Cybersec Feeds Overview, Feb 3 - Feb 9, 2025 #

This brief consolidates key updates from 80+ sources, including government organizations, cybersecurity vendors, threat intelligence teams, security research labs, and blogs from cybersecurity communities and professionals. It highlights the most significant threats, vulnerabilities, and developments from the past week to keep you informed.

Gov Feeds #

• Recent exploitation of CVE-2025-0994 in Trimble Cityworks allows remote code execution. The deserialization vulnerability has been actively exploited, with updates now available to mitigate the threat (Trimble Releases Security Updates, A Vulnerability in Trimble Cityworks).

• Multiple vulnerabilities in Google Android OS enable privilege escalation, potentially allowing an attacker to install programs or manipulate system data (Multiple Vulnerabilities in Google Android OS).

• CISA added several known exploited vulnerabilities to its catalog, highlighting threats in products like 7-Zip, Dante, Microsoft Outlook, CyberoamOS, and Sophos XG Firewall. This catalog serves as a guidance for prioritizing vulnerability remediation (CISA Adds Five Known Exploited Vulnerabilities to Catalog).

• Schneider Electric’s EcoStruxure products have several vulnerabilities, with potential for remote code execution and local privilege escalation being concerns. Affected users should update to patched versions (Schneider Electric EcoStruxure Power Monitoring Expert, Schneider Electric EcoStruxure).

• Advisories for industrial control systems (ICS) released, noting varied vulnerabilities like path traversal in ABB Drive Composer and a denial-of-service flaw in Rockwell Automation controllers, requiring updated defenses (CISA Releases Six Industrial Control Systems Advisories).

• Guidance from international entities addresses security for edge devices, stressing importance due to foreign exploitations and offering mitigation strategies (CISA Partners with ASD’s ACSC, CCCS, NCSC-UK).

• New security considerations for the cybersecurity lifecycle of medical devices underscore shifting roles between manufacturers and healthcare providers to bolster resilience (Health-ISAC whitepaper).

Vendor Feeds #

• CVE-2024-49019 is a privilege escalation vulnerability in Active Directory Certificate Services. It allows domain users to create certificates for others, potentially causing impersonation as domain administrators. Microsoft has patched it, and 0patch has released additional micropatches for outdated Windows versions (Micropatches Released for Active Directory Certificate Services Elevation of Privilege Vulnerability).

• CVE-2025-21298 is a Windows OLE memory corruption vulnerability that can be exploited by malicious files to execute arbitrary code. This vulnerability has prompted Microsoft to release patches, while 0patch released micropatches for legacy Windows systems (Micropatches Released for Windows OLE Remote Code Execution).

• The Lazarus Group is using LinkedIn to exploit job seekers. They offer fake job opportunities to capture credentials and deploy malware. This campaign highlights the increasing use of social networking platforms for sophisticated phishing attempts (Lazarus Group Targets Organizations with Sophisticated LinkedIn Recruiting Scam).

• Mizuno USA experienced a ransomware attack by BianLian, resulting in stolen personal data. Similarly, El Cruce Hospital in Argentina faced a ransomware breach threatening to expose 760GB of data. These incidents are indicative of a prevailing trend of ransomware targeting diverse industries globally (3rd February – Threat Intelligence Report).

• A vulnerability in Trimble’s Cityworks software, used by public infrastructure agencies, is being actively exploited. CISA has issued a directive for federal agencies to patch this vulnerability immediately (Hackers exploiting bug in popular Trimble Cityworks tool used by local gov’ts).

• CISA has mandated enhanced cybersecurity measures for federal agencies through the FOCAL Plan, focusing on asset management, vulnerability management, and incident detection. This plan represents an advancement in federal efforts to standardize cybersecurity practices and reduce risks (CISA Releases FOCAL Plan to Help Federal Agencies Reduce Cyber Risk).

• The Kimsuky group continues to utilize RDP Wrapper and other tools for persistent attacks. This North Korean threat actor remains active, adapting its methods for espionage and information theft (Persistent Threats from the Kimsuky Group Using RDP Wrapper).

• Android and iOS apps infected with SparkCat’s crypto stealer have been found in official app stores, highlighting the continuing threat of mobile malware for cryptocurrency theft. Both Google and Apple have removed the malicious apps (Take my money: OCR crypto stealers in Google Play and App Store).

News Feeds #

• The DeepSeek iOS app, highly popular on the App Store, sends unencrypted data to ByteDance-controlled servers, bypassing Apple’s App Transport Security. This poses risks of data interception and potential user tracking when combined with other data sources. (DeepSeek iOS app sends data unencrypted to ByteDance-controlled servers)

• A massive brute force campaign is ongoing, using 2.8 million IP addresses to target VPN devices from manufacturers like Palo Alto Networks, Ivanti, and SonicWall. Attackers use known vulnerabilities and weak credentials to gain unauthorized access. (Massive brute force attack uses 2.8 million IPs to target VPN devices, Hackers Attacking Web Login Pages of Popular Firewalls for Brute-Force Attacks)

• Ransomware payments decreased by 35% in 2024 to $813 million, despite an increase in attack frequency. This decline is attributed to improved defenses, law enforcement actions, and victims’ refusal to pay ransoms. (Ransomware payments dropped 35% in 2024, Global ransomware payments plunge by a third amid crackdown)

• Homeland Security scrutiny intensifies over Elon Musk’s Department of Government Efficiency’s unauthorized access to federal systems, raising privacy and security concerns. This situation is likened to a data breach due to potential exposure of sensitive information. (Lawmakers fear Elon Musk, DOGE not adhering to privacy rules, Cybersecurity, government experts are aghast at security failures in DOGE takeover)

