Daily Cybersecurity News - December 29, 2025
Exploited MongoBleed Flaw Leaks MongoDB Secrets: 87K Servers Exposed
HighExecutive Summary
The MongoBleed vulnerability (CVE-2025-14847) is being actively exploited in the wild, potentially exposing over 87,000 MongoDB servers to unauthenticated remote data leaks. This flaw allows attackers to extract sensitive information from server memory by sending malformed network packets.
Vulnerability Details
- Affected Product: MongoDB Server versions 3.6.x, 4.0.x, 4.2.x, 4.4.x (< 4.4.30), 5.0.x (< 5.0.32), 6.0.x (< 6.0.27), 7.0.x (< 7.0.28), 8.0.x (< 8.0.17), and 8.2.x (< 8.2.3)
- Identifier: CVE-2025-14847
- CVSS Score: 8.7 (High)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: Immediate action is required due to the high risk of sensitive data exposure.
- Attack Vector: Remote, unauthenticated attackers can send specially crafted, compressed network packets to trigger the vulnerability.
- Ease of Exploit: A public proof-of-concept exploit is available, making exploitation easier.
Action Plan
- Immediate Action: Upgrade to MongoDB versions 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, or 4.4.30. MongoDB Atlas has been automatically patched.
- Workaround: Disable zlib compression by starting mongod or mongos with a networkMessageCompressors option that explicitly omits zlib. Restrict network access to trusted IPs only.
- Detection: Monitor MongoDB logs for anomalous pre-authentication connections and enable verbose JSON logging to track connection metadata and parsing errors. Use the open-source MongoBleed detector tool to analyze MongoDB JSON logs for signs of exploitation.
Relevant professional terms
- Heap Memory
- A region of a computer's memory used for dynamic memory allocation, where data is stored during the execution of a program.
- Zlib Compression
- A data compression library used to reduce the size of data for faster transmission and storage. The MongoBleed vulnerability arises from improper handling of zlib compression in MongoDB.
Source: Bleeping Computer
Fortinet Warns of Actively Exploited 5-Year-Old FortiOS 2FA Bypass Vulnerability
MediumExecutive Summary
Fortinet has issued a warning regarding the active exploitation of a five-year-old vulnerability, CVE-2020-12812, in FortiOS that allows threat actors to bypass two-factor authentication (2FA) when targeting vulnerable FortiGate firewalls. The vulnerability is actively being exploited in the wild.
Vulnerability Details
- Affected Product: FortiOS SSL VPN versions 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below
- Identifier: CVE-2020-12812
- CVSS Score: 5.2 (Medium)
- Exploitation Status: Actively Exploited
Risk & Impact
- Triage: Urgent, as exploitation can lead to unauthorized access and potential system compromise.
- Attack Vector: The vulnerability is triggered by inconsistent case-sensitivity handling between FortiGate and LDAP, allowing attackers to bypass 2FA by altering the username case.
- Ease of Exploit: Relatively easy, given the specific configuration requirements are met and the case-sensitivity mismatch is exploited.
Action Plan
- Immediate Action: Upgrade to patched versions of FortiOS (6.0.10, 6.2.4, 6.4.1 or later). If compromised, reset all credentials.
- Workaround: Disable username case sensitivity using the CLI command "set username-sensitivity disable" (or "set username-case-sensitivity disable" for older versions). Consider removing the secondary LDAP group if it is not required.
- Detection: Review authentication logs for unusual login activity or 2FA bypass attempts, specifically looking for case-variant attempts in authentication events.
Relevant professional terms
- FortiGate Firewall
- A next-generation firewall from Fortinet that provides threat protection for businesses of all sizes, utilizing purpose-built security processors and threat intelligence. It employs techniques such as deep packet inspection (DPI) to analyze and filter network traffic.
- Two-Factor Authentication (2FA)
- A security process that requires users to provide two different authentication factors to verify their identity, adding an extra layer of security to the authentication process. This makes it more difficult for attackers to gain access to a person's devices or online accounts.
Source: Bleeping Computer
Wired Subscriber Data Breach
Executive Summary
A hacker known as "Lovely" claims to have breached Condé Nast, leaking a WIRED database containing over 2.3 million subscriber records. The exposed data includes personal information, raising concerns about potential misuse and further breaches of Condé Nast properties.
Attack Overview
- Attack Path: The attacker exploited Insecure Direct Object Reference (IDOR) vulnerabilities and broken access controls within Condé Nast's centralized identity platform to scrape user profiles.
- Attacker: Lovely
Impact Assessment
- Data Stolen: 2.3 million records including email addresses, names, and in some cases, home addresses and phone numbers.
Detection & Hunting
- IOCs: N/A
- Detection Guidance: Monitor for combo lists appearing on the dark web containing Wired domains and spikes in login traffic across the Condé Nast network.
Strategic Takeaway
The breach highlights the risks associated with centralized identity platforms and the importance of robust access controls to prevent unauthorized data access.
Relevant professional terms
- Insecure Direct Object Reference (IDOR)
- A type of access control vulnerability that occurs when an application uses user-supplied input to directly access internal implementation objects.
