Security Roundup: Ray Exploitation, Salt Typhoon Intrusion and Zombie Card Attack
Summary
A weekly roundup covers active Ray vulnerability exploitation, the Salt Typhoon intrusion at T-Mobile, breaches and ransomware activity, a contactless-payment attack demonstration, and a post-quantum HSM certification.
Key points
- CISA added Ray vulnerability CVE-2025-62593 to its Known Exploited Vulnerabilities catalog and directed federal civilian agencies to prioritize remediation; BitSight observed RondoDox exploiting it.
- T-Mobile reportedly cut a compromised router’s network cable in 2024 to stop an intrusion attributed to Chinese state-sponsored group Salt Typhoon.
- Alation confirmed an unauthorized network intrusion; TeamPCP claimed it stole 73 GB of data, a claim not independently confirmed in the article.
- Sakura Internet discovered a breach in its sales management system that may have exposed information for up to 1.36 million users.
- A CISA, FBI and HHS advisory says Medusa affiliates are exploiting Fortra GoAnywhere and BeyondTrust vulnerabilities and have affected more than 500 critical-infrastructure organizations.
- Researchers demonstrated a Zombie Card method to make contactless payments with expired Visa cards; it reportedly did not work with Mastercard, American Express or Discover, or at all banks.
- Crypto4A’s QASM hardware security module received FIPS 140-3 Level 3 validation for support of NIST-approved post-quantum cryptographic algorithms.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering active vulnerability exploitation, cyber intrusions and data breaches, DDoS attacks, ransomware activity, a payment-card attack demonstration, and a post-quantum hardware certification.
- Impact
- Reported incidents include active exploitation of CVE-2025-62593 by the RondoDox botnet; unauthorized access to Snowflake internal Jira tickets through a GitHub Actions workflow vulnerability; Threema service disruptions from DDoS attacks; a Salt Typhoon intrusion targeting T-Mobile; and an Alation breach for which TeamPCP claimed 73 GB of data theft. Sakura Internet said a breach potentially affected up to 1.36 million users. A joint advisory reported that Medusa ransomware affiliates had hit more than 500 critical-infrastructure organizations.
MITRE ATT&CK
CVE
Threat Actors
MedusaThe advisory reports that Medusa ransomware affiliates are exploiting vulnerabilities in Fortra GoAnywhere and BeyondTrust to compromise critical-infrastructure organizations.Salt TyphoonIdentified as a Chinese state-sponsored hacking group responsible for the reported 2024 network intrusion targeting T-Mobile.TeamPCPPublicly claimed responsibility for the Alation breach and alleged that it exfiltrated 73 gigabytes of sensitive data.
Malware
Vendors
AlationTeamPCP claims massive data theft from AlationBeyondTrustMedusa ransomware targeting GoAnywhere and BeyondTrust vulnerabilitiesCrypto4ACrypto4A has become the first company globally to achieve FIPS 140-3 Level 3 validation for an HSM supporting all NIST-approved post-quantum cryptographic algorithms.FortraA joint advisory from CISA, the FBI, and HHS cautions that Medusa ransomware affiliates are rapidly exploiting newly disclosed vulnerabilities in Fortra GoAnywhere and BeyondTrust to compromise critical infrastructure.GitHubGitHub says vulnerability found by autonomous Wiz agent not introduced by AISakura InternetData breach at Japan’s Sakura Internet affects over 1 million customer recordsT-MobileT-Mobile physically cut router cable to stop Chinese hackersThreemaThreema DDoS attackVisaAcademic researchers have demonstrated a new Zombie Card attack that bypasses cryptographic checks to complete contactless payments using physically expired Visa credit cards.WizGitHub says vulnerability found by autonomous Wiz agent not introduced by AI
Products
Fortra GoAnywhere MFTMedusa ransomware targeting GoAnywhere and BeyondTrust vulnerabilitiesGitHub ActionsAn autonomous AI tool developed by Wiz successfully identified and exploited a critical GitHub Actions workflow vulnerability in a public Snowflake repository, gaining unauthorized access to the company’s internal JiraQASMThe newly certified QASM module delivers a tamper-resistant foundation to protect sensitive cryptographic keys from the future threat of advanced quantum computing attacks.RayCISA warns of actively exploited Ray vulnerability ThreemaThreema DDoS attack
Tools
InteractshThe updated alert highlights the group’s evolving evasion toolkit, which now includes utilizing Minidump for credential theft and Interactsh dynamic URLs to verify successful network exploitation.MinidumpThe updated alert highlights the group’s evolving evasion toolkit, which now includes utilizing Minidump for credential theft and Interactsh dynamic URLs to verify successful network exploitation.
Countries
Industries
Critical infrastructureA joint advisory from CISA, the FBI, and HHS cautions that Medusa ransomware affiliates are rapidly exploiting newly disclosed vulnerabilities in Fortra GoAnywhere and BeyondTrust to compromise critical infrastructure.Enterprise softwareThe hacking group TeamPCP has publicly claimed responsibility for the breach, alleging they successfully exfiltrated 73 gigabytes of sensitive data from the enterprise software company.MessagingEncrypted messaging provider Threema recently endured significant service disruptions following a series of sophisticated, sustained DDoS attacks targeting its infrastructure and colocation partner.