Security. In focus.

🔹 Incident 1: NightSpire Ransomware Attack on Tohpe Corporation

📅 Date/Time (EST): March 20, 2025, at 12:00 a.m.

📌 Summary:

• Japanese chemical manufacturer Tohpe Corporation hit by NightSpire ransomware.
• 159 GB of confidential corporate data (paints & high-performance materials) compromised.
• Attribution: NightSpire RaaS, active since early 2025.
• Status: No public mitigation efforts; disclosed via underground forums.

📄 Source: Cyberfirma Weekly Intelligence Report, March 21, 2025 – www.cyfirma.com/news/weekly-intelligence-report-21-mar-2025

---

🔹 Incident 2: RansomHub Ransomware Compromises HexoSys Group

📅 Date/Time (EST): March 20, 2025, at 12:00 a.m.

📌 Summary:

• Malaysian tech firm HexoSys Group breached via RansomHub ransomware.
• 336 GB exfiltrated (FPGA designs, source code, employee contracts, competitor research).
• Attackers: Selling data on darknet forums.
• Status: HexoSys has not publicly acknowledged the breach.

📄 Source: Cyberfirma Weekly Intelligence Report, March 21, 2025 – www.cyfirma.com/news/weekly-intelligence-report-21-mar-2025

---

🔹 Incident 3: SpyX Data Leak Exposes Surveillance Software Users

📅 Date/Time (EST): March 20, 2025, at 8:00 a.m.

📌 Summary:

• Spyzie, Spyic, Cocospy surveillance apps breached.
• 519K+ user emails & device data leaked (call logs, messages, photos).
• Exploited shared app architecture vulnerability; no vendor mitigation disclosed.
• Data added to Have I Been Pwned (HIBP) on Feb 27, 2025; public disclosure today.

📄 Source: CyberPress – www.cyberpress.org/spyx-data-leak

---

🔹 Incident 4: Microsoft 365 Phishing Campaign Exploits Tenant Misconfigurations

📅 Date/Time (EST): March 19, 2025, at 3:00 p.m.

📌 Summary:

• Phishing campaign abuses Microsoft 365 tenants to send fraudulent billing notifications.
• Attackers create admin accounts in compromised tenants to send credential-stealing emails.
• Targets: Enterprises using Microsoft services (no specific sector).
• Guardz researchers confirmed exploitation; no vendor mitigation details disclosed.

📄 Source: Security Magazine – www.securitymagazine.com/articles/101483-phishing-campaign-leverages-microsoft-365-infrastructure-for-attacks

---

🔹 Incident 5: Fortinet Vulnerability Exploited in SuperBlack Ransomware Campaign

📅 Date/Time (EST): March 19, 2025, at 10:00 a.m.

📌 Summary:

• CISA confirms active exploitation of Fortinet’s CVE-2025-24472 (CVSS 8.1).
• Mora_00 group (linked to LockBit) deployed SuperBlack ransomware.
• Affected products: FortiOS 7.0.0–7.0.16, FortiProxy 7.2.0–7.2.12.
• Mitigation: Update to versions 7.0.17, 7.2.13, or 7.0.20 ASAP.

📄 Source: Infosecurity Magazine – www.infosecurity-magazine.com/news/fortinet-vulnerability-ransomware

---

🌍 Geopolitical Context

• Hospitality sector remains high-risk due to Storm-1865’s ongoing ClickFix phishing campaigns (since March 13, 2025).
• Ransomware groups targeting APAC critical manufacturing & tech sectors.

CERT-UA Warns: Dark Crystal RAT Targets Ukrainian Defense via Malicious Signal Messages

CERT-UA warns of a new campaign targeting Ukrainian defense sectors with Dark Crystal RAT (DCRat) distributed via malicious Signal messages. The campaign, attributed to UAC-0200, highlights the expanded attack surface created by popular messaging apps like Signal.

Chinese military-linked companies dominate US digital supply chain - Help Net Security

Chinese military-linked companies, particularly ByteDance Group, remain deeply embedded in the US digital supply chain, posing cybersecurity risks despite government restrictions. Smaller specialized software providers, often overlooked, can also significantly impact industries due to their concentrated market share. Organizations must continuously evaluate their third-party vendors and suppliers to mitigate potential risks and secure their digital supply chains.

70% of leaked secrets remain active two years later - Help Net Security

The 2025 State of Secrets Sprawl report reveals a 25% increase in leaked secrets on GitHub, with 70% of those from 2022 still active. This poses a significant threat to organizations, as exposed credentials can provide attackers with unrestricted access to critical systems and sensitive data. The report emphasizes the need for comprehensive secret lifecycle management and rapid incident response capabilities to address this persistent security crisis.

