### Daily Cybersecurity Briefing — June 16, 2025 --- ### Major Ransomware Threat: Anubis Wiper Permanently Deletes Files The new Anubis ransomware variant is escalating danger for enterprise and consumer environments alike, now featuring wiper capabilities that make file recovery virtually impossible. Victims not only face extortion but the risk of irretrievable data loss. Organizations should review their incident response plans and ensure robust, tested backups are in place. - Read more at SecurityWeek - Forbes coverage: Backup now --- ### Predator Spyware Reemerges Despite Sanctions Commercial spyware Predator is back in the spotlight as researchers reveal new infrastructure and client activity in Mozambique, showing ongoing global proliferation despite US sanctions. Predator has been used for targeted surveillance, raising concerns for governments and private-sector targets. - Details via Security Affairs --- ### WestJet Hit by Cyberattack Canada’s second-largest airline, WestJet, has confirmed it fell victim to a cyberattack affecting its internal systems and customer app. This incident underscores persistent threats facing the aviation sector and critical infrastructure. - Coverage at SecurityWeek - More via Security Affairs --- ### High-Severity Flaws Patched in Tenable Nessus Agent Tenable has released fixes for three high-severity vulnerabilities in its Nessus Agent, allowing for arbitrary code execution and file system manipulation with SYSTEM privileges. Cybersecurity professionals should prioritize updating to the latest versions to protect assessment and vulnerability management infrastructure. - Patch advisory: SecurityWeek --- ### Supply Chain Attacks Target Open Source and Developer Ecosystems - Malicious PyPI package “chimera-sandbox-extensions” impersonates legitimate modules to capture AWS keys and sensitive environment data. - TheHackerNews details - Trend Micro exposes “Water Curse” — a group using GitHub repositories to spread weaponized open-source malware. - Trend Micro MDR Analysis --- ### Mirai Botnets Exploiting Critical Wazuh XDR Vulnerability Active exploitation of a critical RCE flaw (CVE-2025-24016) in the Wazuh XDR/SIEM platform is being driven by at least two Mirai-based botnets. Immediate patching is urged for any unpatched Wazuh servers. - Review at HelpNet Security --- ### New Data Breaches: T-Mobile US, SAP Israel, OKX, Vodafone Egypt & Major Apps Threat actors are claiming leaks or sales of user data involving Vodafone Egypt, SAP Israel, OKX, and T-Mobile US. Separately, India’s Zoomcar and VirtualMacOSX have reported breaches impacting millions. - SOCRadar Intel - Zoomcar breach: CyberNews - VirtualMacOSX: HackRead --- ### India’s Data Protection Law Imposes Stiff Penalties India’s Digital Personal Data Protection (DPDP) Act, 2023, introduces tough new compliance rules and fines. Security teams across industries handling Indian data should review policies and practices to ensure alignment. - Tripwire coverage & CISO perspective --- ### CISOs: Understanding the AI Tech Stack and Red Teaming AI As AI becomes ubiquitous, security leaders are increasingly asked to guard systems they may not fully grasp. Recent resources and debates address how to secure the “AI tech stack,” and whether to build or buy red teaming frameworks for AI risks. - CISO perspective: HelpNet Security - Red Teaming AI: SecurityWeek --- ### You May Also Be Interested In… - Microsoft fixes zero-day exploited in cyber espionage (CVE-2025-33053) - Over 46,000 Grafana instances exposed to account takeover bug - Dutch police round up 126 users of hacking forum Cracked.io; 11-year-old among suspects - Dems demand audit of US CVE program as federal funding uncertain - Google urges 2 billion Gmail users to change passwords amid new attacks --- **Stay vigilant and patch promptly. For more, follow the links above and subscribe for tomorrow’s top headlines.**