Security Affairs.

"Security Affairs Malware Newsletter, Round 41."

Views expressed in this cybersecurity, cyber crime update are those of the reporters and correspondents.  Accessed on 14 April 2025, 0054 UTC.

Content and Source:  Email subscription via https://feedly.com.

Please check link or scroll down to read your selections.  Thanks for joining us today.

Russ Roberts (https://www.hawaiicybersecurityjournal.net).

 Security Affairs

72K followers24 articles per week

#security#tech

19

Today

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 41

by Pierluigi Paganini / 12h

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads BadBazaar: iOS and Android Surveillanceware by China’s APT15 Used to Target Tibetans and Uyghurs GOFFEE continues to attack organizations in Russia Atomic and Exodus

Security Affairs newsletter Round 519 by Pierluigi Paganini – INTERNATIONAL EDITION

by Pierluigi Paganini / 13h

A new round of the weekly SecurityAffairs newsletter arrived! Every week the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Symbolic Link trick lets attackers bypass FortiGate patches, Fortinet warns Attackers are exploiting recently disclosed OttoKit WordPress plugin flaw Labo

Yesterday

China admitted its role in Volt Typhoon cyberattacks on U.S. infrastructure

2 TTPs

•

by Pierluigi Paganini / 16h

•

China admits Volt Typhoon cyberattacks

China admitted in a secret meeting with U.S. officials that it conducted Volt Typhoon cyberattacks on U.S. infrastructure, WSJ reports. China reportedly admitted in a secret meeting with U.S. officials that it carried out cyberattacks on U.S. infrastructure, linked to the Volt Typhoon campaign. According to the Wall Street Journal, at a December Geneva summit, Chinese officials indirectly admitte

Symbolic Link trick lets attackers bypass FortiGate patches, Fortinet warns

Defense Evasion (Enterprise TA0005)

•

by Pierluigi Paganini / 1d

Fortinet warns attackers can keep read-only access to FortiGate devices even after the original vulnerability is patched. Fortinet warns that threat actors can retain read-only access to FortiGate devices even after the original vulnerability used for the breach has been patched. The cybersecurity firm revealed that attackers exploited known FortiGate flaws like CVE-2022-42475 , CVE-2023-27997 ,

Attackers are exploiting recently disclosed OttoKit WordPress plugin flaw

by Pierluigi Paganini / 1d

Threat actors are exploiting a vulnerability in the OttoKit WordPress plugin, a few hours after public disclosure. Threat actors are exploiting a recently discovered vulnerability, tracked as CVE-2025-3102 (CVSS score of 8.1) in the OttoKit WordPress plugin (formerly SureTriggers), a few hours after public disclosure. An attacker can trigger the vulnerability to create malicious administrator use

Apr 11, 2025

Laboratory Services Cooperative data breach impacts 1.6 Million People

by Pierluigi Paganini / 2d

Laboratory Services Cooperative discloses a data breach from October 2024 that exposed personal and medical info of 1.6 million individuals. Laboratory Services Cooperative disclosed a data breach that impacted the personal and medical information of 1.6 million people . The Laboratory Services Cooperative (LSC) is a clinical laboratory based in Bremerton, Washington, providing diagnostic testing

Palo Alto warns of brute-force login attempts on PAN-OS GlobalProtect gateways indicating possible upcoming attacks

5 TTPs

•

by Pierluigi Paganini / 2d

Experts warn of brute-force login attempts on PAN-OS GlobalProtect gateways following increased scanning activity on its devices. Palo Alto Networks reports brute-force login attempts on PAN-OS GlobalProtect gateways. The security firm pointed out that no known vulnerability has been exploited, but monitoring and analysis continue. “Our teams are observing evidence of activity consistent with pas

Apr 10, 2025

Gamaredon targeted the military mission of a Western country based in Ukraine

19 TTPs

•

by Pierluigi Paganini / 2d

•

Shuckworm targets Ukraine military mission

Gamaredon targeted a foreign military mission in Ukraine with updated GammaSteel malware on Feb 26, 2025, per Symantec. Symantec Threat Hunter researchers reported that the Russia-linked APT group Gamaredon (a.k.a. Shuckworm, Armageddon , Primitive Bear , ACTINIUM , Callisto ) targeted a foreign military mission based in Ukraine with an updated version of the GamaSteel infostealer. Shuckworm is k

U.S. CISA adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog

by Pierluigi Paganini / 3d

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Linux Kernel flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Linux Kernel flaws, respectively tracked as CVE-2024-53197 and CVE-2024-53150 , to its Known Exploited Vulnerabilities (KEV) catalog . The vulnerability CVE-2024-53197 (CVSS score of 7.8) resides

