This week’s cybersecurity overview includes critical vulnerabilities in various software and hardware, exploits of chained vulnerabilities, record-high DDoS attacks, and a notable ransomware surge, particularly impacting education and utilities. The article emphasizes the necessity for improved security measures across affected sectors. Affected: 7-Zip, Asus, Ivanti Cloud Service Appliances, Cisco, Cambium Networks, ABB, UK Education Sector, PowerSchool, US Utilities, Russia, Iran
Keypoints :
- 7-Zip has a critical vulnerability (CVE-2025–0411) that allows code execution by bypassing the Mark of the Web security feature.
- AMD is addressing a vulnerability in its microprocessors that could permit unauthorized microcode loading, requiring admin access to exploit.
- Chained vulnerabilities in Ivanti CSA are actively being exploited for breaches and webshell deployments.
- Cisco’s ClamAV has a denial-of-service flaw (CVE-2025–20128) that can cause crashes of the scanning process, and patches are available.
- The AIRASHI botnet has been launched from a zero-day vulnerability in Cambium Networks cnPilot routers, now active for DDoS attacks.
- The Murdoc_Botnet campaign targets AVTECH cameras and Huawei routers, having over 1300 active IPs.
- Cloudflare mitigated the largest DDoS attack recorded at 5.6 Tbps, originating from Mirai botnets.
- 119 vulnerabilities were found in LTE and 5G networks, posing significant attack risks.
- ABB’s building automation products contain over 1,000 vulnerabilities, endangering critical infrastructure.
- 73% of UK educational institutions faced cyber incidents in the last five years, highlighting their vulnerabilities.
- December 2024 recorded the highest ransomware attacks, led by the FunkSec group targeting multiple sectors.
- US utilities report an 80% increase in ransomware incidents since 2023, largely due to outdated infrastructure.
- The PowerSchool hack exposed sensitive data of over 62 million students.
- Middle Eastern and African nations are increasing biometric technology adoption amid cybersecurity concerns.
- Russia and Iran signed an agreement to enhance cooperation regarding cybersecurity and internet regulation.
MITRE Techniques :
- T1203: Exploit Public-Facing Application – Attackers exploited vulnerabilities in Ivanti CSA to execute remote code.
- T1068: Exploitation of Elevation Control Mechanism – AMD vulnerability requires local admin access to load unauthorized microcode.
- T1499: Virtualization/Sandbox Evasion – The AIRASHI botnet exploits vulnerabilities in cnPilot routers.
- T1136: Create Account – The attack on PowerSchool used stolen credentials for unauthorized access.
- T1499: DDoS – The record-setting DDoS attack detected by Cloudflare using a Mirai botnet variant.
Indicator of Compromise :
- [Domain] clamd.[example].com
- [Domain] airashi.[example].com
- [CVE] CVE-2025–0411
- [CVE] CVE-2025–20128
- [IoC] 62.4 million students and teachers data leaked from PowerSchool
Full Story: https://medium.com/ml4den/cybersecurity-news-review-week-4-2025-37254fed2061?source=rss——cybersecurity-5