NetSec News Articles of Interest From the Week of June 23, 2025
Read more cybersecurity news in this edition of NetSec News.
New Malware Campaign Uses Cloudflare Tunnels to Deliver RATs via Phishing Chains
A new campaign is making use of Cloudflare Tunnel subdomains to host malicious payloads and deliver them via malicious attachments embedded in phishing emails. (The Hacker News)
 |
|
“This is a great example of how threat actors are innovating in living-off-the-land binaries (LOLBins) and cloud infrastructure abuse techniques. By exploiting Cloudflare’s legitimate tunneling services, attackers sidestep traditional detection mechanisms that rely on known bad IPs or domains and giving them a disposable, encrypted and hart-to-detect means of staging malware without the cost of maintaining their own infrastructure. Additionally, with the use of Cloudflare Tunnels, this makes the jobs of defenders difficult as it’s not just about spotting known malware but recognizing misuse of legitimate services.” –Craig Flynn, SOC Manager at C3 Integrated Solutions |
Veeam Patches CVE-2025-23121: Critical RCE Bug Rated 9.9 CVSS in Backup & Replication
Veeam has rolled out patches to contain a critical security flaw impacting its Backup & Replication software that could result in remote code execution under certain conditions. The security defect, tracked as CVE-2025-23121, carries a CVSS score of 9.9 out of a maximum of 10.0. (The Hacker News)
Russian Hackers Bypass Gmail MFA With App-Specific Password Ruse
A professional hacking team linked to the Russian government has been caught wielding a new, low-and-slow phishing trick that beats two-factor authentication by exploiting Google’s little-known “app-specific password” feature. (SecurityWeek)
University Researchers Tout Using Smartwatches To Steal Data From Air-Gapped Systems
A new theoretical air-gap attack dubbed SmartAttack has been cooked up by researchers at the Ben-Gurion University of the NegevBeer Sheva, Israel, proposing that smartwatches could be leveraged as receivers for ultra-sonic covert communication in air-gapped systems, highlighting an emerging threat to the networks. (Tom’s Hardware)
Asana’s Cutting-Edge AI Feature Ran Into a Little Data Leakage Problem
Asana has fixed a bug in its Model Context Protocol (MCP) server that could have allowed users to view other organizations’ data, and the experimental feature is back up and running after nearly two weeks of downtime to fix the issue. (The Register)
Whole Foods Distributor United Natural Foods Hit by Cyberattack
United Natural Foods, Inc. (NYSE: UNFI), the main distributor for Amazon’s Whole Foods, has been targeted in a cyberattack that has caused some disruptions to business operations. (SecurityWeek)
Looks Like Aflac Is the Latest Insurance Giant Snagged in Scattered Spider’s Web
Aflac is the latest insurance company to disclose a security breach following a string of others earlier this week, all of which appear to be part of Scattered Spider’s most recent data theft campaign. (The Register)
Meet the Author
