A vulnerability has been identified and remediated in all supported versions of the Commvault software. Webservers can be compromised through bad actors creating and executing webshells.
Exploiting this vulnerability requires a bad actor to have authenticated user credentials within the Commvault Software environment. Unauthenticated access is not exploitable. For software customers, this means your environment must be: (i) accessible via the internet, (ii) compromised through an unrelated avenue, and (iii) accessed leveraging legitimate user credential
Today it was discovered that an unknown actor had managed to exploit a vulnerability in Lockbit’s PHPMyAdmin instance (on their console onion site). Apparently they were running PHP 8.1.2 which is vulnerable to an RCE CVE-2024-4577. Which uhh… lol? It probably would have been prudent to do a post-paid penetration test on their own infrastructure at some point.
Further compounding the unfortunate situation, the actor was able to dump their database. This contained, as stated by Bleeping Computer, a number of tables such as bitcoin addresses, data about their build system such as bespoke builds for affiliates, A ‘chats’ table containing negotiation messages, which we’ll go through in a later post. And finally, of interest today, the usernames and passwords of LockBit agents using the console.
Of special importance, making our work markedly easier, these passwords were not hashed. Which sure is a choice, as an organization that performs ransomware attacks.
The vast majority of the passwords in this table as reasonably secure; it’s not solely hilariously weak credentials, but there still are a number that display poor security hygiene.
The weak passwords
Before going into my standard analysis, I’ll list off all of the weak passwords in question, and then we’ll go through the statistics of the whole set. The fun to highlight passwords:
Spyware maker NSO Group will have to pay more than $167 million in damages to WhatsApp for a 2019 hacking campaign against more than 1,400 users.
On Tuesday, after a five-year legal battle, a jury ruled that NSO Group must pay $167,254,000 in punitive damages and around $444,719 in compensatory damages.
This is a huge legal win for WhatsApp, which had asked for more than $400,000 in compensatory damages, based on the time its employees had to dedicate to remediate the attacks, investigate them, and push fixes to patch the vulnerability abused by NSO Group, as well as unspecified punitive damages.
WhatsApp’s spokesperson Zade Alsawah said in a statement that “our court case has made history as the first victory against illegal spyware that threatens the safety and privacy of everyone.”
Alsawah said the ruling “is an important step forward for privacy and security as the first victory against the development and use of illegal spyware that threatens the safety and privacy of everyone. Today, the jury’s decision to force NSO, a notorious foreign spyware merchant, to pay damages is a critical deterrent to this malicious industry against their illegal acts aimed at American companies and the privacy and security of the people we serve.”
NSO Group’s spokesperson Gil Lainer left the door open for an appeal.
“We will carefully examine the verdict’s details and pursue appropriate legal remedies, including further proceedings and an appeal,” Lainer said in a statement.
The LockBit ransomware gang has suffered a data breach after its dark web affiliate panels were defaced and replaced with a message linking to a MySQL database dump.
All of the ransomware gang's admin panels now state. "Don't do crime CRIME IS BAD xoxo from Prague," with a link to download a "paneldb_dump.zip."
LockBit dark web site defaced with link to database
As first spotted by the threat actor, Rey, this archive contains a SQL file dumped from the site affiliate panel's MySQL database.
From analysis by BleepingComputer, this database contains twenty tables, with some more interesting than others, including:
A 'btc_addresses' table that contains 59,975 unique bitcoin addresses.
A 'builds' table contains the individual builds created by affiliates for attacks. Table rows contain the public keys, but no private keys, unfortunately. The targeted companies' names are also listed for some of the builds.
A 'builds_configurations' table contains the different configurations used for each build, such as which ESXi servers to skip or files to encrypt.
A 'chats' table is very interesting as it contains 4,442 negotiation messages between the ransomware operation and victims from December 19th to April 29th.
Affiliate panel 'chats' table
Affiliate panel 'chats' table
A 'users' table lists 75 admins and affiliates who had access to the affiliate panel, with Michael Gillespie spotting that passwords were stored in plaintext. Examples of some of the plaintext passwords are 'Weekendlover69, 'MovingBricks69420', and 'Lockbitproud231'.
