Cybersec Feeds Overview, Mar 31 - Apr 6, 2025 #
This brief consolidates key updates from 80+ sources, including government organizations, cybersecurity vendors, threat intelligence teams, security research labs, and blogs from cybersecurity communities and professionals. It highlights the most significant threats, vulnerabilities, and developments from the past week to keep you informed.
Most Discussed Topics #
- Critical vulnerabilities in widely used enterprise software, including Ivanti Connect Secure (CVE-2025-22457), Apache Tomcat (CVE-2025-24813), and Industrial Control Systems (ICS) from vendors like Hitachi Energy, ABB, and B&R, are being actively discussed and exploited. CISA’s Known Exploited Vulnerabilities (KEV) catalog continues to expand with newly discovered and actively exploited flaws, emphasizing the need for immediate patching and mitigation efforts. These vulnerabilities often allow for remote code execution or denial-of-service, posing significant risks to organizations.
- cisecurity.org: A Vulnerability in Ivanti Products Could Allow for Remote Code Execution
- cisa.gov: CISA Adds One Vulnerability to the KEV Catalog
- cisa.gov: Ivanti Releases Security Updates for Connect Secure, Policy Secure & ZTA Gateways Vulnerability (CVE-2025-22457)
- cisa.gov: Hitachi Energy TRMTracker
- cisa.gov: ABB Low Voltage DC Drives and Power Controllers CODESYS RTS
- cisa.gov: CISA Releases Five Industrial Control Systems Advisories
- cisa.gov: B&R APROL
- cisa.gov: Hitachi Energy RTU500 Series
- cisa.gov: ABB ACS880 Drives Containing CODESYS RTS
- cisa.gov: CISA Adds One Known Exploited Vulnerability to Catalog
- cisa.gov: CISA Adds One Known Exploited Vulnerability to Catalog
- rapid7.com: Ivanti Connect Secure CVE-2025-22457 exploited in the wild
- darkreading.com: China-Linked Threat Group Exploits Ivanti Bug
- cyberscoop.com: China-backed espionage group hits Ivanti customers again
- therecord.media: CISA warns of latest Ivanti firewall bug being exploited by suspected Chinese hackers
- bleepingcomputer.com: Max severity RCE flaw discovered in widely used Apache Parquet
- rapid7.com: Metasploit Wrap-Up 04/04/2025
- socradar.io: UNC5221 Targets Critical Ivanti Flaw (CVE-2025-22457) with TRAILBLAZE & BRUSHFIRE Malware
- thecyberexpress.com: CISA’s Latest Advisories Expose High-Risk Vulnerabilities in Industrial Control Systems
- The role and implications of Artificial Intelligence (AI) in cybersecurity are frequently discussed, covering both defensive applications and associated risks. Topics include the development of AI-driven security tools like Google’s Sec-Gemini and Trend Micro’s Cybertron, the rise of AI-powered Security Operations Centers (AI SOCs), and the critical need for AI governance, ethical frameworks, and data privacy. Concerns are also raised about threat actors leveraging AI for sophisticated attacks, such as malware generation and advanced phishing, alongside the potential for AI overuse to cause “cognitive atrophy” among security professionals.
- googleblog.com: Google announces Sec-Gemini v1, a new experimental cybersecurity model
- googleblog.com: Taming the Wild West of ML: Practical Model Signing with Sigstore
- intezer.com: Insights From HumanX 2025: The Rise of the AI SOC
- intezer.com: The Human Element in Intezer’s AI SOC: Balancing Automation with Expertise
- intezer.com: Solve Alert Overload: Meet Intezer at the RSAC 2025 Conference
- cisco.com: Unlocking the Privacy Advantage to Build Trust in the Age of AI
- microsoft.com: Analyzing open-source bootloaders: Finding vulnerabilities faster with AI
- darkreading.com: Trend Micro Open Sources AI Tool Cybertron
- cyberscoop.com: Cyber Command touts AI-driven gains in cybersecurity, network monitoring
- cio.com: Anthropic’s and OpenAI’s new AI education initiatives offer hope for enterprise knowledge retention
- zdnet.com: Want AI to work for your business? Then privacy needs to come first
- reddit.com: New attack vector on AI toolchains: Tool Poisoning in MCPs (Machine Code Models)
- eclecticiq.com: Bring your own LLM: Total control over AI in threat intelligence
- Phishing and social engineering attacks continue to evolve, incorporating new techniques to evade detection and deceive users. Recent campaigns frequently utilize QR codes embedded within email attachments (like PDFs) to bypass scanning and direct users, often via mobile devices, to credential harvesting pages. Threat actors are also hijacking legitimate email marketing platform accounts (Mailchimp, SendGrid) to distribute large-scale phishing emails, such as the ‘PoisonSeed’ campaign involving fake cryptocurrency wallet seed phrases. Additionally, seasonal events like tax season are actively leveraged with urgent-themed lures to deploy malware or steal sensitive information.
