Cybersecurity News: Rogue NuGet package steals data, Venezuela’s PDVSA suffers attack, patched Fortinet flaws exploited

By
Sarah Lane
-

In today’s cybersecurity news…

Rogue NuGet package steals data

Researchers from Socket Security have uncovered a malicious NuGet package that impersonates the popular .NET library Tracer.Fody to steal cryptocurrency wallet data. The typosquatted package, Tracer.Fody.NLog, sat in the NuGet repository for around six years, using name tricks and hidden code to exfiltrate Stratis wallet files and passwords to attacker-controlled servers in Russia. (The Hacker News)

Venezuela’s PDVSA suffers attack

Reuters reports that Venezuela’s state oil company PDVSA was hit by a ransomware attack that knocked out administrative systems, forcing workers offline and suspending oil cargo loadings, though production and refining were unaffected. This comes amid escalating tensions with the U.S. Both PDVSA and the Venezuelan government blame the U.S. for the attack, with more than 11 million barrels stranded on vessels. (Reuters)

Patched Fortinet flaws exploited

Attackers are actively exploiting two critical Fortinet authentication-bypass vulnerabilities we told you about last week, shortly after Fortinet released patches. The flaws affect multiple Fortinet products when FortiCloud SSO is enabled and allow attackers to gain unauthenticated admin access via forged SAML assertions. Researchers at cybersecurity company Arctic Wolf observed attackers downloading system configuration files, exposing network details and credentials. Fortinet says patch immediately, or disable FortiCloud SSO until systems are upgraded. (BleepingComputer)

JumpCloud Windows Agent flaw: the latest

Researchers at XM Cyber disclosed a critical local privilege escalation flaw in the JumpCloud Remote Assist for Windows agent that allows low-privileged users to gain SYSTEM-level access or trigger denial-of-service attacks. The bug affects versions prior to 0.317.0 and stems from unsafe file operations during uninstallation, where a SYSTEM-level process interacts with user-writable TEMP directories. JumpCloud has released a patch. (Infosecurity Magazine)

Huge thanks to our sponsor, Adaptive Security

This episode is brought to you by Adaptive Security, the first cybersecurity company backed by OpenAI. Picture a “new hire” who interviews well… except they’re synthetic: AI video, AI voice, AI backstory. Once they’re in, they go after payroll, internal docs, and access. That’s the new reality: the attack surface is trust itself. Adaptive fights back with realistic deepfake simulations and training that actually sticks. Learn more at adaptivesecurity.com.

Amazon warns of Sandworm shifted tactics

Amazon Threat Intelligence warns that the Russia-linked hacking group known as Sandworm is in an ongoing campaign against Western critical infrastructure, especially energy companies. Instead of exploiting software vulnerabilities, the group now primarily targets poorly configured network edge devices hosted on AWS to gain and maintain access. Amazon says it has notified affected customers, remediated compromised systems, and that the activity reflects customer misconfigurations rather than flaws in AWS itself. (CyberScoop)

Ink Dragon hides in European networks

Researchers from Check Point report that a China-linked espionage group known as Ink Dragon has expanded operations into European government networks, compromising misconfigured Microsoft IIS and SharePoint servers to steal credentials and establish long-term access. The group uses victim infrastructure as covert relay nodes and updated its FinalDraft backdoor to blend in with Microsoft cloud activity, including hiding command traffic in email drafts. A separate China-linked group, RudePanda, was found to be accessing some of the same networks. (The Register)

Cellik malware builds off Google Play apps

Mobile security firm iVerify reports a new Android malware-as-a-service called Cellik that lets cybercriminals create trojanized versions of legitimate Google Play apps. It’s sold on underground forums for $150 per month or $900 lifetime and lets attackers wrap malware inside real apps while preserving their normal functionality, helping infections stay hidden longer and potentially evade Play Protect. Capabilities include screen streaming, file theft, credential harvesting via app overlays, hidden browser access using stored cookies, and encrypted command-and-control communications. (BleepingComputer)

Beware of ‘gift card draining’

The U.S. Treasury is warning consumers about a surge in holiday cyber scams, highlighting business impersonation, fake charities, and “gift card draining” as the most common threats. Scammers are increasingly using AI, voice cloning, and cryptocurrency to make fraud more convincing and harder to trace, with losses from online shopping scams nearing hundreds of millions of dollars. The Treasury urges consumers to verify charities and transactions, use secure payment methods, strengthen account security, and report fraud quickly. (ZDNet)