Cybersecurity in April 2025 brings a mix of groundbreaking industry moves, critical zero-day exploits, and large-scale breaches that demand immediate attention. From Google’s multi-billion-dollar push into cloud security to Next.js vulnerabilities and massive ransomware threats, organizations of every size are being reminded how fast the threat landscape shifts. This newsletter gives you the essential updates you need to stay informed, proactive, and prepared against evolving risks.
Welcome to our April 2025 Cybersecurity Newsletter! This edition brings you the latest updates on global cyber incidents, emerging threats, and critical vulnerabilities impacting organizations and individuals alike. From high-profile arrests to massive data breaches and new malware campaigns, we cover the key developments shaping the cybersecurity landscape this month.
News Highlights:
1. Google Acquires Wiz for $32 Billion to Strengthen Cloud Security
Google has announced a $32 billion all-cash acquisition of cloud security firm Wiz, aiming to enhance its cybersecurity capabilities. Wiz, founded in 2020, provides a platform that helps organizations secure multi-cloud environments, including AWS, Azure, and Oracle Cloud. Google CEO Sundar Pichai emphasized that the acquisition will bolster cloud security and enable businesses to operate securely across multiple providers.
2. Critical Next.js Vulnerability Allows Attackers to Bypass Authorization Checks
A newly discovered flaw in Next.js, tracked as CVE-2025-29927, allows attackers to bypass authorization by exploiting the x-middleware-subrequest header. This vulnerability enables unauthorized access to protected resources, posing a significant security risk. With Next.js powering major platforms like TikTok and Netflix, developers are urged to apply security patches immediately.
3. WEMIX Suffers $6.1 Million Crypto Heist in Cyberattack
Blockchain gaming platform WEMIX was hacked on February 28, 2025, resulting in the theft of 8.65 million WEMIX tokens worth $6.1 million. CEO Kim Seok-Hwan confirmed the breach, explaining that disclosure was delayed to prevent further attacks. The company swiftly shut down affected servers, launched an internal investigation, and filed a criminal complaint with Seoul authorities, who are now probing the incident.
4. DOJ Seizes $8.2 Million in Crypto from Romance Scam Operation
The U.S. Department of Justice has seized $8.2 million in USDT cryptocurrency linked to ‘romance baiting’ scams, a form of financial fraud where victims are tricked into fake investment schemes. Often disguised as high-return opportunities, these scams lure individuals into depositing funds, only to block withdrawals and disappear with their money. The DOJ’s action aims to disrupt these fraudulent networks and recover stolen assets.
5. Eleven11bot Botnet Infects 86,000 Devices for Large-Scale DDoS Attacks
A new botnet malware, Eleven11bot, has compromised over 86,000 IoT devices, including security cameras and NVRs, to carry out DDoS attacks. Allegedly linked to Iran, it has targeted telecom providers and online gaming platforms. Discovered by Nokia researchers and reported to GreyNoise, Eleven11bot is among the largest DDoS botnets seen in recent years, posing a significant cybersecurity threat.
6. CrushFTP Urges Immediate Patching of Critical Authentication Bypass Flaw
CrushFTP has warned users about a critical authentication bypass vulnerability (CVE-2025-2825) that allows attackers to access unpatched servers exposed over HTTP(S). The flaw affects all CrushFTP v11 versions, and the company has urged administrators to apply the latest patch immediately to prevent potential exploitation.
Breaches Highlights:
1. Pennsylvania Education Union Data Breach Exposes 500,000 Individuals
The Pennsylvania State Education Association (PSEA) is notifying over 500,000 people of a data breach that occurred in July 2024, compromising personal information. The attack impacted the union’s network, affecting educators, support staff, and retirees. PSEA, which represents over 178,000 education professionals, has sent breach notification letters to 517,487 individuals.
2. DollyWay Malware Campaign Compromises 20,000 WordPress Sites
The long-running ‘DollyWay’ malware campaign has infected over 20,000 WordPress sites since 2016, redirecting visitors to malicious destinations. Security researchers report that the operation has evolved with advanced evasion and re-infection techniques. While its latest version functions as a large-scale scam redirection system, previous variants have delivered ransomware and banking trojans.