AkiraBot: AI-Powered spam bot evades CAPTCHA to target 80,000+ websites

by Pierluigi Paganini / 3d

AkiraBot, a CAPTCHA-evading Python framework, has spammed over 80,000 websites with AI-generated messages, targeting small and medium-sized businesses. SentinelOne’s SentinelLabs researchers warn that AkiraBot, a spam framework, targets websites’ chats and contact forms to promote low-quality SEO services, AkiraBot has already targeted more than 400,000 websites and successfully spammed at least

An APT group exploited ESET flaw to execute malware

10 TTPs

•

by Pierluigi Paganini / 3d

•

CVE-2024-11859

At least one APT group has exploited a vulnerability in ESET software to stealthily execute malware, bypassing security measures. Kaspersky researchers reported that an APT group, tracked as ToddyCat , has exploited a vulnerability in ESET software to stealthily execute malware, bypassing security. The vulnerability, tracked as CVE-2024-11859 , is a DLL Search Order Hijacking issue that potential

Oracle confirms the hack of two obsolete servers hacked. No Oracle Cloud systems or customer data were affected

8 TTPs

•

by Pierluigi Paganini / 3d

•

Oracle faces criticism over security incidents

Oracle confirmed a hacker stole credentials from two obsolete servers but said no Oracle Cloud systems or customer data were affected. Oracle confirmed a hacker stole and leaked credentials from two obsolete servers, but said no Oracle Cloud systems or customer data were affected. The threat actor accessed usernames from two outdated, non-Oracle Cloud Infrastructure (OCI) servers, but no customer

Apr 9, 2025

National Social Security Fund of Morocco Suffers Data Breach

2 TTPs

•

by Pierluigi Paganini / 4d

•

Morocco blames Algeria for cyberattack

Threat actor ‘Jabaroot’ claims breach of National Social Security Fund of Morocco, aiming to steal large volumes of sensitive citizen data. Resecurity has identified a threat actor targeting government systems in Morocco with the goal of exfiltrating large volumes of sensitive data relating to citizens. The actor using the alias ‘Jabaroot’ released claims about the successful compromise of the Na

Critical Fortinet FortiSwitch flaw allows remote attackers to change admin passwords

2 TTPs

•

by Pierluigi Paganini / 4d

Fortinet addressed a critical vulnerability in its FortiSwitch devices that can be exploited to change administrator passwords remotely. Fortinet has released security updates to address a critical vulnerability, tracked as CVE-2024-48887 (CVSS score 9.8), in its FortiSwitch devices. A remote attacker can exploit the vulnerability to change administrator passwords. “An unverified password change

The US Treasury’s OCC disclosed an undetected major email breach for over a year

3 TTPs

•

by Pierluigi Paganini / 4d

•

Hackers accessed US bank regulators' emails

The US Office of the Comptroller of the Currency (OCC) disclosed a major email breach compromising 100 accounts, undetected for over a year. The US Treasury’s Office of the Comptroller of the Currency (OCC) disclosed an undetected major email breach for over a year. The cybersecurity incident involved unauthorized access to emails via a compromised admin account. The breach was confirmed on Feb.

U.S. CISA adds Gladinet CentreStack and ZTA Microsoft Windows Common Log File System (CLFS) Driver flaws to its Known Exploited Vulnerabilities catalog

by Pierluigi Paganini / 4d

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Gladinet CentreStack and ZTA Microsoft Windows Common Log File System (CLFS) Driver flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Gladinet CentreStack and ZTA Microsoft Windows Common Log File System (CLFS) Driver flaws, respectively tracked as CVE-2025-

Apr 8, 2025

WhatsApp fixed a spoofing flaw that could enable Remote Code Execution

2 TTPs

•

by Pierluigi Paganini / 5d

WhatsApp addressed a flaw, tracked as CVE-2025-30401, that could allow attackers to trick users and enable remote code execution. WhatsApp released a security update to address a vulnerability, tracked as CVE-2025-30401, that could let attackers trick users and enable remote code execution. The spoofing flaw impacts WhatsApp for Windows before version 2.2450.6. An attacker could exploit the vulne

Everest ransomware group’s Tor leak site offline after a defacement

5 TTPs

•

by Pierluigi Paganini / 5d

•

Everest ransomware gang site hacked

The Tor leak site of the Everest ransomware group went offline after being hacked and defaced over the weekend. The Everest ransomware gang’s darknet site went offline after being hacked and defaced, with victim listings replaced by the following message. “Don’t do crime CRIME IS BAD xoxo from Prague” read the message published on the site’s homepage after the defacement. Later, the site went dow

Apr 7, 2025

Google fixed two actively exploited Android zero-days

by Pierluigi Paganini / 5d

Google addressed 62 vulnerabilities with the release of Android ‘s April 2025 security update, including two actively exploited zero-days. Google released Android ‘s April 2025 security updates to address 62 vulnerabilities, including two zero-day vulnerabilities ( CVE-2024-53197 , CVE-2024-53150 ) exploited in targeted attacks. The vulnerability CVE-2024-53197 is a Linux kernel issue affecting A

End of feed