Weekly Cybersecurity Digest: Latest in Cyber Attacks, Vulnerabilities, & Data Breaches

Welcome to this week’s Cyber Security Newsletter, where we delve into the latest developments and key updates in the realm of cybersecurity. Your involvement in this swiftly changing digital environment is vital, and we aim to deliver the most pertinent insights and information to you.

This issue highlights emerging threats and the current state of defenses in our transforming digital landscape. We will explore critical topics such as advanced ransomware assaults and the influence of state-sponsored cyber activities on international security.

Our examination will feature an extensive review of the evolving nature of these dangers, along with practical advice for enhancing your organization’s defenses. We will look into how revolutionary technologies like artificial intelligence (AI), machine learning (ML), and quantum computing are transforming cybersecurity frameworks while also being exploited by malicious actors. Examples include AI-powered phishing attacks, ML-based malware, and the potential of quantum computing to break encrypted communications.

In addition, we will provide insights into how different sectors are swiftly adapting to cybersecurity challenges, including the necessity of securing remote work settings and addressing weaknesses in IoT devices. The urgency of these issues underscores the importance of taking prompt action.

We will also highlight the most recent regulatory changes affecting cybersecurity practices worldwide, focusing on new regulations such as the EU’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA). These regulations are setting standards for data privacy and security, ensuring that your compliance strategies are aligned with present requirements.

Join us weekly as we address these intricate matters and more, arming you with the essential knowledge to stay proactive in the ever-evolving cybersecurity landscape.

Vulnerabilities

1. Banshee Malware Targets macOS Users

A new version of the Banshee macOS Stealer evades detection by leveraging advanced string encryption techniques. Distributed via phishing campaigns, this malware steals credentials, browser data, and crypto wallet information.
Read More

2. Hackers Exploiting YouTube to Spread Malware

Cybercriminals hijack YouTube channels to distribute Lumma Stealer malware disguised as cracked software and game cheats. The campaign uses legitimate file-hosting services to bypass antivirus protections.
Read More

3. Rootkit Malware Controls Linux Systems Remotely

A sophisticated rootkit exploits zero-day vulnerabilities in Linux systems, enabling attackers to hijack traffic and execute commands with root-level privileges. The malware combines kernel modules and user-space binaries for persistence.
Read More

4. Critical Vulnerabilities in Rsync File Transfer Tool

Six vulnerabilities in the rsync tool for Linux systems, including a critical heap-based buffer overflow (CVE-2024-12084), allow attackers to execute arbitrary code. Users are urged to update to version 3.4.0 immediately.
Read More

5. Cl0p Ransomware Exploits Cleo Software Vulnerability

The Cl0p ransomware group targets organizations using Cleo’s managed file transfer software, exploiting a critical vulnerability (CVE-2024-50623) for unauthorized access. Over 66 organizations have been impacted globally.
Read More

6. Botnet Exploits 13,000 MikroTik Devices

A botnet leveraging misconfigured DNS records on MikroTik routers launches spam campaigns and DDoS attacks while bypassing email security measures. The campaign underscores the risks of poor DNS configurations.
Read More

7. UEFI Secure Boot Bypass Vulnerability Exposed

A critical flaw (CVE-2024-7344) in UEFI Secure Boot allows attackers to execute malicious code during boot, even on systems with Secure Boot enabled. Updates from Microsoft and vendors are essential to mitigate risks.
Read More

8. Tunneling Protocol Vulnerabilities Impact Millions

Over 4 million internet hosts are vulnerable due to flaws in tunneling protocols like GRE and IPIP, enabling DoS attacks and unauthorized access to private networks. Researchers urge immediate mitigation measures.
Read More

Cyber Attacks

1. U.S. Treasury Breach: Chinese Hackers Access Janet Yellen’s Computer

Chinese state-sponsored hackers breached the U.S. Treasury Department, exploiting vulnerabilities in third-party software provided by BeyondTrust. The attackers gained access to Secretary Janet Yellen’s computer and other workstations, compromising sensitive but unclassified files. This incident highlights vulnerabilities in third-party vendor software and the need for stronger supply chain security measures.
Read More

