> InfoSec News Nuggets 12/18/2025

CISA Flags Critical ASUS Live Update Flaw After Evidence of Active Exploitation The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability in ASUS Live Update to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. The flaw originated from an earlier supply‑chain compromise and could allow unintended actions on affected systems, prompting urgency ahead of sunset support deadlines.   Attackers Use Stolen AWS Credentials in Cryptomining Campaign Threat actors are leveraging stolen Amazon Web Services (AWS) Identity and Access Management (IAM) credentials to deploy unauthorized crypto mining workloads across customer cloud environments. The campaign uses valid credentials rather than service vulnerabilities, illustrating risks tied to credential exposure and inadequate privilege protections.   GhostPoster Attacks Hide Malicious JavaScript in Firefox Add‑on Logos A new campaign dubbed GhostPoster embeds malicious JavaScript in the display logos of Firefox extensions with tens of thousands of installs. This technique subverts standard review and distribution controls to exfiltrate data and monitor user sessions stealthily.   Netstar Australia Hit by Blackshrantac Ransomware Netstar Australia, a Melbourne based fleet management and GPS telematics provider, has been hit by the Blackshrantac ransomware group in a data extortion attack. The group claims to have stolen sensitive telematics and operational data and is threatening to publish it, highlighting the risks these services pose when they hold detailed location and behavior information for government and critical infrastructure fleets.   SoundCloud Breach Potentially Affects Millions of Accounts SoundCloud confirmed that threat actors accessed an internal service dashboard and exposed user account information, potentially affecting millions of users. The breach disrupted service availability and raised concerns about downstream abuse of exposed profile and contact data, even though passwords and payment information are not believed to be compromised.   PHI Data Breach at NS Support Impacts 92,845 Patients Healthcare provider NS Support LLC reported that an external attacker gained access to its network and removed files containing protected health information for up to 92,845 patients. The exposed data includes names and medical notes created during physician appointments, and the organization has notified federal regulators while working with forensic specialists to investigate and remediate the incident. The post InfoSec News Nuggets 12/18/2025 appeared first on AboutDFIR - The Definitive Compendium Project.