- Data Breach
- A security incident in which sensitive, protected, or confidential data is copied, transmitted, viewed, stolen, or used by an individual unauthorized to do so.
Source: Bleeping Computer
HoneyMyte APT Uses Kernel Rootkit
Executive Summary
The HoneyMyte APT group is using a kernel-mode rootkit to deploy and protect the ToneShell backdoor. This campaign targets Asian governments, likely leveraging prior infections for persistence.
Key TTPs
- Defense Evasion: Uses a kernel-mode rootkit signed with a stolen digital certificate to hide the ToneShell backdoor. The rootkit protects malicious files, registry keys, and processes from security software and user deletion.
Campaign Analysis
The use of a kernel-mode rootkit represents a significant escalation in sophistication, potentially blinding traditional security tools. The APT employs a small user-mode component for final injection and uses obfuscation techniques.
Targeting & Infrastructure
- Target Profile: Government organizations in Southeast and East Asia.
Relevant Terms
- Kernel-Mode Rootkit: A type of malware that operates at the kernel level of an operating system, allowing it to deeply manipulate system behavior and hide its presence.
- Backdoor: A method of bypassing normal authentication or encryption in a system, allowing unauthorized remote access.
Source: Kaspersky
EmEditor Supply Chain Attack Delivers Infostealer
Executive Summary
The EmEditor supply chain was compromised between December 19th and 22nd, serving a malicious installer that delivered infostealer malware. Users who downloaded the software during this period may have received a compromised version signed with "WALSHAM INVESTMENTS LIMITED" instead of "Emurasoft, Inc.".
Key TTPs
- Initial Access: Supply chain compromise via malicious installer served through the official EmEditor website.
- Execution: The malicious installer executes a PowerShell command to download and run a file from a fake EmEditor domain.
- Defense Evasion: The malware checks the system's language and terminates if it is set to former Soviet countries or Iran.
Campaign Analysis
The attackers tampered with the website's redirection settings, serving a malicious MSI installer signed with a non-official signature. The malware installs a browser extension named 'Google Drive Caching' for persistence and data exfiltration.
Targeting & Infrastructure
- Target Profile: Developers, IT professionals, and enterprise environments, particularly those in China, are at risk due to EmEditor's popularity.
- Infrastructure: The attack used a fake EmEditor domain to host malicious files and a compromised path to distribute the malicious installer.
Actionable Intelligence
- Domains:
emeditorgb.com
Relevant Terms
- Supply Chain Attack: An attack that targets vulnerabilities in the software development and distribution process.
- Infostealer: Malware designed to steal sensitive information, such as credentials, browser data, and files, from a compromised system.
Source: SecurityWeek
AI Supply Chain Attacks Expose Security Gaps
Executive Summary
Traditional security frameworks are failing to protect organizations from AI-specific attack vectors, as demonstrated by recent supply chain compromises and ChatGPT vulnerabilities. These incidents highlight the urgent need for security programs to adapt to the unique threats posed by AI systems.
Key Findings
- The "Shai-Hulud" NPM Worm (November 2025): This worm utilizes self-replicating capabilities to compromise developer accounts and automatically inject malicious post-install scripts.
- Nx Build System Breach (August 2025): The system was breached using AI-weaponized reconnaissance, where malicious code coerced AI assistants (specifically Claude and Gemini) to search local filesystems for secrets.
- Leakage Impact: The Nx incident resulted in the exposure of over 2,349 distinct secrets, including critical API keys for OpenAI, Anthropic, and AWS.
The Bottom Line
The increasing reliance on AI systems introduces new attack surfaces that traditional security measures are ill-equipped to handle. Organizations must recognize that AI-specific threats require a shift in security strategies, including enhanced monitoring, proactive scanning, and robust secrets management. Failing to adapt to these evolving threats leaves sensitive data and critical infrastructure vulnerable to compromise.
Relevant Terms
- Supply Chain Attack: An attack that targets vulnerabilities in the software development and distribution process, often by compromising third-party components.
- Cryptomining: The process of using computing resources to generate cryptocurrency, often done illicitly on compromised systems.
Source: The Hacker News
Coinbase Insider Data Theft Leads to Arrest
Executive Summary
Hyderabad Police arrested a former Coinbase customer service agent in India for assisting hackers in stealing sensitive customer data. The breach, occurring in May 2025 through the outsourcing firm TaskUs, affected approximately 69,500 customers.
The exposed data included names, physical addresses, dates of birth, last four digits of SSNs, and in some cases, scanned KYC documents.
The Scheme
- TTP 1: Bribing of customer support agents for insider access.
- TTP 2: Exfiltration of sensitive customer data from company databases.
- TTP 3: Extortion attempt with a $20 million ransom demand.
The Players
- Facilitators Arrested: [Former Coinbase Customer Service Agent]
The Consequence
- Outcome: Arrest of a former Coinbase support agent.
Strategic Takeaway
This incident highlights the critical need for robust insider threat detection and security protocols within cryptocurrency exchanges.
Relevant Terms
- Exfiltration: Unauthorized removal of data from a system.
- Ransomware: A type of malware that demands a payment to restore access to data.
Source: Bleeping Computer