Security Roundup Covers OnTrac Intrusion, SonicWall Credential Stuffing and AI-Assisted Crypto Research
Summary
SecurityWeek’s roundup covers an OnTrac network intrusion, Adobe patches, SonicWall credential stuffing, UK education records accessed, AWS attribution of package compromises to Sapphire Sleet, and AI-assisted cryptanalysis that does not affect deployed systems.
Key points
- Attackers accessed OnTrac’s corporate network and certain files between March 20 and 22; the company detected the activity on March 23, and no ransomware group has claimed it.
- Adobe patched critical vulnerabilities in Format Plugins, Bridge and Campaign Classic; Adobe reported no known exploitation in the wild.
- Huntress observed credential stuffing against SonicWall VPN and firewall accounts, with successful logins at 30 organizations and no detected hands-on activity after compromise.
- OpenAI released the open-source Codex Security CLI for repository scanning, tracking findings, verifying fixes and integrating checks into CI/CD pipelines.
- Hackers obtained about 607,000 phone-number and email records from England’s Department for Education; the department said the data excluded bank details and the incident was contained quickly.
- Amazon Threat Intelligence attributed compromises involving the Axios, Debug and Chalk NPM packages and a typo-crypto incident to North Korea-linked Sapphire Sleet, citing fragmented payloads and environment-aware malware as evolving techniques.
- Researchers reported an improved key-recovery attack on HAWK and a faster attack on 7-round AES; neither result affects currently deployed systems.
Article Details
- Event Type
- Weekly cybersecurity roundup covering data breaches, vulnerability updates, credential stuffing, software supply-chain compromises, exposed APIs, and cryptanalysis research.
- Impact
- Reported incidents included access to OnTrac’s corporate network and files, theft of approximately 607,000 Department for Education contact records, successful credential-stuffing logins at 30 organizations, and exposure of customer, user, and vehicle data through My Eicher. Amazon attributed compromises of Axios, Debug, and Chalk packages and a typo-crypto incident to Sapphire Sleet. Adobe reported no known exploitation of the patched vulnerabilities. The HAWK and reduced-round AES research does not affect currently deployed systems.
MITRE ATT&CK
T1110.004 · Credential StuffingHuntress observed automated credential stuffing against SonicWall VPN and firewall accounts, with successful logins at 30 organizations.T1195.001 · Compromise Software Dependencies and Development ToolsAmazon attributed compromises of the Axios, Debug, and Chalk NPM packages to Sapphire Sleet, describing supply-chain techniques including fragmented payloads.
Threat Actors
Vendors
AdobeAdobe patches vulnerabilities in Bridge, Campaign Classic and Format PluginsAmazonAmazon ties Axios, Debug and Chalk hacks to North Korea’s Sapphire SleetAnthropicAnthropic researchers using Claude Mythos Preview developed an improved key-recovery attack on the post-quantum signature scheme HAWK that roughly halves its effective security level, and a faster meet-in-the-middleHuntressHuntress observed a broad credential stuffing campaign against SonicWall VPN and firewall accounts beginning July 25, with successful logins at 30 organizations so far.OpenAIOpenAI releases open source Codex Security CLISonicWallSonicWall VPN and firewall accounts hit by widespread credential stuffing
Products
BridgeAdobe patches vulnerabilities in Bridge, Campaign Classic and Format PluginsCampaign ClassicAdobe patches vulnerabilities in Bridge, Campaign Classic and Format PluginsClaude Mythos PreviewAnthropic researchers using Claude Mythos Preview developed an improved key-recovery attack on the post-quantum signature scheme HAWK that roughly halves its effective security level, and a faster meet-in-the-middleFormat PluginsAdobe patches vulnerabilities in Bridge, Campaign Classic and Format PluginsMy EicherA security researcher discovered unauthenticated internal APIs in VE Commercial Vehicles’ My Eicher platform that exposed customer, user, and vehicle data and enabled account takeover.