Cybersec Feeds Overview, Jan 20 - Jan 26, 2025 #

This brief consolidates key updates from 80+ sources, including government organizations, cybersecurity vendors, threat intelligence teams, security research labs, and blogs from cybersecurity communities and professionals. It highlights the most significant threats, vulnerabilities, and developments from the past week to keep you informed.

Gov Feeds #

• CISA has added two new known exploited vulnerabilities to its catalog: SonicWall SMA1000 (CVE-2025-23006) and JQuery Cross-Site Scripting (CVE-2020-11023). These vulnerabilities pose significant risks and require remediation to protect against threats (CISA Adds One Known Exploited Vulnerability to Catalog, CISA Adds One Known Exploited Vulnerability to Catalog).

• Oracle has released its quarterly critical patch update, addressing multiple vulnerabilities, including those that could allow remote code execution across various Oracle products (Oracle Quarterly Critical Patches Issued January 21, 2025).

• Multiple Industrial Control Systems (ICS) vulnerabilities were disclosed by CISA, affecting products from mySCADA, Schneider Electric, and Hitachi Energy among others. These include critical vulnerabilities that could allow remote code execution, unauthorized access, and privilege escalation (CISA Releases Six Industrial Control Systems Advisories, CISA Releases Three Industrial Control Systems Advisories).

• CISA and the FBI issued a joint advisory on the chaining of vulnerabilities in Ivanti Cloud Service Applications, highlighting exploits in administrative bypass, SQL injection, and remote code execution vulnerabilities. Network defenders are advised to monitor for malicious activity and upgrade to the latest versions (Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications, CISA and FBI Release Advisory on How Threat Actors Chained Vulnerabilities in Ivanti Cloud Service Applications).

• The National Cyber Security Centre’s recent update emphasizes a significant increase in edge device vulnerabilities and exploitation. Upcoming guidance will be released for improved telemetry and forensics in early February (CTO at NCSC Summary: week ending January 26th).

• Health-ISAC has emphasized the importance of improved cybersecurity measures for the healthcare sector, amidst rising challenges posed by AI, ransomware, and the necessity of securing medical devices and patient data (Securing Health Data in 2025: The Rising Cybersecurity Challenges, AI, Ransomware, and Medical Devices: Safeguarding Healthcare).

• The European Data Protection Board has released guidelines on pseudonymization and its role in managing data protection risks, stressing the need for clear objectives and integration with competition law (Guidelines 01/2025 on Pseudonymisation, Position paper on Interplay between data protection and competition law).

Vendor Feeds #

• SonicWall’s Secure Mobile Access (SMA) 1000 product has a critical zero-day vulnerability (CVE-2025-23006) exploited in the wild. This flaw has a severity rating of 9.8 out of 10 and allows unauthenticated remote attackers to execute arbitrary commands (CVE-2025-23006: SonicWall Secure Mobile Access (SMA) 1000 Zero-Day Reportedly Exploited, More than 2,000 SonicWall devices vulnerable to critical zero-day).

• A ransomware attack on Change Healthcare, now owned by UnitedHealth, affected approximately 190 million individuals, with hackers accessing extensive personal health data including insurance, medical, and financial information (UnitedHealth updates number of data breach victims to 190 million).

• Check Point Research reported a massive data breach involving the hotel management platform Otelier, where threat actors stole almost eight terabytes of data from Amazon S3 cloud storage containing personal and reservation details for major hotel brands (20th January– Threat Intelligence Report).

• The Andariel attack group is performing RID Hijacking attacks, a method involving modifications of the Relative Identifier of user accounts to bypass restrictions and gain privileges (RID Hijacking Technique Utilized by Andariel Attack Group).

• The Federal Trade Commission (FTC) is investigating surveillance pricing practices where personal data including location and browser history are used to set individualized consumer prices, raising concerns over privacy and fairness (Your location or browsing habits could lead to price increases when buying online).

• The World Economic Forum released AI security best practices, highlighting the need for risk management teams and robust cybersecurity controls for AI systems (Cybersecurity Snapshot: WEF Offers AI Security Best Practices).

• Android devices have improved theft protection features with the introduction of Identity Check and Theft Detection Lock to enhance device security by requiring biometric authentication and locking screens during theft attempts (Android enhances theft protection with Identity Check and expanded features).

News Feeds #

• A major cybersecurity incident has affected 190 million Americans due to a ransomware attack on UnitedHealth’s subsidiary, Change Healthcare. This breach highlights significant vulnerabilities in healthcare data handling (UnitedHealth now says 190 million impacted by 2024 data breach, UnitedHealth Group’s Massive Data Breach Impacts 190 Million Americans).

• Sony’s SMA appliance vulnerability allows remote code execution with a severity score of 9.8. It’s crucial for users to apply the latest patch to prevent exploitation (SonicWall pushes urgent patch for its SMA appliance, CISA Warns of SonicWall 0-day RCE Vulnerability Exploited in Wild).

• A new backdoor targeting Juniper routers, dubbed “J-Magic,” exploits devices configured as VPN gateways, emphasizing the need for enhanced security monitoring on network infrastructure (New backdoor discovered that specifically targets Juniper routers, Black ‘Magic’ Targets Enterprise Juniper Routers With Backdoor).

• North Korea’s fraudulent IT worker scheme led to the indictment of five individuals by the DOJ. This scheme highlights vulnerabilities in hiring processes for remote positions in the IT sector (DOJ indicts five in North Korean fake IT worker scheme, North Korean Cyber Fraud Scheme Targets U.S. Firms, DOJ Indicts Five Individuals).

