime environment for applications, this isolation is often overestimated. While containers encapsulate dependencies and ensure consistency, the fact that they share the host system’s kernel introduces security risks.

Based on our experience providing Compromise Assessment, SOC Consulting, and Incident Response services to our customers, we have repeatedly seen issues related to a lack of container visibility. Many organizations focus on monitoring containerized environments for operational health rather than security threats. Some lack the expertise to properly configure logging, while others rely on technology stacks that don’t support effective visibility of running containers.

Environments that suffer from such visibility issues are often challenging for threat hunters and incident responders because it can be difficult to clearly distinguish between processes running inside a container and those executed on the host itself. This ambiguity makes it difficult to determine the true origin of an attack and whether it started in a compromised container or directly on the host. The aim of this blog post is to explain how to restore the execution chain inside a running container using only host-based execution logs, helping threat hunters and incident responders determine the root cause of a compromise.

Man pleads guilty to swatting spree impacting scores of government officials therecord.media/man-plead…

The Department of Justice said Monday that a 26-year-old Romanian man has pleaded guilty to a string of swatting and bomb threat incidents which impacted dozens of senior government officials.

Starting in late-2023, Thomas Szabo and members of a group he oversaw allegedly swatted or made bomb threats against at least 25 members of Congress or their family members; multiple cabinet-level officials; and at least 13 former or current senior federal law enforcement officials, including heads of multiple law enforcement agencies.

Swatting typically involves calling police to falsely report serious crimes, prompting a SWAT team response. The spree, which allegedly continued through early January 2024, also impacted multiple members of the federal judiciary, at least 27 then-current or former state government officials or their family members, at least four religious institutions and multiple journalists.

NSO appeals WhatsApp decision, says it can’t pay $168 million in ‘unlawful’ damages therecord.media/nso-group…

The NSO Group has filed an appeal in response to a jury’s $168 million award to WhatsApp last month for the spyware manufacturer’s alleged role in allowing government clients to infect some 1,400 phones with its zero-click surveillance technology.

NSO asked the Northern California federal judge who oversaw the five-year trial to either drastically reduce the $167.2 million in punitive damages the jury awarded WhatsApp or greenlight a new trial, according to a Thursday court filing.

The surveillance product allegedly used against the WhatsApp users, Pegasus, has been found on devices belonging to members of civil society worldwide for years, proving NSO’s clients widely abuse the technology.

The North Face warns customers of April credential stuffing attack www.bleepingcomputer.com/news/secu…

Outdoor apparel retailer The North Face is warning customers that their personal information was stolen in credential stuffing attacks targeting the company’s website in April.

The North Face is a major American outdoor apparel and equipment brand owned by VF Corporation that also controls Vans, Timberland, and Dickies.

The North Face generates over $3 billion in annual revenue, making it one of the largest outdoor brands in the world, with its e-commerce accounting for approximately 42% of its total sales volumes.

Credential stuffing attacks are a type of cyberattack where threat actors attempt to gain unauthorized access to user accounts by automating login attempts using username-password pairs previously exposed in data breaches.

Meta and Yandex are de-anonymizing Android users’ web browsing identifiers arstechnica.com/security/…

Tracking code that Meta and Russia-based Yandex embed into millions of websites is de-anonymizing visitors by abusing legitimate Internet protocols, causing Chrome and other browsers to surreptitiously send unique identifiers to native apps installed on a device, researchers have discovered. Google says it’s investigating the abuse, which allows Meta and Yandex to convert ephemeral web identifiers into persistent mobile app user identities.

The covert tracking—implemented in the Meta Pixel and Yandex Metrica trackers—allows Meta and Yandex to bypass core security and privacy protections provided by both the Android operating system and browsers that run on it. Android sandboxing, for instance, isolates processes to prevent them from interacting with the OS and any other app installed on the device, cutting off access to sensitive data or privileged system resources.

Google patches new Chrome zero-day bug exploited in attacks www.bleepingcomputer.com/news/secu…

Google has released an emergency security update to fix the third Chrome zero-day vulnerability exploited in attacks since the start of the year.

“Google is aware that an exploit for CVE-2025-5419 exists in the wild,” the company warned in a security advisory published on Monday.

This high-severity vulnerability is caused by an out-of-bounds read and write weakness in Chrome’s V8 JavaScript engine, reported one week ago by Clement Lecigne and Benoît Sevens of Google’s Threat Analysis Group. Google says the issue was mitigated one day later by a configuration change the company pushed to the Stable channel across all Chrome platforms.

