This article provides a comprehensive overview of significant cybersecurity incidents and vulnerabilities reported recently, including outages, data breaches, and exploits targeting various platforms. Affected: Proton Mail, Ivanti VPN, Banshee, BayMark Health Services, Medusind, MirrorFace, STIIIZY, Samsung, GFI KerioControl, Mitel MiCollab, CrowdStrike, Akamai, Casio.
Keypoints :
- Proton Mail experienced a worldwide outage due to a surge in database connections during infrastructure migration.
- Ivanti VPN had critical vulnerabilities exploited by state-sponsored actors, leading to the release of patches.
- Banshee macOS Stealer uses advanced evasion techniques to steal sensitive user information.
- BayMark Health Services reported a data breach affecting patient information due to a ransomware attack.
- Medusind disclosed a data breach impacting over 360,000 individuals’ personal and health information.
- The Chinese APT group MirrorFace has been targeting Japanese organizations for sensitive information since 2019.
- STIIIZY experienced a data breach exposing customer information at multiple retail locations.
- A zero-click vulnerability in Samsung devices was disclosed, allowing remote code execution.
- GFI KerioControl identified a critical vulnerability that could lead to CSRF token theft.
- Mitel MiCollab has critical vulnerabilities that are actively exploited, requiring immediate updates.
- The U.S. government launched a Cyber Trust Mark for IoT devices to certify security compliance.
- Three Russian nationals were charged for operating crypto-mixing services facilitating illicit transactions.
- Phishing campaigns impersonating CrowdStrike target job seekers with cryptomining malware.
- Akamai plans to discontinue its CDN services in China by June 2026.
- Casio suffered a ransomware attack exposing personal data of approximately 8,500 individuals.
MITRE Techniques :
- Initial Access (T1078): Exploitation of vulnerabilities in Ivanti VPN by state-sponsored actors.
- Credential Dumping (T1003): Use of custom malware to maintain persistence in compromised systems.
- Data Encrypted for Impact (T1486): Ransomware attack on BayMark Health Services and Casio.
- Phishing (T1566): Phishing campaigns impersonating CrowdStrike to distribute malware.
- Exploitation of Vulnerability (T1203): Zero-click vulnerability in Samsung devices allowing remote code execution.
- Command and Control (T1071): Use of C2 infrastructure by malware like Banshee to evade detection.
- Privilege Escalation (T1068): Exploitation of vulnerabilities in Mitel MiCollab for unauthorized access.
Indicator of Compromise :
- [domain] protonmail.com
- [domain] ivanti.com
- [url] github.com/Banshee
- [email] support@baymark.com
- [file hash] Check the article for all found IoCs.
Full Research: https://threatweek.medium.com/weekly-cybersecurity-roundup-jan-6-2025-jan-12-2025-83affc7ac513?source=rss——cybersecurity-5
Views: 1