The August 2025 Cybersecurity Newsletter highlights major global incidents, including critical vulnerabilities in Base44, Sophos, and SonicWall, ransomware attacks on U.S. infrastructure, North Korean IT scams, and large-scale breaches at Allianz Life, Co-op, and BigONE Exchange. It also covers emerging malware threats, new CVEs, and the latest security tools to help organizations stay protected.
Welcome to our August 2025 Cybersecurity Newsletter! This edition brings you the latest updates on global cyber incidents, emerging threats, and critical vulnerabilities impacting organizations and individuals alike. From high-profile arrests to massive data breaches and new malware campaigns, we cover the key developments shaping the cybersecurity landscape this month.
News Highlights:
1. Wiz Discovers Critical Authentication Bypass in AI-Based Coding Platform Base44
Security researchers at Wiz uncovered a critical flaw in Base44, an AI-powered coding platform owned by Wix, that allowed attackers to bypass authentication using only a visible “app_id” value. By exploiting undocumented registration and OTP verification endpoints, attackers could gain unauthorized access to private applications, bypassing even SSO protections. The vulnerability was quickly patched within 24 hours of disclosure on July 9, 2025. Though no malicious activity was detected, the case highlights growing risks in AI-driven development platforms.
2. Scattered Spider Uses Social Engineering to Hijack VMware ESXi and Deploy Ransomware on U.S. Infrastructure
The threat group Scattered Spider, also known as 0ktapus or UNC3944, has been targeting critical U.S. infrastructure by hijacking VMware ESXi systems to deploy ransomware. Rather than exploiting software vulnerabilities, the attackers rely heavily on social engineering tactics, including impersonating IT support to bypass security controls. Once inside, they leverage administrative tools and Active Directory to access VMware environments, enabling stealthy data exfiltration and ransomware deployment. Their operations are precise, campaign-driven, and often involve spoofed domains resembling legitimate company portals.
3. U.S. Sanctions North Korean IT Front Company as Arizona Woman Jailed for Running Laptop Farm
The U.S. Treasury has sanctioned North Korean front company Korea Sobaeksu Trading Company and three individuals for operating a fraudulent remote IT worker scheme to fund the DPRK’s weapons programs. These workers, often posing with fake identities and using pop culture-themed profiles, infiltrated global companies to earn foreign income and, in some cases, deploy malware. An Arizona woman was also jailed for managing a “laptop farm” supporting the operation. The crackdown underscores ongoing efforts to dismantle Pyongyang’s global cyber and sanctions-evasion network.
4. Sophos and SonicWall Patch Critical Remote Code Execution Vulnerabilities in Firewall Devices
Sophos and SonicWall have released security updates to address critical remote code execution flaws in their firewall and SMA 100 Series devices. Sophos patched multiple high-severity issues, including CVE-2025-6704 and CVE-2025-7624, affecting a small percentage of devices under specific configurations. Meanwhile, SonicWall fixed a critical vulnerability (CVE-2025-40599) in its SMA 100 Series that could allow file uploads leading to code execution. Though not yet exploited, the risk is elevated due to recent findings of threat actors targeting fully-patched devices.
5. China-Linked APTs Use Fake Dalai Lama Apps to Spy on Tibetan Community
China-based cyber espionage groups launched targeted campaigns—Operation GhostChat and PhantomPrayers—against the Tibetan community ahead of the Dalai Lama’s 90th birthday. Zscaler reports that attackers compromised a legitimate website, redirecting users to a fake page hosting a backdoored chat app named TElement. The malware-laced app deployed Gh0st RAT or PhantomNet to spy on victims, while JavaScript on the site collected visitor data for exfiltration.
6. CERT-UA Uncovers APT28’s LAMEHUG Malware Using LLM for Targeted Phishing Attacks
Ukraine’s CERT-UA has revealed a phishing campaign linked to Russian APT group APT28 (Fancy Bear), involving a new Python-based malware called LAMEHUG. The malware was delivered via ZIP archives in emails impersonating government officials and targeting executive authorities. LAMEHUG uses Alibaba Cloud’s Qwen2.5-Coder-32B-Instruct LLM to generate commands from textual descriptions, making it more adaptive and stealthier. Three payload variants were identified, including .pif, .exe, and .py files.
Breaches Highlights:
1. Allianz Life Data Breach Exposes Personal Information of Majority of 1.4 million Customers
Allianz Life has confirmed that a recent data breach compromised the personal information of most of its 1.4 million customers, financial professionals, and some employees. The breach, which occurred on July 16, 2025, stemmed from unauthorized access to a third-party cloud-based CRM via social engineering. While the company’s internal systems remain unaffected, the FBI has been notified and an ongoing investigation is underway. Affected individuals are being contacted and offered support.
