Serious Intelligence Weekly
Tuesday, April 29, 2025
This week saw significant developments in cybersecurity threats and corporate responses. Marks & Spencer faced disruptions from a Scattered Spider ransomware attack, while Hitachi Vantara was forced to take servers offline following an Akira ransomware attack. In the public sector, CISA added critical vulnerabilities in Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities catalog.
Targeted attacks continued to pose threats to specific communities and sectors. The World Uyghur Congress leaders were targeted through a trojanized version of UyghurEdit++, while the Earth Kurma APT group conducted sophisticated campaigns against government and telecommunications organizations in Southeast Asia. Additionally, over 1,200 SAP NetWeaver servers were found vulnerable to an actively exploited flaw.
On the corporate front, significant investments in cybersecurity were announced. IBM committed $150 billion for US investment in quantum innovation and national security, while Palo Alto Networks moved to acquire AI security firm Protect AI. The cybercrime landscape also evolved with the shutdown of BreachForums, a major data leak marketplace.
This week saw significant developments across privacy, AI security, and system vulnerabilities. A notable victory for privacy advocates emerged as Windscribe's founder was acquitted in a Greek court over the company's no-logs VPN policy, setting an important precedent for privacy-focused services. Meanwhile, cryptocurrency security concerns escalated with a dramatic $250 million theft that led to physical violence, highlighting the increasing real-world implications of digital assets.
In system security, a concerning new Linux threat emerged with the Curing rootkit exploiting io_uring to bypass traditional detection methods. Android security saw both offensive and defensive developments - while detailed rooting techniques were published, Google announced an automatic reboot feature to enhance security, following Apple's lead.
Perhaps most notably, researchers proposed Guillotine, a groundbreaking hypervisor architecture designed to contain potentially dangerous AI systems through multiple layers of isolation and physical failsafes. This development comes amid growing concerns about AI safety and control, suggesting a shift toward hardware-level containment strategies for advanced AI systems.
A significant cyber-attack impacted British retailer Marks & Spencer (M&S), causing disruptions to their online order system and in-store contactless payments. The company had to temporarily suspend online orders and issue refunds to affected customers.
Steganography techniques continue to evolve as a method for concealing malicious payloads. Example of a Payload Delivered Through Steganography demonstrates how attackers are using digital photographs and other media to hide suspicious data from security tools. This development highlights the growing sophistication of threat actors in evading detection.
SMS gateway exploitation has emerged as a significant vector for spam distribution, with attackers targeting Teltonika Networks SMS Gateways. Rather than using legitimate services like Twilio or AWS SNS, malicious actors are compromising these gateways to send spam messages at scale, representing a shift in tactics from credential theft to direct infrastructure exploitation.
The FBI reports a significant surge in ransomware attacks targeting critical infrastructure, with complaints jumping 9% over the previous year. Manufacturing, healthcare, government facilities, financial services, and IT sectors were the primary targets. This trend is particularly concerning for the manufacturing sector, which has seen itself increasingly targeted by sophisticated attacks.
The 2025 LevelBlue Futures Report reveals concerning statistics about emerging threats, with 59% of organizations struggling to discern deepfake attacks and only 32% feeling prepared for synthetic identity attacks. The report highlights how AI is advancing attack capabilities faster than organizations can implement protective measures.
The Verizon 2025 DBIR further emphasizes these concerns, showing vulnerability exploitation present in 20% of breaches - a 34% increase year-over-year. The report particularly highlights vulnerabilities in VPNs and edge devices, which accounted for 22% of CVE-related breaches, nearly eight times the amount from the previous year.
ISO Serious Ltd. is a company registered England and Wales (Company No. 15466339), Dragon CoWorking, 7-8 New Road Avenue, Rochester, Kent, United Kingdom, ME4 6BB.
intelligence@isoserious.com | Privacy Policy
Weekly Intelligence Briefing: 29th April 2025
The Plain English Version
Hello there! Welcome back to our weekly translation of digital nightmares into something approaching understandable English. Pour yourself something fortifying as we explore how various bits of technology tried to ruin everyone's week.
