Surge in Edge Device Zero-Day Exploits

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, a surge in zero-day exploits, Baltimore city public schools hit by data breach, CISA added Broadcom Brocade and Commvault flaws, fake WooCommerce patch delivers backdoor, Hitachi Vantara hit by Akira, ex-Disney employee imprisoned for hacking menus, Darcula phishing kit adds GenAI. Also, FBI published 42,000 phishing domains.

See Also: Top 10 Technical Predictions for 2025

Google says it tracked 75 exploited zero-day vulnerabilities in 2024, with 44% targeting enterprise technologies – a percentage that edged upward from 37% the year before.

It’s a warning that “a wider and more diverse set of vendors” will need to increased proactive security measures, Google said in a Tuesday report.

The majority of zero-day exploits in enterprise solutions were in security and networking products. “The variety of targeted enterprise products continues to expand across security and networking products, with notable targets in 2024 including Ivanti Cloud Services Appliance, Palo Alto Networks PAN-OS, Cisco Adaptive Security Appliance and Ivanti Connect Secure VPN,” Google said.

Edge devices are valuable entry points into networks and have become the focus of state sponsored groups, including Chinese cyberespionage groups (see: Sophos Discloses Half Decade of Sustained Chinese Attack).

Cyberespionage operations collectively accounted for more than half of the attributable exploits tracked during 2024. Still, it’s not all Chinese hackers: Commercial spyware vendors rather than Chinese hackers accounted for the most number of zero-day exploits. North Korean nation state groups, who hack for financial theft as much as cyberespionage, also matched Chinese groups in zero-day exploit total.

The year-to-year count of exploited zero-days fluctuates, with the total number last year a decrease from 2023’s total of 98. But “the average trend line indicates that the rate of zero-day exploitation continues to grow at a slow but steady pace,” Google warned.

Exploitation of browsers and mobile devices decreased but attack chains targeting mobile users remained prevalent. Vendors such as Microsoft – 26 exploits – and Google – 11 – were top targets, followed by Ivanti, with 7 exploits. Exploit types such as use-after-free, code injection and cross-site scripting continued to dominate.

Spanish authorities on Wednesday extradited Artem Stryzhak to face ransomware charges in Brooklyn federal court. Stryzhak, 35, is a Ukrainian national arrested in Spain in June 2024, was an alleged hacker for the Nefilim ransomware as a service operation. Also spelled “Nephilim,” the group emerged in March 2020. Although apparently inactive, Nefilim cut a high profile earlier this decade, attacking appliances giant Whirlpool and hitting unpatched Citrix gateways.

A heavily redacted indictment says Stryzhak began his association with Nefilim in June 2021. He agreed to target companies with revenues greater than $200 million located in the United States, Canada and Australia, prosecutors say.

In addition to exploiting Citrix vulnerabilities, Nefilim used remote desktop protocol to gain initial access, also using RDP and Cobalt Strike to move laterally within organizations, Sophos reported in June 2021.

Prosecutors want Stryzhak held without bail. If found guilty, he faces a five year prison sentence, prosecutors said.

Baltimore City Public Schools notified tens of thousands of employees, students and contractors of a data breach following a cyberattack in February. The attack exposed Social Security numbers, driver’s license numbers and student records. The breach affected current and former employees, volunteers, contractors and roughly 1,150 students. The Baltimore Sun reported the breach affects 31,000 individuals.

The school district did not directly attribute the breach to a specific cybercriminal group. WBAL reported the attack came from the Cloak ransomware group, which has targeted over 130 victims since late 2022.

The U.S. Cybersecurity and Infrastructure Security Agency added two high-severity vulnerabilities under active exploitation to its Known Exploited Vulnerabilities catalog. One flaw, tracked CVE-2025-1976 affects Broadcom Brocade Fabric OS, allowing local admin users to execute arbitrary code with root privileges. This vulnerability, found in versions 9.1.0 to 9.1.1d6, is fixed in version 9.1.1d7. The other flaw, tracked CVE-2025-3928 impacts the Commvault Web Server, enabling authenticated remote attackers to create and execute webshells.

No public details on the scale or the actors behind these attacks are available. CISA told federal agencies to apply patches for Commvault by May 17 and for Broadcom by May 19.

WordPress security firm Patchstack uncovered a large-scale phishing campaign targeting WooCommerce users with fake security alerts pushing a bogus “critical patch” that installs a backdoor. Researchers said the campaign closely resembles a similar December 2023 attack, suggesting it’s either the same threat actor or a copycat.

Victims receive phishing emails warning of a fake “Unauthenticated Administrative Access” vulnerability and are urged to download a patch from a spoofed WooCommerce, woocommėrce.com. A downloaded zip file mimics a legitimate plugin but, when installed, creates a hidden admin user and connects to multiple attacker-controlled servers.

The malicious plug-in fetches a second-stage payload containing webshells like P.A.S.-Fork, p0wny and WSO, giving attackers remote access. The malware hides itself from plugin lists and can be used to inject spam, launch DDoS attacks, redirect visitors or extort victims by encrypting server files.

Hitachi Vantara, the IT arm of Japanese multinational news Hitachi, suffered a ransomware attack over the weekend, with its servers taken offline, reported BleepingComputer. The Akira ransomware gang claimed responsibility, allegedly exfiltrating data, including from government-related projects. Hitachi Vantara, which serves clients including T-Mobile, BMW and China Telecom, is investigating the breach with external cybersecurity experts. Self-hosted customer environments remain unaffected.

A former Disney employee, received a three year prison sentence for hacking into the company’s internal servers and tampering with restaurant menus, including falsifying allergen details and inserting profanity.

Michael Scheuer, a former menu production manager, pled guilty to computer fraud and aggravated identity theft and was ordered to pay nearly $690,000 in restitution. After being fired in June 2023, Scheuer accessed Disney’s secure systems multiple times, changing fonts to wingdings, crashing the menu platform and falsely labeling peanut-containing items as peanut-free. He also disrupted operations by locking out employees and using a bot to attempt over 100,000 logins. According to the DOJ, some hacked menus included references to mass shooting locations in wine regions. Disney removed altered menus before distribution.

The Darcula phishing-as-a-service platform introduced generative AI features, enabling cybercriminals to create customized, multi-language phishing pages without coding skills, said Netcraft.

Originally documented in March 2024 report, Darcula uses iMessage and RCS to deliver smishing scams, often impersonating postal services. The platform, tied to the threat actor Larva-246 and promoted via the Telegram channel “darcula_channel,” clones of legitimate websites for phishing.

It shares traits with other PhaaS kits like Lucid and Lighthouse, all part of a broader ecosystem dubbed the Smishing Triad, believed to operate out of China (see: Surge in Smishing Fueled by Lucid PhaaS Platform).

The FBI made public a list of 42,000 domains taken from the servers of now-defunct phishing-as-a-service provider LabHost. An international law enforcement agency took down the site in April 2024, arresting 37 and seizing infrastructure (see: Breach Roundup: LabHost Phishing-as-a-Service Site Goes Down).

Police found more than one million stolen user credentials and nearly 500,000 compromised credit cards, the FBI said in a Tuesday publication. Although the domains are “historical in nature,” they could help defenders through retrospective analysis. “FBI recommends organizations that identify any activity related to these indicators of compromise within their networks act to mitigate or minimize the impact and prepare their environment for incident response.”

Other Stories From Last Week

With reporting from Information Security Media Group’s David Perera in Northern Virginia.