Cybersecurity News | Daily Recap [03 Jul 2025]

hendryadrian.com

hendryadrian.com

Ransomware & Data Breaches

• IdeaLab confirms Hunters International ransomware stole sensitive employee data in an October 2024 breach with data leaked on the dark web – IdeaLab data theft; shortly after, Hunters International shut down and released free decryptors to victims – Hunters International shutdown.
• Kelly Benefits suffers a breach exposing data of over 550,000 individuals including Social Security numbers and health info – Kelly Benefits breach; Qantas reveals a cyberattack compromised personal details of 6 million customers, with no financial data affected – Qantas data theft.
• Medical device maker Surmodics reports a cyberattack disrupting operations and is assessing stolen data impact after notifying law enforcement – Surmodics cyberattack.
• California jury orders Google to pay $314 million for alleged unauthorized Android cellular data collection without user consent – Google data lawsuit.
• Columbia University targeted by a politically motivated hacker stealing sensitive student and staff data, investigation ongoing – Columbia data breach.

North Korean Cyber Threats

• Microsoft shuts down 3,000 email accounts tied to North Korean IT workers employing AI and voice-changer tech for fraud – Microsoft blocks North Korean emails.
• North Korean hackers deploy advanced Nim-based NimDoor malware targeting macOS users in web3 and crypto sectors using fake Zoom updates and persistent signal handlers – NimDoor macOS malware, NimDoor persistence, North Korea targets Web3.

Cybercrime & Hacktivism in Conflict

• Pro-Russian hacktivist groups including IT Army of Russia and TwoNet intensify attacks on Ukraine via DDoS, insider recruitment, and data theft, escalating toward Western critical infrastructure and ICS targets – Pro-Russian hacktivist groups, Hacktivist offensive escalation.
• Spanish authorities arrest hackers in Las Palmas responsible for stealing government data targeting politicians and journalists for online leaks – Spain hacker arrests.
• Interpol identifies West Africa as an emerging hotspot for cybercrime compounds linked with human trafficking, paralleling trends in the Middle East, Central America, and Southeast Asia – Interpol on West Africa cybercrime.
• China-linked hackers operate extensive phishing networks impersonating major brands like Apple and PayPal to steal shopper payment details, posing ongoing risks despite takedowns – China-linked phishing scams.

Vulnerabilities & Exploits

• Cisco issues urgent patches for critical CVE-2025-20309 in Unified Communications Manager that allows root access through hardcoded credentials, prompting immediate mitigation – Cisco hardcoded credentials, Cisco patch CVE-2025-20309, Cisco critical vulnerability, Cisco backdoor fix.
• Citrix warns of login issues following NetScaler ADC and Gateway patches for vulnerabilities exploited in session hijacking and DoS, requiring urgent configuration fixes – Citrix login issues.
• WordPress Forminator plugin suffers a critical vulnerability (CVE-2025-6463) allowing unauthenticated file deletion and potential site takeover, urging users to update to version 1.44.3 – Forminator plugin flaw.
• CISA adds TeleMessage TM SGNL vulnerabilities involving insecure resource initialization and core dump exposure to Known Exploited Vulnerabilities catalog, calling for immediate patching – TeleMessage vulnerabilities.

Security Software & Platform Updates

• Microsoft releases Exchange Server Subscription Edition featuring evergreen licensing as the sole supported on-prem version after October 2025, modernizing enterprise email infrastructure – Exchange Server SE launch.
• Microsoft addresses Windows Firewall Event 2042 errors caused by a new feature not affecting system security, advising users to ignore them until a fix is released – Windows Firewall errors.
• Adaptive AI in SOC platforms delivers dynamic real-time threat analysis surpassing static models, thus enhancing detection accuracy and reducing analyst workload – AI SOC tools advantage.

Malware & Browser Threats

• Security flaw in Android spyware Catwatchful leaks more than 62,000 user credentials via a vulnerable Firebase database, exposing detailed personal data – Catwatchful data leak.
• Over 40 malicious Firefox extensions have been discovered stealing cryptocurrency wallet secrets by impersonating popular wallet tools, with Mozilla removing most and improving detection – Malicious Firefox extensions.

Geopolitical Cyber Cooperation

• Germany and Israel plan to deepen cybersecurity collaboration through a joint research center “Cyber Dome” enhancing defenses against Iranian and other foreign cyber threats – Germany-Israel cyber partnership.

Cloud Service & Access Issues

• Microsoft investigates intermittent SharePoint Online access problems related to authentication cookies and recommends incognito mode as a workaround – Microsoft SharePoint issues.

Cybersecurity News | Daily Recap – hendryadrian.com