🛒 British Icons Under Attack: M&S Hit Hard
Marks & Spencer has joined the increasingly un-exclusive club of "Retailers Who've Had Their Systems Compromised":
They're not alone in their suffering – Hitachi Vantara also had to take servers offline following an "Akira" ransomware attack. Not to be confused with the classic anime film, though both do feature systems going horribly wrong.
💉 Critical Infrastructure: Healthcare & Manufacturing in the Crosshairs
The people who should be focusing on keeping us alive and making useful things are instead dealing with digital headaches:
📱 When Text Messages Attack: SMS Gateway Problems
It turns out those text messages about your parcel delivery might be more sinister than you thought:
🤖 AI Security: When Containing Artificial Intelligence Becomes Essential
The "teaching computers to think" project continues to need increasingly robust guardrails:
What You Actually Need To Do
🚨 Do These Today (We Mean It)
⚠️ Do These This Week
🔔 Schedule These Soon
What's Actually Happening Out There
Ransomware Trends
The digital extortion business continues to thrive:
- Marks & Spencer hit by Scattered Spider ransomware affecting online and in-store systems
- Hitachi Vantara forced to take servers offline following Akira ransomware
- FBI reports significant surge in attacks targeting critical infrastructure
- Manufacturing, healthcare, government facilities, financial services, and IT sectors are primary targets
AI Security Developments
The battle between helpful and harmful AI intensifies:
- Guillotine research proposes hardware-level containment strategies for advanced AI systems
- Major investments in AI security from industry leaders like IBM, Palo Alto Networks
- 59% of organisations struggle to identify deepfake attacks
- Only 32% feel prepared for synthetic identity attacks
Emerging Attack Techniques
The criminals continue to get more creative:
- Steganography evolving as a method for concealing malicious payloads in digital photographs
- SMS gateway exploitation emerging as a significant vector for spam distribution
- Linux "Curing rootkit" exploiting io_uring to bypass traditional detection methods
- VPN and edge device vulnerabilities accounting for 22% of security breaches
Special Focus: The Rising Threat of Steganography
This week saw concerning developments in "steganography" – the art of hiding malicious code inside seemingly innocent files like photographs or documents.
What Is It?: Steganography is essentially digital hide-and-seek, where attackers conceal harmful code within ordinary-looking files. Unlike encryption, which makes it obvious something is hidden (but makes it unreadable), steganography makes the very existence of the secret data difficult to detect.
Why You Should Care: Security tools are designed to spot obviously suspicious files. When malicious code is hidden inside what appears to be a harmless holiday photo or corporate PowerPoint, it can easily slip past defences.
Recent Developments: New examples show attackers hiding complete attack tools inside digital photographs and other media files, effectively making them invisible to standard security controls.
What To Do About It:
- Ensure your security teams are aware of these techniques
- Consider implementing more advanced file inspection tools
- Be suspicious of unexpected image files, even from apparently trusted sources
- When in doubt, don't open it (the digital equivalent of "if it smells off, don't eat it")
Startling Stat of the Week
This week's "well that's concerning" award goes to: VPN and edge device vulnerabilities accounted for 22% of all security breaches, nearly eight times the amount from the previous year.
Translation: All those services that connect your remote workers to your systems have become eight times more likely to be the weak point in your defences. No pressure.
As always, if you need help implementing any of these recommendations or just want to vent about the relentless pace of digital security threats, we're available at intelligence@isoserious.com
Stay secure,
ISO Serious
P.S. We're delighted to report that our email server has recovered from its existential crisis and is now dutifully delivering these digests once more. We're sorry for the disruption but pleased to be back in your inbox – though judging by this week's news, perhaps blissful ignorance wasn't so bad after all.