Infosec bits for 2025 week 23
Heloise Meyer | June 6, 2025, 3:55 p.m.
Cybersecurity Insights:
Don’t let dormant accounts become a doorway for cybercriminals [Phil Muncaster, ESET]
Future-ready cybersecurity: Lessons from the MITRE CVE crisis [Brad Laporte, Cyberscoop]
Going Into the Deep End: Social Engineering and the AI Flood [Trevin Edgeworth, SecurityWeek]
TOP 20 Not-So-Secret Business Passwords [NordPass, NordPass]
Ransomware:
Mysterious leaker GangExposed outs Conti kingpins in massive ransomware data dump [Jessica Lyons, The Register]
Interlock ransomware: what you need to know [Graham Cluley, Tripwire]
FBI: Play ransomware breached 900 victims, including critical orgs [Sergiu Gatlan, BleepingComputer]
Vulnerabilities & Patches:
CISA Warns of Chrome 0-Day Vulnerability Exploited in the Wild to Execute Arbitrary Code [Guru Baran, Cyber Security News]
VMware NSX XSS Vulnerability Allows Attackers to Inject Malicious Code [Guru Baran, Cyber Security News]
New Linux Vulnerabilities Expose Password Hashes via Core Dumps [Alessandro Mascellino, Infosecurity Magazine]
PoC Exploit Released for Apache Tomcat DoS Vulnerability [Anupriya, GBHackers]
Malware:
FBI: BADBOX 2.0 Android malware infects millions of consumer devices [Lawrence Abrams, BleepingComputer]
ViperSoftX Stealing Cryptocurrencies [ASEC, ASEC]
Cyberattacks:
Malicious PyPI, npm, and Ruby Packages Exposed in Ongoing Open-Source Supply Chain Attacks [Ravie Lakshmanan, The Hacker News]
New Eleven11bot Hacks 86,000 IP Cameras for Large-Scale DDoS Attack [Aman Mishra, GBHackers]
Popular Chrome Extensions Leak API Keys, User Data via HTTP and Hard-Coded Credentials [Ravie Lakshmanan, The Hacker News]
