Cybersecurity threats in May 2025 continue to evolve at a rapid pace, with critical vulnerabilities, large-scale breaches, and new malware campaigns making headlines worldwide. From healthcare giants facing multi-million record breaches to zero-day flaws threatening enterprises, the stakes have never been higher. This newsletter brings you a clear, concise breakdown of the most important incidents, helping you stay informed and better prepared to protect your organization against the latest risks.
Welcome to our May 2025 Cybersecurity Newsletter! This edition brings you the latest updates on global cyber incidents, emerging threats, and critical vulnerabilities impacting organizations and individuals alike. From high-profile arrests to massive data breaches and new malware campaigns, we cover the key developments shaping the cybersecurity landscape this month.
News Highlights:
1. Fortinet Discovers Persistent FortiGate Access via SSL-VPN Symlink Exploit Despite Patching
Fortinet has warned that attackers exploited SSL-VPN vulnerabilities (including CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762) to maintain read-only access on FortiGate devices even after patches were applied. The attackers used a symlink trick within the user file system to bypass detection and retain access to configuration files. Fortinet has released updates across multiple FortiOS versions to remove malicious symlinks and harden SSL-VPN UI handling, urging affected customers to upgrade immediately and treat existing configurations as potentially compromised.
2. SonicWall Confirms Active Exploitation of Critical Flaws in SMA 100 Series Appliances
SonicWall has confirmed active exploitation of two patched vulnerabilities—CVE-2023-44221 and CVE-2024-38475—impacting its SMA 100 Series devices, including models 200, 210, 400, 410, and 500v. The flaws allow OS command injection and unauthorized file access, potentially enabling session hijacking. Despite fixes released in December 2023 and 2024, SonicWall urges customers to update to the latest firmware and check for unauthorized logins on affected systems.
3. Meta Unveils LlamaFirewall to Defend AI Systems Against Jailbreaks, Injections, and Unsafe Code
Meta has introduced LlamaFirewall, a modular, open-source framework aimed at protecting AI systems from threats like prompt injection, jailbreaks, and insecure code. It features PromptGuard 2 for real-time threat detection, Agent Alignment Checks for goal hijacking prevention, and CodeShield to block unsafe code generation. Designed for flexibility, it supports both simple chatbots and advanced agents. Meta also updated LlamaGuard and CyberSecEval to enhance AI safety and evaluation.
4. Ripple’s xrpl.js npm Library Backdoored to Steal Crypto Wallet Keys in Supply Chain Attack
Ripple’s popular JavaScript library xrpl.js was backdoored in a supply chain attack targeting users’ private keys, affecting versions 4.2.1 to 4.2.4 and 2.14.2. The attack, traced to a user “mukulljangid,” added a malicious function that exfiltrated keys to an external domain. The issue has since been patched in versions 4.2.5 and 2.14.3. Used widely for interacting with the XRP Ledger, the package has over 2.9 million downloads.
5. Apple ‘AirBorne’ Vulnerabilities Enable Zero-Click RCE via AirPlay Protocol
Researchers from Oligo Security have uncovered 23 critical vulnerabilities in Apple’s AirPlay protocol and SDK, dubbed “AirBorne,” that could allow attackers to perform zero-click and one-click remote code execution, man-in-the-middle attacks, and more. These flaws, impacting both Apple and third-party devices, were patched by Apple on March 31 across iOS, macOS, and visionOS platforms.
6. Kali Linux Users Urged to Manually Install New Repo Signing Key After Key Loss
Offensive Security has warned Kali Linux users to manually install a new repository signing key after losing access to the previous one, causing update failures. The old key wasn’t compromised but is now obsolete, and systems still relying on it will encounter signature verification errors. OffSec froze the repo on February 18 to prevent issues but is resuming updates with the new key. Users must run a provided command to update their keyring and restore normal functionality.
Breaches Highlights:
1. Yale New Haven Health Confirms Data Breach Impacting 5.5 million Patients
Yale New Haven Health (YNHHS) has confirmed a data breach affecting 5.5 million patients following a cyberattack in March 2025. While patient care was not disrupted, personal details such as names, contact information, SSNs, and medical record numbers were exposed. The breach did not compromise financial or treatment data. YNHHS enlisted Mandiant and notified federal authorities to investigate and respond to the incident.
2. Blue Shield of California Data Breach Exposes 4.7 million Members’ Health Information to Google
Blue Shield of California revealed a data breach affecting 4.7 million members after a misconfigured Google Analytics setup exposed protected health information to Google Ads between April 2021 and January 2024. The nonprofit health plan stated the incident may have enabled Google to use the data for targeted advertising. The breach was discovered on February 11, 2025, and has since been reported to federal authorities.
