Cybersecurity Weekly Recap: Key Updates on Attacks, Vulnerabilities, & Data Breaches

Welcome to this week’s Cybersecurity Newsletter, providing you with the latest updates and essential insights from the rapidly evolving field of cybersecurity. Keeping updated is essential in the rapidly changing digital landscape of today. We aim to equip you with relevant insights to enable you to skillfully address the challenges presented by this ever-evolving domain. […] The post Cybersecurity Weekly Recap: Key Updates on Attacks, Vulnerabilities, & Data Breaches appeared first on Cyber Security News.

Apr 7, 2025 - 03:43

Cybersecurity Weekly Recap: Key Updates on Attacks, Vulnerabilities, & Data Breaches

Welcome to this week’s Cybersecurity Newsletter, providing you with the latest updates and essential insights from the rapidly evolving field of cybersecurity.

Keeping updated is essential in the rapidly changing digital landscape of today. We aim to equip you with relevant insights to enable you to skillfully address the challenges presented by this ever-evolving domain.

This edition highlights emerging threats and the shifting dynamics of digital defenses. Key topics include advanced ransomware attacks and the increasing influence of state-sponsored cyber activities on global security.

We provide a comprehensive examination of these emerging threats, along with practical strategies to enhance your organization’s security measures. Furthermore, we explore how advanced technologies such as artificial intelligence (AI), machine learning (ML), and quantum computing are transforming cybersecurity, serving both as protective tools and potential vulnerabilities that attackers may exploit.

Examples covered include AI-powered phishing schemes, ML-enhanced malware, and quantum computing’s potential to break encryption. We also explore how industries are addressing critical cybersecurity challenges, such as securing remote work environments and mitigating vulnerabilities in Internet of Things (IoT) devices.

These issues underscore the importance of proactive measures to protect digital infrastructure. We’ll also review recent regulatory developments, such as the European Union’s General Data Protection Regulation (GDPR) and California’s Consumer Privacy Act (CCPA), which are setting new benchmarks for data privacy and security to ensure your compliance strategies remain up-to-date.

Stay tuned each week as we dive into these complex topics and beyond, equipping you with the knowledge needed to stay ahead in the ever-evolving cybersecurity landscape.

Threats

1. Hackers Leveraging URL Shorteners and QR Codes

Cybercriminals are exploiting URL shorteners and QR codes in phishing campaigns targeting taxpayers. These methods bypass traditional security controls, leading to credential theft and malware installation. A recent campaign targeted over 2,300 organizations using QR codes embedded in PDFs to redirect victims to phishing sites mimicking Microsoft services.
Read More

2. Weaponized PDF-Based Attacks

PDF files are increasingly being weaponized by attackers, constituting 22% of malicious email attachments. Threat actors use sophisticated evasion techniques such as URL masking, QR codes, and obfuscation to bypass security systems. Organizations are advised to implement robust security measures to combat these evolving threats.
Read More

3. Beware of Fake Unpaid Toll Message Attack

A new phishing campaign is circulating fake unpaid toll messages to trick victims into clicking malicious links or downloading harmful attachments. The attack leverages urgency and social engineering tactics to compromise users’ systems.
Read More

4. PoisonSeed Malware Targeting CRM and Bulk Email Providers

The PoisonSeed malware is targeting CRM platforms and bulk email providers, exploiting vulnerabilities to steal sensitive data and compromise business operations. Organizations are urged to strengthen their defenses against this emerging threat.
Read More

5. EncryptHub Ransomware Unmasked

EncryptHub ransomware has been identified as a significant threat, targeting businesses with advanced encryption techniques that lock critical files until a ransom is paid. Experts recommend proactive measures like regular backups and endpoint security solutions to mitigate risks.
Read More

6. UAC-0219 Hackers Using PowerShell Stealer WreckStealer

The UAC-0219 hacking group is leveraging a PowerShell-based stealer called WreckStealer to exfiltrate sensitive data from compromised networks. Their tactics include advanced scripting methods that evade detection by traditional security tools.
Read More