- microsoft.com: Threat actors leverage tax season to deploy tax-themed phishing campaigns
- bleepingcomputer.com: PoisonSeed phishing campaign behind emails with wallet seed phrases
- paloaltonetworks.com: Evolution of Sophisticated Phishing Tactics: The QR Code Phenomenon
- malwarebytes.com: QR codes sent in attachments are the new favorite for phishers
- malwarebytes.com: “Urgent reminder” tax scam wants to phish your Microsoft credentials
- schneier.com: Troy Hunt Gets Phished
- malwarebytes.com: Security expert Troy Hunt hit by phishing attack
- grahamcluley.com: Smashing Security podcast #411: The fall of Troy, and whisky barrel scammers
- socradar.io: The Blogspot Based Phishing Attacks
- Ransomware and data extortion remain prominent threats, with significant incidents affecting organizations like the Port of Seattle and Australian pension funds. Attackers employ credential stuffing and exploit known vulnerabilities for initial access. Some groups, like Hunters International (rebranding as World Leaks), are shifting strategies towards pure data extortion rather than encryption. The Ransomware-as-a-Service (RaaS) model continues to evolve, with groups like Medusa gaining momentum and potential collaborations or takeovers occurring, such as the rumored link between DragonForce and RansomHub.
- therecord.media: Port of Seattle says 90,000 people impacted in 2024 ransomware attack
- therecord.media: Cybercriminals are trying to loot Australian pension accounts in new campaign
- bleepingcomputer.com: Port of Seattle says ransomware breach impacts 90,000 people
- bleepingcomputer.com: Australian pension funds hit by wave of credential stuffing attacks
- bleepingcomputer.com: Hunters International shifts from ransomware to pure data extortion
- darkreading.com: Medusa Rides Momentum From Ransomware-as-a-Service Pivot
- thecyberexpress.com: DragonForce Claims to Be Taking Over RansomHub Ransomware Infrastructure
- rapid7.com: A Rebirth of a Cursed Existence? Examining ‘Babuk Locker 2.0’ Ransomware
- thecyberexpress.com: AustralianSuper, Rest, ART Among Victims in Widespread Superannuation Cyberattacks
Critical Vulnerabilities #
- A critical stack-based buffer overflow vulnerability (CVE-2025-22457) in Ivanti Connect Secure, Policy Secure, and ZTA Gateways allows unauthenticated remote code execution. It is actively exploited, reportedly by China-nexus threat actors (UNC5221), and has been added to CISA’s KEV catalog. Ivanti released patches for Connect Secure (v 22.7R2.6) and plans updates for Policy Secure (v 22.7R1.4 by Apr 21) and ZTA Gateways (v 22.8R2.2 by Apr 19); Pulse Connect Secure 9.1x is End-of-Support. CISA urges immediate patching for supported versions and recommends specific remediation steps, including factory resets for potentially compromised devices, especially those unpatched since Feb 28, 2025.
