Team around laptop displaying warning icon with floating hexagons, spider, locks, globe, and code screens

Daily Dose of Cybersecurity News - August 12, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

August 12, 2025 7:34 AM 5 min read

North Korean Kimsuky Hackers Exposed in Alleged Data Breach

Medium

What happened

Two individuals, 'Saber' and 'cyb0rg,' reportedly infiltrated and leaked data from the North Korean state-sponsored hacking group Kimsuky, exposing their tools and stolen information.

Who is affected

Kimsuky, a North Korean advanced persistent threat (APT) group, and potentially their victims, including entities in South Korea and other nations.

Why it matters

The exposure of Kimsuky's internal data could provide cybersecurity professionals with insights into the group's methodologies, potentially aiding in the development of more effective defense strategies against their cyber-espionage activities.

How it could have been prevented

Implementing robust internal security measures, including regular audits and access controls, could mitigate the risk of unauthorized access and data leaks within hacking groups.

Relevant professional terms

Advanced Persistent Threat (APT): A prolonged and targeted cyberattack in which an intruder gains access to a network and remains undetected for an extended period.
Cyber-Espionage: The act of using computer networks to gain illicit access to confidential information, typically held by government or corporate entities.

Recommended reading: US Govt Sanctions North Korea’s Kimsuky Hacking Group

Source: bleepingcomputer.com

Critical Citrix NetScaler Vulnerability (CVE-2025-6543) Exploited in the Netherlands

Critical

What happened

A critical memory overflow vulnerability (CVE-2025-6543) in Citrix NetScaler ADC and Gateway devices has been actively exploited, leading to unauthorized access and potential remote code execution.

Who is affected

Organizations in the Netherlands utilizing vulnerable versions of Citrix NetScaler ADC and Gateway, particularly those configured as Gateway or AAA virtual servers.

Why it matters

Exploitation of this vulnerability can result in unauthorized access, service disruptions, and potential data breaches, posing significant risks to critical infrastructure and sensitive information.

How it could have been prevented

Timely application of security patches provided by Citrix and regular monitoring for unusual activity could have mitigated the risk of exploitation.

Relevant professional terms

Memory Overflow: A condition where a program writes more data to a block of memory than it was allocated, potentially leading to unintended behavior or system crashes.
Remote Code Execution (RCE): The ability of an attacker to execute arbitrary code on a remote system, often leading to full system compromise.

Recommended reading: Citrix Security Bulletin CTX694788

Source: bleepingcomputer.com

WinRAR Zero-Day Vulnerability (CVE-2025-8088) Exploited by RomCom Group

Critical

What happened

A critical path traversal vulnerability in WinRAR, identified as CVE-2025-8088, was exploited by the Russian-linked cyberespionage group RomCom to deploy various malware payloads through malicious RAR archives.

Who is affected

Users of WinRAR versions prior to 7.13, particularly those in financial, manufacturing, defense, and logistics sectors in Europe and Canada, were targeted by RomCom's phishing campaigns.

Why it matters

The exploitation of this vulnerability allowed attackers to execute arbitrary code on victims' systems, leading to potential data breaches, system compromises, and unauthorized access to sensitive information.

How it could have been prevented

Regularly updating software to the latest versions and exercising caution when opening email attachments from unknown or untrusted sources.

Relevant professional terms

Path Traversal Vulnerability: A security flaw that allows attackers to access directories and files stored outside the intended directory.
Zero-Day Exploit: An attack that occurs on the same day a vulnerability is discovered, before a fix becomes available.

Recommended reading: ESET Research on WinRAR Zero-Day Exploitation

Source: bleepingcomputer.com

Native Phishing Attacks Exploiting Microsoft 365 Applications

High

What happened

Cybercriminals are leveraging Microsoft 365's built-in collaboration features to conduct "native phishing" attacks. By compromising a single user account, attackers distribute malicious files or links through trusted internal channels, such as the platform's file-sharing system, making the phishing attempts appear legitimate.

