Cybersecurity News | Daily Recap [23 May 2025]

hendryadrian.com

hendryadrian.com

Ransomware & Cybercrime Takedowns

• The FBI warns that the Silent Ransom Group (aka Luna Moth) targets U.S. law firms via social engineering to demand ransoms up to $8 million without encrypting systems – Luna Moth Attacks
• Law enforcement operations dismantled ransomware networks seizing 300 servers, €3.5M, and arrested dozens targeting malware like QakBot, TrickBot, and DanaBot in a global crackdown – Ransomware Crackdown, DanaBot Disrupted, Server Seizure
• The U.S. indicted Russian national Rustam Gallyamov for leading the QakBot botnet used in global ransomware attacks, linked to seizures of over $24 million in cryptocurrency – QakBot Indictment, QakBot Charges, QakBot DOJ Charges

Malware & Exploits

• Cybercriminals exploit TikTok’s viral AI-generated videos to spread infostealer malware Vidar and StealC, delivering PowerShell commands that steal credentials and crypto wallets – TikTok Malware, TikTok Infostealer
• The threat actor ViciousTrap leverages a critical Cisco vulnerability (CVE-2023-20118) to compromise over 5,300 devices globally, turning them into honeypots to intercept networks, with heavy infections in Macau – ViciousTrap Cisco Flaw
• Fake Ledger apps on macOS deceive users to steal cryptocurrency seed phrases using sophisticated malware like Odyssey and AMOS, exposing wallets to theft – Fake Ledger Apps
• A Chinese-linked group exploits a zero-day in Trimble Cityworks (CVE-2025-0994) to infiltrate U.S. local governments with malware and webshells, maintaining persistent access – Cityworks Zero-Day, Cityworks Attacks, Cityworks Exploitation
• A newly discovered Linux kernel zero-day (CVE-2025-37899) in SMB was found by OpenAI’s language model o3, showcasing AI’s growing role in vulnerability research – Linux SMB Zero-Day
• The AI assistant GitLab Duo suffers from a prompt injection vulnerability that allows attackers to hijack AI responses, risking source code theft and malicious HTML injections – GitLab Duo Flaw
• Chinese espionage actors exploit Ivanti Endpoint Manager Mobile vulnerabilities to target enterprises across Europe and North America, focusing on data theft and device control – Ivanti Exploits
• Akamai and Microsoft diverge over the severity of the unpatched BadSuccessor privilege escalation flaw in Windows Server 2025, with Akamai warning of critical risks in Active Directory – BadSuccessor Flaw
• The decentralized crypto platform Cetus Protocol suffered a massive $223M hack on the Sui blockchain, triggering contract locks and fund recovery efforts – Cetus Protocol Hack, Cetus Crypto Theft

Corporate Breaches & Vulnerabilities

• Coca-Cola and its bottling partner suffered ransomware and data breaches attributed to the Everest and Gehenna hacking groups, exposing sensitive employee and customer data – Coca-Cola Breaches
• Companies are warned of active exploitation of a Commvault SaaS zero-day vulnerability (CVE-2025-3928) targeting Azure-hosted backup services, prompting elevated security monitoring – Commvault Exploitation, CISA SaaS Warning
• A new malvertising campaign abuses trusted Google domains and outdated JSONP APIs to deliver phishing scripts stealing payment data and impacting major brands like Ray-Ban – Google Domains Malvertising
• Cloudflare patched a request smuggling bug (CVE-2025-4366) in its Pingora OSS framework that could leak visitor URLs and redirect users to malicious sites – Cloudflare Fix

AI & Privacy Enhancements

• Signal introduced a screenshot-blocker on Windows 11 to combat Microsoft’s Windows Recall feature, enhancing user privacy against OS-level activity logging – Signal Screenshot-Blocker
• Microsoft rolled out AI-powered text writing and editing features in Windows 11 Notepad, Paint, and Snipping Tool for Insiders, showcasing increased AI integration in productivity apps – Windows 11 AI Features
• Anthropic released the AI model Claude 4 with benchmark improvements but retains a constrained 200K token context window that limits handling large projects – Claude 4 Benchmarks

Cyber Espionage & Geopolitical Threats

• Russian-aligned hackers launched a phishing-based cyber-espionage campaign targeting government and research institutions in Tajikistan, using macro-enabled Word documents to evade detection – Russian Espionage Tajikistan
• The pro-Kremlin Russian hacker group Killnet resurfaced with a new identity, shifting from hacktivism to profit-driven cybercrime amid geopolitical tensions – Killnet Returns

Security Tools & Solutions

• SafeLine launched an open-source Web Application Firewall (WAF) offering zero-day detection, bot protection, and DDoS mitigation as a self-hosted alternative to cloud WAFs – SafeLine WAF

Cybersecurity News | Daily Recap – hendryadrian.com