- cisecurity.org: A Vulnerability in Ivanti Products Could Allow for Remote Code Execution
- cisa.gov: CISA Adds One Vulnerability to the KEV Catalog
- cisa.gov: Ivanti Releases Security Updates for Connect Secure, Policy Secure & ZTA Gateways Vulnerability (CVE-2025-22457)
- google.com: Suspected China-Nexus Threat Actor Actively Exploiting Critical Ivanti Connect Secure Vulnerability (CVE-2025-22457)
- rapid7.com: Ivanti Connect Secure CVE-2025-22457 exploited in the wild
- darkreading.com: China-Linked Threat Group Exploits Ivanti Bug
- cyberscoop.com: China-backed espionage group hits Ivanti customers again
- therecord.media: CISA warns of latest Ivanti firewall bug being exploited by suspected Chinese hackers
- socradar.io: UNC5221 Targets Critical Ivanti Flaw (CVE-2025-22457) with TRAILBLAZE & BRUSHFIRE Malware
- Multiple vulnerabilities impact Industrial Control Systems (ICS): Hitachi Energy TRMTracker (CVE-2025-27631, CVE-2025-27632, CVE-2025-27633) has injection and XSS flaws. Hitachi Energy RTU500 series (CVE-2024-10037, CVE-2024-11499, CVE-2024-12169, CVE-2025-1445) suffer DoS risks. ABB drives with CODESYS RTS (CVE-2023-37559, CVE-2023-37558, CVE-2023-37557, CVE-2023-37556) face DoS or RCE. B&R APROL (multiple CVEs inc. CVE-2024-45480-4, CVE-2024-8313-4, CVE-2024-10206-10) has code injection, SSRF, XSS, and auth issues. Rockwell Automation using Veeam (CVE-2025-23120) has an RCE flaw via deserialization.
- cisa.gov: Hitachi Energy TRMTracker
- cisa.gov: ABB Low Voltage DC Drives and Power Controllers CODESYS RTS
- cisa.gov: CISA Releases Five Industrial Control Systems Advisories
- cisa.gov: B&R APROL
- cisa.gov: Hitachi Energy RTU500 Series
- cisa.gov: ABB ACS880 Drives Containing CODESYS RTS
- cisa.gov: Rockwell Automation Lifecycle Services with Veeam Backup and Replication
- cisa.gov: CISA Releases Two Industrial Control Systems Advisories
- thecyberexpress.com: CISA’s Latest Advisories Expose High-Risk Vulnerabilities in Industrial Control Systems
- Multiple vulnerabilities in Mozilla products (Firefox < 137, ESR < 128.9/115.22; Thunderbird < 137/ESR 128.9) could allow arbitrary code execution via use-after-free (CVE-2025-3028) and memory safety bugs (CVE-2025-3030, CVE-2025-3034). Additional issues include JIT optimization bugs (CVE-2025-3031), file descriptor leaks (CVE-2025-3032), URL spoofing (CVE-2025-3029), and information disclosure (CVE-2025-3035, CVE-2025-3033). Patching is strongly recommended.
- IBM AIX 7.2 and 7.3 are vulnerable to arbitrary command execution due to flaws in the nimesis NIM master service (CVE-2024-56346) and improper SSL/TLS protections in the nimsh service (CVE-2024-56347). Successful exploitation could allow attackers to install programs, modify data, or create privileged accounts. Administrators should apply the relevant IBM patches immediately.
- CISA added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation: Ivanti Connect Secure/Policy Secure/ZTA Gateways stack buffer overflow (CVE-2025-22457), Apache Tomcat path equivalence vulnerability (CVE-2025-24813), and Cisco Smart Licensing Utility static credential vulnerability (CVE-2024-20439). Federal agencies are required to patch by specified deadlines, and CISA strongly urges all organizations to prioritize remediation of these flaws.
- cisa.gov: CISA Adds One Vulnerability to the KEV Catalog
- cisa.gov: Ivanti Releases Security Updates for Connect Secure, Policy Secure & ZTA Gateways Vulnerability (CVE-2025-22457)
- cisa.gov: CISA Adds One Known Exploited Vulnerability to Catalog
- cisa.gov: CISA Adds One Known Exploited Vulnerability to Catalog
- rapid7.com: Metasploit Wrap-Up 04/04/2025
Major Incidents #
- The Port of Seattle announced that an August 2024 ransomware attack, attributed to the Rhysida group, resulted in a data breach affecting approximately 90,000 individuals. Stolen data, primarily from legacy systems containing employee, contractor, and parking information, included names, dates of birth, SSNs, and driver’s license numbers. The port refused to pay the ransom and is offering credit monitoring services to those affected.
