Daily Dose of Cybersecurity News - September 19, 2025
UK Arrests 'Scattered Spider' Teens Linked to Transport for London Hack
HighWhat happened
Two teenagers, suspected members of the 'Scattered Spider' hacking group, were arrested in the UK for their alleged involvement in the August 2024 cyberattack on Transport for London (TfL). The individuals are also linked to attacks on U.S. healthcare organizations.
Who is affected
Transport for London, SSM Health Care Corporation, Sutter Health, and potentially other organizations targeted by the 'Scattered Spider' group.
Why it matters
The arrests highlight the ongoing threat posed by cybercriminal groups targeting critical infrastructure and healthcare sectors, emphasizing the need for robust cybersecurity measures.
How it could have been prevented
Implementing multi-factor authentication, regular security audits, and employee training on phishing and social engineering tactics.
Relevant professional terms
- Social Engineering
- Manipulating individuals into divulging confidential information or performing actions that compromise security.
- Multi-Factor Authentication (MFA)
- A security process that requires multiple forms of verification to access a system, enhancing protection against unauthorized access.
Recommended reading: UK shares security tips after major retail cyberattacks
SystemBC Malware Exploits Vulnerable VPS for Proxy Botnet
HighWhat happened
SystemBC malware operators are exploiting unpatched vulnerabilities in commercial virtual private servers (VPS) to create a proxy botnet, maintaining approximately 1,500 infected servers daily to route malicious traffic.
Who is affected
Organizations utilizing vulnerable VPS systems worldwide are at risk, as these compromised servers are being used to facilitate malicious activities.
Why it matters
The exploitation of VPS systems by SystemBC allows attackers to conceal command-and-control (C2) communications and other malicious traffic, complicating detection and mitigation efforts.
How it could have been prevented
Regularly applying security patches to VPS systems and conducting comprehensive vulnerability assessments can prevent exploitation by malware like SystemBC.
Relevant professional terms
- Proxy Botnet
- A network of compromised computers used to route malicious traffic through intermediary systems, obscuring the origin of the attack.
- Command-and-Control (C2) Server
- A server used by attackers to send commands to and receive data from compromised systems within a network.
Recommended reading: BleepingComputer
Microsoft 365's Market Dominance Increases Cybersecurity Risks
HighWhat happened
Microsoft 365's widespread adoption has made it a prime target for cybercriminals, leading to increased phishing attacks, malware distribution, and data breaches.
Who is affected
Organizations and individuals utilizing Microsoft 365 services are at heightened risk due to the platform's popularity.
Why it matters
The centralization of email, file sharing, and collaboration tools in Microsoft 365 creates a "target-rich environment," amplifying the potential impact of security breaches.
How it could have been prevented
Implementing multi-factor authentication, conducting regular security audits, and providing comprehensive employee training on recognizing phishing attempts can mitigate risks.
Relevant professional terms
- Phishing
- A cyberattack method where attackers impersonate legitimate entities to deceive individuals into providing sensitive information.
- Multi-Factor Authentication (MFA)
- A security process requiring users to verify their identity through multiple methods before accessing an account.
Recommended reading: Acronis: Microsoft 365 Security
PyPI Invalidates Tokens Stolen in GhostAction Supply Chain Attack
MediumWhat happened
In early September 2025, malicious GitHub Actions workflows exfiltrated PyPI tokens to external servers. The Python Software Foundation invalidated all affected tokens to prevent potential misuse.
Who is affected
Over 570 GitHub repositories were impacted, with project maintainers needing to rotate their PyPI tokens and secure their workflows.
Why it matters
The incident highlights vulnerabilities in CI/CD pipelines and the importance of securing tokens to prevent supply chain attacks.
How it could have been prevented
Implementing short-lived tokens and regularly auditing CI/CD workflows can mitigate such risks.
Relevant professional terms
- PyPI Tokens
- Authentication credentials used to publish packages to the Python Package Index.
- GitHub Actions
- CI/CD service that automates software workflows directly within GitHub repositories.
Recommended reading: Researcher hacks over 35 tech firms in novel supply chain attack
Critical Remote Code Execution Vulnerability in WatchGuard Firebox Firewalls (CVE-2025-9242)
CriticalWhat happened
WatchGuard has identified and patched a critical remote code execution vulnerability (CVE-2025-9242) in its Firebox firewalls, which could allow unauthenticated attackers to execute arbitrary code remotely.
Who is affected
Organizations using WatchGuard Firebox firewalls running Fireware OS versions 11.x (end of life), 12.x, and 2025.1 are affected, especially those configured with IKEv2 VPN.
Why it matters
Exploitation of this vulnerability could lead to full system compromise, allowing attackers to control network traffic, exfiltrate sensitive data, or deploy further attacks within the network.
How it could have been prevented
Regularly updating Fireware OS to the latest versions and reviewing VPN configurations to ensure they are not vulnerable.
Relevant professional terms
- Remote Code Execution (RCE)
- A type of vulnerability that allows an attacker to run arbitrary code on a remote system.
- Out-of-Bounds Write
- A flaw where a program writes data outside the boundaries of allocated memory, potentially leading to code execution.
Recommended reading: WatchGuard Security Advisory WGSA-2025-00015
Google Patches Sixth Chrome Zero-Day Exploited in 2025 (CVE-2025-10585)
HighWhat happened
Google released emergency security updates to address a high-severity zero-day vulnerability (CVE-2025-10585) in Chrome's V8 JavaScript engine, identified as a type confusion flaw. This marks the sixth such vulnerability exploited in attacks this year.
Who is affected
All users of Google Chrome on Windows, Mac, and Linux platforms are affected. The vulnerability was reported by Google's Threat Analysis Group (TAG).
Why it matters
Exploitation of this vulnerability could allow attackers to execute arbitrary code on users' systems, potentially leading to data theft, system compromise, or further malware deployment. The existence of a public exploit increases the risk of widespread attacks.
How it could have been prevented
Regularly updating software to the latest versions and promptly applying security patches can mitigate the risk of exploitation. Additionally, employing robust security practices and monitoring for unusual activity can help detect and prevent attacks.
Relevant professional terms
- Zero-day vulnerability
- A security flaw that is exploited by attackers before the software vendor has released a fix.
- Type confusion
- A programming error where a piece of code uses one type of data as if it were another, leading to unpredictable behavior and potential security vulnerabilities.
Recommended reading: Chrome Releases Blog
SonicWall Data Breach Exposes Firewall Backup Configurations
HighWhat happened
Threat actors breached SonicWall's cloud backup service, accessing firewall configuration files and encrypted credentials for a subset of customers.
Who is affected
SonicWall customers whose firewall configuration backups were stored in the cloud, representing fewer than 5% of the company's firewall install base.
Why it matters
The exposure of firewall configurations and encrypted credentials could enable attackers to exploit affected firewalls, potentially compromising network security.
How it could have been prevented
Implementing robust access controls, monitoring for suspicious activity, and ensuring encrypted storage of sensitive configuration files could mitigate such breaches.
Relevant professional terms
- Firewall Configuration Files
- Files containing settings and rules that define how a firewall controls incoming and outgoing network traffic.
- Encrypted Credentials
- Usernames and passwords that have been transformed into a secure format to prevent unauthorized access.
Recommended reading: SonicWall Cloud Backup File Incident Notification