3. Baltimore City Public Schools Data Breach Impacts Over 31,000 Students and Staff
Baltimore City Public Schools disclosed a data breach affecting over 31,000 individuals after attackers infiltrated its network on February 13, 2025. The district, which serves over 76,000 students across 164 schools, immediately launched an investigation and notified law enforcement. Efforts were taken to secure affected systems and assess the scope of the incident.
4. Lab Testing Provider LSC Data Breach Exposes Personal Information of 1.6 Million Individuals
Seattle-based Laboratory Services Cooperative (LSC) disclosed a data breach affecting 1.6 million people after a threat actor accessed and exfiltrated sensitive files in October 2024. LSC, which supports reproductive health services across over 35 U.S. states, detected the breach on October 27 and promptly engaged cybersecurity experts and federal authorities. The stolen data includes personal and lab-related information.
5. Port of Seattle Data Breach: Ransomware Attack Affects 90,000 Individuals
The Port of Seattle has notified 90,000 individuals about a data breach caused by a ransomware attack in August 2024. The attack, attributed to the Rhysida ransomware group, disrupted various services, including reservation systems, airport display boards, and the Port’s website, along with flight delays at Seattle-Tacoma International Airport. The breach compromised personal information and caused a significant IT outage.
6. Europcar GitLab Breach Exposes Data of 200,000 Customers and Sensitive Company Information
Europcar Mobility Group suffered a breach in its GitLab repositories, exposing personal data of up to 200,000 customers, along with source code for its Android and iOS apps. The hacker, who demanded a ransom, threatened to release 37GB of sensitive data, including company backups and details of its cloud infrastructure. Europcar, which operates multiple car rental brands across 140 countries, is addressing the breach and its potential impact.
Malware Highlights:
1. Triada Malware Found Preloaded on Counterfeit Android Phones, Infects Over 2,600 Devices
A new wave of Triada malware infections has been discovered on counterfeit Android smartphones, impacting over 2,600 users—mostly in Russia—between March 13 and 27, 2025, according to Kaspersky. Preinstalled on fake versions of popular phone models, the malware functions as a remote access trojan (RAT), capable of data theft and turning devices into botnet nodes. Previously spread via apps and WhatsApp mods like FMWhatsApp, this latest campaign poses significant security risks through preloaded malware.
2. DslogdRAT Malware Leveraged in Japan Attacks via Ivanti ICS Zero-Day CVE-2025-0282
A new malware strain dubbed DslogdRAT was deployed in attacks targeting Japanese organizations after threat actors exploited a zero-day flaw (CVE-2025-0282) in Ivanti Connect Secure, now patched. Active around December 2024, the campaign involved China-linked group UNC5337 using the flaw to drop DslogdRAT, web shells, and other malware like SPAWN, DRYHOOK, and PHASEJAM. Subsequent reports from JPCERT/CC and CISA confirmed wider abuse of this vulnerability to deliver variants such as SPAWNCHIMERA and RESURGE.
3. ResolverRAT Malware Targets Global Pharma and Healthcare Firms via Phishing Attacks
A newly discovered remote access trojan named ResolverRAT is targeting pharmaceutical and healthcare organizations worldwide through phishing emails posing as legal or copyright violation notices. The emails use country-specific languages and lure victims into downloading a legitimate file (‘hpreader.exe’) that injects the malware into memory via reflective DLL loading. Uncovered by Morphisec, ResolverRAT was missed in earlier reports that focused on stealers like Rhadamanthys and Lumma using the same phishing infrastructure.
4. PipeMagic Trojan Exploits Windows Zero-Day to Deploy Ransomware in Targeted Global Attacks
Microsoft has disclosed that a now-patched Windows zero-day vulnerability, CVE-2025-29824, was exploited by threat actors using the PipeMagic trojan to deploy ransomware. The attacks, tracked as Storm-2460, targeted organizations in the IT and real estate sectors in the U.S., Venezuela’s financial sector, a Spanish software firm, and retailers in Saudi Arabia. The flaw, a CLFS privilege escalation bug enabling SYSTEM-level access, was patched in the April 2025 security update.
5. New TCESB Malware Exploits ESET Flaw in Ongoing ToddyCat Cyber Attacks Across Asia
A Chinese-linked threat group known as ToddyCat is exploiting a flaw in ESET security software to deploy a newly discovered malware dubbed TCESB, according to a recent Kaspersky report. The malware is designed to stealthily execute payloads while bypassing device protections. Active since at least 2020, ToddyCat continues to target organizations across the Asia-Pacific, harvesting data and maintaining long-term access to compromised networks.