• Experts warned of a significant ChatGPT API vulnerability that could be exploited for DDoS attacks, though the issue has been addressed. This points to the importance of rigorous security protocols for emerging AI technologies (‘Severe’ bug in ChatGPT’s API could be used to DDoS websites).

• New ransomware campaigns are utilizing Microsoft Teams for fake tech support scams, targeting multiple organizations, which could pose new risks for companies using collaborative platforms (Ransomware groups pose as fake tech support over Teams).

• Cyble research discovered security vendor credentials available on the dark web, raising concerns over the protection of sensitive information by cybersecurity companies and the strength of existing authentication mechanisms (Account Credentials for Security Vendors Found on Dark Web).

• Cloudflare detected a record-breaking 5.6 Tbps DDoS attack using Mirai botnet variants, illustrating the need for robust automated defenses against increasingly large and complex DDoS threats (Cloudflare detected (and blocked) the biggest DDoS attack on record).

Personal Feeds #

• Nearly half of observed security alerts are due to overprivileged service accounts in cloud environments. Credential weaknesses and misconfigured cloud services remain major attack vectors (Google Cloud Security Threat Horizons Report #11 Is Out!).

• A sharp increase in API and UI compromises accounted for 17.1% of incidents, with threat actors exploiting insecure private keys. Lateral movement by attackers accounted for 62.2% of penetrated environments (Google Cloud Security Threat Horizons Report #11 Is Out!).

• The BSC blockchain is a prime target for on-chain exploitation, with smaller projects frequently compromised. Ethereum remains vulnerable with significant financial losses from breaches such as the $200K UniLend hack (BlockThreat - Week 3, 2025).

• Koi Loader and Koi Stealer malware campaigns are active, utilizing social engineering and insecure downloads to compromise systems (2025-01-22: Traffic Analysis Exercise, 2025-01-21: Quick post for Koi Loader/Koi Stealer activity).

• A DNS misconfiguration at MasterCard persisted for nearly five years, exposing the company to potential traffic interception or redirection (MasterCard DNS Error Went Unnoticed for Years).

• Change Healthcare reported a data breach impacting 190 million individuals, with increased ransom activities from groups like Alphv/BlackCat (Change Healthcare data breach exposed the private data of over half the U.S.).

• SonicWall SMA1000 zero-day vulnerability, CVE-2025-23006, was added to CISA’s Known Exploited Vulnerabilities catalog, evidencing exploitation in the wild (U.S. CISA adds SonicWall SMA1000 flaw to its Known Exploited Vulnerabilities catalog, SonicWall warns of a critical CVE-2025-23006 zero-day likely exploited in the wild).

• A new executive order signed by President Biden strengthens cybersecurity measures by mandating secure software development practices from contractors, enforced through government procurement processes (Biden Signs New Cybersecurity Order).

Community Feeds #

• A critical Windows OLE Remote Code Execution vulnerability, CVE-2025-21298, has been identified with a CVSS score of 9.8. This highlights a significant risk requiring immediate attention (Proof-of-concept for CVE-2025-21298 - Windows OLE Remote Code Execution Vulnerability (CVSS 9.8)).

• A ransomware gang is exploiting SSH tunnels to gain stealthy access to VMware ESXi servers, emphasizing a pivot towards more covert lateral movement tactics (Ransomware gang uses SSH tunnels for stealthy VMware ESXi access).

• UnitedHealth reported a massive data breach affecting 190 million individuals, marking a significant escalation in the impact of healthcare sector breaches this year (UnitedHealth now says 190 million impacted by 2024 data breach, UnitedHealth confirms 190 million Americans affected by Change Healthcare data breach).

• Access broker groups continue to pose significant threats by maintaining persistence in compromised environments, often using bots like SystemBC as a SOCKS5 proxy for anonymity (Guest Diary How Access Brokers Maintain Persistence).

• Major Chamber of Commerce software platforms contain API security gaps that could expose data of approximately 1.35 million businesses, underlining the importance of API security (Major Chamber of Commerce software platforms have API security gaps exposing member data).

• Clone2Leak demonstrates a new threat to Git repositories by risking credential exposure, highlighting a pressing need for securing these systems (Clone2Leak: Your Git Credentials Belong To Us).

• Blackhat SEO attacks have exploited JavaScript code to target 500 government and university websites, demonstrating the extended reach of such tactics (Blackhat SEO JavaScript attack on 500 Gov and Uni websites).

• An increase in phishing efforts via cross-site scripting (XSS) vulnerabilities within email services is being reported, evidencing a shift in tactics to leverage unsecured webmail implementations (XSS Attempts via E-Mail).

• A security advisory has been issued for the meta-llama/llama-stack due to CVE-2024-50050, emphasizing vulnerabilities affecting AI infrastructure (CVE-2024-50050: Critical Vulnerability in meta-llama/llama-stack).

Disclaimer #

The summaries in this brief are generated autonomously by the OpenAI LLM model based on the provided system and user prompts. While every effort is made to consolidate accurate and relevant insights, the model may occasionally misinterpret, misrepresent, or hallucinate information. Readers are strongly advised to verify all key points by consulting the original sources linked in the brief for complete context and accuracy.

This document is created with BlackStork and is based on the template available on GitHub.

Reach out if you have questions or suggestions.