Data breaches in the last 48 hours

Incident: Coinbase contractor breach exposes customer data Date: June 2, 2025, at 4:51 p.m. ET Summary: Coinbase confirmed a breach involving TaskUs employees in India who illicitly photographed and sold customer data, leading to potential losses of up to $400 million. Source: www.reuters.com/sustainab…

Incident: Telefonica investigates leak of 1 million Peruvian customer records Date: June 3, 2025, at 7:07 a.m. ET Summary: Hacker group Dedale released 1 million records allegedly from Telefonica Peru, claiming to possess data on 22 million customers; the company is verifying the breach. Source: www.reuters.com/business/…

Incident: AT&T data leak exposes 31 million customer records Date: June 2, 2025 Summary: A threat actor leaked 3.1 GB of AT&T customer data, including names, birthdates, tax IDs, and IP addresses, posing significant privacy risks. Source: news.networktigers.com/cybersecu…

Incident: Cartier confirms cyberattack compromising customer data Date: June 3, 2025, at 8:30 a.m. ET Summary: Cartier reported a breach where an unauthorized party accessed its systems, stealing limited client information such as names and email addresses. Source: www.reuters.com/sustainab…

Over 30 Vulnerabilities Patched in Android - SecurityWeek

Google’s June 2025 Android update addresses 30+ high-risk flaws, including CVE-2025-26443, a local privilege escalation bug. Fixes span Android Runtime, Framework, System, and third-party components, including Qualcomm.

Vet: Open-source software supply chain security tool - Help Net Security

Vet helps developers and security teams detect vulnerabilities and malicious packages across ecosystems like npm, PyPI, Maven, Docker and more.

It features real-time threat detection and customizable policies via CEL, and integrates with CI/CD tools.

New Chrome Zero-Day Actively Exploited; Google Issues Emergency Out-of-Band Patch

Google has patched CVE-2025-5419, a high-risk V8 engine flaw (CVSS 8.8) under active exploitation. The issue enables remote attacks via crafted HTML.

Update to Chrome 137.0.7151.68/.69 on Windows/macOS, or .68 on Linux. Chromium-based browsers will receive updates shortly.

Victims risk AsyncRAT infection after being redirected to fake Booking.com sites www.malwarebytes.com/blog/news…

Cybercriminals have started a campaign of redirecting links placed on gaming sites and social media—and as sponsored ads—that lead to fake websites posing as Booking.com. According to Malwarebytes research, 40% of people book travel through a general online search, creating a lot of opportunities for scammers.

The first signs of the campaign showed up mid-May and the final redirect destination changes every two to three days.

Following the links brings visitors to a familiar strategy where fake CAPTCHA websites hijack your clipboard and try to trick visitors into infecting their own device.

‘Russian Market’ emerges as a go-to shop for stolen credentials www.bleepingcomputer.com/news/secu…

The “Russian Market” cybercrime marketplace has emerged as one of the most popular platforms for buying and selling credentials stolen by information stealer malware.

Although the marketplace has been active for roughly six years and became relatively popular by 2022, ReliaQuest reports that the Russian Market has recently reached new heights. Part of this surge in popularity is due to the takedown of the Genesis Market, which created a large vacuum in the field.

Although the majority (85%) of credentials sold on the Russian Market are “recycled” from existing sources, it has still won massive cybercrime audiences thanks to its wide selection of items of sale and availability of logs at prices as low as $2.

‘Russian Market’ emerges as a go-to shop for stolen credentials www.bleepingcomputer.com/news/secu…

The “Russian Market” cybercrime marketplace has emerged as one of the most popular platforms for buying and selling credentials stolen by information stealer malware.

Although the marketplace has been active for roughly six years and became relatively popular by 2022, ReliaQuest reports that the Russian Market has recently reached new heights. Part of this surge in popularity is due to the takedown of the Genesis Market, which created a large vacuum in the field.

Although the majority (85%) of credentials sold on the Russian Market are “recycled” from existing sources, it has still won massive cybercrime audiences thanks to its wide selection of items of sale and availability of logs at prices as low as $2.

Malaysian home minister’s WhatsApp hacked, used to scam contacts therecord.media/malaysia-…

Malaysia’s home minister had his WhatsApp account hacked and then used to send malicious links to his contacts, according to police.

The attacker reportedly used a virtual private network (VPN) to compromise the account of Datuk Seri Saifuddin Nasution Ismail, authorities said at a press conference on Friday, adding that no victims have reported financial losses so far. They did not elaborate on how the hack was carried out.

The Ministry of Home Affairs, which oversees law enforcement, immigration and censorship, confirmed the incident and urged the public not to respond to any messages or calls claiming to be from the minister, especially those involving financial or personal requests.

The breach is under investigation and law enforcement is working to determine the hacker’s location.

Qualcomm fixes three Adreno GPU zero-days exploited in attacks www.bleepingcomputer.com/news/secu…

Qualcomm has released security patches for three zero-day vulnerabilities in the Adreno Graphics Processing Unit (GPU) driver that impact dozens of chipsets and are actively exploited in targeted attacks.

The company says two critical flaws (tracked as CVE-2025-21479 and CVE-2025-21480) were reported through the Google Android Security team in late January, and a third high-severity vulnerability (CVE-2025-27038) was reported in March.

The first two are both Graphics framework incorrect authorization weaknesses that can lead to memory corruption because of unauthorized command execution in the GPU micronode while executing a specific sequence of commands, while CVE-2025-27038 is a use-after-free causing memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Thousands of ASUS routers compromised in sophisticated hacking campaign | Cybersecurity Dive

Over 9,000 ASUS routers have been compromised in an ongoing campaign exploiting CVE-2023-39780, with researchers warning of potential botnet formation. Linked to the suspected threat actor “ViciousTrap,” the attacks involve brute-force logins and command injection, targeting unpatched and previously compromised devices.