Team of hackers at laptops with central hacker displaying code surrounded by hexagonal locks and threat labels

Daily Dose of Cybersecurity News - August 22, 2025

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

August 22, 2025 6:03 AM 5 min read

Colt Technology Services Data Breach via Warlock Ransomware Exploiting CVE-2025-53770

Critical

What happened

Colt Technology Services, a UK-based telecommunications company, experienced a cyberattack on August 12, 2025, attributed to the Warlock ransomware group. The attackers exploited a known vulnerability in Microsoft SharePoint (CVE-2025-53770) to gain unauthorized access and exfiltrate sensitive data.

Who is affected

Colt Technology Services and its customers, whose data may have been compromised during the breach.

Why it matters

The breach led to the theft of approximately one million documents containing sensitive information, including financial records, network architecture details, and customer data. The Warlock group is auctioning this data on the dark web, posing significant risks to Colt's operations and its customers' security.

How it could have been prevented

Timely application of security patches for known vulnerabilities, particularly CVE-2025-53770, and regular security audits to identify and mitigate potential weaknesses in the system.

Relevant professional terms

Remote Code Execution (RCE): A type of vulnerability that allows an attacker to execute arbitrary code on a target system remotely.
Zero-Day Vulnerability: A software security flaw that is unknown to the vendor and lacks a patch, making it exploitable by attackers.

Recommended reading: BleepingComputer

Source: bleepingcomputer.com

Russian State-Backed Hackers Exploit CVE-2018-0171 in Cisco Devices

Critical

What happened

Russian state-sponsored hackers, identified as Berserk Bear, are exploiting a critical vulnerability (CVE-2018-0171) in Cisco devices to infiltrate critical infrastructure organizations.

Who is affected

Organizations utilizing unpatched Cisco networking devices, particularly within critical infrastructure sectors, are at risk.

Why it matters

Exploitation of this vulnerability allows unauthorized access, enabling attackers to conduct reconnaissance and potentially disrupt essential services.

How it could have been prevented

Regularly applying security patches and updates to networking devices; disabling unused services like Cisco's Smart Install feature.

Relevant professional terms

Denial-of-Service (DoS): An attack aimed at making a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services.
Arbitrary Code Execution: The ability of an attacker to execute any command of their choice on a target machine or process.

Recommended reading: Cisco Security Advisory on CVE-2018-0171

Source: bleepingcomputer.com

Orange Belgium Data Breach Exposes 850,000 Customer Accounts

High

What happened

In late July 2025, Orange Belgium experienced a cyberattack that led to unauthorized access to data from approximately 850,000 customer accounts. The compromised information includes names, phone numbers, SIM card numbers, PUK codes, and tariff plans. Passwords, email addresses, and financial details were not affected.

Who is affected

Approximately 850,000 Orange Belgium customers had their personal data accessed during this breach.

Why it matters

The exposure of SIM card numbers and PUK codes raises concerns about potential SIM swapping attacks, where attackers could hijack victims' phone numbers to intercept calls and messages, including those used for multi-factor authentication.

How it could have been prevented

Implementing robust access controls and regular security audits could have helped identify and mitigate vulnerabilities in the IT systems. Additionally, encrypting sensitive customer data at rest would reduce the impact of unauthorized access.

Relevant professional terms

SIM Swapping: A type of fraud where an attacker convinces a mobile carrier to transfer a victim's phone number to a SIM card they control, allowing them to intercept calls and messages.
PUK Code: Personal Unblocking Key; an eight-digit code used to reset a SIM card that has been locked after multiple incorrect PIN entries.

Recommended reading: Infosecurity Magazine

Source: bleepingcomputer.com

ChatGPT Downgrade Attack Exposes GPT-5 Vulnerabilities

High

What happened

Researchers have identified a technique named "PROMISQROUTE" that allows users to manipulate ChatGPT into routing prompts to older, less secure language models by embedding specific cues in their inputs.