India Is Top Global Target for Hacktivists, Regional APTs

India has become the top global target for hacktivists and regional target of advanced persistent threat (APT) groups, facing a surge in cyberattacks due to its growing economy and geopolitical stance. Hacktivists, state-sponsored attackers, and cybercriminals are increasingly targeting India, with applications attacks rising 20% in 2024, particularly in the financial and utilities sectors. To combat this, Indian firms are implementing new cybersecurity guidelines, mapping external attack surfaces, and leveraging AI to proactively block attacks.

Leaked Black Basta Chats Suggest Russian Officials Aided Leader’s Escape from Armenia - The Cyber Post

Leaked Black Basta chat logs suggest possible connections between the ransomware operation and Russian authorities, including potential aid in their leader’s escape from Armenia. The logs also reveal the group’s use of ChatGPT, overlap with other ransomware operations, and development of new malware and post-exploitation frameworks. Additionally, the group has been using a brute-forcing framework called BRUTED since 2023 to perform credential stuffing and brute-force attacks on target devices.

WhatsApp fixed zero-day used to deploy Paragon Graphite spyware

WhatsApp addressed a zero-day vulnerability exploited by Paragon to install Graphite spyware on targeted devices. The campaign, which targeted journalists and civil society members, was disrupted in December 2024, and WhatsApp alerted affected users. Citizen Lab linked Paragon to several IP addresses and a misconfigured certificate, suggesting global spyware operations with potential clients in several countries.

Google Chrome security advisory (AV25-151) - Canadian Centre for Cyber Security

Google published a security advisory on March 19, 2025, addressing vulnerabilities in Chrome for desktop. Users and administrators are encouraged to review and apply updates.

11 Nation-State Hackers Exploit Unpatched Windows Flaw Since 2017

A Windows zero-day vulnerability, allowing malicious code execution through shortcut files, has been exploited by at least 11 nation-state hacking groups since 2017. Despite evidence of widespread attacks, Microsoft has declined to issue a security patch, categorizing the issue as low severity. This decision has been met with criticism from industry leaders, highlighting concerns about Microsoft’s vulnerability disclosure practices and leaving millions of users exposed to cybersecurity threats.

Veeam security advisory (AV25-150) - Canadian Centre for Cyber Security

Veeam published a security advisory (AV25-150) for a critical vulnerability in Veeam Backup & Replication versions 12 prior to build 12.3.1.1139. Users and administrators are encouraged to review and apply the necessary updates.

Jenkins security advisory (AV25-149) - Canadian Centre for Cyber Security

Jenkins published a security advisory on March 19, 2025, addressing vulnerabilities in three plugins: AnchorChain, EDDSA API, and Zoho QEngine. Users are encouraged to review and apply the necessary updates.

Phishing-based attacks have risen 140% year-over-year | Security Magazine

Menlo Threat Intelligence reports a 140% year-over-year increase in browser-based phishing attacks, with a 130% rise in zero-hour incidents. Malicious actors are increasingly using generative AI to exploit browser flaws and steal user credentials.

Chinese Hacking Group MirrorFace Targeting Europe - SecurityWeek

Chinese hacking group MirrorFace, linked to APT10, targeted a Central European diplomatic institute using updated tactics and new tools, including the Anel backdoor and AsyncRAT. The attacks, part of Operation AkaiRyū, aimed to gain network access and steal data, with the upcoming Expo 2025 event used as a lure. This marks the first known MirrorFace attack against a European entity, highlighting the group’s expanding geographic focus beyond Japan.

Windows Shortcut Zero-Day (ZDI-CAN-25373) Exploited by State-Backed Threat Actors Since 2017: Overview of Key Details - SOCRadar® Cyber Intelligence Inc.

A sophisticated zero-day vulnerability, ZDI-CAN-25373, has been exploited by state-backed threat actors since 2017. This exploit, targeting Windows shortcut files, allows attackers to execute malicious commands undetected, leading to cyber espionage and data theft. Despite Microsoft’s inaction, organizations must implement security measures to mitigate risks, including monitoring .lnk file usage, implementing endpoint protection, and conducting network monitoring.