• Android’s February security update addresses 47 vulnerabilities, including an actively exploited flaw in the Linux kernel’s USB Video Class driver, known to allow privilege escalation and arbitrary code execution. (Android security update includes patch for actively exploited vulnerability)

• Hackers exploit ASP.NET keys found online to perform code injection attacks, compromising web server environments for remote code execution. Microsoft warns against using publicly disclosed keys without modification. (Microsoft says attackers use exposed ASP.NET keys to deploy malware, Microsoft: Thousands of Public ASP.NET Keys Allow Web Server RCE)

• Hackers continue to abuse Hugging Face’s machine learning platform with vulnerable ‘pickle’ files, capable of executing malicious code by directing to remote web shells, highlighting ongoing risks to AI developers. (Hugging Face platform continues to be plagued by vulnerable ‘pickles’)

• Hackers are exploiting servers with the Cityworks RCE vulnerability to breach Microsoft IIS environments and deploy malware. This vulnerability allows unauthorized remote code execution through deserialization attacks. (Hackers exploit Cityworks RCE bug to breach Microsoft IIS servers, CISA Warns of Trimble Cityworks RCE Vulnerability Exploited to Hack IIS Servers)

Personal Feeds #

• The UK requires Apple to disable its iCloud encryption under a new “technical capability notice,” potentially setting a precedent for future demands in other countries. Apple’s response may involve disabling the service for UK users (UK Is Ordering Apple to Break Its Own Encryption).
• New smartphone malware using optical character recognition targets screenshots of crypto wallet recovery phrases, with over 242,000 downloads on Google Play (Screenshot-Reading Malware).
• The US CISA has added several vulnerabilities, including a Trimble Cityworks issue and flaws in Microsoft Outlook and Sophos XG Firewall, to its Known Exploited Vulnerabilities catalog, requiring federal agencies to take action by specified deadlines (U.S. CISA adds Trimble Cityworks flaw, U.S. CISA adds Microsoft Outlook, Sophos XG Firewall).
• Journalists and civil society members using WhatsApp were targeted by Paragon’s commercial spyware in a widespread breach with “zero-click” attacks (Journalists and Civil Society Members Using WhatsApp Targeted by Paragon Spyware).
• A cyberattack on the Hospital Sisters Health System in 2023 exposed sensitive information of 882,782 individuals, with the breach impacting internal systems for several days (Hospital Sisters Health System impacted 882,782 individuals).
• North Korea’s Kimsuky APT group conducted spear-phishing attacks using a custom RDP Wrapper and the forceCopy info-stealer malware, targeting South Korea and others (Kimsuky APT group used custom RDP Wrapper version and forceCopy stealer).
• New collaborative AI agents are changing SIEM operations by capturing and sharing expertise, improving detection and response to threats, and building a collective security intelligence (Agents of Change: Building Collective SIEM Intelligence).
• The FBI and European authorities seized domains used by the cybercrime forums Cracked and Nulled, targeting stolen data, hacking tools, and malware sales (Who’s Behind the Seized Forums ‘Cracked’ & ‘Nulled’?).
• Security concerns arise over DeepSeek AI apps due to hard-coded encryption keys and unencrypted data transmission, posing risks to user privacy (Experts Flag Security, Privacy Risks in DeepSeek AI App).

Community Feeds #

• Hackers are exploiting a remote code execution vulnerability in the Cityworks tool to breach Microsoft IIS servers, indicating an active threat utilizing known software bugs (Hackers exploit Cityworks RCE bug to breach Microsoft IIS servers, Hackers exploiting bug in popular Trimble Cityworks tool used by local gov’ts).

• Europol recommends that financial institutions transition to quantum-safe cryptography in anticipation of future threats to existing cryptographic systems (Europol: Financial institutions should switch to quantum-safe cryptography).

• There is a continued trend of high remediation times for critical security alerts with SLAs extending up to 90 days, calling for assessment of existing processes in organizations to manage vulnerabilities (Remediation takes forever, while critical alerts pile up…).

• Phishing campaigns are utilizing domains with “com-” prefixes to deceive users into believing in the legitimacy of fraudulent websites. Security teams should monitor DNS logs for such domains (Phishing via “com-” prefix domains).

• The Known Beacons attack continues to pose risks for users of systems with open network ESSIDs in their Preferred Network Lists, bypassing protections that prevent automatic connections without user knowledge (Known beacons attack [At the 34C3]).

• Certificate Transparency is now enforced in Mozilla Firefox starting with version 135, enhancing verification against certificate issuance abuses (Certificate Transparency is now enforced in Firefox on desktop platforms starting with version 135).

• NanoCore RAT continues to be a prevalent malware threat, analyzed in recent findings highlighting its capabilities and its targeting techniques (NanoCore RAT Malware Analysis).

• Apple faces pressure from the UK to create an iCloud encryption backdoor, underscoring ongoing global policy challenges confronting end-to-end encryption (Apple ordered by U.K. to create global iCloud encryption backdoor).

• Researchers highlight a “ghost-server” tactic where systems masquerade as having unconstrained Kerberos delegation, alerting on access attempts to catch unauthorized actions (Making Ghost-Servers that appear to have Unconstrained Kerberos Delegation (but alert on access attempts)).

Disclaimer #

The summaries in this brief are generated autonomously by the OpenAI LLM model based on the provided system and user prompts. While every effort is made to consolidate accurate and relevant insights, the model may occasionally misinterpret, misrepresent, or hallucinate information. Readers are strongly advised to verify all key points by consulting the original sources linked in the brief for complete context and accuracy.

This document is created with BlackStork and is based on the template available on GitHub.

Reach out if you have questions or suggestions.