- therecord.media: Port of Seattle says 90,000 people impacted in 2024 ransomware attack
- bleepingcomputer.com: Port of Seattle says ransomware breach impacts 90,000 people
- A large-scale credential stuffing campaign targeted multiple major Australian superannuation (pension) funds over the weekend of March 29-30, compromising potentially over 20,000 member accounts. Funds including AustralianSuper, Rest, Australian Retirement Trust, and Insignia Financial confirmed breaches, with AustralianSuper reporting 600 affected accounts and Rest noting potential PII exposure for 8,000 members. While most funds stated no unauthorized financial transactions occurred, some members reportedly lost savings, prompting funds to implement protective measures and urge password security best practices.
- therecord.media: Cybercriminals are trying to loot Australian pension accounts in new campaign
- bleepingcomputer.com: Australian pension funds hit by wave of credential stuffing attacks
- thecyberexpress.com: AustralianSuper, Rest, ART Among Victims in Widespread Superannuation Cyberattacks
- Europcar Mobility Group’s GitLab repositories were breached, leading to the theft of source code for Android and iOS apps, along with names and email addresses of up to 200,000 Goldcar and Ubeeqo customers, some dating back to 2017/2020. The attacker attempted extortion, threatening to leak 37GB of data containing backups and infrastructure details. Europcar confirmed the breach, stated no financial data was exposed, and is notifying affected customers and authorities.
- bleepingcomputer.com: Europcar GitLab breach exposes data of up to 200,000 customers
- A threat actor known as ‘Satanic’ advertised on BreachForums the alleged sale of a database containing nearly 849,000 customer and company records purportedly stolen from Twilio SendGrid. The data, offered for $2,000, allegedly includes PII, company financials, employee details, and tech stack information, with samples referencing major companies like Bank of America and BBC. Twilio is investigating the claim, but its authenticity remains unverified.
- Threat actor ‘CoreInjection’ claimed a breach of Check Point Software Technologies, offering allegedly stolen internal data (network diagrams, credentials, customer info) for sale on a hacker forum. Check Point acknowledged a limited incident from December 2024 involving compromised portal credentials but stated the issue was contained, had no impact on customer environments or production systems, and that the actor’s claims are exaggerated.
Emerging Threats #
- A joint advisory from multiple international cybersecurity agencies (NSA, CISA, FBI, ACSC, CCCS, NCSC-NZ) highlights “Fast Flux” as a significant national security threat. This DNS technique rapidly changes IP addresses associated with a domain, allowing threat actors (cybercriminals and nation-states) to obfuscate server locations, evade IP blocking, and maintain resilient C2 infrastructure for malware delivery, phishing, and bulletproof hosting. Organizations are urged to implement multi-layered detection using tools like Protective DNS (PDNS) that can identify and block malicious fast flux activity.
- cisa.gov: NSA, CISA, FBI, and International Partners Release Cybersecurity Advisory on “Fast Flux,” a National Security Threat
- cisa.gov: Fast Flux: A National Security Threat
- substack.com: CTO at NCSC Summary: week ending April 6th
- darkreading.com: CISA Warns: Old DNS Trick ‘Fast Flux’ Is Still Thriving
- cyberscoop.com: International intelligence agencies raise the alarm on fast flux
- sysdig.com: Detecting Fast Flux with Sysdig Secure and VirusTotal
- hackread.com: NSA and Global Allies Declare Fast Flux a National Security Threat
- The ‘PoisonSeed’ phishing campaign compromises corporate email marketing accounts (Mailchimp, SendGrid, HubSpot, etc.) to distribute emails containing pre-generated cryptocurrency wallet seed phrases. Targeting large mailing lists, attackers trick recipients (e.g., via fake Coinbase migration alerts) into using these compromised seeds for new wallets, allowing the threat actors to steal any deposited funds. This highlights the growing risk of attacks leveraging marketing platforms and the critical importance of users generating their own secure seed phrases.
- bleepingcomputer.com: PoisonSeed phishing campaign behind emails with wallet seed phrases
- A web skimming campaign dubbed ‘RolandSkimmer’ is targeting e-commerce sites using platforms like WooCommerce, WordPress, and PrestaShop. The attack injects malicious JavaScript that mimics legitimate payment forms and utilizes a deprecated Stripe API to validate stolen credit card details in real-time before exfiltrating the valid card data to attacker-controlled servers. This validation step increases the efficiency of the card theft operation.
