Daily Briefing for 03.07.25

At a glance.

• Law enforcement shutters Garantex crypto exchange.
• NTT discloses breach affecting corporate customers.
• Malvertising campaign hits nearly a million devices.
• Botnets exploit critical IP camera vulnerability.

Law enforcement shutters Garantex crypto exchange.

The US Secret Service, working with international law enforcement partners, has seized domains used by the Russian cryptocurrency exchange Garantex, which was frequently used by ransomware gangs for money laundering. A Secret Service spokesperson told The Register, "The US Secret Service has seized website domains associated with the administration and operation of Russian cryptocurrency exchange Garantex as part of an ongoing investigation. We are unable to provide additional comments at this time and will release additional information when available."

A notice on the exchange's website states, "The domain for Garantex has been seized by the United States Secret Service pursuant to a seizure warrant obtained by the United States Attorney's Office for the Eastern District of Virginia under the authority of 18 U.S.C §§ 981 and 982."

Stablecoin operator Tether has also blocked Garantex wallets as a result of EU sanctions levied last week.

NTT discloses breach affecting corporate customers.

Japanese telecom giant NTT Communications Corporation has disclosed a breach that affected nearly 18,000 of its corporate customers, BleepingComputer reports. The breach, which was discovered in February, affected names, contract numbers, phone numbers, email addresses, physical addresses, and service usage information. The hackers gained access to NTT's Order Information Distribution System, which holds information on corporate customers. NTT says some of the information "might have been leaked externally."

Malvertising campaign hits nearly a million devices.

Microsoft says a malvertising campaign impacted nearly one million devices around the world, originating on illegal streaming websites. Malvertising redirectors on these sites sent users to a GitHub repository designed to trick them into installing malware as part of a tech support scam.

Microsoft states, "Once the redirection to GitHub occurred, the malware hosted on GitHub established the initial foothold on the user’s device and functioned as a dropper for additional payload stages and running malicious code. The additional payloads included information stealers to collect system and browser information on the compromised device, of which most were either Lumma stealer or an updated version of Doenerium."

Botnets exploit critical IP camera vulnerability.

The US Cybersecurity and Infrastructure Security Agency (CISA) has published an advisory on an actively exploited vulnerability (CVE-2025-1316) affecting Edimax IP cameras. The flaw can lead to remote code execution, and received a CVSS score of 9.3.

SecurityWeek reports that multiple Mirai-based botnets are exploiting the vulnerability. Researchers at Akamai, who discovered the flaw, told SecurityWeek that attackers have been exploiting it since fall of last year.