The Breach News

Streamlining Zero Trust in Healthcare: Implementing Dynamic Policy Enforcement Through Risk Assessment Without Redesigning Networks

April 24, 2025
IoT Security / Zero Trust

The Shifting Landscape of Cybersecurity in Healthcare

In 2025, healthcare organizations are grappling with unparalleled cybersecurity threats. As operational technology (OT) environments come under increasing attack and the integration of IT and medical systems expands the potential for breaches, traditional security measures are falling short. Recent data reveals that the healthcare sector faced a record number of data breaches in 2024, compromising over 133 million patient records. The financial implications are severe, with the average cost of a healthcare data breach soaring to $11 million, making it the industry with the highest breach costs.

The tactics of cybercriminals have evolved significantly; they are now focused on compromising the very devices that provide patient care, rather than just stealing patient records. The risk has intensified, with ransomware accounting for 71% of attacks on healthcare organizations, resulting in an average operational downtime of 11 days per incident.

Automating Zero Trust in Healthcare: Enhancing Security Through Dynamic Policy Enforcement Without Overhauling Networks As of April 24, 2025, the cybersecurity landscape within the healthcare sector is facing increasingly complex challenges. Healthcare organizations are grappling with significant threats exacerbated by the targeting of operational technology (OT) environments and the merging…

Read More

Streamlining Zero Trust in Healthcare: Implementing Dynamic Policy Enforcement Through Risk Assessment Without Redesigning Networks

April 24, 2025
IoT Security / Zero Trust

The Shifting Landscape of Cybersecurity in Healthcare

In 2025, healthcare organizations are grappling with unparalleled cybersecurity threats. As operational technology (OT) environments come under increasing attack and the integration of IT and medical systems expands the potential for breaches, traditional security measures are falling short. Recent data reveals that the healthcare sector faced a record number of data breaches in 2024, compromising over 133 million patient records. The financial implications are severe, with the average cost of a healthcare data breach soaring to $11 million, making it the industry with the highest breach costs.

The tactics of cybercriminals have evolved significantly; they are now focused on compromising the very devices that provide patient care, rather than just stealing patient records. The risk has intensified, with ransomware accounting for 71% of attacks on healthcare organizations, resulting in an average operational downtime of 11 days per incident.

NDPC Launches Investigation into Banks and Others for Data Breaches – MSN

NDPC Initiates Investigation into Data Breaches Affecting Financial Institutions The National Data Protection Commission (NDPC) has launched a formal investigation into several banks and related entities following reports of significant data breaches. These breaches have raised concerns regarding the safeguarding of sensitive customer information and the overall cybersecurity protocols implemented…

Read MoreNDPC Launches Investigation into Banks and Others for Data Breaches – MSN

Qualcomm Resolves Three Zero-Day Vulnerabilities Targeting Android Devices Through Adreno GPU

June 02, 2025
Spyware / Vulnerability

Qualcomm has released security updates to address three zero-day vulnerabilities that have been exploited in limited, targeted attacks. These flaws, responsibly disclosed by the Google Android Security team, include:

  • CVE-2025-21479 and CVE-2025-21480 (CVSS score: 8.6): Two incorrect authorization vulnerabilities in the Graphics component that could lead to memory corruption due to unauthorized command execution in GPU microcode during specific command sequences.

  • CVE-2025-27038 (CVSS score: 7.5): A use-after-free vulnerability in the Graphics component that may result in memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

According to Qualcomm’s advisory, the Google Threat Analysis Group has indicated that CVE-2025-21479, CVE-2025-21480, and CVE-2025-27038 might be under limited, targeted exploitation. Patches have been issued to resolve the vulnerabilities affecting the Adreno graphics architecture.

