An initial access broker exploited leaked Machine Keys on ASP.NET sites to gain unauthorized access to organizations. The group, tracked as TGR-CRI-0045, targeted industries in Europe and the U.S.including finance, manufacturing, and technology. They used ASP.NET View State deserialization to execute malicious payloads in server memory, minimizing forensic artifacts. The attackers deployed post-exploitation tools for persistence and privilege escalation. The campaign began in October 2024, with increased activity from January to March 2025. Organizations are advised to review and remediate compromised Machine Keys following Microsoft's guidance. The threat group is possibly linked to Gold Melody based on overlapping indicators and tactics.
Employee gets $920 for credentials used in $140 million bank heist
Source: https://www.bleepingcomputer.com/news/security/employee-gets-920-for-credentials-used-in-140-million-bank-heist/
Cisco Issues Emergency Fix for Critical Root Credential Flaw in Unified CM
Source: https://hackread.com/cisco-emergency-fix-critical-root-credential-flaw-unified-cm/
DPRK threat actors are targeting Web3 and crypto-related businesses using Nim-compiled binaries and multiple attack chains. The malware, dubbed NimDoor, employs unusual techniques for macOS, including process injection and encrypted WebSocket communications. It uses a novel persistence mechanism leveraging signal handlers and deploys AppleScripts as beacons and backdoors. The attack chain begins with social engineering via Telegram, leading to the execution of malicious scripts and binaries. The malware exfiltrates browser data, Keychain credentials, and Telegram user information. The use of Nim introduces new levels of complexity for analysts, blending complex behavior into binaries with less obvious control flow.
Cisco warns that Unified CM has hardcoded root SSH credentials
Source: https://www.bleepingcomputer.com/news/security/cisco-removes-unified-cm-callManager-backdoor-root-account/
An authenticated remote code execution vulnerability exists in Lucee’s administrative interface due to insecure design in the scheduled task functionality. An administrator with access to /lucee/admin/web.cfm can configure a scheduled job to retrieve a remote .cfm file from an attacker-controlled server, which is written to the Lucee webroot and executed with the privileges of the Lucee service account. Because Lucee does not enforce integrity checks, path restrictions, or execution controls for scheduled task fetches, this feature can be abused to achieve arbitrary code execution. This issue is distinct from CVE-2024-55354.
Switzerland says government data stolen in ransomware attack
Source: https://www.bleepingcomputer.com/news/security/switzerland-says-government-data-stolen-in-ransomware-attack/
The FBI warns that Scattered Spider is now targeting the airline sector
Source: https://securityaffairs.com/179413/cyber-crime/the-fbi-warns-that-scattered-spider-is-now-targeting-the-airline-sector.html
Deleting a file in Wire doesn’t remove it from servers — and other findings
Source: https://offsec.almond.consulting/deleting-file-wire-doesnt-remove-it.html
Hackers Target Over 70 Microsoft Exchange Servers to Steal Credentials via Keyloggers
Source: https://thehackernews.com/2025/06/hackers-target-65-microsoft-exchange.html
SparkKitty Spyware on App Store and Play Store, Steals Photos for Crypto Data
Source: https://hackread.com/sparkkitty-spyware-app-store-play-store-steals-photos-crypto/
Scammers Use Inferno Drainer to Steal $43,000 of Crypto from Over 110 Wallets on CoinMarketCap
Source: https://hackread.com/scammers-inferno-drainer-crypto-coinmarketcap-users/
An AMOS malware campaign has been discovered utilizing GitHub repositories to distribute malicious files. The attackers created a fake Ledger Live app that prompts users to enter their secret phrases, which are then exfiltrated. The malware uses obfuscation techniques, including base64 encoding and custom XOR operations. The campaign targets cryptocurrency users, specifically those using hardware wallets. The malware is distributed through DMG files and ZIP archives, containing both x64 and ARM64 versions of AMOS. The attackers use multiple domains for command and control, and the malware performs checks to detect virtual environments.
N. Korean Hackers Deploy New PylangGhost Malware in Fake Crypto and Blockchain Job Interviews
Source: https://hackread.com/n-korean-hackers-pylangghost-malware-crypo-job-scam/