In a Tox conversation with Rey, the LockBit operator known as 'LockBitSupp' confirmed the breach, stating that no private keys were leaked or data lost.
Based on the MySQL dump generation time and the last date record in the negotiation chats table , the database appears to have been dumped at some point on April 29th, 2025.
It's unclear who carried out the breach and how it was done, but the defacement message matches the one used in a recent breach of Everest ransomware's dark web site, suggesting a possible link.
Le 21 janvier 2025, au petit matin, David Balland, co-fondateur d’une start-up française spécialisée dans les crypto-monnaies, est enlevé avec sa compagne à leur domicile, dans le Cher. Une rançon est demandée. En moins de trois jours, les différentes unités de la gendarmerie mobilisées sur cette affaire conduisent les investigations, retrouvent les deux conjoints et interpellent dix malfaiteurs.
Le matin du 21 janvier 2025, un couple est enlevé à son domicile, à Vierzon, dans le Cher, par une équipe de malfaiteurs. David Balland est le co-fondateur de Ledger, une entreprise française spécialisée dans les crypto-monnaies. Les deux victimes sont aussitôt séparées et conduites en des lieux différents. Les ravisseurs contactent alors l’un des autres co-fondateurs de la start-up pour obtenir une rançon en monnaie électronique.
Concernant le volet cyber des investigations, l’Unité nationale cyber a déployé une quinzaine de ses gendarmes spécialistes, en appui de la S.R. de Bourges. « Notre action dans ce dossier a été double, a indiqué le colonel Hervé Pétry, commandant l’UNC. D'abord par une force de projection sur le terrain, pour appuyer les investigations par rapport à l'ensemble des supports numériques. Ces derniers ont été saisis de manière à geler la preuve, extraire les données, les traiter, les exploiter pour récupérer un maximum de preuves et d'informations nous permettant d'identifier et de localiser les individus pour retrouver les victimes. Nous avons pu progresser et transmettre les informations à la fois aux enquêteurs de la S.R. de Bourges et au GIGN, pour tout ce qui concerne le dispositif d'intervention et de recherches opérationnelles. Le deuxième aspect concerne des recherches effectuées à l'UNC, dont le siège est à Pontoise, en matière cette fois de cryptoactifs, d'identification, de traçabilité et de saisie. »
In the latest blow to the criminal market for distributed denial of service (DDoS)-for-hire services, Polish authorities have arrested four individuals who allegedly ran a network of platforms used to launch thousands of cyberattacks worldwide. The suspects are believed to be behind six separate stresser/booter services that enabled paying customers to flood websites and servers with malicious traffic — knocking them offline for as little as EUR 10.
The now defunct platforms – Cfxapi, Cfxsecurity, neostress, jetstress, quickdown and zapcut – are thought to have facilitated widespread attacks on schools, government services, businesses, and gaming platforms between 2022 and 2025.
The platforms offered slick interfaces that required no technical skills. Users simply entered a target IP address, selected the type and duration of attack, and paid the fee — automating attacks that could overwhelm even well-defended websites.
Global law enforcement response
The arrests in Poland were part of a coordinated international action involving law enforcement authorities in 4 countries, with Europol providing analytical and operational support throughout the investigation.
Dutch authorities have deployed fake booter sites designed to warn users seeking out DDoS-for-hire services, reinforcing the message that those who use these tools are being watched and could face prosecution. Data from booter websites, seized by Dutch law enforcement in data centres in the Netherlands, was shared with international partners, including Poland, contributing to the arrest of the four administrators.
The United States seized 9 domains associated with booter services during the coordinated week of action, continuing its broader campaign against commercialised DDoS platforms.
Germany supported the Polish-led investigation by helping identify one of the suspects and sharing critical intelligence on others.
Polish authorities have detained four suspects linked to six DDoS-for-hire platforms, believed to have facilitated thousands of attacks targeting schools, government services, businesses, and gaming platforms worldwide since 2022.
Such platforms are often marketed as legitimate testing tools on the dark web and hacking forums, but are mainly used to disrupt online services, servers, and websites by flooding them with traffic in distributed denial-of-service (DDoS) attacks and causing outages for real users.
