IT Security Newsletter

IT Security Newsletter - 4/8/2025

Written by Cadre | Tue, Apr 8, 2025

Food giant WK Kellogg discloses data breach linked to Clop ransomware

US food giant WK Kellogg Co is warning employees and vendors that company data was stolen during the 2024 Cleo data theft attacks. Cleo software is a managed file transfer utility that was targeted by the Clop ransomware gang en masse at the end of last year. This attack leveraged two zero-day flaws tracked as CVE-2024-50623 and CVE-2024-55956, allowing the threat actors to breach servers and steal data. READ MORE...

Alleged Scattered Spider SIM-swapper must pay back $13.2M to 59 victims

Noah Michael Urban, 20, of alleged Scattered Spider infamy, has pleaded guilty to various charges and potentially faces decades in prison. Urban was one of five spiders scattered across the US and UK indicted in November 2024 for their alleged roles in various cyberattacks, most of which used the group's typical SIM-swapping MO. Urban pleaded guilty to two counts of wire fraud and one of aggravated identity theft in Florida, and also one count of wire fraud from the California indictment. READ MORE...

Everest ransomware's dark web leak site defaced, now offline

The dark web leak site of the Everest ransomware gang has apparently been hacked over the weekend by an unknown attacker and is now offline. The unknown attacker replaced the website's contents with the following sarcastic message: "Don't do crime CRIME IS BAD xoxo from Prague." The Everest operation has since taken down its leak site, which no longer loads and now displays an "Onion site not found" error. READ MORE...

SAP Patches Critical Code Injection Vulnerabilities

SAP on Tuesday announced the release of 18 new and two updated security notes as part of its April 2025 Security Patch Day, including three notes addressing critical-severity vulnerabilities. The first two critical flaws, tracked as CVE-2025-27429 and CVE-2025-31330 (CVSS score of 9.9) are code injection bugs in S/4HANA (Private Cloud) and Landscape Transformation (Analysis Platform). READ MORE...

Google fixes two actively exploited zero-day vulnerabilities in Android

Google has patched 62 vulnerabilities in Android, including two actively exploited zero-days in its April 2025 Android Security Bulletin. When we say "zero-day" we mean an exploitable software vulnerability for which there was no patch at the time of the vulnerability being exploited or published. The term reflects the amount of time that a vulnerable organization has to protect against the threat by patching-zero days. READ MORE...

ToddyCat APT Targets ESET Bug to Load Silent Malware

The Chinese-speaking ToddyCat advanced persistent threat (APT) group is targeting a security vulnerability in ESET's antivirus software to silently execute malicious payloads on infected devices. Kaspersky reported the dynamic link library (DLL) search order hijacking vulnerability CVE-2024-11859 to ESET several months ago. The vendor issued a patch for it in January, before publicly disclosing the issue on April 4 READ MORE...

Cyberattacks on water and power utilities threaten public safety

62% of utility operators were targeted by cyberattacks in the past year, and of those, 80% were attacked multiple times, according to Semperis. 54% suffered permanent corruption or destruction of data and systems. Recent high-profile cyberattacks by nation-state groups on water and electricity utilities underscore the vulnerability of critical infrastructure. A public utility in Littleton, MA, was recently compromised by a group linked to Volt Typhoon, the Chinese state-sponsored threat group. READ MORE...

Exploited Vulnerability Puts 5,000 Ivanti VPN Appliances at Risk

There are more than 5,000 internet-accessible Ivanti Connect Secure appliances that are susceptible to attacks exploiting a recently disclosed vulnerability, the non-profit cybersecurity organization The Shadowserver Foundation warns. The issue, tracked as CVE-2025-22457 (CVSS score of 9), is described as a stack-based buffer overflow that could be exploited by remote, unauthenticated attackers to execute arbitrary code on a vulnerable appliance. READ MORE...

CISA adds Ivanti Connect Secure vulnerability to KEV catalog

CISA on Friday added CVE-2025-22457, a critical stack-based buffer-overflow flaw that affects several Ivanti products, to the agency's known exploited vulnerabilities catalog. Ivanti disclosed it on April 3 and warned the flaw has been exploited in the wild. The critical vulnerability affects Ivanti Connect Secure as well as Pulse Connect Secure, Ivanti Policy Secure and ZTA gateway products. Ivanti had previously misidentified the flaw as a product bug that could not be exploited remotely. READ MORE...

  • ...in 1820, the Venus de Milo is discovered in ancient Greek ruins on the Aegean island of Milos.
  • ...in 1904, Longacre Square in Manhattan is renamed Times Square, after The New York Times.
  • ...in 1959, computer scientist Grace Hopper and leaders from science and industry discuss the creation of a new programming language, COBOL.
  • ...in 1974, Hank Aaron of the Atlanta Braves hits his 715th career home run, breaking Babe Ruth's record.