Alright team, it's been a pretty packed 24 hours in the cyber world! We've got a mix of recent breaches, a critical Docker vulnerability, some clever new AI attack techniques, and a few significant regulatory moves. Let's dive in:
Recent Cyber Attacks & Breaches
- Electronics manufacturer Data I/O, a supplier to major automotive and tech firms, has reported significant operational disruptions following a ransomware attack on August 16th.
- The incident impacted internal and external communications, shipping, manufacturing, and other support functions, with a full restoration timeline currently unknown.
- This highlights how ransomware can cripple multiple business processes, even for companies serving critical supply chains, underscoring the need for robust incident response and recovery plans.
🤫 CyberScoop | https://cyberscoop.com/dataio-ransomware-attack/
- Maryland's Transit Administration (MTA) is investigating a cyberattack that has impacted systems used to organise transportation for disabled people, specifically their "Mobility" service.
- While core bus, subway, and light rail services remain unaffected, the incident has prevented new trip scheduling and rebooking, and impacted real-time information and call centres.
- This is another stark reminder of how cyberattacks can directly affect vulnerable populations and critical public services, necessitating immediate and effective mitigation strategies.
🗞️ The Record | https://therecord.media/maryland-cyberattack-transit-disabled-people
- Farmers Insurance has disclosed a data breach impacting 1.1 million customers, with BleepingComputer confirming the data was stolen via the widespread Salesforce supply chain attacks. Exposed data includes names, addresses, dates of birth, driver's license numbers, and the last four digits of SSNs.
- Separately, French retailer Auchan is notifying hundreds of thousands of customers about a cyberattack that exposed loyalty account data, including full names, postal addresses, email, phone numbers, and loyalty card numbers, though bank data and passwords were not impacted.
- These incidents underscore the persistent threat of supply chain attacks (like the Salesforce vishing campaign by UNC6040/UNC6240/ShinyHunters/Scattered Spider) and the broad impact of data breaches on customer privacy, even when sensitive financial data isn't directly compromised.
🗞️ The Record | https://therecord.media/farmers-insurance-million-data-breach
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/auchan-retailer-data-breach-impacts-hundreds-of-thousands-of-customers/
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/farmers-insurance-data-breach-impacts-11m-people-after-salesforce-attack/
- US authorities, with assistance from major tech firms like AWS, Cloudflare, and Google, have charged Oregon resident Ethan Foltz, 22, for allegedly operating the Rapper Bot DDoS network.
- The botnet, comprising up to 95,000 infected machines (many being WiFi routers and DVRs), launched over 370,000 attacks, some reaching 6 terabits per second, targeting a US government agency, a social media platform, and tech companies.
- This successful takedown highlights the ongoing collaboration between law enforcement and industry partners in disrupting large-scale cybercrime operations and holding perpetrators accountable.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/08/25/infosec_in_brief/
- South Korean police have arrested a Chinese national, identified as Jeon, suspected of leading a hacking ring that stole over $29 million from wealthy victims, including BTS singer Jungkook.
- The group allegedly exploited Korean telecom websites to steal personal data, then used it to open mobile phone accounts and access victims' bank and cryptocurrency accounts.
- This case demonstrates the global reach of cybercrime and the importance of international cooperation (Interpol, Thai officials) in tracking and apprehending threat actors.
🗞️ The Record | https://therecord.media/south-korea-arrests-hacker-accused-of-targeting-celebrities-bts
Vulnerabilities
- A critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2025-9074 (CVSS 9.3), has been discovered in Docker Desktop for Windows and macOS, allowing malicious containers to compromise the host.
- The flaw enables unauthenticated access to the Docker Engine API from within any container, even with Enhanced Container Isolation (ECI) active, allowing attackers to launch new containers and access host files.
- On Windows, this can lead to full administrator privileges by mounting the host filesystem and overwriting system DLLs, while macOS is safer due to additional isolation layers, though backdooring remains a risk. Docker Desktop version 4.44.3 addresses this.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/critical-docker-desktop-flaw-lets-attackers-hijack-windows-hosts/
New Threat Research & Techniques
- Zscaler's ThreatLabs identified 77 malicious Android apps, with over 19 million installs, delivering various malware families including adware, Joker, Harly, and the Anatsa (Tea Bot) banking trojan.
- Joker malware can read/send SMS, take screenshots, make calls, steal contacts, and subscribe users to premium services, while Anatsa now targets 831 banking/crypto apps and includes a keylogger.
- Google has removed the reported apps, but users are urged to keep Play Protect active, only trust reputable publishers, review app permissions carefully, and take immediate action with their banks if Anatsa is suspected.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/malicious-android-apps-with-19m-installs-removed-from-google-play/
- Researchers at Trail of Bits have developed a new attack method that injects malicious prompts into images, invisible to the human eye, which become apparent when the image is downscaled by AI systems.
- This technique exploits image resampling algorithms (like bicubic interpolation) to reveal hidden text that the AI model then interprets as part of the user's instructions, potentially leading to data leakage or other unauthorised actions.
