TL Blue

• Introduction
• Credential stuffing attacks breach Australian superannuation funds
• CVE program faces uncertain future amid funding lapse
• RansomHub implodes – DragonForce moves in
• Fortinet FortiGate firewalls exploited – persistent access via symlink technique
• Ivanti CVE-2025-22457 – Remote Code Execution (RCE) vulnerability

• ASIC and FIIG: The AFS Licensee was accused of insufficient planning, technical safeguards, and training.
• Medusa slams Critical Infrastructure: the ransomware gang has targeted over 300 healthcare, manufacturing, and technology organisations.
• RansomHub uses a novel backdoor function: unlike typical ransomware campaigns that rely on public tools, Betruger is a multi-function backdoor built specifically for pre-ransomware activity.
• 23andMe bankruptcy and the genetic data of 15 million users.
• CISA released 13 new Industrial Control Systems (ICS) advisories
• Vulnerability of the fortnight - Apple, CVE-2025-24201.
• Findings from our SOC and DFIR teams:
• Click Fix: Fake CAPTCHA, but make it Email.
• Endpoint Detection and Response (EDR) and Monitoring: Backdoor & Brute Ratel.

➡️ Further Sanctions in Response to Medibank Cyberattack

➡️ Will Law Enforcement success against ransomware continue in 2025?

➡️ OneDrive Offline Mode

➡️ Fake Captcha

➡️ Lynx Ransomware-as-a-Service

➡️ Black Basta Chat Logs Leaked

➡️ Concerns Raised of Musk's Department of Government Efficiency

➡️ Vulnerability of the fortnight - SimpleHelp

➡️ SOC and DFIR activity

FortiGate data posting / Microsoft bug allowed users to update their user principal names / Court orders company to pay invoice after paying a fraudulent invoice / Ross Ulbricht pardoned by Donald Trump / Ransomware campaigns using email bombing / Critical Vulnerability in FortiOS and FortiProxy (CVE-2024-55591)

• LockBit 4.0 Teaser
• Coveware’s insights: Australia ransomware payment statistics
• Cyberattack on Japan Airlines during Holiday Season
• Mailbox Synchronisation and Malicious OAuth Applications (https://www.triskelelabs.com/business-email-compromise-mailbox-synchronisation-malicious-oauth-applications)
• Vulnerability of the fortnight - CVE-2025-0282, CVE-2025-0283: Active Exploitation of Ivanti Vulnerabilities (https://www.triskelelabs.com/blog/cve-2025-0282-cve-2025-0283-active-exploitation-of-ivanti-vulnerabilities)
• SOC and DFIR updates

• ACSC Annual Report
• Texas teen arrested for Scattered Spider telecom hacks
• Commonwealth Director of Public Prosecutions (CDPP) secured 32 convictions for cyber offences in last six years
• Vulnerability of the fortnight: Critical security vulnerabilities affecting Mitel MiCollab

1. Sydney hospital loses $2m to alleged BEC fraud
2. RedLine and META infostealers disrupted by global operation
3. ASD releases guidance on Detecting and mitigating Active Directory compromises
4. Bengal cat lovers targeted in GootLoader campaign
5. Vulnerability of the month - CVE-2024-47575 affecting FortiManager and FortiManager Cloud

- Intro

- New Australian Cybersecurity Bill Mandating Ransomware Reporting

- Rising Cost of Data Breaches in Australia - IBM and Rubrik Reports

- Australian SMBs’ Willingness to Pay Ransomware Criminals

- Cyber Extortion Up 61% in Australia

- Phishing Attacks Adapting to Current Events

- 2024 Midyear Threat Landscape Review

00:00 Intro

02:15 Microsoft delays release of Recall

05:14 ASD releases their Blueprint for secure cloud

10:47 Australian Information Commissioner v Medibank

25:03 Vulnerability of the week - Trio of Vcenter RCE

28:16 News from our SOC and DFIR teams

Resources:

https://www.itnews.com.au/news/microsoft-to-delay-release-of-recall-ai-feature-608832

https://blueprint.asd.gov.au/

https://www.bleepingcomputer.com/news/security/vmware-fixes-critical-vcenter-rce-vulnerability-patch-now/

• Intro
• Leaking Clouds
• Optus Forensic report is not protected by legal privilege
• Australian bank account details
• Guardian childcare hack
• Microsoft Recall
• Topic Vulnerability of the fortnight Check Point Security
• Breaking News MediSecure
• SOC and DFIR updates

• https://www.linkedin.com/feed/update/urn:li:activity:7202881429796466688/
• https://www.bleepingcomputer.com/news/security/snowflake-account-hacks-linked-to-santander-ticketmaster-breaches/
• https://community.snowflake.com/s/question/0D5VI00000Emyl00AB/detecting-and-preventing-unauthorized-user-access
• https://community.snowflake.com/s/article/Communication-ID-0108977-Additional-Information
• https://www.itnews.com.au/news/optus-loses-bid-to-hide-deloitte-report-on-data-breach-608336
• https://www.clydeco.com/en/insights/2023/11/legal-protections-in-the-age-of-data-breaches-less
• https://hallandwilcox.com.au/thinking/court-guidance-on-privilege-and-cyber-forensic-reports-in-australia/
• https://www.cyberdaily.au/security/10640-russian-hacker-opens-bidding-on-18-000-lines-of-australian-bank-account-details
• https://amp.9news.com.au/article/cdf9d285-4ece-413c-8f43-8413f6ff1825
• https://www.triskelelabs.com/blog/cve-2024-24919-check-point
• https://www.triskelelabs.com/blog/microsoft-entra-conditional-access-policies