Week of March 24, 2025: Oracle Cloud breach samples check out, and Chrome fixes a sandbox escape zero-day

What mattered to security leaders in the week of March 24, 2025? Several companies confirmed to BleepingComputer that data samples from an alleged breach of Oracle Cloud's federated login servers were genuine, even as Oracle denied any Oracle Cloud breach, and Google patched a Chrome sandbox escape that Kaspersky caught being exploited against Russian targets. Wiz also disclosed IngressNightmare, a set of ingress-nginx flaws it said left about 43% of cloud environments exposed to Kubernetes cluster takeover.

Companies confirm leaked data from the alleged Oracle Cloud breach

A threat actor calling themselves rose87168 claimed the previous week to have breached Oracle Cloud's federated SSO login servers and offered authentication data and encrypted passwords for 6 million users, releasing a list of 140,621 domains said to be affected. Oracle told BleepingComputer there had been no breach of Oracle Cloud. On March 26 BleepingComputer reported that multiple companies, speaking anonymously, confirmed that LDAP display names, email addresses and other details in samples were accurate. Oracle customers had reason to rotate SSO and LDAP credentials regardless of the dispute. (BleepingComputer)

Google patches a Chrome sandbox escape used against Russian targets

Google began rolling out Chrome 134.0.6998.178 for Windows to fix CVE-2025-2783, an incorrect handle issue in the Mojo IPC framework that let attackers bypass the browser sandbox. Kaspersky researchers found it being exploited, alongside a separate remote code execution exploit, by a suspected state-sponsored group targeting media outlets and educational institutions in Russia; victims were hit simply by opening a phishing link in Chrome. Because the escape was paired with a second exploit, browser patch speed was the practical defense. (Help Net Security)

IngressNightmare flaws put Kubernetes clusters at risk of takeover

Wiz disclosed several critical vulnerabilities in the Ingress NGINX Controller for Kubernetes. The worst, CVE-2025-1974, rated 9.8 on CVSS, lets anything on the pod network abuse the controller's validating admission feature and, combined with configuration injection bugs, run code in the controller. Wiz estimated about 43% of cloud environments were vulnerable and found more than 6,500 clusters, including at Fortune 500 companies, exposing vulnerable admission controllers to the internet. Platform teams needed to confirm which ingress controller they actually run. (Help Net Security)

CISA analyzes RESURGE malware on Ivanti Connect Secure appliances

On March 28 CISA published a malware analysis report on RESURGE, a variant tied to exploitation of CVE-2025-0282, a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure and ZTA Gateways. RESURGE shares SPAWNCHIMERA's ability to survive reboots and adds commands to create web shells, manipulate integrity checks, harvest credentials and copy a web shell to the running boot disk. The report includes YARA and SIGMA detection content, useful for teams that patched but never checked for persistence. (CISA)

UK NCSC publishes security guidance for domain and DNS registrars

The UK National Cyber Security Centre released guidance for domain registrars and DNS operators on reducing malicious registrations used for malware, phishing and botnets. It asks them to limit registration of misleading domains, speed takedowns, help customers secure their registrations, and apply automated checks at sign-up, such as validating contact and payment details against prior fraud reports. Brand protection teams can cite it when pressing registrars to act on lookalike domains. (Help Net Security)

FamousSparrow resurfaces in a US financial-sector trade group

ESET said it found tools of FamousSparrow, a China-aligned espionage group with no documented activity since 2022, while remediating a compromise at a US trade group in the financial sector. The network held two previously undocumented versions of the group's SparrowDoor backdoor, and ESET linked the same campaign to a research institute in Mexico, both breached in late June 2024. Groups presumed dormant can return with retooled malware. (Help Net Security)

CrushFTP warns of a critical unauthenticated access flaw

CrushFTP fixed CVE-2025-2825, a critical flaw that could let remote, unauthenticated attackers access internet-facing servers through an exposed HTTP(S) port, releasing versions 11.2.3 and 10.8.3. The company said its DMZ feature mitigates the issue. No active exploitation or public proof of concept had been reported as of March 27, but managed file transfer products have repeatedly drawn ransomware gangs. (Help Net Security)