SpyCloud’s 2025 Identity Exposure Report Reveals the Scale and Hidden Risks of Digital Identity Threats

SpyCloud’s 2025 Identity Exposure Report reveals a surge in holistic identity exposures, with cybercriminals leveraging data from various sources to exploit vulnerabilities. The report highlights the need for organizations to adopt a comprehensive defense strategy, as traditional defenses are insufficient against the interconnected nature of digital identities. SpyCloud’s holistic identity analytics, powered by the industry’s largest collection of recaptured darknet data, enables organizations to mitigate identity-based threats effectively.

Scareware Combined With Phishing in Attacks Targeting macOS Users - SecurityWeek

A scareware campaign, previously targeting Windows users with phishing attacks, has shifted its focus to macOS users. The campaign, which leverages compromised websites and legitimate hosting platforms, employs sophisticated tactics to bypass anti-phishing defenses and trick users into revealing their login credentials. This shift highlights the campaign’s adaptability and poses a significant risk to enterprise users, particularly those using Safari.

Sperm bank breach deposits data into hands of cybercriminals | Malwarebytes

California Cryobank, a prominent sperm bank, experienced a data breach in April 2024, exposing customer information including names, SSNs, and financial details. The breach raises privacy concerns, especially for anonymous donors, and highlights the importance of data protection under HIPAA regulations. Individuals affected by the breach are offered credit monitoring services and advised to take protective measures such as changing passwords and enabling 2FA.

ClearFake Infects 9,300 Sites, Uses Fake reCAPTCHA and Turnstile to Spread Info-Stealers

The ClearFake campaign, utilizing fake reCAPTCHA and Cloudflare Turnstile verifications, has infected over 9,300 websites to spread information-stealing malware. The campaign, known for its evolving tactics, employs EtherHiding and ClickFix to deliver Lumma Stealer and Vidar Stealer, with the latest iteration incorporating Web3 capabilities for resilience. As social engineering campaigns become more sophisticated, organizations must implement robust authentication and access-control mechanisms to protect against evolving threats.

Major teacher’s union breach leaks members' PIN codes| Cybernews

Over 500,000 members of the Pennsylvania State Education Association (PSEA) had their personal and financial data stolen in a cyberattack. The stolen data includes sensitive information like Social Security Numbers, credit card details, and health insurance information, potentially leading to identity theft and financial fraud. Despite the breach, PSEA assures members that there is no evidence of misuse and offers free credit monitoring.

Cl0p Hackers Leak 22K Bank Records in Cleo Breach Shock

Cl0p hackers exploited vulnerabilities in Cleo file transfer software, exposing 22,000 Western Alliance Bank records. The breach, which occurred in October 2024, led to the leak of sensitive information, including Social Security numbers and financial account details, putting victims at risk of identity theft and fraud.

Tesla Owners Doxxed by Dogequest, an Unnerving Breach of Privacy

A website called Dogequest published a map exposing the personal information of Tesla owners, including their names, addresses, phone numbers, and email addresses. The website, which also included locations of Tesla dealerships and superchargers, justified its actions as a form of protest against Tesla and its CEO, Elon Musk. The incident has sparked outrage and raised concerns about privacy and safety, with Musk calling it “domestic terrorism.”

Extortion Reboot: Ransomware Crew Threatens Leak to Snowden – DataBreaches.Net

Ox Thief, a ransomware group, initially used traditional tactics like data theft and ransom demands. However, their threat to leak the data to Edward Snowden, a whistleblower, backfired and drew ridicule.

GitHub Action hack likely led to another in cascading supply chain attack

A cascading supply chain attack on GitHub Actions likely led to the compromise of “tj-actions/changed-files,” leaking CI/CD secrets. The attack began with the compromise of “reviewdog/action-setup@v1,” which injected code to dump secrets to log files. Developers are advised to check for references to affected actions, delete workflow logs, and rotate exposed secrets to mitigate risks.

How to Secure Your Information on AWS: 10 Best Practices | Tripwire

Organizations using Amazon Web Services (AWS) must prioritize data security due to its popularity as a target for cyberattacks. The Shared Responsibility Model outlines that while AWS secures the cloud infrastructure, customers are responsible for securing their content and applications within it. To fulfill this responsibility, organizations should implement best practices such as activating CloudTrail, restricting access to sensitive data, and regularly rotating IAM access keys.

New Arcane stealer spreading via YouTube and Discord | Securelist

A new stealer, Arcane, is being distributed through YouTube videos promoting game cheats and a loader called ArcanaLoader. Arcane steals a wide range of data, including browser credentials, VPN and gaming client information, and network utility details. The campaign, likely targeting a Russian-speaking audience, highlights cybercriminals’ adaptability in using evolving malware and distribution methods.