Qualcomm Addresses Critical Security Flaws Exploited in Targeted Android Attacks On June 2, 2025, Qualcomm announced the release of vital security updates aimed at mitigating three zero-day vulnerabilities that have reportedly been leveraged in targeted attacks against Android devices. These vulnerabilities, identified in collaboration with the Google Android Security team,…

Read More

Qualcomm Resolves Three Zero-Day Vulnerabilities Targeting Android Devices Through Adreno GPU

June 02, 2025
Spyware / Vulnerability

Qualcomm has released security updates to address three zero-day vulnerabilities that have been exploited in limited, targeted attacks. These flaws, responsibly disclosed by the Google Android Security team, include:

  • CVE-2025-21479 and CVE-2025-21480 (CVSS score: 8.6): Two incorrect authorization vulnerabilities in the Graphics component that could lead to memory corruption due to unauthorized command execution in GPU microcode during specific command sequences.

  • CVE-2025-27038 (CVSS score: 7.5): A use-after-free vulnerability in the Graphics component that may result in memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

According to Qualcomm’s advisory, the Google Threat Analysis Group has indicated that CVE-2025-21479, CVE-2025-21480, and CVE-2025-27038 might be under limited, targeted exploitation. Patches have been issued to resolve the vulnerabilities affecting the Adreno graphics architecture.

Large-Scale Campaign Exploits Kubernetes RBAC for Cryptocurrency Mining

In a recently uncovered attack campaign, Kubernetes (K8s) Role-Based Access Control (RBAC) vulnerabilities have been exploited to establish backdoors and deploy cryptocurrency miners. Cloud security firm Aqua reported that attackers utilized DaemonSets to commandeer resources within targeted K8s clusters. Dubbed “RBAC Buster,” the campaign has reportedly infiltrated 60 unprotected K8s clusters. The attack began with the exploitation of a misconfigured API server, followed by a search for competing miner malware, and the establishment of persistence through RBAC adjustments. Aqua noted that the attacker created a new ClusterRole with almost admin-level permissions and set up a ‘ServiceAccount’ named ‘kube-controller’ in the ‘kube-system’ namespace.

Kubernetes RBAC Vulnerability Exploited in Major Cryptocurrency Mining Campaign On April 21, 2023, cybersecurity firm Aqua reported a large-scale attack exploiting Kubernetes (K8s) Role-Based Access Control (RBAC) to establish backdoors and execute cryptocurrency mining operations. This operation, named “RBAC Buster,” has targeted numerous Kubernetes clusters, leveraging misconfigurations to gain unauthorized…

Read More

Large-Scale Campaign Exploits Kubernetes RBAC for Cryptocurrency Mining

In a recently uncovered attack campaign, Kubernetes (K8s) Role-Based Access Control (RBAC) vulnerabilities have been exploited to establish backdoors and deploy cryptocurrency miners. Cloud security firm Aqua reported that attackers utilized DaemonSets to commandeer resources within targeted K8s clusters. Dubbed “RBAC Buster,” the campaign has reportedly infiltrated 60 unprotected K8s clusters. The attack began with the exploitation of a misconfigured API server, followed by a search for competing miner malware, and the establishment of persistence through RBAC adjustments. Aqua noted that the attacker created a new ClusterRole with almost admin-level permissions and set up a ‘ServiceAccount’ named ‘kube-controller’ in the ‘kube-system’ namespace.

New Rack::Static Vulnerabilities Discovered, Posing Risks of Data Breaches in Ruby Servers

April 25, 2025
Vulnerability / Data Breach

Cybersecurity experts have unveiled three critical security flaws within the Rack Ruby web server interface. If exploited, these vulnerabilities could allow attackers to access unauthorized files, inject harmful data, and alter logs in certain circumstances. Highlighted by cybersecurity firm OPSWAT, the vulnerabilities include:

  • CVE-2025-27610 (CVSS score: 7.5) – A path traversal vulnerability that could potentially grant access to all files beneath the specified root directory, provided the attacker can ascertain the paths to those files.

  • CVE-2025-27111 (CVSS score: 6.9) – A vulnerability involving improper handling of carriage return line feeds (CRLF) sequences and inadequate output neutralization, which could be used to manipulate and distort log files.

