Daily Briefing for 03.28.25

At a glance.

• Mozilla patches Firefox flaw similar to actively exploited Chrome vulnerability.
• Russia-based RedCurl gang deploys ransomware for the first time.
• Ukraine's railway operator recovers from cyberattack.
• Morphing Meerkat's phishing kit abuses DNS mail exchange records.

Mozilla patches Firefox flaw similar to actively exploited Chrome vulnerability.

Mozilla has issued a patch for a critical Firefox vulnerability that could allow attackers to perform sandbox escapes on Windows, the Register reports. The flaw is similar to an actively exploited vulnerability (CVE-2025-2783) patched by Google in the Chrome browser earlier this week. The Chrome vulnerability, which Kaspersky says was being exploited to target Russian entities and individuals, enabled attackers to bypass the browser's sandbox protections as soon as the victim clicked on a phishing link.

Mozilla stated, "Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our inter-process communication (IPC) code. Attackers were able to confuse the parent process into leaking handles to unprivileged child processes leading to a sandbox escape."

Russia-based RedCurl gang deploys ransomware for the first time.

Bitdefender says the Russia-based threat actor "RedCurl," which has been conducting data theft since 2018, has launched its first ransomware campaign. RedCurl is a mysterious group whose motivations are unclear: the threat actor seems to be financially motivated, but there's no evidence that it extorts its victims after stealing their data. Bitdefender hypothesizes that RedCurl is either a mercenary hacker group conducting corporate espionage or that it conducts extortion negotiations discreetly. The researchers note that the former hypothesis "could potentially explain their current interest in ransomware that targets infrastructure, rather than endpoint computers. In a mercenary model, ransomware could serve as a diversion, masking the true objective: a targeted data exfiltration operation."

In this recent campaign, the group deployed a new strain of ransomware dubbed "QWCrypt," targeting only hypervisors. Bitdefender explains, "This focused targeting can be interpreted as an attempt to inflict maximum damage with minimum effort. By encrypting the virtual machines hosted on the hypervisors, making them unbootable, RedCurl effectively disables the entire virtualized infrastructure, impacting all hosted services. Interestingly, they deliberately excluded specific VMs that acted as network gateways, demonstrating their familiarity with the network implementation."

Ukraine's railway operator recovers from cyberattack.

Ukraine's state railway operator, Ukrzaliznytsia, has restored online ticket sales following a cyberattack earlier this week, the Record reports. The incident didn't affect train schedules, but online services were disrupted for several days. The company hasn't shared details on the attack, but said no sensitive information was compromised. Ukraine's Ministry of Justice assisted in the recovery.

Passengers who purchased paper tickets during the cyberattack will be offered free tea onboard.

Morphing Meerkat's phishing kit abuses DNS mail exchange records.

Infoblox has published a report on a phishing kit that uses DNS mail exchange (MX) records to dynamically serve phishing pages that spoof over a hundred brands. MX records specify which mail server is responsible for receiving incoming emails sent to a domain. In this case, the phishing kit uses MX records "to identify the victim’s email service provider and dynamically serve fake login pages." The kit is designed to harvest email user login credentials, and is currently able to impersonate 114 brands.

The threat actor behind this activity, dubbed "Morphing Meerkat," has been peddling its phishing-as-a-service (PhaaS) platform since at least January 2020.