The six DDoS services, named Cfxapi, Cfxsecurity, neostress, jetstress, quickdown, and zapcut, have been taken down in a coordinated law enforcement action involving authorities from Germany, the Netherlands, Poland, and the United States.
"In the latest blow to the criminal market for distributed denial of service (DDoS)-for-hire services, Polish authorities have arrested four individuals who allegedly ran a network of platforms used to launch thousands of cyberattacks worldwide," Europol said on Wednesday.
"The suspects are believed to be behind six separate stresser/booter services that enabled paying customers to flood websites and servers with malicious traffic — knocking them offline for as little as EUR 10."
Dass sich Betrüger auf Kleinanzeigenplattformen als Kaufinteressenten ausgeben und vorschlagen, den Kauf über einen angeblichen Paketdienst abzuwickeln, ist eine bereits bekannte Masche. Neu setzen sie jedoch gefälschte Postquittungen ein, um glaubwürdiger zu wirken.
Betrüger suchen gezielt nach Angeboten auf Kleinanzeigenportalen und kontaktieren die Verkäufer zunächst über den Plattform-Chat, später meist via WhatsApp.
Die Cyberkriminellen geben vor, beispielsweise über die Schweizerische Post den Artikel sowie die Lieferung bereits bezahlt zu haben. Dazu schicken sie den potenziellen Opfern ein Foto einer angeblichen Postquittung mit einem QR-Code, der für den Erhalt des Geldes gescannt werden müsse.
Der QR-Code führt zu einer gefälschten Website auf der die Cyberkriminellen vorgeben, der Kaufbetrag werde auf die persönliche Kreditkarte überwiesen. So versuchen sie, an die Kreditkartendaten zu gelangen.
I've been following the development of Deno for some time. It kind of pushes all my buttons: a Rust-based Node alternative with an active web developer community?? Yes please.
As a developer, I've been looking for excuses to use Deno because, frankly, it's so much fun. It makes JavaScript/TypeScript enjoyable again by shipping sane defaults and making delightful choices about dependency management.
Deno also has some truly incredible features that go beyond the web development ecosystem. I want to focus on these features. I've wanted to explore Deno from an offensive security perspective for some time, but a new development in version 2.3 made this imperative: deno.exe—the standalone binary that constitutes the entire tool—is now code-signed on Windows.
Great news for Deno! But because of what Deno can do, it's also good news for those who would do nefarious things with it.
Code signing is a guarantee that the binary you got is the one you're supposed to have. It's supposed to be a higher level of trust than simply a hash checksum, since this is Microsoft telling you a trusted developer shipped this program.
It also means (for now), that Defender SmartScreen gives deno.exe a pass.
So what can Deno do for the red team and the ne'er-do-wells? I've put together a small sampling of demonstrations of Deno's capabilities.
I'm focusing somewhat on the "ClickFix" attack vector, since it is so prevalent at the time of writing, and apparently so effective. So with each of these, I want you to imagine some version of a user opening Win+R and pasting a short command in.
The number of reported cyber incidents and online threats in Switzerland rose sharply last year, according to the National Cyber Security Centre (NCSC).
Last year, almost 63,000 cyber-related incidents were reported to the National Cyber Security Centre (NCSC) in Switzerland, an increase of 13,500 cases over the previous year. Between July and December, the NCSC recorded more than 28,000 incidents, slightly fewer than in the first half of 2024.
Fraud, phishing and spam messages continue to be the most frequently reported incidents. The increase on the previous year is mainly due to the phenomenon of false calls in the name of the authorities, with almost 22,000 reports compared with around 7,000 the previous year.
On the other hand, the number of e-mail threats has dropped. Over the past four years, fraudsters have used the telephone more as a communication channel.
Berne, 06.05.2025 — Le dernier rapport semestriel de l’Office fédéral de la cybersécurité (OFCS) montre comment les cybercriminels opèrent à l’échelle internationale et quels moyens ils utilisent pour diffuser leurs attaques. En raison des cybermenaces désormais mondiales et de la dépendance croissante aux solutions logicielles globales, la coopération interétatique gagne en importance dans ce domaine. Pour renforcer la cybersécurité en Suisse, l’obligation de signaler les cyberattaques contre des infrastructures critiques est entrée en vigueur le 1er avril 2025. Les principes de cette obligation sont harmonisés avec les normes internationales et les directives de l’UE.