7. New Outlaw Linux Malware Leveraging SSH Brute Forcing

Outlaw hackers have developed Linux malware that uses SSH brute-forcing techniques to infiltrate servers, enabling unauthorized access and data theft. This highlights the need for strong password policies and network monitoring solutions.
Read More

8. Attackers Leveraging JavaScript and CSS Style Changes

Cybercriminals are using JavaScript and CSS style manipulation techniques to create deceptive phishing pages that bypass visual detection methods employed by users and automated systems alike.
Read More

Data Breaches

1. State Bar of Texas Confirms Data Breach

The State Bar of Texas experienced a significant data breach between January 28 and February 9, 2025, compromising sensitive information of members and clients. Malicious actors infiltrated the organization’s network and exfiltrated data using sophisticated techniques. Notifications have been sent to affected individuals, and complimentary credit monitoring services are being offered. This incident underscores the growing cybersecurity challenges in the legal sector.
Read more

2. Oracle Acknowledges Data Breach

Oracle Corporation disclosed a breach involving its legacy Gen 1 servers, with attackers exfiltrating sensitive data such as usernames, email addresses, and hashed passwords. The breach was facilitated by a 2020 Java exploit, and the threat actor demanded a $20 million ransom. Oracle has assured stakeholders that its Gen 2 servers remain unaffected while reinforcing security measures for legacy systems.
Read more

3. GitHub Reports 39M Secret API Keys Leaked

GitHub revealed over 39 million secrets, including API keys and credentials, were leaked in 2024 due to accidental exposure by developers. In response, GitHub launched new security tools such as organization-wide secret scanning and standalone secret protection to mitigate risks. These tools aim to prevent future leaks and improve security across development ecosystems.
Read more

4. Verizon Call Filter App Vulnerability

A critical vulnerability in Verizon’s Call Filter iOS app exposed call history logs of millions of users due to improper authorization checks in its backend API. While the flaw has been patched, it raised concerns about privacy risks for individuals relying on confidentiality in their communication patterns. This incident highlights the importance of robust access control mechanisms in telecom applications.
Read more

Cyber Attacks

1. Chinese Hackers Exploiting Ivanti VPN Vulnerability

A critical buffer overflow flaw (CVE-2025-22457) in Ivanti Connect Secure VPN appliances is being actively exploited by Chinese threat actors. The attackers deploy sophisticated malware like TRAILBLAZE and BRUSHFIRE to maintain persistence and evade detection. Organizations are urged to update to version 22.7R2.6 or later.
Read More

2. DarkCloud Stealer Targets Spanish Organizations

The DarkCloud information stealer is leveraging phishing emails with weaponized .TAR archives to target Spanish entities in technology, legal, financial, and government sectors. The malware harvests credentials, cryptocurrency wallets, and sensitive files while evading detection.
Read More

3. Qilin Ransomware Mimics ScreenConnect Login Pages

Qilin ransomware affiliates are using phishing campaigns to impersonate ScreenConnect login pages, bypassing MFA protections and deploying ransomware across Managed Service Providers (MSPs) and their customers. This highlights the growing risks of supply chain attacks.
Read More

4. Russian Seashell Blizzard Intensifies Global Attacks

The Russian-linked Seashell Blizzard group has escalated its operations, targeting critical infrastructure sectors like energy and telecommunications worldwide. Their “BadPilot” campaign exploits software vulnerabilities to gain persistent access.
Read More

5. Apache Tomcat Vulnerability Under Active Exploitation

A critical flaw (CVE-2025-24813) in Apache Tomcat allows attackers to take control of servers or steal sensitive data via malicious file uploads. Organizations using affected versions are advised to apply patches immediately.
Read More

6. Over 1,500 PostgreSQL Servers Compromised

A fileless malware campaign has exploited misconfigured PostgreSQL instances globally, deploying cryptominers like XMRig-C3. The malware operates entirely in memory, making it difficult to detect.
Read More

