Cybersecurity Roundup: Ransomware Prosecutions, Exploited Flaws and New Threat Activity
Summary
A roundup covers BlackCat ransomware indictments, actively exploited vulnerabilities, a University of Pennsylvania data breach, malicious NuGet packages, APT37 Android attacks, Iranian malware activity and a new ransomware-as-a-service platform.
Key points
- Three former cybersecurity company employees were indicted over alleged BlackCat ransomware attacks on five U.S. companies in 2023.
- CISA added three vulnerabilities affecting DELMIA Apriso and XWiki to its list of flaws under active exploitation.
- The University of Pennsylvania confirmed attackers used an employee’s SSO account to access systems and steal internal documents and 1.2 million donor records.
- Malicious NuGet packages include delayed payloads targeting database providers used in .NET applications.
- APT37 reportedly used KakaoTalk spear-phishing and Google Find Hub in attacks targeting South Koreans, stealing credentials and wiping data.
- Mandiant attributed aerospace and defense attacks using DEEPROOT and TWOSTROKE malware to Iranian-linked UNC1549.
- Scattered Lapsus$ Hunters announced a ransomware-as-a-service platform called ShinySp1d3r.
Article Details
- Event Type
- A roundup of cybersecurity incidents and threat activity, including ransomware attacks, actively exploited vulnerabilities, a university data breach, malicious package activity, phishing and malware campaigns, cryptocurrency fraud, and a newly announced ransomware-as-a-service platform.
- Impact
- Reported impacts include data theft and extortion affecting five U.S. companies; vulnerabilities enabling arbitrary code execution and application compromise in DELMIA Apriso and XWiki; theft of 1.71 GB of University of Pennsylvania documents and 1.2 million donor records; and attacks involving credential theft, data wiping, espionage, and ransomware. The roundup also reports a cryptocurrency fraud affecting more than 128,000 victims in China.
MITRE ATT&CK
CVE
CVE-2025-24893The vulnerabilities CVE-2025-6204, CVE-2025-6205, and CVE-2025-24893 allow threat actors to execute arbitrary code and gain access to applications.CVE-2025-6204The vulnerabilities CVE-2025-6204, CVE-2025-6205, and CVE-2025-24893 allow threat actors to execute arbitrary code and gain access to applications.CVE-2025-6205The vulnerabilities CVE-2025-6204, CVE-2025-6205, and CVE-2025-24893 allow threat actors to execute arbitrary code and gain access to applications.
People
Jian WenIdentified as an associate who helped Zhimin Qian attempt to launder cryptocurrency through property purchases.Kevin Tyler MartinIndicted in connection with alleged BlackCat ransomware attacks on U.S. companies.Ryan Clifford GoldbergIndicted in connection with alleged BlackCat ransomware attacks on U.S. companies.Yadi ZhangName identified in the article as an alias of Zhimin Qian, who was found guilty of a cryptocurrency fraud campaign.Zhimin QianFound guilty of a cryptocurrency fraud campaign; also known as Yadi Zhang.
Threat Actors
ALPHVIdentified in the article as another name for BlackCat ransomware.APT37North Korean hackers reported to have abused Google Find Hub in attacks targeting South Koreans.BlackCatRansomware identified in allegations that attackers hacked and extorted five U.S. companies; the article says it is also known as ALPHV.Nimbus ManticoreIdentified in the article as another name for UNC1549.Scattered Lapsus$ HuntersGroup that announced development of the ShinySp1d3r ransomware-as-a-service platform.ShinyHuntersThe article says ShinyHunters will lead development of ShinySp1d3r under the Scattered Lapsus$ Hunters brand.UNC1549Mandiant-attributed group reported to have conducted espionage-driven attacks using malware and phishing; also identified as Nimbus Manticore and Subtle Snail.
Malware
BlackCat1. U.S. Prosecutors Indict Cybersecurity Insiders Accused of BlackCat Ransomware Attacks – The Hacker NewsDEEPROOT7. Iranian Hackers Use DEEPROOT and TWOSTROKE Malware in Aerospace and Defense Attacks – The Hacker Newsshinysp1d3r8. Meet ShinySp1d3r: New Ransomware-as-a-Service created by ShinyHunters – Bleeping ComputerTWOSTROKE7. Iranian Hackers Use DEEPROOT and TWOSTROKE Malware in Aerospace and Defense Attacks – The Hacker News
Vendors
Products
DELMIA AprisoCybersecurity and Infrastructure Security Agency (CISA) listed three new vulnerabilities that have impacted Dassault Systèmes DELMIA Apriso and XWiki.Google Find Hub6. APT37 hackers abuse Google Find Hub in Android data-wiping attacks – Bleeping ComputerKakaoTalkVictims are approached through KakaoTalk messenger, a popular instant messaging app.Microsoft SharePoint“the university’s Salesforce instance, Qlik analytics platform, SAP business intelligence system, and SharePoint files.” This access provided the threat actors with 1.71 GB of internal documents as well as 1.2NaverMeanwhile the malware grabs the victim’s Google and Naver login details, signs into their email accounts, changes security settings, and deletes traces of the break-in.NuGet5. Malicious NuGet packages drop disruptive ‘time bombs’ – The Bleeping ComputerQlikPennKey SSO account the threat actor was able to gain access to “the university’s Salesforce instance, Qlik analytics platform, SAP business intelligence system, and SharePoint files.” This access provided theSalesforceUsing an employee’s PennKey SSO account the threat actor was able to gain access to “the university’s Salesforce instance, Qlik analytics platform, SAP business intelligence system, and SharePoint files.” This accessSAPthreat actor was able to gain access to “the university’s Salesforce instance, Qlik analytics platform, SAP business intelligence system, and SharePoint files.” This access provided the threat actors with 1.71 GB ofSharp7ExtendThe packages target three major database providers used in .NET applications, with the most dangerous targeting Sharp7Extend.XWiki2. Active Exploits Hit Dassault and XWiki — CISA Confirms Critical Flaws Under Attack – The Hacker News
Countries
Chinaas Yadi Zhang), was found guilty of a large-scale fraud campaign that defrauded over 128,000 victims in China between 2014 and 2017.South KoreaSpear-phishing messages transmitted through KakaoTalk impersonate South Korea’s National Tax Service, the police, and other agencies to deceive recipients into interacting.United KingdomAfter her scheme was uncovered in 2017, she converted the proceeds into Bitcoin and fled to the United Kingdom, where, with the help of an associate named Jian Wen, she attempted to launder the cryptocurrency through