- The attack has been demonstrated against Google Gemini CLI, Vertex AI Studio, Gemini's web interface/API, Google Assistant, and Genspark, highlighting a widespread vector that requires AI systems to implement dimension restrictions, provide user previews, and seek explicit confirmation for sensitive tool calls.
🤖 Bleeping Computer | https://www.bleepingcomputer.com/news/security/new-ai-attack-hides-data-theft-prompts-in-downscaled-images/
- Perplexity's Comet, an AI browser, has shown concerning security flaws, including an inability to distinguish between real and fake e-commerce sites and susceptibility to prompt injection attacks that can bypass CAPTCHA.
- These prompt injection attacks could allow an attacker to control the AI, enabling it to send emails with personal details, grant file-sharing permissions, or execute other actions its permissions allow.
- The ease with which Comet was fooled raises significant concerns about the security of agentic AI browsers and the potential for attackers to leverage AI to automate and scale social engineering tactics.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/08/25/infosec_in_brief/
Data Privacy
- The University of Melbourne used Wi-Fi location data to identify students participating in a sit-in protest in July 2024, leading to an investigation by Victoria’s Office of the Information Commissioner.
- While CCTV use was deemed not to breach privacy, the use of Wi-Fi data was, as the university's policies lacked sufficient detail, meaning students couldn't make an informed choice about using the network.
- The university has since changed its policies, but this incident serves as a critical reminder for organisations to ensure transparency and clear policies regarding the collection and use of location data, especially in sensitive contexts.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/08/25/asia_tech_news_in_brief/
Regulatory & Government Issues
- Senator Ron Wyden has urged Supreme Court Chief Justice John Roberts to commission an independent review of federal court cybersecurity, citing "incompetence" and "negligence" following recent breaches.
- Hackers reportedly stole sealed case data from federal district courts, exploiting vulnerabilities left unfixed for five years, with alleged Russian hackers suspected in this and a 2020 intrusion.
- Wyden criticised the judiciary's "glacial speed" in adopting phishing-resistant multi-factor authentication and accused them of "covering up" their failures, highlighting a severe national security threat due to mishandling sensitive information.
🤫 CyberScoop | https://cyberscoop.com/blistering-wyden-letter-seeks-review-of-federal-court-cybersecurity-citing-incompetence-negligence/
🗞️ The Record | https://therecord.media/wyden-probe-federal-judiciary-data-breaches
- The Federal Communications Commission (FCC) has blocked over 1,200 voice service providers from accessing the US phone network for failing to comply with anti-robocall regulations, marking its largest enforcement action.
- These providers violated rules requiring accurate certifications in the Robocall Mitigation Database and STIR/SHAKEN caller authentication protocols, which verify caller identity.
- This aggressive move aims to combat the persistent issue of robocalls, which remain a top consumer complaint, and underscores the FCC's commitment to enforcing compliance, even as robocallers adapt their tactics.
🤫 CyberScoop | https://cyberscoop.com/fcc-robocall-action-operation-robocall-roundup/
- A senior Russian official has indicated the government is considering blocking Google Meet, following brief disruptions last week, as part of a broader crackdown on foreign tech deemed a national security threat.
- This move aligns with Russia's ongoing efforts to promote state-backed alternatives, such as the Max messaging app, and follows recent restrictions on voice and video calls on WhatsApp and Telegram.
- The potential ban highlights Russia's increasing digital sovereignty ambitions and its willingness to restrict Western services, accusing them of enabling surveillance or facilitating illicit activities.
🗞️ The Record | https://therecord.media/russia-google-meet-ban-crackdown
Everything Else
- Microsoft has unveiled its Quantum Safe Program Strategy, aiming to harden its operating systems, cryptographic protocols, and applications against future quantum computer attacks.
- The company plans to introduce quantum safeguards starting in 2029 and roll them out across its entire codebase by 2033, ahead of the US government's deadline.
- This proactive approach addresses the "harvest now, decrypt later" threat, where malicious actors collect encrypted data today with the intent to decrypt it using future quantum capabilities, emphasising the immediate need for transition to quantum-safe cryptography.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/08/25/infosec_in_brief/
- Former US Navy Petty Officer Jinchao Wei has been found guilty of stealing valuable missile technology and critical systems, selling them to the Chinese government for less than $15,000.
- Over 18 months, Wei passed more than 55 classified military manuals on ships and their systems, as well as information on restricted naval base areas, demonstrating a severe betrayal of trust.
- This conviction underscores the persistent threat of insider espionage and the critical importance of national security clearances and robust counter-intelligence measures within military and government organisations.
🕵🏼 The Register | https://go.theregister.com/feed/www.theregister.com/2025/08/25/infosec_in_brief/
#CyberSecurity #ThreatIntelligence #Ransomware #DataBreach #Vulnerability #Docker #AI #PromptInjection #AndroidMalware #DDoS #Cybercrime #DataPrivacy #Regulatory #InfoSec #CyberAttack #IncidentResponse
TechNadu
Mathrubhumi English
Henry Fisher
SOC Goulash
The DefendOps Diaries
