Week of June 9, 2025: SimpleHelp Ransomware Advisory and Zoomcar's 8.4 Million-User Breach

Security leaders tracking the week of June 9, 2025 saw CISA warn that ransomware actors had exploited an unpatched SimpleHelp RMM flaw to compromise a utility billing software provider's customers, while Zoomcar Holdings disclosed a breach exposing personal data of approximately 8.4 million users. CISA also added four vulnerabilities to its Known Exploited Vulnerabilities Catalog and published fourteen Industrial Control Systems advisories, as SecurityWeek reported new CISO and executive appointments at Upwind, SecurityBridge and SimSpace.

CISA Warns of SimpleHelp RMM Ransomware Exploitation

CISA released Advisory AA25-163A on June 12, 2025, describing ransomware actors exploiting unpatched SimpleHelp Remote Monitoring and Management software to compromise a utility billing software provider's downstream customers. The agency said attackers had been leveraging CVE-2024-57727, a path traversal flaw in SimpleHelp versions 5.5.7 and earlier, since January 2025, enabling double extortion compromises. CISA had already added CVE-2024-57727 to its Known Exploited Vulnerabilities catalog on February 13, 2025, and urged vendors and downstream customers to patch immediately or isolate vulnerable servers. (CISA)

CISA Adds Wazuh and WebDAV Flaws to Known Exploited Vulnerabilities Catalog

On June 10, 2025, CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation: CVE-2025-24016, a deserialization flaw in the Wazuh Server, and CVE-2025-33053, an external control of file name or path vulnerability affecting Web Distributed Authoring and Versioning implementations. The agency said both vulnerability types are frequent attack vectors for malicious cyber actors and directed federal civilian agencies to remediate them under Binding Operational Directive 22-01, while urging all organizations to prioritize the fixes. (CISA)

CISA Flags Erlang/OTP and RoundCube Vulnerabilities as Actively Exploited

CISA added two more vulnerabilities to its Known Exploited Vulnerabilities Catalog on June 9, 2025: CVE-2025-32433, a missing-authentication flaw in the Erlang/OTP SSH server, and CVE-2024-42009, a cross-site scripting vulnerability in RoundCube Webmail. The agency again cited active exploitation as the basis for inclusion and noted that such vulnerability classes remain common entry points for malicious actors against federal networks, reiterating its standing guidance that all organizations prioritize remediation of catalog entries as part of routine vulnerability management. (CISA)

Zoomcar Discloses Breach Affecting 8.4 Million Users

Zoomcar Holdings disclosed in a Form 8-K that on June 9, 2025, it identified a cybersecurity incident after employees received external communications from a threat actor claiming unauthorized access to company data. The car-sharing company said a third party accessed a limited dataset covering approximately 8.4 million users, including names, phone numbers, car registration numbers, personal addresses and email addresses, though no evidence emerged of compromised financial information or plaintext passwords. Zoomcar activated its incident response plan and notified regulators and law enforcement. (SEC EDGAR)

Upwind, SecurityBridge and SimSpace Name New Security and Revenue Executives

SecurityWeek's Industry Moves column for the week of June 9, 2025 reported several cybersecurity leadership changes. Cloud security startup Upwind appointed a new chief security officer with prior experience at Twitter, Rubrik and Palo Alto Networks. SAP security firm SecurityBridge named a new chief revenue officer who previously led cyber security enterprise sales for OpenText in Europe. Cybersecurity training and simulation provider SimSpace appointed Peter Lee as chief executive officer, with company co-founder William Hutchison remaining on the board of directors. (SecurityWeek)

CISA Publishes Ten Industrial Control Systems Advisories

CISA released ten Industrial Control Systems advisories on June 12, 2025, covering products from Siemens and AVEVA along with pan-tilt-zoom camera equipment. The advisories spanned Siemens Tecnomatix Plant Simulation, SCALANCE and RUGGEDCOM networking gear, and the SIMATIC S7-1500 CPU family, as well as AVEVA's PI Data Archive, PI Web API and PI Connector for CygNet products. CISA encouraged asset owners and administrators to review the advisories for technical details and mitigations relevant to critical infrastructure environments. (CISA)

CISA Issues Four More ICS Advisories Covering Hitachi Energy and Medical Imaging Software

CISA released four Industrial Control Systems advisories on June 10, 2025, addressing security issues in the SinoTrack GPS Receiver, