Cybersec Feeds Overview, Mar 17 - Mar 23, 2025 #

This brief consolidates key updates from 80+ sources, including government organizations, cybersecurity vendors, threat intelligence teams, security research labs, and blogs from cybersecurity communities and professionals. It highlights the most significant threats, vulnerabilities, and developments from the past week to keep you informed.

Gov Feeds #

• Four significant vulnerabilities have been identified: Google Chrome (arbitrary code execution), Veeam Backup & Replication (authenticated user based RCE), AMI MegaRAC Software (remote control and RCE), and Apache Tomcat (remote code execution via partial PUT misconfiguration) (A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution, A Vulnerability in Veeam Backup & Replication Could Allow for Arbitrary Code Execution, A Vulnerability in AMI MegaRAC Software Could Allow for Remote Code Execution, A Vulnerability in Apache Tomcat Could Allow for Remote Code Execution).

• Proof of Concept exploits are publicly available for vulnerabilities in AMI MegaRAC and Apache Tomcat, suggesting a heightened risk of exploitation (A Vulnerability in AMI MegaRAC Software Could Allow for Remote Code Execution, A Vulnerability in Apache Tomcat Could Allow for Remote Code Execution).

• CISA has added multiple new vulnerabilities to the Known Exploited Vulnerabilities catalog, highlighting ongoing threats that organizations should prioritize for remediation (CISA Adds Three Known Exploited Vulnerabilities to Catalog, CISA Adds Two Known Exploited Vulnerabilities to Catalog).

• The UK government, through NCSC, has issued a migration roadmap for transitioning to post-quantum cryptography by 2035 to safeguard long-term data protection (CTO at NCSC Summary: week ending March 23rd).

• A joint threat bulletin from Health-ISAC and AHA indicates potential terror threats targeting the health sector, emphasizing the sector’s vulnerability and the need for heightened security measures (Potential Terror Threat Targeted at Health Sector – AHA & Health-ISAC Joint Threat Bulletin).

• The Lithuanian National Threat Assessment 2025 warns of persistent cyber espionage by Chinese and Russian actors targeting public sector employees, reflecting geopolitical cyber threats (CTO at NCSC Summary: week ending March 23rd).

Vendor Feeds #

• A new Remote Access Trojan (RAT) named StilachiRAT has been identified, utilizing sophisticated evasion techniques to execute cyber-espionage, credential theft, and digital wallet targeting capabilities. This malware is being monitored for its stealth and potential threat landscape impacts (StilachiRAT analysis: From system reconnaissance to cryptocurrency theft).

• The GitHub Actions supply chain attack incident has exposed CI/CD pipelines to compromise risks, with attackers initially targeting Coinbase’s open-source project. Organizations using the affected GitHub actions are advised to review workflow logs for leaked secrets and rotate them (GitHub Actions Supply Chain Attack: A Targeted Attack on Coinbase Expanded to the Widespread tj-actions/changed-files Incident: Threat Assessment).

• A critical vulnerability (CVE-2025-23120) in Veeam Backup & Replication allows authenticated users to execute code remotely. Affected systems should promptly update to Veeam Backup & Replication 12.3.1.1139 to mitigate exposure (Critical Veeam Backup & Replication CVE-2025-23120, Critical Veeam Vulnerability (CVE-2025-23120) Enables Remote Code Execution by Domain Users).

• Apache Tomcat is facing an active exploitation threat due to a CVE-2025-24813 vulnerability, which can allow attackers to achieve unauthenticated remote code execution. Users should update to the latest Tomcat version immediately (Apache Tomcat CVE-2025-24813: What You Need to Know, Apache Tomcat RCE Vulnerability (CVE-2025-24813) Under Active Exploitation: Patch Now).

• Amadey malware, an infostealer and loader, continues to target Windows systems with capabilities including privilege escalation, keystroke logging, and screen capturing. Its latest variants demonstrate a modular design allowing versatile malicious tasks (Amadey: Malware Overview).

• A large-scale Google Play Store campaign has distributed hundreds of malicious apps, resulting in over 60 million downloads. These apps engage users in credential phishing attacks, leveraging Android’s security bypasses (Hundreds of Malicious Google Play-Hosted Apps Bypassed Android 13 Security With Ease).

• Cloudflare Radar updates provide new insights into DDoS attacks, leaked credentials, and bot trends, emphasizing enhanced visibility and data analysis in cybersecurity operations (Extending Cloudflare Radar’s security insights with new DDoS, leaked credentials, and bots datasets).

• Ransomware-as-a-Service (RaaS) models continue to evolve, with the introduction of VanHelsing, offering a cross-platform attack capability extending to various operating systems. This RaaS service has revealed a growing affiliate program since March 7, 2025 (VanHelsing, new RaaS in Town).

News Feeds #

• The FBI warns about fake file converters on the internet spreading malware and ransomware. These tools work as advertised but embed malware to gain device access, scrape personal information, and result in potential remote access for threat actors (FBI warnings are true—fake file converters do push malware).

• Cloudflare has implemented a policy that entirely blocks unencrypted HTTP connections to its API endpoints. All connections must now be over HTTPS to prevent sensitive information from being exposed and to avoid adversary-in-the-middle attacks (Cloudflare now blocks all unencrypted traffic to its API endpoints).

• A security vulnerability in the Microsoft Trusted Signing service was abused by cybercriminals for code signing malware with three-day certificates, making malware appear trustworthy and bypassing certain protections (Microsoft Trusted Signing service abused to code-sign malware).

• A recent cyberattack on GitHub Actions targeted Coinbase and involved cascading supply chain compromises. The attack was initiated by injecting malicious code into actions to exfiltrate secrets and compromise operations (Coinbase was primary target of recent GitHub Actions breaches, CISA Warns of Exploited GitHub Action CVE-2025-30066 – Users Urged to Patch).