  • CVE-2025-25184 (CVSS score: 5.7) – Another issue related to CRLF sequences and improper output neutralization that could also allow for log file manipulation.

Researchers Uncover Vulnerabilities in Rack::Static, Exposing Ruby Servers to Data Breaches On April 25, 2025, cybersecurity experts revealed critical security flaws within the Rack web server interface for Ruby, putting server data at significant risk. The vulnerabilities, identified by the cybersecurity firm OPSWAT, could potentially allow attackers unauthorized access to…

Read More

New Rack::Static Vulnerabilities Discovered, Posing Risks of Data Breaches in Ruby Servers

April 25, 2025
Vulnerability / Data Breach

Cybersecurity experts have unveiled three critical security flaws within the Rack Ruby web server interface. If exploited, these vulnerabilities could allow attackers to access unauthorized files, inject harmful data, and alter logs in certain circumstances. Highlighted by cybersecurity firm OPSWAT, the vulnerabilities include:

  • CVE-2025-27610 (CVSS score: 7.5) – A path traversal vulnerability that could potentially grant access to all files beneath the specified root directory, provided the attacker can ascertain the paths to those files.

  • CVE-2025-27111 (CVSS score: 6.9) – A vulnerability involving improper handling of carriage return line feeds (CRLF) sequences and inadequate output neutralization, which could be used to manipulate and distort log files.

  • CVE-2025-25184 (CVSS score: 5.7) – Another issue related to CRLF sequences and improper output neutralization that could also allow for log file manipulation.

Security Flaws in Preinstalled Apps on Ulefone and Krüger&Matz Phones Allow Unauthorized Device Resets and PIN Theft

Three security vulnerabilities have been identified in preloaded Android applications on Ulefone and Krüger&Matz smartphones. These flaws enable any installed app to factory reset the device and potentially encrypt other applications. Key details of the vulnerabilities include:

  • CVE-2024-13915 (CVSS score: 6.9): A pre-installed “com.pri.factorytest” app on Ulefone and Krüger&Matz devices exposes a service that permits any app to execute a factory reset.

  • CVE-2024-13916 (CVSS score: 6.9): The “com.pri.applock” app on Krüger&Matz smartphones allows users to encrypt apps using a PIN or biometric data. This app also exposes a method that lets malicious apps access sensitive fingerprint data.

Security Flaws in Preinstalled Apps on Ulefone and Krüger&Matz Smartphones Enable Malicious Actions On June 2, 2025, significant security vulnerabilities were uncovered in pre-installed applications on smartphones manufactured by Ulefone and Krüger&Matz. These vulnerabilities could potentially allow any application downloaded onto these devices to conduct a factory reset or encrypt…

Read More

Security Flaws in Preinstalled Apps on Ulefone and Krüger&Matz Phones Allow Unauthorized Device Resets and PIN Theft

Three security vulnerabilities have been identified in preloaded Android applications on Ulefone and Krüger&Matz smartphones. These flaws enable any installed app to factory reset the device and potentially encrypt other applications. Key details of the vulnerabilities include:

  • CVE-2024-13915 (CVSS score: 6.9): A pre-installed “com.pri.factorytest” app on Ulefone and Krüger&Matz devices exposes a service that permits any app to execute a factory reset.

  • CVE-2024-13916 (CVSS score: 6.9): The “com.pri.applock” app on Krüger&Matz smartphones allows users to encrypt apps using a PIN or biometric data. This app also exposes a method that lets malicious apps access sensitive fingerprint data.