7. 20,000 WordPress Sites Vulnerable to File Upload Exploits

Two high-risk vulnerabilities in the WP Ultimate CSV Importer plugin (CVE-2025-2008 and CVE-2025-2007) allow attackers to upload malicious files or delete critical site files, leading to full site compromise.
Read More

Vulnerabilities

1. Ivanti Connect Secure Vulnerability Actively Exploited

A critical stack-based buffer overflow vulnerability (CVE-2025-22457) in Ivanti Connect Secure products has been actively exploited by state-sponsored attackers since mid-March 2025. The flaw allows remote code execution and has affected VPN and network access solutions. Ivanti has released patches to mitigate the risk.
Read More: Ivanti Connect Secure Vulnerability Actively Exploited in the Wild

2. React Router Flaw Exposes Web Apps

React Router and Remix frameworks are vulnerable to cache poisoning, WAF bypass, and path traversal attacks due to improper sanitization of HTTP headers (CVE-2025-31137). Developers are urged to update to patched versions immediately.
Read More: React Router Vulnerability Exposes Web Apps

3. Apache Traffic Server Request Smuggling Vulnerability

A flaw (CVE-2024-53868) in Apache Traffic Server allows attackers to smuggle HTTP requests, potentially bypassing security controls and poisoning caches. System administrators should apply the latest patches to secure their infrastructure.
Read More: Apache Traffic Server Vulnerability

4. OpenVPN Denial of Service Vulnerability

OpenVPN servers configured with the –tls-crypt-v2 option are affected by CVE-2025-2704, which can crash servers via malformed packets during TLS handshakes. The vulnerability has been patched in version 2.6.14.
Read More: OpenVPN Vulnerability Let Attackers Crash Servers

5. SonicWall Firewall Authentication Bypass

A critical vulnerability (CVE-2024-53704) in SonicWall firewalls allows attackers to hijack SSL VPN sessions without authentication, exposing private networks to unauthorized access. Immediate patching is recommended.
Read More: SonicWall Firewall Vulnerability Exploited

6. Multiple Jenkins Plugin Vulnerabilities

Several Jenkins plugins are affected by vulnerabilities that expose sensitive information and allow arbitrary code execution (e.g., CVE-2025-31722). Organizations should update Jenkins core and plugins to secure their CI/CD environments.
Read More: Multiple Jenkins Plugin Vulnerabilities

7. WinRAR “Mark of the Web” Bypass

WinRAR versions prior to 7.11 are vulnerable to CVE-2025-31334, allowing attackers to bypass Windows’ security mechanisms and execute arbitrary code via symbolic links in malicious archives. Users should upgrade immediately.
Read More: WinRAR Mark of the Web Bypass Vulnerability

8. Firefox 137 Released with Security Fixes

Mozilla has released Firefox 137, addressing multiple high-severity vulnerabilities such as CVE-2025-3028 (use-after-free flaw) and CVE-2025-3030 (memory safety bug). Users should update immediately for enhanced protection.
Read More: Firefox 137 Released

Other News

1. Frida 16.7.0: A Game-Changer for Security Professionals

Frida, the popular dynamic instrumentation toolkit, has released its latest version, 16.7.0, introducing groundbreaking APIs for advanced threat monitoring and security analysis. This update includes tools for real-time monitoring of thread and module lifecycles, enabling security professionals to identify vulnerabilities and optimize testing workflows. The new profiling capabilities provide precise performance measurement, making Frida an indispensable tool for penetration testers and developers.

2. Microsoft Strengthens Outlook Security

Microsoft has announced new security enhancements for Outlook to safeguard users against phishing attacks and malicious links. These updates aim to provide better protection for email communications, ensuring a safer experience for users in enterprise and personal environments.

Read more: Microsoft Strengthens Outlook

3. A New Tool to Analyze Golang Malware

A recently released tool is designed to analyze Golang malware and extract critical insights. This development addresses the growing prevalence of malware written in Go, offering researchers a powerful solution to dissect and counteract these threats effectively.

The post Cybersecurity Weekly Recap: Key Updates on Attacks, Vulnerabilities, & Data Breaches appeared first on Cyber Security News.