- Attackers are exploiting WordPress’s “Must-Use” (MU) plugins feature to establish persistent backdoors and hide malware. Malicious PHP files placed in the
wp-content/mu-pluginsdirectory are automatically activated and cannot be disabled through the standard admin interface. Observed malicious MU-plugins include those that redirect visitors to malware sites, provide remote access backdoors (index.php), or inject spam/malicious content (custom-js-loader.php), making detection and removal more challenging for website owners. - The persistent Outlaw malware continues compromising Linux systems via SSH brute-forcing and cron persistence, deploying XMRig miners and using IRC for C2. Separately, North Korea-linked BeaverTail malware is being spread through phishing emails disguised as recruitment offers, using downloaders like “car.dll” to install the BeaverTail infostealer and the Tropidoor backdoor. These campaigns highlight ongoing threats targeting Linux and leveraging social engineering for initial access.
Regulatory and Policy Updates #
- Cybersecurity regulations and national strategies are being updated globally. The UK released a policy statement for its Cyber Security and Resilience Bill targeting critical infrastructure. The US extended the national emergency concerning malicious cyber activities and proposed HIPAA Security Rule updates. Japan enacted a Cyber Defense Bill, and the European Commission launched the ProtectEU strategy to enhance internal security coordination, intelligence sharing, and resilience against cyber/hybrid threats across member states.
- substack.com: CTO at NCSC Summary: week ending April 6th
- health-isac.org: President Trump extends national emergency over cyber threats for another year
- health-isac.org: How HTM Staff Can Prepare for the Proposed HIPAA Security Rule Changes
- archive.ph: Continuation of the National Emergency With Respect to Significant Malicious Cyber-Enabled Activities
- darkreading.com: Japan Bolsters Cybersecurity Safeguards With Cyber Defense Bill
- thecyberexpress.com: ProtectEU Is Here – But Can It Really Protect Europe from Rising Security Threats?
- A bipartisan bill, the Combatting Money Laundering in Cyber Crime Act, has been reintroduced in the US Senate by Sens. Cortez Masto and Grassley. The legislation aims to expand the U.S. Secret Service’s authority to investigate financial cybercrimes involving digital assets and unlicensed money transmitting businesses. This addresses a gap in current law, allowing the agency to probe transnational cybercriminal activity using cryptocurrencies more effectively.
- A US House subcommittee hearing focused on the cybersecurity risks of legacy medical devices highlighted significant challenges. Experts testified about the lack of comprehensive asset inventory across the healthcare sector, making it difficult to track devices, notify users of vulnerabilities, and apply patches effectively, especially for devices resold on the secondary market. Concerns were also raised about the potential impact of HHS/FDA staffing cuts on cybersecurity oversight for medical devices.
- house.gov: Aging Technology, Emerging Threats: Examining Cybersecurity Vulnerabilities in Legacy Medical Devices
- health-isac.org: Medical device cybersecurity could be challenged by HHS staffing cuts
- cyberscoop.com: Dispersed responsibility, lack of asset inventory is causing gaps in medical device cybersecurity
- darkreading.com: FDA’s Critical Role in Keeping Medical Devices Secure
- Leaders of the House Homeland Security Subcommittee on Cybersecurity expressed concern over proposed personnel cuts at CISA, arguing the agency needs more resources, not less. Legislative priorities include reauthorizing the 2015 Cybersecurity Information Sharing Act (CISA), renewing the state and local cybersecurity grant program, and potentially codifying the Joint Cyber Defense Collaborative (JCDC). They also plan further oversight on CISA’s implementation of the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) regulations.
Security Operations #
- Industry-specific Information Sharing and Analysis Centers (ISACs) are releasing updated resources to enhance sector cybersecurity. Auto-ISAC published revised Best Practice Guides for the automotive industry, emphasizing vulnerability management, secure development, and third-party risk. FS-ISAC introduced a Cyber Fraud Prevention Framework to foster better collaboration between security and fraud teams within the financial sector. Health-ISAC continues to advocate for robust resilience planning and information sharing to protect patient safety in healthcare.