Paperbug Exploit: New Politically-Driven Surveillance Initiative in Tajikistan

On April 27, 2023, a relatively obscure Russian-speaking cyber-espionage group has been identified as the orchestrator of a new politically motivated surveillance initiative targeting senior government officials, telecom services, and public infrastructure in Tajikistan. The operation, named Paperbug by the Swiss cybersecurity firm PRODAFT, has been linked to a threat actor known as Nomadic Octopus (also referred to as DustSquad). According to PRODAFT’s comprehensive technical report shared with The Hacker News, “The types of compromised machines range from individual computers to operational technology devices. These targets render ‘Operation Paperbug’ intelligence-driven.” While the ultimate motives behind the attacks are still uncertain, the cybersecurity firm has suggested the possibility of involvement from domestic opposition groups or an intelligence-gathering effort conducted by Russia or China. Nomadic Octopus first gained attention in October 2018.

Paperbug Attack: Emerging Politically-Driven Surveillance Campaign in Tajikistan April 27, 2023 A relatively obscure Russian-speaking cyber-espionage group has been implicated in a politically-motivated surveillance campaign aimed at high-ranking government officials and critical infrastructure in Tajikistan. This operation, referred to as “Paperbug” by Swiss cybersecurity firm PRODAFT, is linked to a…

Read More

Paperbug Exploit: New Politically-Driven Surveillance Initiative in Tajikistan

On April 27, 2023, a relatively obscure Russian-speaking cyber-espionage group has been identified as the orchestrator of a new politically motivated surveillance initiative targeting senior government officials, telecom services, and public infrastructure in Tajikistan. The operation, named Paperbug by the Swiss cybersecurity firm PRODAFT, has been linked to a threat actor known as Nomadic Octopus (also referred to as DustSquad). According to PRODAFT’s comprehensive technical report shared with The Hacker News, “The types of compromised machines range from individual computers to operational technology devices. These targets render ‘Operation Paperbug’ intelligence-driven.” While the ultimate motives behind the attacks are still uncertain, the cybersecurity firm has suggested the possibility of involvement from domestic opposition groups or an intelligence-gathering effort conducted by Russia or China. Nomadic Octopus first gained attention in October 2018.

Why Non-Human Identities Are Cybersecurity’s Most Overlooked Threat

Published: April 25, 2025
Category: Secrets Management / DevOps

When discussing identity in cybersecurity, people typically think of usernames, passwords, and the occasional multi-factor authentication prompt. However, an escalating threat lies beneath the surface, rooted in Non-Human Identities (NHIs). While security teams often equate NHIs with Service Accounts, the reality is much broader. NHIs encompass Service Principals, Snowflake Roles, IAM Roles, and platform-specific constructs across AWS, Azure, GCP, and beyond. The variability of NHIs reflects the diversity within modern tech stacks, making effective management essential.

The true risk associated with NHIs stems from their authentication methods.

Secrets: The Currency of Machines
Non-Human Identities primarily rely on secrets—API keys, tokens, certificates, and other credentials—that provide access to systems, data, and critical infrastructure.

The Rising Threat of Non-Human Identities in Cybersecurity In today’s cybersecurity landscape, discussions surrounding identity often center on traditional human elements such as usernames, passwords, and multi-factor authentication (MFA). However, a significant and escalating risk currently lurks beneath this familiar terrain in the form of Non-Human Identities (NHIs). This burgeoning…

Read More

Why Non-Human Identities Are Cybersecurity’s Most Overlooked Threat

Published: April 25, 2025
Category: Secrets Management / DevOps

When discussing identity in cybersecurity, people typically think of usernames, passwords, and the occasional multi-factor authentication prompt. However, an escalating threat lies beneath the surface, rooted in Non-Human Identities (NHIs). While security teams often equate NHIs with Service Accounts, the reality is much broader. NHIs encompass Service Principals, Snowflake Roles, IAM Roles, and platform-specific constructs across AWS, Azure, GCP, and beyond. The variability of NHIs reflects the diversity within modern tech stacks, making effective management essential.

The true risk associated with NHIs stems from their authentication methods.

Secrets: The Currency of Machines
Non-Human Identities primarily rely on secrets—API keys, tokens, certificates, and other credentials—that provide access to systems, data, and critical infrastructure.