May 19th, 2025

One source details a global cyberespionage campaign called 'RoundPress', attributed with medium confidence to the Russian state-sponsored hackers APT28. This campaign targeted government webmail servers in various countries by exploiting XSS vulnerabilities in products like Roundcube, Horde, MDaemon, and Zimbra to steal credentials and email content. Another source describes a new tool named 'Defendnot' that can disable Microsoft Defender on Windows devices. This tool functions by registering a fake antivirus product using an undocumented Windows Security Center API and injecting a DLL into a trusted system process to bypass security checks. A separate source reports on a data breach at Nova Scotia Power, a Canadian utility, where hackers stole sensitive customer data including personal information, account history, and in some cases, bank account and Social Insurance Numbers. The company discovered the unauthorized access and later confirmed the data theft, offering credit monitoring services to affected customers.