2. Russian Hackers Exploit WhatsApp Users via Malicious QR Codes

The Star Blizzard hacking group has shifted tactics to target WhatsApp users using malicious QR codes. Victims were tricked into linking their WhatsApp accounts to attackers’ devices, enabling data exfiltration. This campaign underscores the growing sophistication of phishing tactics and the importance of verifying QR code sources.
Read More

3. FlowerStorm: Phishing-as-a-Service Targeting Microsoft 365 Users

FlowerStorm, a new phishing-as-a-service platform, is targeting Microsoft 365 users with counterfeit login pages delivered through Telegram. The service mimics legitimate SaaS platforms to steal credentials and multifactor authentication tokens, posing a significant threat to organizations in North America and Europe.
Read More

4. CISA Warns of Critical Aviatrix Controllers Vulnerability

CISA has flagged a critical OS command injection flaw (CVE-2024-50603) in Aviatrix Controllers, used in multi-cloud environments. Exploited actively since January 7, attackers have leveraged this vulnerability to deploy cryptocurrency miners and backdoors. Organizations are urged to apply patches immediately or discontinue using affected products.
Read More

5. FunkSec Ransomware Dominates December Attacks

FunkSec, a new ransomware group, claimed over 85 victims in December 2024 alone, employing AI-assisted malware development for rapid tool iteration. Despite doubts about the authenticity of some claims, FunkSec’s rise highlights the increasing use of AI in cybercrime and the evolving ransomware landscape.
Read More

Vulnerabilities

1. Ivanti Connect Secure Vulnerability Actively Exploited
A critical vulnerability, CVE-2025-0282, affecting Ivanti Connect Secure and related products, has been actively exploited. This buffer overflow flaw allows remote code execution (RCE) and impacts over 33,000 instances globally. Ivanti has released patches, urging immediate updates to mitigate risks.
Read More

2. Aviatrix Controller RCE Vulnerability in the Wild
CVE-2024-50603, a command injection flaw in Aviatrix Controller, has been exploited to deploy cryptojacking malware and backdoors. Rated with a CVSS score of 10.0, this vulnerability highlights the need for timely patching in cloud environments.
Read More

3. BeyondTrust Privileged Remote Access Exploited
A critical OS command injection vulnerability (CVE-2024-12686) in BeyondTrust’s tools is being actively exploited. Attackers can execute commands remotely, posing significant risks to privileged access management systems.
Read More

4. iMessage Smishing Campaign
A new smishing campaign targets iMessage users by exploiting Apple’s phishing protections. Attackers trick users into enabling malicious links by replying to messages or adding senders to their contact list.
Read More

5. Zero-Day PDF Vulnerability Leaking NTLM Data
A zero-day behavior in Adobe and Foxit Reader could leak NTLM authentication data via malicious PDF files. While Adobe downplayed the risk, Foxit has issued a patch.
Read More

6. Google OAuth Vulnerability Exposes Accounts
A flaw in Google’s “Sign in with Google” OAuth flow allows attackers to exploit defunct domains for unauthorized access to sensitive accounts. Google is working on a fix after initial dismissal of the issue.
Read More

7. Windows RD Gateway DoS Vulnerability
CVE-2025-21225, a race condition in Windows Remote Desktop Gateway, could lead to denial-of-service attacks. Microsoft has released patches as part of January’s Patch Tuesday update.
Read More

8. Chrome 132 Released with Security Fixes
Google Chrome version 132 addresses 16 vulnerabilities, including critical remote code execution flaws in its JavaScript engine and graphics components. Users are advised to update immediately.
Read More

9. Microsoft January 2025 Patch Tuesday
Microsoft patched 159 vulnerabilities this month, including 10 critical RCE flaws affecting Excel, NTLM authentication, and Remote Desktop Services. Organizations should prioritize these updates.
Read More

