NetSec News Articles of Interest From the Week of February 17, 2025
Read more cybersecurity news in this edition of NetSec News.
Hackers Use CAPTCHA Trick on Webflow CDN PDFs to Bypass Security Scanners
A widespread phishing campaign has been observed leveraging bogus PDF documents hosted on the Webflow content delivery network (CDN) with an aim to steal credit card information and commit financial fraud. (The Hacker News)
 |
|
“Completely Automated Public Turing test to tell Computers and Humans Apart, better known as CAPTCHA, saw its initial commercial use in the early 2000s. As of 2025, it is common for users to interact with some form of CAPTCHA on a daily basis. This familiarity fosters an inherent sense of trust when we are prompted to interact with this form of security. Unfortunately, threat actors are now exploiting this trust to launch attacks, leveraging what would seem like a benign process in order to establish command and control (C2) connections for long term malicious goals or stealing credentials and sensitive information stored on victims’ devices. One of the most recent fake CAPTCHAs involves instructing the user to perform a three-step process: 1. Press the “Windows” key + R This essentially has the user unknowingly copying and pasting a hidden command into the “Run” box, which then launches a connection to a malicious URL, propagating a multi-step attack. From a business perspective, this highlights the need for organizations to enforce the appropriate permissions for user accounts/groups to minimize the blast radius of increasingly subversive attacks. Sharing up to date security news and trends like this (and the Astaroth Phishing Kit) by implementing an internal newsletter or general communication channel can go a long way towards educating users on these attacks. Effective security controls and effective security awareness go hand-in-hand to protect organizations and end users alike, who can further benefit by sharing security best practices to their families and friends. ” –Roman Weathermon, T3 Incident Response Lead at |
New FinalDraft Malware Abuses Outlook Mail Service for Stealthy Comms
A new malware called FinalDraft has been using Outlook email drafts for command-and-control communication in attacks against a ministry in a South American country. (BleepingComputer)
GAO Calls on Coast Guard To Improve Cyber for Maritime Transportation System
Discover how the U.S. Coast Guard is being urged to bolster its cybersecurity measures for the Maritime Transportation System (MTS), which handles over $5.4 trillion in annual commerce. A recent GAO report highlights critical gaps in the Coast Guard’s current strategies, revealing vulnerabilities in the face of escalating threats from nations like China, Iran, North Korea, and Russia, as well as transnational cybercriminals. The findings underscore the urgent need for enhanced oversight, strategic planning, and a skilled cybersecurity workforce to safeguard this vital artery of U.S. trade and security from potentially devastating cyberattacks. Dive into the details of these recommendations and the implications for national security in this compelling analysis. (Breaking Defense)
Hackers Exploit Authentication Bypass in Palo Alto Networks PAN-OS
Hackers are launching attacks against Palo Alto Networks PAN-OS firewalls by exploiting a recently fixed vulnerability (CVE-2025-0108) that allows bypassing authentication. (BleepingComputer)
127 Servers of Bulletproof Hosting Service Zservers Seized by Dutch Police
Days after several governments announced sanctions against the Zservers bulletproof hosting service, Dutch police took 127 servers associated with the service offline. The US, UK and Australia on February 11 announced sanctions against the Russia-based hosting service and two Russian nationals who allegedly operate it. (SecurityWeek)
SonicWall Firewall Bug Leveraged in Attacks After PoC Exploit Release
Attackers are now targeting an authentication bypass vulnerability affecting SonicWall firewalls shortly after the release of proof-of-concept (PoC) exploit code. This security flaw (CVE-2024-53704), tagged by CISA as critical severity and found in the SSLVPN authentication mechanism, impacts SonicOS versions 7.1.x (up to 7.1.1-7058), 7.1.2-7019, and 8.0.0-8035, used by multiple models of Gen 6 and Gen 7 firewalls and SOHO series devices. (BleepingComputer)
Virginia Attorney General’s Office Struck by Cyberattack Targeting Attorneys’ Computer Systems
The Virginia Attorney General’s office, the state’s top prosecutorial agency led by Jason Miyares, was struck by a cyberattack this week that forced officials off the office’s computer systems. According to the Richmond Times-Dispatch, the chief deputy attorney general of the agency sent an email on Wednesday that said nearly all of is computer systems were offline, and that Virginia State Police and other law enforcement officials were investigating the attack. (SecurityWeek)
Russian Hacking Group Targets Critical Infrastructure in the US, the UK, and Canada
Microsoft warns of expanding Russian cyberwarfare as attackers exploit IT management software to breach enterprises. A Russian state-backed hacking group is executing one of the most far-reaching cyber espionage campaigns ever seen, infiltrating critical infrastructure across multiple continents by exploiting vulnerabilities in IT management software. (CSO)
US Cyber Vulnerabilities Fuel N. Korea’s Nuclear Arsenal, but Solutions Are Near: DARPA Official
“We are essentially funding nuclear weapons development in North Korea with our bad software practices,” said Kathleen Fisher, director of DARPA’s Information Innovation Office. (Breaking Defense)
Meet the Author
