Cybersecurity Roundup: Dolphin X Malware, Linux CVEs and Vehicle Security Flaw
Summary
The roundup covers Dolphin X’s AI-assisted profiling, cyber incidents and takedowns, exploit disclosures, 432 Linux kernel CVEs, Google CodeMender, and a patched Bluetooth flaw affecting aftermarket vehicle security devices.
Key points
- Varonis Threat Labs found that Dolphin X infostealer uses an AI behavioral profiler and targets more than 300 applications, including to steal passwords, cryptocurrency wallets, SSH keys and cloud tokens.
- Abbott disclosed unauthorized access to a limited number of Cancer Diagnostics systems. ShinyHunters claimed responsibility; Abbott said business operations, manufacturing and patient care were not disrupted.
- A cyberattack on a Maine telecommunications provider disrupted internet service across 23 towns, affecting municipal networks and local government operations.
- Unit 42 described three zero-days in Siemens ROX II switches that can be chained for persistent root-level access: CVE-2025-40948, CVE-2025-40947 and CVE-2025-40949.
- Stadler Rail said it refused Everest’s 10 million Swiss franc extortion demand after attackers stole technical information from a supplier-shared data exchange platform. The company said production was unaffected and no critical security or personal data was compromised.
- German authorities dismantled the Kratos phishing group. Separately, 432 Linux kernel CVEs were published within 24 hours, prompting security teams to assess affected systems and patch priorities.
- A CISA and international-partner advisory says Russian state-sponsored group Laundry Bear is exploiting patched Zimbra vulnerability CVE-2025-66376 to exfiltrate inboxes after a victim opens a malicious email.
- Google introduced a preview of CodeMender, a service intended to help developers find and remediate insecure code in development workflows.
- Researchers found that a hardcoded Bluetooth key in Acrisure KARR and SWDS aftermarket anti-theft devices could expose at least 2.2 million vehicles to remote unlocking; a patch has been released.
Article Details
- Event Type
- Weekly cybersecurity news roundup covering malware, cyberattacks, vulnerability exploitation, law enforcement action, and security product news.
- Impact
- Reported impacts include theft of credentials, tokens, and other data; unauthorized access to Abbott systems; internet outages affecting 23 Maine towns; potential root-level compromise of Siemens ROX II switches; a data theft and extortion incident involving Stadler Rail; inbox exfiltration in an espionage campaign; and remote unlocking risk for at least 2.2 million vehicles. The roundup also reports a German law enforcement takedown of the Kratos phishing group and disclosure of hundreds of Linux kernel CVEs.
CVE
CVE-2025-40947By exploiting an arbitrary file disclosure flaw (CVE-2025-40948), an attacker can gather sensitive system intelligence to facilitate a subsequent privilege escalation via command injection (CVE-2025-40947).CVE-2025-40948By exploiting an arbitrary file disclosure flaw (CVE-2025-40948), an attacker can gather sensitive system intelligence to facilitate a subsequent privilege escalation via command injection (CVE-2025-40947).CVE-2025-40949The compromise is then cemented using a third vulnerability (CVE-2025-40949) in the web management task scheduler, allowing malicious code execution to survive system reboots.CVE-2025-66376state-sponsored threat group, known as Laundry Bear, is actively exploiting a patched vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite.
Threat Actors
EverestThe ransomware group reportedly demanded 10 million Swiss francs from Stadler Rail after attackers stole technical information from a data exchange platform shared with a supplier.KratosGerman authorities dismantled the phishing group, which the article describes as responsible for organized credential theft and phishing campaigns.Laundry BearA joint advisory described this Russian state-sponsored group as actively exploiting CVE-2025-66376 in an espionage campaign that exfiltrated victims’ inboxes.ShinyHuntersThe group claimed credit for the hack involving unauthorized access to a limited number of systems in Abbott’s Cancer Diagnostics business.
Malware
Vendors
AcrisureResearchers at UC San Diego discovered a vulnerability in aftermarket anti-theft systems manufactured by Acrisure, leaving at least 2.2 million vehicles susceptible to remote compromise.GoogleGoogle launches CodeMender previewSiemensPalo Alto Networks details exploit chain in Siemens ROX II switchesZimbraRussian APT Laundry Bear exploits Zimbra flaw in espionage campaign
Products
KARRAcrisure has since released a patch to secure the affected KARR and SWDS devices, which were installed primarily by dealerships in Southern California.ROX II OT switchesUnit 42 researchers identified three zero-day vulnerabilities in Siemens ROX II OT switches that can be chained together to achieve persistent root-level access.SWDSAcrisure has since released a patch to secure the affected KARR and SWDS devices, which were installed primarily by dealerships in Southern California.Zimbra Collaboration Suiteknown as Laundry Bear, is actively exploiting a patched vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite.
Tools
Countries
Industries
GovernmentThe disruption impacted municipal networks and local government operations that rely on the regional telecom’s infrastructure.ManufacturingThe company stated that the breach has not disrupted business operations, manufacturing, or patient care.TelecommunicationsA recent cyberattack targeting a telecommunications provider in Maine resulted in widespread internet service outages across 23 towns.