10. AWS Patches Cloud Service Vulnerabilities
AWS resolved two critical vulnerabilities (CVE-2025-0500 and CVE-2025-0501) impacting Amazon WorkSpaces and AppStream 2.0 clients. Users must update affected software versions promptly.
Read More

Research Papers

1. ZAP Scanner’s Capabilities: A Comparative Analysis

Researchers have conducted an in-depth evaluation of OWASP ZAP (Zed Attack Proxy), a popular open-source tool for identifying vulnerabilities in web applications. The study compared versions 2.12.0 and 2.13.0 using the OWASP Benchmark and revealed nuanced differences in their performance across five major vulnerability categories, including SQL Injection and XSS. Key findings include:

• Version 2.13.0 showed improved detection for SQL Injection and Secure Cookie vulnerabilities.
• Version 2.12.0 excelled in Command Injection precision and XSS True Positive Rates.

These insights highlight the importance of regular updates and hybrid testing strategies to address evolving cyber threats effectively.

Read more

2. CISA’s National Call to Close the Software Understanding Gap

The Cybersecurity and Infrastructure Security Agency (CISA) has released a report titled “Closing the Software Understanding Gap”, emphasizing the need for better software behavior analysis in critical infrastructure systems. Key recommendations include:

• Implementing multi-factor authentication for development processes.
• Encrypting sensitive data instead of storing it in source code.
• Creating robust software supply chain risk management plans.

These measures aim to align with CISA’s Secure by Design principles, shifting the security burden from end-users to manufacturers.

Read more

3. MITRE Launches D3FEND 1.0: A Cybersecurity Game-Changer

MITRE has officially launched D3FEND 1.0, a cybersecurity ontology designed to standardize defense techniques against malicious threats. Funded by the NSA and DoD, this framework provides:

• Cyber Attack-Defense (CAD) Tool: An interactive platform for scenario-specific applications.
• Expanded Taxonomies: Covering identity control, operational technology, and vulnerability modeling.
• Ontological Precision: Ensuring compatibility with semantic standards.

D3FEND aims to foster collaboration within the cybersecurity community and improve strategic decision-making.

Read more

Other News

1. Microsoft Faces Multi-Factor Authentication (MFA) Outage

Microsoft users experienced disruptions in accessing Microsoft 365 applications due to an MFA system issue. The outage highlights the importance of contingency plans for organizations relying on MFA. Microsoft is working to restore full functionality and improve reliability.
Read More

2. Microsoft Patch Tuesday Update Hits Compatibility Issues

The January 2025 Patch Tuesday update caused installation failures on systems running Citrix Session Recording Agent (SRA) version 2411. Affected organizations are advised to follow Citrix’s workaround to apply updates safely.
Read More

3. 2024 CVE Review Highlights Shifting Trends

An analysis of 2024 vulnerabilities reveals a decline in the severity of CVEs, with average CVSS scores dropping from “High” to “Medium.” However, WordPress-related vulnerabilities surged, reflecting evolving cybersecurity challenges.
Read More

4. FTC Criticizes GoDaddy’s Security Practices

The FTC has taken action against GoDaddy for inadequate security measures that led to multiple data breaches between 2019 and 2022. The company must now overhaul its cybersecurity practices under a settlement agreement.
Read More

5. Let’s Encrypt Introduces Six-Day Certificates

Let’s Encrypt announced six-day validity certificates to enhance web security by reducing reliance on inefficient revocation mechanisms. The shorter lifespan aims to minimize risks from compromised certificates.
Read More

6. U.S. President Signs Executive Order on National Cybersecurity

A new Executive Order mandates federal agencies and private contractors to strengthen cybersecurity measures, focusing on supply chain security, AI-driven defenses, and post-quantum cryptography adoption.
Read More

The post Weekly Cybersecurity Digest: Latest in Cyber Attacks, Vulnerabilities, & Data Breaches appeared first on Cyber Security News.