2. Critical Flaw in CrushFTP Actively Exploited, over 1,000 Servers at Risk
Over 1,000 internet-exposed CrushFTP servers are vulnerable to active hijack attacks due to a critical AS2 validation flaw (CVE-2025-54309), affecting versions below 10.8.5 and 11.3.4_23. CrushFTP confirmed the issue is being exploited in the wild, urging immediate patching. Servers using up-to-date versions or configured with a DMZ instance remain protected.
3. BigONE Exchange Suffers $27 Million Crypto Heist, Promises Full Reimbursement
Cryptocurrency exchange BigONE confirmed a $27 million loss after hackers breached its hot wallet on July 16. While private keys and user data were not compromised, the platform assured all affected users will be fully reimbursed. The attack has been contained, and BigONE is working with security firm SlowMist to trace the stolen assets across blockchains.
4. Co-op Confirms Data Breach Impacted 6.5 million Members in April Cyberattack
UK retailer Co-op has confirmed that personal data of all 6.5 million members was stolen during the April cyberattack that disrupted operations and caused food shortages. While no financial details were exposed, contact information was accessed by attackers. Co-op CEO Shirine Khoury-Haq apologized publicly, calling the breach a deeply personal blow to members and staff, and emphasized the emotional toll it had on the organization.
5. IdeaLab Confirms Ransomware Breach Exposed Employee Data
IdeaLab has confirmed a data breach from October 2024, where hackers accessed sensitive information belonging to employees, contractors, and their dependents. The attack, now attributed to the Hunters International ransomware group, led to the theft of 262.8 GB of data. While the company did not fully detail the exposed data, names and other personal identifiers were compromised. The incident was disclosed after a months-long investigation, and the stolen data was leaked on the dark web following an apparent failed extortion.
6. Bitcoin Depot Data Breach Exposes Personal Info of 27,000 Crypto Users
Bitcoin Depot, a major Bitcoin ATM operator, has disclosed a data breach affecting nearly 27,000 users. The incident, first detected in June 2023 but publicly revealed after a federal investigation concluded in July 2024, exposed sensitive personal information such as names, contact details, driver’s license numbers, and dates of birth. The compromised data was collected as part of mandatory Know-Your-Customer (KYC) processes. While no identity protection services were offered, users are urged to stay vigilant for fraud and consider credit freezes.
Malware Highlights:
1. Free Decryptor Released for Defunct FunkSec Ransomware Targeting Global Sectors
A free decryptor for the FunkSec ransomware has been released after the group appeared to stop its operations. FunkSec, which surfaced in late 2024, affected 172 victims across the U.S., India, and Brazil, mainly targeting the tech, government, and education sectors. The ransomware was built using the Rust programming language and used ChaCha20-Poly1305 encryption through the orion-rs library. Experts believe the group may have been made up of less experienced hackers aiming for attention, with no new activity since March 2025.
2. Soco404 and Koske Malware Exploit Cloud Flaws for Cross-Platform Cryptomining
Security researchers have identified two malware campaigns named Soco404 and Koske that are targeting cloud services through misconfigurations and vulnerabilities. These attacks deploy cryptocurrency miners on both Linux and Windows systems using fake 404 error pages hosted on Google Sites. Soco404 uses process masquerading to blend in with system processes, while the campaigns have been linked to broader crypto scams involving weakly secured services like Apache Tomcat and Atlassian Confluence.
3. CastleLoader Malware Hits 469 Systems Using Fake GitHub Repositories and ClickFix Phishing
CastleLoader, a new modular malware loader, has infected 469 devices through phishing campaigns using fake GitHub repositories and Cloudflare-themed ClickFix lures. According to PRODAFT, it delivers stealers like RedLine and RATs such as NetSupport by tricking users into running PowerShell commands from spoofed domains. The malware uses dead code injection and runtime unpacking to evade detection, then connects to a command-and-control server to download additional payloads. Its flexible, staged structure allows attackers to separate the infection method from final malware delivery, complicating detection and response.
4. Coyote Malware Variant Abuses Windows UI Automation to Target Banking and Crypto Credentials
A new variant of the Coyote banking trojan is the first known malware to exploit Windows UI Automation (UIA) to steal credentials from 75 financial institutions and crypto exchanges, mainly targeting Brazilian users. Researchers at Akamai discovered that the malware uses UIA to scan browser UI elements when standard checks fail, enabling it to extract sensitive data. Coyote also uses keylogging, screenshot capture, and fake overlays to harvest information. This technique resembles methods used by Android banking trojans that abuse accessibility features for credential theft.
5. Iran-Linked DCHSpy Android Malware Poses as VPN and Starlink Apps to Spy on Users
Researchers from Lookout have discovered DCHSpy, a sophisticated Android spyware linked to Iran’s Ministry of Intelligence, disguised as VPN and Starlink apps to target dissidents. First detected in July 2023, the malware is attributed to the MuddyWater group and is capable of collecting WhatsApp data, SMS, contacts, files, location, and even recording audio and taking photos. The spyware uses corrupted APK metadata and reused signing certificates to hide its origins, with some samples traced back to 2023 and uploaded from Russia.