Premier point de contact pour la population en cas de cyberincidents, l’OFCS reçoit déjà depuis 2020, via un formulaire en ligne, des signalements volontaires concernant des incidents survenus dans le cyberespace. L’analyse de ces signalements montre comment les cybercriminels opèrent à l’échelle internationale et développent de nouvelles méthodes et stratégies pour diffuser leurs attaques. Le dernier rapport semestriel de l’OFCS présente ces développements ainsi que la situation en matière de cybermenaces – en Suisse et dans le monde – au deuxième semestre 2024.
De juillet à décembre 2024, l’OFCS a reçu 28 165 signalements concernant des cyberincidents, soit un peu moins qu’au cours du premier semestre. Sur toute l’année 2024, il en a enregistré 62 954, soit 13 574 de plus que l’année précédente. Ces fluctuations s’expliquent principalement par les vagues d’appels au nom de fausses autorités. Le rapport entre les signalements de la population (90 %) et ceux des entreprises, associations ou autorités (10 %) est resté stable. S’agissant des entreprises, on constate une forte hausse des arnaques au président (719 en 2024 contre 487 en 2023). Comme à l’accoutumée, les catégories les plus fréquemment mentionnées par les personnes qui ont rempli le formulaire en ligne étaient « Fraude », « Hameçonnage » et « Spam ». En ce qui concerne les jeux-concours frauduleux, l’OFCS a même reçu au deuxième semestre 2024 trois fois plus de signalements que d’ordinaire.
A messaging service used by former National Security Advisor Mike Waltz has temporarily shut down while the company investigates an apparent hack. The messaging app is used to access and archive Signal messages but is not made by Signal itself.
404 Media reported yesterday that a hacker stole data "from TeleMessage, an obscure Israeli company that sells modified versions of Signal and other messaging apps to the US government to archive messages." 404 Media interviewed the hacker and reported that the data stolen "contains the contents of some direct messages and group chats sent using [TeleMessage's] Signal clone, as well as modified versions of WhatsApp, Telegram, and WeChat."
TeleMessage is based in Israel and was acquired in February 2024 by Smarsh, a company headquartered in Portland, Oregon. Smarsh provided a statement to Ars today saying it has temporarily shut down all TeleMessage services.
"TeleMessage is investigating a recent security incident," the statement said. "Upon detection, we acted quickly to contain it and engaged an external cybersecurity firm to support our investigation. Out of an abundance of caution, all TeleMessage services have been temporarily suspended. All other Smarsh products and services remain fully operational."
Last week, Waltz was photographed using the TeleMessage Signal app on his phone during a White House cabinet meeting. Waltz's ability to secure sensitive government communications has been in question since he inadvertently invited The Atlantic Editor-in-Chief Jeffrey Goldberg to a Signal chat in which top Trump administration officials discussed a plan for bombing Houthi targets in Yemen.
Waltz was removed from his post late last week, with Trump nominating him to serve as ambassador to the United Nations.
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
The Go ecosystem, valued for its simplicity, transparency, and flexibility, has exploded in popularity. With over 2 million modules available, developers rely heavily on public repositories like GitHub. However, this openness is precisely what attackers exploit.
No Central Gatekeeping: Developers freely source modules directly from GitHub repositories, trusting the naming conventions implicitly.
Prime Target for Typosquatting: Minimal namespace validation enables attackers to masquerade malicious modules as popular libraries.
Introduction: The Silent Threat#
In April 2025, we detected an attack involving three malicious Go modules which employ similar obfuscation techniques:
github[.]com/truthfulpharm/prototransform
github[.]com/blankloggia/go-mcp
github[.]com/steelpoor/tlsproxy
Despite appearing legitimate, these modules contained highly obfuscated code designed to fetch and execute remote payloads. Socket’s scanners flagged the suspicious behaviors, leading us to a deeper investigation.