6. Spyware Masquerading as Alpine Quest Targets Russian Military with Stealth Data Theft
A new Android spyware campaign is targeting Russian military personnel by disguising malware as the Alpine Quest mapping app. Embedded in modified APKs distributed via fake Telegram channels and app catalogs, the spyware (dubbed Android.Spy.1292.origin) stealthily mimics the legitimate app while collecting sensitive data, including contacts, location, and stored files. It can also exfiltrate Telegram and WhatsApp content, sending updates to a Telegram bot and downloading additional modules for deeper surveillance.
New Vulnerabilities:
1. CVE-2025-3928: Unspecified Vulnerability in Commvault Web Server Allows Remote Web Shell Execution
CVE-2025-3928 is an unspecified vulnerability in the Commvault Web Server that can be exploited by a remote, authenticated attacker to execute web shells. Commvault states attackers could compromise webservers through malicious shell uploads. The issue affects both Windows and Linux platforms and is fixed in versions 11.36.46, 11.32.89, 11.28.141, and 11.20.217.
2. CVE-2025-32432: High-Impact Remote Code Execution Vulnerability in Craft CMS Versions Below 5.6.17
CVE-2025-32432 is a remote code execution (RCE) vulnerability affecting Craft CMS from versions 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17. The flaw enables attackers to execute arbitrary code remotely with low complexity, posing a significant risk. It serves as an additional fix for CVE-2023-41892 and has been patched in versions 3.9.15, 4.14.15, and 5.6.17.
3. CVE-2025-32433: Unauthenticated Remote Code Execution Vulnerability in Erlang/OTP SSH Server
CVE-2025-32433 is a critical unauthenticated remote code execution vulnerability in the Erlang/OTP SSH server, affecting all versions that expose SSH access. By exploiting a flaw in SSH message handling, attackers with network access can execute arbitrary commands without valid credentials. The issue has been patched in OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20. Disabling the SSH server or applying firewall rules is advised as a temporary workaround.
4. CVE-2025-31324: Unrestricted File Upload Vulnerability in SAP NetWeaver Visual Composer
CVE-2025-31324 is a critical vulnerability in SAP NetWeaver’s Visual Composer Metadata Uploader, allowing unauthenticated attackers to upload malicious executable files, including webshells, to the system. The issue arises from improper authentication and authorization checks, which permit unauthorized access to sensitive functionality. With a CVSS score of 10, successful exploitation can lead to full system compromise. The vulnerability impacts systems running SAP NetWeaver 7.xx, and is particularly widespread despite being an optional component.
5. CVE-2025-29824: Elevation of Privilege Vulnerability in Windows Common Log File System Driver
CVE-2025-29824 is an important elevation of privilege vulnerability in the Windows Common Log File System, with a CVSS score of 7.8. This flaw allows remote attackers to execute arbitrary code on a victim machine, typically via a malicious email attachment or website. Microsoft has confirmed the vulnerability is actively being exploited, though no proof-of-concept has been disclosed. A fix was included in the April 2025 Patch Tuesday updates.
6. CVE-2025-27480: Critical RCE Vulnerability in Windows Remote Desktop Services
CVE-2025-27480 is a critical remote code execution (RCE) vulnerability affecting Microsoft Windows Remote Desktop Services, with a CVSS score of 8.1. The vulnerability allows attackers to execute malicious code remotely without authentication by exploiting a race condition in the Remote Desktop Gateway role. No user interaction is required, making this flaw particularly dangerous. It affects memory handling in the Remote Desktop Gateway Service.
Tools of the Month
- Scan4secrets: It’s a lightweight and high-performance scanner designed to detect secrets during both static (SAST) and dynamic (DAST) application security testing.
- Trishul: It’s a web-based framework that streamlines mobile application security testing by integrating tools like Frida for efficient hooking and runtime analysis.
Protect Your Business from Cyber Attacks!
In today’s world, cyber threats are constantly evolving, and staying one step ahead is crucial for your business. At iwebbs.com, we understand the stakes. Our team of certified security experts is here to help you pinpoint weak spots, implement rock-solid protection, and keep your business safe from even the most sophisticated attacks.
Don’t wait until it’s too late. Take control of your cybersecurity today. Reach out to us for a personalized consultation and find out how we can help you protect your organization from cyber risks. Let’s work together to secure your future!