• Oracle has denied a breach following claims of data theft involving 6 million records allegedly stolen from its Cloud systems. The attack could potentially exploit known vulnerabilities in Oracle’s infrastructure (Oracle denies breach after hacker claims theft of 6 million data records, Oracle Denies Breach Amid Hacker’s Claim of Access to 6 Million Records).

• Fake Google Ads and other phishing campaigns have been identified as targeting SEO professionals using Semrush ads to steal Google account credentials. These campaigns bypass security measures through convincing phishing sites (Fake Semrush ads used to steal SEO professionals’ Google accounts).

• A Medusa ransomware campaign has been intensifying, targeting diverse sectors including healthcare and tech. The FBI and CISA have issued warnings about the group’s expanding operations and elevated risk (Medusa Ransomware Surge: 60 Victims in 3 Months—Are You Next?).

• Cert-UA issued a warning of cyberattacks on Ukraine’s defense sector using the DarkCrystal RAT, as attacks have targeted military personnel and used documents to deploy malware (CERT-UA Warns of Escalating Cyberattacks Targeting Ukraine’s Defense Sector with DarkCrystal RAT).

• A critical remote code execution vulnerability in Apache Tomcat (CVE-2025-24813) is under active exploitation, according to CERT NZ. Users are strongly encouraged to update affected systems to prevent attacks (CERT NZ Warns of Critical Apache Tomcat Vulnerability (CVE-2025-24813) Under Active Exploitation).

Personal Feeds #

• A series of Ethereum Improvement Proposals (EIPs) in the upcoming Petra upgrade pose security risks, such as EIP-7702 which risks emptying wallets and EOF which may allow reentrancy exploits (BlockThreat - Week 11, 2025).

• A tap-to-pay fraud operation using phishing scams has led to arrests in the United States. Fraudsters used custom Android apps with stolen credit card data to execute tap-to-pay transactions (Arrests in Tap-to-Pay Scheme Powered by Phishing).

• A sophisticated supply chain attack on GitHub Actions compromised CI/CD secrets across multiple repositories, impacting thousands of developers. The breach targeted the “tj-actions/changed-files” utility (Critical GitHub Attack).

• A phishing scam posing as a mandatory Coinbase wallet migration has been identified, targeting individuals for sensitive information through fake notifications (Mandatory Coinbase wallet migration? It’s a phishing scam!).

• A free file converter malware scam is reportedly widespread and has the attention of the FBI. Users are tricked into downloading malicious software disguised as legitimate file converters (Free file converter malware scam “rampant” claims FBI).

• Improvements in brute force attacks have been noted, with significant optimization of KASUMI, SPECK, and TEA3 cryptographic algorithms on GPUs, raising concerns for GPRS, GSM, RFID, and TETRA communications (Improvements in Brute Force Attacks).

• A supply chain CAPTCHA attack has affected more than 100 car dealerships, highlighting the vulnerabilities in dealership software supply chains (Supply-chain CAPTCHA attack hits over 100 car dealerships).

Community Feeds #

• Cyber attackers exploit five vulnerabilities in the Paragon Partition Manager’s BioNTdrv.sys driver. Vulnerabilities allow privilege escalation and denial-of-service attacks. Threat actors use CVE-2025-0289 in BYOVD ransomware attacks for SYSTEM-level access. Microsoft and Paragon released patches and blocklists (Paragon Partition Manager contains five memory vulnerabilities).

• Microsoft Trust Signing service has been misused to sign malware, compromising the integrity of trusted software distribution. This abuse poses significant risks as attackers can disguise malware as legitimate software (Microsoft Trust Signing service abused to code-sign malware).

• A critical out-of-bounds write vulnerability (CVE-2025-0927) in the Linux kernel can be exploited for local privilege escalation, emphasizing ongoing risks in kernel-level vulnerabilities (CVE-2025-0927 - Linux Kernel vulnerability).

• Vehicle manufacturer Jaguar Land Rover fell victim to a ransomware attack by the HELLCAT group, exploiting its infostealer playbook. This highlights the growing threat of ransomware on large enterprises (Jaguar Land Rover breached by HELLCAT ransomware).

• Exploitation activity observed targeting Cisco Smart Licensing Utility’s static credentials and information disclosure vulnerabilities (CVE-2024-20439, CVE-2024-20440). Attackers use these to gain unauthorized access and extract sensitive information (Exploit Attempts for Cisco Smart Licensing Utility CVE-2024-20439 and CVE-2024-20440).

• An API vulnerability in Node.js and xml-crypto libraries enables critical authentication bypass, reinforcing the need for secure handling of authentication tokens and proxies (SAMLStorm: Critical Authentication Bypass).

• A significant wormable vulnerability in Veeam Backup & Replication software (CVE-2025-23120) allows domain-level remote code execution, underscoring the risk posed by server-side vulnerabilities (Domain-Level RCE in Veeam Backup & Replication).

• Recent hacking incidents show a rise in the exploitation of compromised GitHub Actions with publicly leaked secrets, raising concerns about CI/CD pipeline security (Compromised tj-actions/changed-files GitHub Action).

Disclaimer #

The summaries in this brief are generated autonomously by the OpenAI LLM model based on the provided system and user prompts. While every effort is made to consolidate accurate and relevant insights, the model may occasionally misinterpret, misrepresent, or hallucinate information. Readers are strongly advised to verify all key points by consulting the original sources linked in the brief for complete context and accuracy.

This document is created with BlackStork and is based on the template available on GitHub.

Reach out if you have questions or suggestions.