A supply-chain attack targets Linux servers with disk-wiping malware hidden in Golang modules published on GitHub.
The campaign was detected last month and relied on three malicious Go modules that included “highly obfuscated code” for retrieving remote payloads and executing them.
Complete disk destruction
The attack appears designed specifically for Linux-based servers and developer environments, as the destructive payload - a Bash script named done.sh, runs a ‘dd’ command for the file-wiping activity.
Furthermore, the payload verifies that it runs in a Linux environment (runtime.GOOS == "linux") before trying to execute.
An analysis from supply-chain security company Socket shows that the command overwrites with zeroes every byte of data, leading to irreversible data loss and system failure.
The target is the primary storage volume, /dev/sda, that holds critical system data, user files, databases, and configurations.
“By populating the entire disk with zeros, the script completely destroys the file system structure, operating system, and all user data, rendering the system unbootable and unrecoverable” - Socket
The researchers discovered the attack in April and identified three Go modules on GitHub, that have since been removed from the platform:
github[.]com/truthfulpharm/prototransform
github[.]com/blankloggia/go-mcp
github[.]com/steelpoor/tlsproxy
Arctic Wolf has observed exploitation in the wild of CVE-2024-7399 in Samsung MagicINFO 9 Server—a CMS used to manage and remotely control digital signage displays.
As of early May 2025, Arctic Wolf has observed exploitation in the wild of CVE-2024-7399 in Samsung MagicINFO 9 Server—a content management system (CMS) used to manage and remotely control digital signage displays. The vulnerability allows for arbitrary file writing by unauthenticated users, and may ultimately lead to remote code execution when the vulnerability is used to write specially crafted JavaServer Pages (JSP) files.
This high-severity vulnerability had originally been made public by Samsung in August 2024 following responsible disclosure by security researchers, with no exploitation reported at the time. On April 30, 2025, a new research article was published along with technical details and a proof-of-concept (PoC) exploit. Exploitation was then observed within days of that publication.
Given the low barrier to exploitation and the availability of a public PoC, threat actors are likely to continue targeting this vulnerability. Arctic Wolf will continue to monitor for malicious post-compromise activities related to this vulnerability, and will alert Managed Detection and Response customers as required when malicious activities are observed.
29.04.2025 - L’Office fédéral de la cybersécurité (OFCS) observe une vague de tentatives de fraude au PDG qui perdure. La semaine dernière, de nombreux cas ont été signalés à l’OFCS dans lesquels des cybercriminels se font passer pour des dirigeants de communes afin d’inciter des employé/e/s à acheter des cartes cadeaux ou à effectuer des virements. La rétrospective hebdomadaire examine le modus operandi des cybercriminels, explique pourquoi les communes sont particulièrement exposées et donne des conseils pour que les communes (et toutes les autres victimes potentielles) puissent se protéger.
En raison de leur structure publique et de la disponibilité des informations sur les sites municipaux, les communes constituent une cible attractive pour les tentatives de fraude au PDG. Ces dernières semaines, de nombreux cas de ce type ont été signalés à l’OFCS. Les méthodes utilisées par les escrocs sont décrites ci-après, en particulier les deux procédures consistant soit à exiger des cartes cadeaux, soit à insister pour obtenir un paiement direct.
The open source software easyjson is used by the US government and American companies. But its ties to Russia’s VK, whose CEO has been sanctioned, have researchers sounding the alarm.
Security researchers warn that a popular open source tool maintained by Russian developers could pose significant risks to US national security.
Key Points:
The open source tool easyjson is linked to VK Group, a company run by a sanctioned Russian executive.
easyjson is widely used in the US across various critical sectors including defense, finance, and healthcare.
Concerns are heightened due to the potential for data theft and cyberattacks stemming from this software.
*Recent findings from cybersecurity researchers at Hunted Labs indicate that easyjson, a code serialization tool for the Go programming language, is at the center of a national security alert. This tool, which has been integrated into multiple sectors such as the US Department of Defense, is maintained by a group of Russian developers linked to VK Group, led by Vladimir Kiriyenko. While the complete codebase appears secure, the geopolitical context surrounding its management raises substantial concerns about the potential risks involved.
