> InfoSec News Nuggets 01/02/2025

European Space Agency Confirms Cyber Breach After Hacker Claims System Access The European Space Agency acknowledged a security incident involving servers outside its corporate network after a threat actor known as ‘888’ claimed on BreachForums to have accessed ESA systems for approximately one week. The affected servers supported unclassified collaborative engineering activities within the scientific community, and ESA says only a very small number of external systems were compromised. The agency is conducting forensic investigations and working to secure affected devices.   Two Former Cybersecurity Professionals Plead Guilty to BlackCat Ransomware Involvement Ryan Clifford Goldberg, a former Sygnia incident response manager, and Kevin Tyler Martin, previously with DigitalMint, admitted to conspiracy to obstruct commerce by extortion for their roles as BlackCat (ALPHV) ransomware affiliates. The pair targeted U.S. organizations across pharmaceutical, engineering, healthcare, and drone manufacturing sectors between May and November 2023, with ransom demands ranging from $300,000 to $10 million. Both face sentencing in March 2026 and could receive up to 20 years in prison, highlighting the growing insider threat where trusted cybersecurity expertise is exploited for criminal purposes.   Critical GNU Wget2 Vulnerability Enables Remote File Overwrite Attacks Security researchers disclosed CVE-2025-69194, a high-severity path traversal vulnerability in GNU Wget2 with a CVSS score of 8.8. The flaw stems from improper validation of file paths in Metalink documents, allowing attackers to craft malicious Metalink files that escape intended download directories and overwrite critical system files. This could lead to data loss, system crashes, or execution of malicious code when the tool runs affected scripts automatically. Organizations relying on Wget2 for automated downloads should patch immediately.   Covenant Health Data Breach Affects 478,000 Individuals Covenant Health, Inc. informed authorities that a data breach discovered in May 2025 has impacted more than 478,000 individuals. The healthcare provider is notifying affected patients as investigations continue into the scope and nature of the compromised information. This incident adds to the mounting healthcare sector breaches that continue to expose sensitive medical and personal data.   700Credit Breach Exposes Social Security Numbers of Over 108,000 South Carolina Residents The South Carolina Department of Consumer Affairs disclosed that 108,829 state residents were affected by a 700Credit data breach involving unauthorized access to the company’s web application. Compromised data includes names, addresses, birth dates, and Social Security numbers. The company, which provides credit reporting services to car dealerships nationwide, detected suspicious activity in late October and has found no evidence of actual misuse but is offering free credit monitoring services to affected individuals through Cyberscout. The post InfoSec News Nuggets 01/02/2025 appeared first on AboutDFIR - The Definitive Compendium Project.