Who is affected

Users and organizations utilizing ChatGPT, particularly those relying on its security measures to prevent misuse.

Why it matters

This vulnerability enables malicious actors to bypass the enhanced security features of GPT-5 by downgrading to older models, potentially facilitating the generation of harmful content.

How it could have been prevented

Implementing stricter input validation to prevent routing manipulation and ensuring all model variants adhere to uniform security protocols.

Relevant professional terms

Prompt Injection: A technique where specific inputs are crafted to manipulate an AI model's behavior.
Model Downgrade Attack: An attack that forces a system to use an older, less secure version of a model.

Source: darkreading.com

Columbia University Enhances Security Through Advanced Logging Practices

High

What happened

Columbia University experienced multiple cyberattacks, including a breach by state-sponsored hackers targeting research labs and incidents involving hacktivists protesting university policies. The university utilized comprehensive logging of network flows to monitor and analyze attacker activities, enabling effective incident response and mitigation.

Who is affected

Columbia University, including its research departments, students, and employees, were impacted by these cyberattacks.

Why it matters

Educational institutions are increasingly targeted due to the valuable data they possess and often limited cybersecurity resources. Columbia's proactive use of logging demonstrates an effective strategy for detecting and mitigating sophisticated cyber threats.

How it could have been prevented

Implementing comprehensive network monitoring and logging to detect unauthorized activities. Regularly updating and patching systems to address vulnerabilities. Conducting security awareness training for staff and students to recognize and report suspicious activities.

Relevant professional terms

Netflow: A network protocol developed by Cisco for collecting IP traffic information and monitoring network flow.
Honeypot: A security mechanism set to detect, deflect, or study attempts at unauthorized use of information systems by simulating vulnerable systems.

Recommended reading: Columbia University Data Breach Affects 860K Individuals

Source: darkreading.com

Password Managers Vulnerable to Data Theft via Clickjacking

High

What happened

A security researcher identified that nearly a dozen popular password managers are susceptible to clickjacking attacks, potentially allowing attackers to steal sensitive user data.

Who is affected

Users of password managers such as 1Password, Bitwarden, Dashlane, Enpass, Keeper, LastPass, LogMeOnce, NordPass, ProtonPass, RoboForm, and Apple's iCloud Passwords are impacted.

Why it matters

Clickjacking vulnerabilities in widely-used password managers could lead to unauthorized access to personal data, usernames, passwords, passkeys, and payment card information, posing significant security risks.

How it could have been prevented

Implementing user interface design practices that prevent unauthorized overlay of elements and requiring user confirmation before autofilling sensitive information can mitigate clickjacking risks.

Relevant professional terms

Clickjacking: A malicious technique where an attacker tricks a user into clicking on something different from what the user perceives, potentially leading to unintended actions or data exposure.
DOM (Document Object Model): A programming interface for web documents that represents the page structure, allowing scripts to update content and structure dynamically.

Recommended reading: Three Ways to Prevent Clickjacking

Source: securityweek.com

Apple Patches CVE-2025-43300 Zero-Day Exploited in Targeted Attacks

High

What happened

Apple released security updates for iOS and macOS to address a zero-day vulnerability (CVE-2025-43300) in the ImageIO framework, which was exploited in highly targeted attacks.

Who is affected

Users of iOS, iPadOS, and macOS devices are affected, particularly those targeted in sophisticated attacks.

Why it matters

The vulnerability allows attackers to execute arbitrary code by processing a malicious image file, potentially leading to unauthorized access and control over affected devices.

How it could have been prevented

Regularly updating devices to the latest software versions and exercising caution when handling image files from untrusted sources.

Relevant professional terms

Zero-day vulnerability: A security flaw that is exploited by attackers before the software vendor has released a fix.
Out-of-bounds write: A type of programming error where data is written outside the boundaries of allocated memory, potentially leading to arbitrary code execution.

Recommended reading: Apple Security Updates

Source: securityweek.com