## Daily Cybersecurity Briefing – June 15, 2025 ### Microsoft Patches Exploited Zero-Day; Mirai Botnets Target Wazuh Servers **Microsoft has addressed a zero-day vulnerability (CVE-2025-33053) actively exploited for cyber espionage. Additionally, researchers warn that Mirai botnets are exploiting a critical remote code execution flaw (CVE-2025-24016) in unpatched Wazuh XDR/SIEM servers.** Recommended action: Patch all affected Microsoft products and update Wazuh servers immediately. Full story (HelpNet Security) --- ### FBI Issues Smartphone Warning – Malicious Text Campaigns Surge **The FBI warns that millions of malicious texts targeting both iPhone and Android users are circulating, urging recipients to delete such messages immediately.** These scams often attempt credential theft and malware installation. Full story (Forbes Security) --- ### Google Urges 2 Billion Gmail Users to Reset Passwords **Google is telling all Gmail users to change their passwords now due to ongoing credential-stuffing attacks and security threats.** Full story (Forbes Security) --- ### Critical Updates for Google Messages and Popular Mobile Apps **Over 1 billion users are affected by a security update to Google Messages aimed at closing a critical vulnerability.** Experts also urge users to urgently update specific apps exposing sensitive data. - Google Messages update (Forbes) - High-risk app list (Forbes) --- ### Major Data Breach: 7.4 Million Paraguayan Citizen Records Leaked **PII of 7.4 million Paraguayan citizens has appeared for sale on the dark web, exposing sensitive information to cybercriminals.** This sizable leak demonstrates ongoing global risks of mass data exposure. Full story (CISO2CISO / Security Affairs) --- ### Apple Messages Zero-Day Actively Exploited **Apple has confirmed that a now-patched vulnerability (CVE-2025-43200) in its Messages app was actively exploited to target journalists, likely via Paragon’s Graphite spyware.** Update all Apple devices promptly to secure against this threat. Full story (CISO2CISO / Security Affairs) --- ### CISA Warns: Ransomware Targeting SimpleHelp RMM **CISA is tracking a “pattern” of ransomware attacks exploiting SimpleHelp remote monitoring and management (RMM) platforms.** Organizations using SimpleHelp should review security configurations and monitor for compromise. Full story (CISO2CISO / Dark Reading) --- ### WestJet Hit by Cyberattack, Operations Disrupted **Canada’s second-largest airline, WestJet, is investigating a cyberattack that has caused internal system outages.** Affects ticketing, operations, and potentially customer data. Full story (BleepingComputer) --- ### Ransomware Trends: Fog Attackers Use Unusual Toolset; Anubis Adds Wiper - **Fog Ransomware** operators recently used uncommon penetration testing and monitoring tools in a targeted attack, complicating defense and detection. Full story (CISO2CISO / Security Affairs) - **Anubis Ransomware** now includes a wiper module: paying the ransom won’t restore your files. Full story (BleepingComputer) --- ### Policy & Vulnerability Updates - **Trend Micro** has patched critical vulnerabilities (RCE, authentication bypass) in Apex Central and Endpoint Encryption platforms. Details (CISO2CISO / Security Affairs) - **Palo Alto Networks** fixed multiple privilege escalation flaws and integrated Chrome security patches. Details (Security Affairs) - **TeamFiltration** pentesting tool abused in large-scale Entra ID account takeover campaigns. Details (CISO2CISO / SecurityWeek) --- ### Industry Tools & Research - **Kali Linux 2025.2** now available with Bloodhound CE, CARsenal, and 13 new security tools. Release details (Help Net Security) - **GenAI-powered Attacks:** Criminals are rapidly leveraging generative AI for deepfakes, malware, and social engineering, straining security guardrails. Analysis (GovTech) --- ### You May Also Be Interested In… - Simple Click on Malicious Link Exposes Precise Geolocation — Social engineering tricks smartphone users into sharing real-time location. (CyberNews) - New Way to Covertly Track Android Users — Researchers expose tracking methods used by Meta & Yandex. (Schneier) - Discord Invite Link Hijacking Delivers Malware — Vanity link abuse targets crypto wallets. (The Hacker News) - How to Delete Your 23andMe Data — Privacy after 23andMe’s bankruptcy and breaches. (TechCrunch) - Dutch Police Identify Young Users on Hacking Forum — Law enforcement tracks users as young as 11 on cracked.io. (Bitdefender) --- Stay patched and stay vigilant! *— The Cybersecurity Daily Briefing Team*