- automotiveisac.com: Auto-ISAC Releases Updated “Best Practice Guides” for Automotive Community
- fsisac.com: [Future CISO] FS-ISAC Releases Cyber Fraud Prevention Framework
- fsisac.com: [Finextra] FS-ISAC Releases Cyber Fraud Prevention Framework
- fsisac.com: FS-ISAC Releases Cyber Fraud Prevention Framework to Strengthen Collaboration Between Fraud and Cybersecurity Teams
- health-isac.org: For healthcare orgs, disaster recovery means making sure docs can save lives during ransomware infection
- health-isac.org: The Significance of Cybersecurity in Global Health
- health-isac.org: The critical link in patient safety: A collaborative defense
- AI continues to be integrated into security operations, aiming to improve threat detection, analysis, and response times. Google introduced Sec-Gemini v1, an AI model enhanced with real-time threat intelligence. Trend Micro open-sourced its AI tool, Cybertron. AI SOC platforms like Intezer automate alert triage and investigation. The Model Context Protocol (MCP) is emerging as a standard to streamline interactions between LLMs and security tools, potentially accelerating automation and improving analyst efficiency.
- googleblog.com: Google announces Sec-Gemini v1, a new experimental cybersecurity model
- darkreading.com: Trend Micro Open Sources AI Tool Cybertron
- intezer.com: Insights From HumanX 2025: The Rise of the AI SOC
- intezer.com: The Human Element in Intezer’s AI SOC: Balancing Automation with Expertise
- intezer.com: Solve Alert Overload: Meet Intezer at the RSAC 2025 Conference
- cyberscoop.com: Cyber Command touts AI-driven gains in cybersecurity, network monitoring
- detectionatscale.com: MCP: Building Your SecOps AI Ecosystem
- Security analysts can utilize platforms like ANY.RUN’s Threat Intelligence Lookup and interactive sandbox for proactive hunting and investigation of Linux malware. These tools allow searching for specific indicators (OS versions, threat names like XORbot) and examining detailed analysis reports, including process activity, network communications (potentially identifying Fast Flux), and extracted IOCs. This approach aids in understanding threat behavior and strengthening defenses against Linux-specific attacks.
- medium.com: How to Hunt and Investigate Linux Malware
- To enhance AI/ML supply chain security, the Open Source Security Foundation, Google, NVIDIA, and HiddenLayer have released a stable version of a model signing library. Utilizing Sigstore, this library enables cryptographic signing and verification of machine learning models. This ensures that models used in applications are authentic and have not been tampered with, addressing a critical security need analogous to code signing for software.
- Independent testing by CyberRatings.org revealed that native Cloud Network Firewalls from major providers (AWS, Azure, GCP) significantly underperformed against exploits and evasions compared to several third-party solutions. AWS, Azure, and GCP all received 0% overall security effectiveness scores in the evaluation, largely due to failures in preventing evasions or lack of HTTPS decryption. This suggests organizations may achieve stronger cloud security by complementing or replacing native tools with specialized third-party firewalls.
Wins #
- The US Department of Justice successfully seized over $8 million derived from a large-scale “pig butchering” cryptocurrency investment scam. Investigators traced the illicit funds through a complex web of transactions across multiple crypto platforms to identify and confiscate the assets held in three primary accounts linked to the fraudulent operation.
- darkreading.com: DoJ Seizes Over $8M From Sprawling Pig Butchering Scheme
- An international law enforcement operation, coordinated across more than 35 countries and supported by Europol, dismantled “Kidflix,” identified as one of the largest child sexual abuse material (CSAM) websites on the dark web. The operation resulted in the seizure of the platform’s servers, 79 arrests, the identification of nearly 1,400 suspects, and the rescue of 39 children. The platform had incentivized the upload and sharing of CSAM through a token-based system.
Disclaimer #
The summaries in this brief are generated autonomously by an LLM model from the provided system and user prompts. While every effort is made to consolidate accurate and relevant insights, the model may occasionally misinterpret, misrepresent, or hallucinate information. Readers are strongly advised to verify all key points by consulting the original sources linked in the brief for complete context and accuracy.
This document is created with BlackStork and is based on the template available on GitHub.
Reach out if you have questions or suggestions.