3. Western Alliance Bank Reports Data Breach Affecting 21,899 Customers
Western Alliance Bank is notifying 21,899 customers that their personal data was stolen in an October 2024 breach caused by a third-party vendor’s compromised file transfer software. The bank, a subsidiary of Western Alliance Bancorporation, revealed in a February SEC filing that attacker exploited a zero-day vulnerability disclosed on October 27 to access and exfiltrate sensitive files from its systems.
4. MassJacker Malware Hijacks 778,000 Wallets to Steal Cryptocurrency
The newly discovered MassJacker malware targets cryptocurrency wallets by hijacking the clipboard on compromised computers, utilizing 778,531 wallet addresses to steal digital assets. Research from CyberArk revealed that 423 of the wallets contained $95,300, with a central Solana wallet accumulating over $300,000. Historical data indicates even more significant transactions, making the attack a major cryptocurrency theft operation.
5. Data Breach at NTT Affects 18,000 Corporate Customers
NTT Communications Corporation has revealed a data breach impacting 18,000 corporate clients after unauthorized access to its systems was detected in early February 2025. Hackers breached the company’s ‘Order Information Distribution System,’ exposing sensitive details such as customer names, contract numbers, and contact information, but no personal customer data was compromised. NTT confirmed the incident on February 6, 2025, and stated that contracts for corporate smartphones were unaffected by the breach.
6. 6 million Records Stolen in Oracle Cloud Breach
A significant breach in Oracle Cloud has led to the exfiltration of 6 million records, affecting over 140,000 tenants. Security firm CloudSEK reports that the breach exploited a suspected undisclosed vulnerability, with the attacker demanding ransom and leaking sensitive data, including encrypted passwords and key files. CloudSEK assesses the threat as highly sophisticated and rates the severity as high.
Malware Highlights:
1. New Android Malware Uses Microsoft .NET MAUI to Avoid Detection
New Android malware campaigns have been discovered using Microsoft’s .NET MAUI framework to disguise as legitimate services and evade detection. McAfee’s Mobile Research Team uncovered the tactic, which currently targets users in China and India, though the method’s potential to spread suggests other cybercriminals may adopt it soon. The findings underscore the growing sophistication of mobile security threats.
2. RansomHub Ransomware Uses New Betruger ‘Multi-Function’ Backdoor
A newly discovered backdoor, named Betruger, has been linked to RansomHub ransomware-as-a-service (RaaS) operations. Symantec researchers describe it as a “multi-function” malware capable of keylogging, network scanning, privilege escalation, credential dumping, screenshotting, and uploading files to a command-and-control server. This backdoor enhances ransomware attacks by enabling several malicious actions before deploying the ransomware payload.
3. New Akira Ransomware Decryptor Cracks Encryption Keys Using GPUs
Security researcher Yohanes Nugroho has developed a decryptor for the Linux variant of Akira ransomware, utilizing GPU power to recover the decryption key and unlock encrypted files. Nugroho worked on the project for three weeks, spending $1,200 on GPU resources. Initially estimated to take a week, the project faced unforeseen challenges, but the researcher ultimately succeeded in cracking the encryption, offering a free solution for affected users.
4. Chinese Cyberespionage Group FamousSparrow Deploys Upgraded Malware in Recent Attacks
The Chinese cyberespionage group FamousSparrow has been observed using a new modular version of its backdoor, “SparrowDoor,” in attacks targeting a US-based trade organization. ESET researchers discovered that the group has been more active than previously thought, with additional attacks reported against a Mexican research institute and a government agency in Honduras. The group has been active since its operations were first exposed in 2022.
5. Researchers Expose BlackLock Ransomware After Exploiting Leak Site Vulnerability
Threat hunters have uncovered crucial information about the BlackLock ransomware group by exploiting a vulnerability in their data leak site. Resecurity identified a misconfiguration that allowed them to extract sensitive data, including configuration files, credentials, and command history. The flaw also revealed clearnet IP addresses linked to the group’s infrastructure, exposing their operations behind TOR hidden services.