The significance of easyjson cannot be overstated, as it serves as a foundational element within the cloud-native ecosystem, critical for operations across various platforms. With connections to a sanctioned CEO and the broader backdrop of Russian state-backed cyberattacks, the fear is that easyjson could be manipulated to conduct espionage or potentially compromise critical infrastructures. Such capabilities underscore the pressing need for independent evaluations and potential reevaluations of software supply chains, particularly when foreign entities are involved.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation
CVE-2025-3248 Langflow Missing Authentication Vulnerability
These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise.
La Confédération n'avait pas établi de distinction entre les fournisseurs de services de communication dérivés. Toutes les entreprises classées comme FSDC sont soumises à des obligations de coopération moins strictes – jusqu'à présent. Le Conseil fédéral souhaite désormais introduire une catégorisation plus précise pour les FSDC. Il prévoit à cet effet un modèle à trois niveaux, à savoir les FSDC avec des obligations «minimales», avec des obligations «restreintes» et avec des obligations «complètes».
Une révision partielle des ordonnances relatives au service de surveillance de la correspondance postale et des télécommunications (service SCPT) fait des remous dans le secteur technologique suisse. La pierre d'achoppement est une nouvelle classification des entreprises qui doivent aider le service SCPT dans ses activités de surveillance.
Jusqu'à présent, la Confédération faisait la distinction entre les fournisseurs de services de télécommunication (FST) et les fournisseurs de services de communication dérivés (FSDC), selon un communiqué de la Confédération. La Confédération divisait également les FST en deux sous-catégories, à savoir ceux les FST ayant des obligations complètes et les FST ayant des obligations restreintes.
Trois nouveaux niveaux
La Confédération n'avait pas établi de distinction entre les fournisseurs de services de communication dérivés. Toutes les entreprises classées comme FSDC sont soumises à des obligations de coopération moins strictes – jusqu'à présent. Le Conseil fédéral souhaite désormais introduire une catégorisation plus précise pour les FSDC. Il prévoit à cet effet un modèle à trois niveaux, à savoir les FSDC avec des obligations «minimales», avec des obligations «restreintes» et avec des obligations «complètes».
DragonForce ransomware group is targeting major UK retailers. Learn about this evolving threat and what steps can be taken to mitigate risk.
In recent weeks, the DragonForce ransomware group has been targeting UK retailers in a series of coordinated attacks causing major service disruptions. Prominent retailers such as Harrods, Marks and Spencer, and the Co-Op have all reported ongoing incidents affecting payment systems, inventory, payroll and other critical business functions.
DragonForce has previously been attributed for a number of notable cyber incidents including attacks on Honolulu OTS (Oahu Transit Services), the Government of Palau, Coca-Cola (Singapore), the Ohio State Lottery, and Yakult Australia.
In this post, we offer a high-level overview of the DragonForce group, discuss its targeting, initial access methods, and payloads. We further provide a comprehensive list of indicators and defensive recommendations to help security teams and threat hunters better protect their organizations.
Background
DragonForce ransomware operations emerged in August 2023, primarily out of Malaysia (DragonForce Malaysia). The group originally positioned itself as a Pro-Palestine hacktivist-style operation; however, over time their goals have shifted and expanded.
The modern-day operation is focused on financial gain and extortion although the operation still targets government entities, making it something of a hybrid actor, both politically aligned and profit-motivated. The group operates a multi-extortion model, with victims threatened with data leakage via the group’s data leak sites, alongside reputational damage.
Recent DragonForce victims have included government institutions, commercial enterprises, and organizations aligned with specific political causes. The group is also known to heavily target law firms and medical practices. Notably, the group has targeted numerous entities in Israel, India, Saudi Arabia, and more recently several retail outlets in the United Kingdom.
Some components of the UK retail attacks have been attributed to an individual affiliated with the loose threat actor collective ‘The Com’, with claims that members are leveraging DragonForce ransomware. Our assessment indicates that the affiliate in question exhibits behavioral and operational characteristics consistent with those previously associated with The Com. However, due to the lack of strong technical evidence and shifting boundaries of The Com, that attribution remains inconclusive and subject to further analysis.
