Daily Dose of Cybersecurity News - August 22, 2025
Colt Technology Services Data Breach via Warlock Ransomware Exploiting CVE-2025-53770
CriticalWhat happened
Colt Technology Services, a UK-based telecommunications company, experienced a cyberattack on August 12, 2025, attributed to the Warlock ransomware group. The attackers exploited a known vulnerability in Microsoft SharePoint (CVE-2025-53770) to gain unauthorized access and exfiltrate sensitive data.
Who is affected
Colt Technology Services and its customers, whose data may have been compromised during the breach.
Why it matters
The breach led to the theft of approximately one million documents containing sensitive information, including financial records, network architecture details, and customer data. The Warlock group is auctioning this data on the dark web, posing significant risks to Colt's operations and its customers' security.
How it could have been prevented
Timely application of security patches for known vulnerabilities, particularly CVE-2025-53770, and regular security audits to identify and mitigate potential weaknesses in the system.
Relevant professional terms
- Remote Code Execution (RCE)
- A type of vulnerability that allows an attacker to execute arbitrary code on a target system remotely.
- Zero-Day Vulnerability
- A software security flaw that is unknown to the vendor and lacks a patch, making it exploitable by attackers.
Recommended reading: BleepingComputer
Russian State-Backed Hackers Exploit CVE-2018-0171 in Cisco Devices
CriticalWhat happened
Russian state-sponsored hackers, identified as Berserk Bear, are exploiting a critical vulnerability (CVE-2018-0171) in Cisco devices to infiltrate critical infrastructure organizations.
Who is affected
Organizations utilizing unpatched Cisco networking devices, particularly within critical infrastructure sectors, are at risk.
Why it matters
Exploitation of this vulnerability allows unauthorized access, enabling attackers to conduct reconnaissance and potentially disrupt essential services.
How it could have been prevented
Regularly applying security patches and updates to networking devices; disabling unused services like Cisco's Smart Install feature.
Relevant professional terms
- Denial-of-Service (DoS)
- An attack aimed at making a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services.
- Arbitrary Code Execution
- The ability of an attacker to execute any command of their choice on a target machine or process.
Recommended reading: Cisco Security Advisory on CVE-2018-0171
Orange Belgium Data Breach Exposes 850,000 Customer Accounts
HighWhat happened
In late July 2025, Orange Belgium experienced a cyberattack that led to unauthorized access to data from approximately 850,000 customer accounts. The compromised information includes names, phone numbers, SIM card numbers, PUK codes, and tariff plans. Passwords, email addresses, and financial details were not affected.
Who is affected
Approximately 850,000 Orange Belgium customers had their personal data accessed during this breach.
Why it matters
The exposure of SIM card numbers and PUK codes raises concerns about potential SIM swapping attacks, where attackers could hijack victims' phone numbers to intercept calls and messages, including those used for multi-factor authentication.
How it could have been prevented
Implementing robust access controls and regular security audits could have helped identify and mitigate vulnerabilities in the IT systems. Additionally, encrypting sensitive customer data at rest would reduce the impact of unauthorized access.
Relevant professional terms
- SIM Swapping
- A type of fraud where an attacker convinces a mobile carrier to transfer a victim's phone number to a SIM card they control, allowing them to intercept calls and messages.
- PUK Code
- Personal Unblocking Key; an eight-digit code used to reset a SIM card that has been locked after multiple incorrect PIN entries.
Recommended reading: Infosecurity Magazine
ChatGPT Downgrade Attack Exposes GPT-5 Vulnerabilities
HighWhat happened
Researchers have identified a technique named "PROMISQROUTE" that allows users to manipulate ChatGPT into routing prompts to older, less secure language models by embedding specific cues in their inputs.
Who is affected
Users and organizations utilizing ChatGPT, particularly those relying on its security measures to prevent misuse.
Why it matters
This vulnerability enables malicious actors to bypass the enhanced security features of GPT-5 by downgrading to older models, potentially facilitating the generation of harmful content.
How it could have been prevented
Implementing stricter input validation to prevent routing manipulation and ensuring all model variants adhere to uniform security protocols.
Relevant professional terms
- Prompt Injection
- A technique where specific inputs are crafted to manipulate an AI model's behavior.
- Model Downgrade Attack
- An attack that forces a system to use an older, less secure version of a model.
Recommended reading: Unpatched Critical Vulnerabilities Open AI Models to Takeover
Columbia University Enhances Security Through Advanced Logging Practices
HighWhat happened
Columbia University experienced multiple cyberattacks, including a breach by state-sponsored hackers targeting research labs and incidents involving hacktivists protesting university policies. The university utilized comprehensive logging of network flows to monitor and analyze attacker activities, enabling effective incident response and mitigation.
Who is affected
Columbia University, including its research departments, students, and employees, were impacted by these cyberattacks.
Why it matters
Educational institutions are increasingly targeted due to the valuable data they possess and often limited cybersecurity resources. Columbia's proactive use of logging demonstrates an effective strategy for detecting and mitigating sophisticated cyber threats.
How it could have been prevented
Implementing comprehensive network monitoring and logging to detect unauthorized activities. Regularly updating and patching systems to address vulnerabilities. Conducting security awareness training for staff and students to recognize and report suspicious activities.
Relevant professional terms
- Netflow
- A network protocol developed by Cisco for collecting IP traffic information and monitoring network flow.
- Honeypot
- A security mechanism set to detect, deflect, or study attempts at unauthorized use of information systems by simulating vulnerable systems.
Recommended reading: Columbia University Data Breach Affects 860K Individuals
Password Managers Vulnerable to Data Theft via Clickjacking
HighWhat happened
A security researcher identified that nearly a dozen popular password managers are susceptible to clickjacking attacks, potentially allowing attackers to steal sensitive user data.
Who is affected
Users of password managers such as 1Password, Bitwarden, Dashlane, Enpass, Keeper, LastPass, LogMeOnce, NordPass, ProtonPass, RoboForm, and Apple's iCloud Passwords are impacted.
Why it matters
Clickjacking vulnerabilities in widely-used password managers could lead to unauthorized access to personal data, usernames, passwords, passkeys, and payment card information, posing significant security risks.
How it could have been prevented
Implementing user interface design practices that prevent unauthorized overlay of elements and requiring user confirmation before autofilling sensitive information can mitigate clickjacking risks.
Relevant professional terms
- Clickjacking
- A malicious technique where an attacker tricks a user into clicking on something different from what the user perceives, potentially leading to unintended actions or data exposure.
- DOM (Document Object Model)
- A programming interface for web documents that represents the page structure, allowing scripts to update content and structure dynamically.
Recommended reading: Three Ways to Prevent Clickjacking
Apple Patches CVE-2025-43300 Zero-Day Exploited in Targeted Attacks
HighWhat happened
Apple released security updates for iOS and macOS to address a zero-day vulnerability (CVE-2025-43300) in the ImageIO framework, which was exploited in highly targeted attacks.
Who is affected
Users of iOS, iPadOS, and macOS devices are affected, particularly those targeted in sophisticated attacks.
Why it matters
The vulnerability allows attackers to execute arbitrary code by processing a malicious image file, potentially leading to unauthorized access and control over affected devices.
How it could have been prevented
Regularly updating devices to the latest software versions and exercising caution when handling image files from untrusted sources.
Relevant professional terms
- Zero-day vulnerability
- A security flaw that is exploited by attackers before the software vendor has released a fix.
- Out-of-bounds write
- A type of programming error where data is written outside the boundaries of allocated memory, potentially leading to arbitrary code execution.
Recommended reading: Apple Security Updates