6. RESURGE Malware Targets Ivanti Flaw with Rootkit and Web Shell Features
RESURGE, a new malware discovered by CISA, exploits a recently patched Ivanti Connect Secure vulnerability (CVE-2025-0282) to deploy a sophisticated attack. This malware, which includes features from the SPAWNCHIMERA variant, incorporates rootkit, dropper, backdoor, bootkit, proxy, and tunneler functionalities. It takes advantage of a stack-based buffer overflow vulnerability in Ivanti Connect Secure appliances, enabling remote code execution and persistent access despite system reboots.
New Vulnerabilities:
1. CVE-2025-0108: CVE-2025-29927: Critical Authorization Bypass Vulnerability in Next.js
CVE-2025-29927 is a critical vulnerability in Next.js that allows attackers to bypass authorization checks by manipulating the x-middleware-subrequest header. This flaw enables unauthorized requests to reach protected paths without undergoing security validation. Next.js, a widely used React framework with over 9 million weekly downloads, is used by major companies like TikTok, Netflix, and Uber. Developers are urged to apply patches immediately to mitigate potential exploitation.
2. CVE-2025-24813: Critical RCE in Apache Tomcat
CVE-2025-24813 is a critical remote code execution (RCE) vulnerability in Apache Tomcat, actively exploited in the wild. Attackers can take over servers with a simple PUT request, leveraging proof-of-concept (PoC) exploits published on GitHub just 30 hours after disclosure. Wallarm security researchers confirmed the malicious activity, noting that traditional security tools fail to detect the attack due to the obfuscation of malicious content using base64 encoding.
3. CVE-2025-22230: Authentication Bypass Vulnerability in VMware Tools for Windows
CVE-2025-22230 is an authentication bypass vulnerability in VMware Tools for Windows due to improper access control. A malicious actor with non-administrative privileges on a guest VM can perform high privilege operations within that VM. This issue impacts VMware Tools for Windows versions 11.x.x and 12.x.x, and has been fixed in version 12.5.1. There are no available workarounds to address the issue.
4. CVE-2025-26633: Microsoft Management Console Security Feature Bypass Vulnerability
CVE-2025-26633 is a security feature bypass vulnerability in Microsoft Management Console (MMC) due to improper handling of MSC files. The flaw allows an attacker to evade file reputation protections and execute code in the context of the current user. Although user interaction is required, threat actors such as EncryptHub (Larva-208) have successfully exploited this flaw in targeted attacks against over 600 organizations. Immediate action is recommended to patch this vulnerability.
5. CVE-2025-24983: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2025-24983 is an elevation of privilege vulnerability in the Windows Win32 Kernel Subsystem that allows an authenticated user to execute specially crafted code with SYSTEM privileges. This type of vulnerability is typically paired with a code execution flaw to fully compromise a system. Although Microsoft has not disclosed the scope of exploitation, it is recommended to deploy the patches immediately to mitigate the risk of targeted attacks.
6. CVE-2025-24991: Windows NTFS Information Disclosure Vulnerability
CVE-2025-24991 is an information disclosure vulnerability in the Windows NTFS that could allow attackers to access unspecified memory contents. The vulnerability is triggered when the target mounts a specially crafted VHD, leading to an info leak. While it’s not targeted, the leak could be valuable for attackers. It’s crucial to test and deploy the fixes swiftly, as active exploitation is already underway.
Tools of the Month
- Garak: It’s a vulnerability scanner for LLMs that detects issues like hallucination, data leakage, prompt injection, and toxicity.
- Wapiti: It’s a black-box web application vulnerability scanner with a built-in fuzzer for detecting security flaws.
Protect Your Business from Cyber Attacks!
In today’s world, cyber threats are constantly evolving, and staying one step ahead is crucial for your business. At iwebbs.com, we understand the stakes. Our team of certified security experts is here to help you pinpoint weak spots, implement rock-solid protection, and keep your business safe from even the most sophisticated attacks.
Don’t wait until it’s too late. Take control of your cybersecurity today. Reach out to us for a personalized consultation and find out how we can help you protect your organization from cyber risks. Let’s work together to secure your future!