6. ZuRu Malware Variant Targets macOS Developers Using Trojanized Termius App
A new variant of the ZuRu malware is targeting macOS developers by distributing a trojanized version of the Termius app through pirated software and fake search ads. Researchers found that the malware, delivered via a modified .dmg file, uses a tampered code signature to bypass macOS security checks. ZuRu has previously spread through fake versions of iTerm2, Microsoft Remote Desktop, and other tools. It leverages the Khepri post-exploitation toolkit to give attackers remote access, with opportunistic campaigns aimed at users seeking business or development utilities.
New Vulnerabilities:
1. CVE-2025-2776: Critical Unauthenticated XXE Vulnerability in SysAid On-Prem ≤ 23.3.40
CVE-2025-2776 is a critical unauthenticated XML External Entity (XXE) vulnerability in SysAid On-Prem ≤ 23.3.40. It allows remote attackers to extract sensitive files and gain admin access without credentials. Exploitation can lead to full system compromise and lateral movement across enterprise networks. No patch is available yet, and public exploits exist. Restrict access and monitor outbound traffic for signs of exploitation.
2. CVE-2025-54309: Critical AS2 Validation Bypass Grants Remote Admin Access in CrushFTP
CVE-2025-54309 is a critical logic flaw in CrushFTP’s AS2 validation that allows remote admin access when the DMZ proxy is disabled. Exploits are publicly available and actively abused in the wild, with no official patch released yet. Affects CrushFTP v10 (before 10.8.5) and v11 (before 11.3.4_23). Mitigation includes enabling the DMZ proxy and restricting HTTPS access to admin ports.
3. CVE-2025-5777: High-Impact Memory Overread Vulnerability in Citrix NetScaler Gateway Services
CVE-2025-5777 is a high-severity unauthenticated memory overread vulnerability in Citrix NetScaler Gateway services (VPN, CVPN, RDP Proxy, ICA Proxy, AAA) due to improper input validation. Actively exploited in the wild with over 19 public exploit variants, it leaks session tokens and sensitive memory content. Exploitation can lead to session hijacking and potential internal pivoting. A patch is available and must be applied immediately, especially for internet-facing systems.
4. CVE-2025-20337: Critical Unauthenticated RCE Vulnerability in Cisco ISE API
CVE-2025-20337 is a critical unauthenticated remote code execution vulnerability in Cisco ISE and ISE-PIC due to improper input validation in the API layer. A single crafted request allows attackers to execute root-level commands without credentials. Although no public exploit exists yet, the vulnerability poses a severe risk to network access control infrastructure. Cisco has released a patch and recommends restricting API access and enabling logging.
5. CVE-2025-49717: High-Severity Heap Overflow in Microsoft SQL Server Leading to RCE
CVE-2025-49717 is a heap-based buffer overflow in Microsoft SQL Server that allows authenticated users to execute remote code by corrupting memory during specific network operations. Though no public exploit exists yet, the vulnerability poses a real threat for privilege escalation and lateral movement in hybrid environments. A patch is available, and restricting access from untrusted networks is strongly advised.
6. CVE-2025-48822: High-Risk Guest-to-Host Escape in Windows Hyper-V
CVE-2025-48822 is a high-severity out-of-bounds read vulnerability in Microsoft Hyper-V that allows a guest VM to execute code on the host without needing elevated privileges. This flaw compromises isolation and poses serious risk in shared or production environments. Though no public exploit exists, Microsoft has released a patch, and minimizing guest-to-host interactions is strongly recommended.
Tools of the Month
- Sirius: It is an open-source vulnerability scanner that combines automated penetration testing with community driven security intelligence. Designed for quick deployment using Docker, it helps identify and exploit weaknesses across systems with minimal setup, making it ideal for continuous and collaborative security assessments.
- AWSRAID: It is a modular AWS enumeration tool designed for penetration testing and security auditing. Using the boto3 library, it identifies and maps cloud resources by listing services such as IAM, EC2, S3, Lambda, RDS, and more, helping uncover misconfigurations and security gaps across AWS environments.
Protect Your Business from Cyber Attacks!
In today’s world, cyber threats are constantly evolving, and staying one step ahead is crucial for your business. At iwebbs.com, we understand the stakes. Our team of certified security experts is here to help you pinpoint weak spots, implement rock-solid protection, and keep your business safe from even the most sophisticated attacks.
Don’t wait until it’s too late. Take control of your cybersecurity today. Reach out to us for a personalized consultation and find out how we can help you protect your organization from cyber risks. Let’s work together to secure your future!