Who is affected

Organizations utilizing Microsoft 365 are at risk, especially those with users who may not recognize internal phishing attempts.

Why it matters

These attacks exploit the inherent trust in internal communications, increasing the likelihood of successful phishing attempts and potential data breaches.

How it could have been prevented

Implementing multi-factor authentication (MFA) for all users, conducting regular security awareness training focusing on internal threats, and monitoring internal communications for unusual activities can mitigate such risks.

Relevant professional terms

Native Phishing: Phishing attacks that utilize an organization's own communication tools and platforms to distribute malicious content, exploiting internal trust.
Multi-Factor Authentication (MFA): A security process that requires users to provide multiple forms of verification to access an account, enhancing security beyond just a password.

Recommended reading: Microsoft's Phishing Protection and Prevention Solutions

Source: bleepingcomputer.com

DarkBit Ransomware Decryption Achieved by Profero

High

What happened

Cybersecurity firm Profero successfully decrypted the DarkBit ransomware, enabling free data recovery for affected organizations without the need to pay a ransom.

Who is affected

Organizations targeted by the DarkBit ransomware, particularly those with encrypted VMware ESXi servers.

Why it matters

This development allows victims to recover their data without financial loss and disrupts the operations of the DarkBit ransomware group.

How it could have been prevented

Implementing robust cybersecurity measures, including regular system updates, employee training on phishing attacks, and maintaining secure backups, can mitigate the risk of ransomware infections.

Relevant professional terms

Ransomware: Malicious software designed to block access to a computer system or data until a sum of money is paid.
Decryption: The process of converting encrypted data back into its original form, making it readable again.

Recommended reading: SentinelOne: DarkBit Ransomware Analysis

Source: bleepingcomputer.com

Ghanaian Nationals Extradited to U.S. for $100 Million Fraud Scheme

Critical

What happened

Four Ghanaian nationals were extradited to the United States and charged for their involvement in a fraud ring responsible for over $100 million in losses through romance scams and business email compromise (BEC) attacks.

Who is affected

The fraud targeted companies and individuals across the United States, particularly vulnerable older men and women living alone.

Why it matters

This case highlights the significant financial and emotional impact of online scams, emphasizing the need for heightened awareness and preventive measures against such fraudulent activities.

How it could have been prevented

Implementing robust email security protocols, conducting regular employee training on recognizing phishing attempts, and verifying the authenticity of financial transactions could mitigate such risks.

Relevant professional terms

Romance Scam: A type of fraud where perpetrators feign romantic interest to manipulate victims into sending money or personal information.
Business Email Compromise (BEC): A cyberattack where attackers impersonate business executives or employees to deceive organizations into transferring funds or sensitive data.

Source: bleepingcomputer.com

Over 29,000 Exchange Servers Unpatched Against High-Severity Flaw (CVE-2025-53786)

High

What happened

Over 29,000 Microsoft Exchange servers remain unpatched against a high-severity vulnerability (CVE-2025-53786) that allows attackers with administrative access to on-premises servers to escalate privileges within connected cloud environments.

Who is affected

Organizations operating Microsoft Exchange Server 2016, 2019, and Subscription Edition in hybrid configurations are at risk.

Why it matters

Exploitation of this vulnerability could lead to complete domain compromise, as attackers can move laterally within Microsoft cloud environments without leaving easily detectable traces.

How it could have been prevented

Applying the April 2025 hotfixes, transitioning to the dedicated Exchange Hybrid app, and resetting credentials for the shared service principal as per Microsoft's guidance.

Relevant professional terms

Privilege Escalation: Gaining higher access rights than originally granted, often by exploiting vulnerabilities.
Hybrid Configuration: A setup where on-premises servers are integrated with cloud services, allowing them to function as a unified system.

Recommended reading: Microsoft's Guidance on Mitigating CVE-2025-53786

Source: bleepingcomputer.com