Cybersecurity Roundup: KVM Flaws, Speagle Malware, Operation Alice and More
Summary
A weekly roundup covers exposed Sears records, IP-KVM flaws, a crypto scam targeting OpenClaw developers, Claude vulnerabilities, Speagle malware, ransomware activity, UK reporting rules, Operation Alice and Android safeguards.
Key points
- Researcher Jeremiah Fowler found three unprotected databases containing nearly 3.7 million Sears Home Services customer service records; they were secured after he notified the parent company.
- Eclypsium identified nine vulnerabilities across four budget IP-KVM vendors. The most severe enables unauthenticated remote file writing and command execution; patch status varies by vendor.
- Fake GitHub accounts targeted OpenClaw developers with a crypto-token scam leading to a wallet-draining site. Ox Security reported no confirmed victims.
- Oasis Security said three Claude vulnerabilities could be chained to hijack a chat session and exfiltrate data after a click. Anthropic patched the prompt-injection flaw; fixes for two others were in progress.
- Researchers reported that Speagle activates on systems with Cobra DocGuard and collects browser and system data; one variant searches for files referencing Chinese ballistic missiles. The infection method remains unknown.
- Group-IB described The Gentlemen ransomware group’s use of CVE-2024-55591 for access and BYOVD to disable security tools before encryption and data exfiltration.
- The UK FCA finalized cyber-incident reporting deadlines of 24 hours for serious incidents and four hours for payment service providers; the rules take effect in March 2027.
- An international operation led by German authorities shut down more than 373,000 dark-web domains and identified 440 customers for investigation.
- Google announced an Android sideloading process with extra verification steps and a one-day wait, intended to help protect users from social-engineering scams.
Article Details
- Event Type
- Multi-event cybersecurity news roundup
- Impact
- The roundup reports exposed Sears Home Services customer records, including personal details, chat logs, and call recordings; vulnerabilities in IP-KVM devices that could allow unauthenticated file writes and OS command execution; a crypto scam with no confirmed victims; Claude vulnerabilities that could enable chat-session hijacking and sensitive-data exfiltration; and Speagle activity involving collection of browser and system data and searches for files referencing Chinese ballistic missiles. The Gentlemen ransomware group reportedly disables security tools before encrypting and exfiltrating victim data. Separately, the FCA finalized cyber-incident reporting deadlines, Operation Alice shut down more than 373,000 fraudulent dark web domains, and Google announced additional safeguards for Android sideloading.
MITRE ATT&CK
CVE
People
Threat Actors
QilinThe article identifies Qilin as a ransomware group; an operator associated with The Gentlemen publicly accused it of withholding affiliate commissions.RunningcrabResearchers attributed the Speagle campaign to this previously unknown threat actor. They believe it was likely the work of a state-sponsored group or hired contractor; the exact infection method is unknown.The GentlemenA ransomware-as-a-service group reported to gain access primarily through CVE-2024-55591, disable security tools using a bring-your-own-vulnerable-driver technique, and encrypt and exfiltrate victim data.
Malware
Vendors
AnthropicAnthropic has patched the prompt injection flaw following responsible disclosure, but fixes for the remaining two vulnerabilities are still in progress.EsafeNetSymantec and Carbon Black researchers have uncovered a stealthy new infostealer called Speagle that piggybacks on Cobra DocGuard (a document encryption platform made by Chinese firm EsafeNet).GoogleURL, wrapping it in an open redirect on claude.com to make it appear legitimate, and then running it as a Google ad — meaning a victim only needs to click what looks like a normal search result.
Products
AndroidGoogle adds scam-resistant safeguards to Android sideloading processClaudeClaudy Day Claude vulnerabilitiesCobra DocGuardSymantec and Carbon Black researchers have uncovered a stealthy new infostealer called Speagle that piggybacks on Cobra DocGuard (a document encryption platform made by Chinese firm EsafeNet).Fortinet FortiGateThe group primarily gains access through CVE-2024-55591, a critical FortiOS/FortiProxy authentication bypass flaw, and maintains a database of around 14,700 already-compromised FortiGate devices.FortiOSThe group primarily gains access through CVE-2024-55591, a critical FortiOS/FortiProxy authentication bypass flaw, and maintains a database of around 14,700 already-compromised FortiGate devices.FortiProxyThe group primarily gains access through CVE-2024-55591, a critical FortiOS/FortiProxy authentication bypass flaw, and maintains a database of around 14,700 already-compromised FortiGate devices.