Cisco, Fortinet Exploits Escalate; Ransomware Surges in Europe

This daily cybersecurity brief highlights critical vulnerabilities and active exploitation campaigns. Cisco Catalyst SD-WAN and Cisco Unified CM are under scrutiny, with zero-day flaws in the former actively exploited for root access and SSRF vulnerabilities in the latter being used to deploy webshells. Fortinet FortiGate firewalls are also heavily impacted by the 'FortiBleed' campaign, which has compromised over 430,000 devices and stolen millions of credentials, primarily sold to ransomware gangs. CISA has mandated urgent patching for actively exploited flaws in Lantronix and Ubiquiti devices, emphasizing immediate risk to enterprise and OT networks.

Ransomware attacks in Europe have surged by 55.1%, with manufacturing being the most targeted sector. The Qilin ransomware group remains prolific, and geographically concentrated campaigns are evident. A new, stealthy Windows backdoor named 'Mistic' has been identified, linked to initial access brokers who supply major ransomware groups. In the AI space, critical 'DifyTap' flaws in the Dify AI platform could expose cross-tenant data in over a million applications. Tata Electronics has confirmed a cyberattack, with hackers claiming to have leaked sensitive data related to Apple and Tesla, underscoring significant supply chain risks.

Finally, Google Chrome version 149 has been released, patching four Critical and fourteen High-severity vulnerabilities, including use-after-free bugs in core components. While not actively exploited, these updates are crucial for user security.