Essential Insights
- Attackers are actively exploiting critical Ivanti and BeyondTrust flaws; a Windows Shell zero-day is also being used to bypass security protections.
- Breaches exposed personal data of over 1 million CenterPoint customers and 11.18 million Burger King Japan members; stolen credentials also enabled access to at least 173 organizations.
- Attackers manipulated supermarket refrigeration controllers in France, causing equipment failures, food losses, and more than $100,000 in losses for one retailer.
Threats, Techniques, and Targets
- CenterPoint Energy reported a breach that exposed personal information belonging to more than one million Texas residents. Meanwhile, Burger King Japan reported that unauthorized access exposed information for about 11.18 million app members, but found no evidence of stolen passwords or payment card data.
- Attackers used compromised ConnectWise Cloud Backup application credentials to access at least 173 customer organizations. They may have reached email, files, and Teams information. In France, attackers changed connected refrigeration controls at several supermarkets, including E. Leclerc stores.
- Check Point researchers found two critical LiteLLM flaws that could let low privilege users change settings, access sensitive files, redirect requests, and steal credentials. Separately, CERT In reported attacks on organizations that used exposed credentials, insecure interfaces, and misconfigured cloud services linked to autonomous AI agents.
- Microsoft released updates for 1,413 vulnerabilities, including three zero day flaws. Attackers actively exploited a Windows Shell flaw and an authentication bypass flaw in Ivanti Connect Secure. GitLab and BeyondTrust also addressed critical vulnerabilities that could allow remote code execution or unauthorized file operations.
- Researchers identified phishing campaigns with fake calendar invitations that stole Microsoft account credentials. They also found election related scams targeting US voters. In addition, Silent Lynx used spear phishing through compromised government email accounts and exploited a WinRAR flaw to target Russian energy infrastructure and Central Asian government entities.
Impact, Security Implications, and Remediation
- The reported breaches exposed personal and business information. The refrigeration attacks disrupted store operations and caused food losses. One retailer reported losses above $100,000. The phishing campaigns identified more than 302,000 emails targeting over 40,000 organizations.
- These incidents show the risks of compromised credentials, exposed services, insecure interfaces, and unpatched software. The report also describes experiments in which peer behavior increased one AI agent’s rule violation rate from 44 percent to 98 percent.
- LiteLLM addressed both reported flaws. Microsoft, GitLab, and BeyondTrust released security updates. Therefore, organizations using these products should apply the relevant vendor updates. Check Point IPS also provides protection against the reported Windows Shell, Ivanti, and WinRAR threats.
- The report does not provide remediation steps for the data breaches, refrigeration attacks, or phishing and election scams. It also does not state whether Ivanti released a fix. Obtain remediation guidance from the relevant vendor or authority.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
