Cybersecurity News | Daily Recap [25 Jun 2025]

hendryadrian.com

hendryadrian.com

Microsoft Windows Updates

• Microsoft extends Windows 10 Extended Security Updates (ESU) until October 2026, offering free and affordable enrollment options for individuals and businesses to maintain security post EOS in 2025 – Windows 10 Extended Updates, Windows 10 ESU Extension, Windows 10 ESU via Rewards
• Microsoft releases June 2025 preview update KB5061087 for Windows 10 fixing bugs and improves system features, while also addressing update failures on Windows 11 with KB5062324 – Windows 10 KB5061087, Windows 11 Update Fix

Data Breaches & Cybercrime Arrests

• French police arrested several suspects operating the BreachForums hacking forum involved in selling stolen data, striking a blow to major cybercrime marketplaces – BreachForums Arrests, BreachForums Arrests Follow-up
• Mainline Health and Select Medical disclosed data breaches impacting over 100,000 individuals each, with ransomware gang INC claiming responsibility for sensitive patient data theft highlighting persistent healthcare threats – Mainline Health Breach, Healthcare Data Breaches
• A pro-Iranian hacktivist group leaked thousands of personal records from the 2024 Saudi Games, illustrating cyber operations intertwined with geopolitical conflicts in the Middle East – Saudi Games Data Leak
• A large-scale data breach in Paraguay exposed 7.4 million citizens’ records via info-stealing malware infecting government employees, attributed to threat actor Brigada Cyber PMC – Paraguay Infostealer Breach

Ransomware & Malware Campaigns

• A ransomware attack by the Qilin group disrupted UK NHS blood testing services, exposing data of 900K+ individuals and contributing to a patient death, demonstrating severe impacts of cyberattacks on healthcare – NHS Qilin Ransomware
• Threat actors are abusing ConnectWise remote access tools via Authenticode stuffing and distributing a trojanized version of SonicWall NetExtender VPN signed with fake certificates to steal credentials – ConnectWise Malware Abuse, SonicWall NetExtender Trojan, SonicWall & ConnectWise Campaign, NetExtender Credential Theft
• Stormous ransomware group exploited infostealer malware to breach retail giant Hy-Vee, compromising 53GB of internal data and highlighting the role of infostealers in major attacks – Hy-Vee Data Heist
• Hackers are poisoning Google search results related to AI tools to distribute info-stealer malware families like Vidar, Lumma, and Legion Loader through black hat SEO and fake AI websites – AI Tool Search Result Poisoning
• Androxgh0st botnet expanded by exploiting U.S. university servers including UC San Diego with remote code execution and web shells, leveraging legitimate domains for malicious activity – Androxgh0st Botnet Expansion
• An advanced malware campaign targeting WordPress and WooCommerce sites deploys hidden skimmers across 20+ variants to steal credit card and credentials in real-time – WordPress Skimmer Campaign
• North Korea-linked supply chain attack delivered via 35 malicious npm packages exfiltrates data and installs malware like BeaverTail and InvisibleFerret, targeting developers – North Korea npm Attack

Critical Vulnerabilities & Security Patches

• Citrix released emergency patches for actively exploited vulnerabilities including CVE-2025-6543 memory overflow and the CitrixBleed 2 flaw allowing session hijacking in NetScaler ADC and Gateway systems – Citrix Emergency Patches, CitrixBleed 2 Flaw, SAP GUI Vulnerabilities
• A critical remote code execution vulnerability CVE-2025-52562 was found in Performave Convoy KVM server panel allowing unauthenticated attackers to fully compromise servers – Convoy RCE Flaw
• Significant vulnerabilities impact millions of Brother and other vendor printers enabling remote unauthorized access and reconfiguration without authentication – Brother Printer Vulnerabilities
• A new privilege escalation vulnerability (CVE-2025-36537) in TeamViewer Remote Management for Windows allows local users to gain SYSTEM access and delete files, prompting urgent patches – TeamViewer Privilege Escalation
• Xiaomi Mi Connect Service App vulnerability (CVE-2024-45347) allows remote attackers on the same network to control smart devices without user permission – Xiaomi Mi Connect Flaw
• A critical WinRAR vulnerability enables remote code execution via malicious archives; users encouraged to update to version 7.12 Beta 1 or newer to mitigate risks – WinRAR RCE Vulnerability

Phishing & Social Engineering

• A sophisticated phishing campaign impersonating the U.S. Social Security Administration compromised over 2,000 devices via weaponized emails and fake sites, highlighting risks from social engineering – SSA Phishing Campaign
• A coordinated SMS phishing scam impersonating U.S. DMV agencies exploits victims’ trust to steal personal and financial data, attributed to Chinese threat actors – DMV Phishing Scam
• Trezor’s support platform is abused by phishing attackers sending deceptive emails to steal cryptocurrency seed phrases, urging caution among users – Trezor Phishing Abuse
• A new U.S. visa rule requires applicants to set social media profiles to public for identity verification, raising privacy and security considerations – US Social Media Visa Rule

Geopolitical & Nation-State Threats

• Russian APT28 targets Ukrainian government using malware delivered via Signal messages including backdoors BeardShell and SlimAgent for espionage – APT28 Signal Malware
• Iranian hacktivists conducted DDoS attacks against U.S. organizations following military strikes, part of wider ongoing Middle East cyber conflicts – Iranian Hacktivist DDoS
• The Middle East cyberwar escalates with operations including GPS spoofing, fake alerts, crypto hacks, and IP camera spying, signaling a new era of cyber-kinetic warfare – Middle East Cyberwar
• The U.S. FBI warns ongoing espionage threats by China’s Typhoon groups continue despite Mideast distractions, highlighting persistent strategic cyber risks – China Typhoon Espionage
• APT36 launched advanced phishing against Indian defense personnel using anti-analysis malware and NIC impersonation, demonstrating sophisticated tactical espionage efforts – APT36 Advanced Phishing

Organizational Cyber Incidents

• Glasgow City Council suffered a cyber incident disrupting online services and raising concerns about possible customer data theft from third-party managed servers – Glasgow Cyber Incident
• Security risks arise from guest user permissions in Microsoft Entra ID, allowing attackers to escalate privileges and manipulate tenant policies covertly – Entra Guest User Risk

Cybersecurity News | Daily Recap – hendryadrian.com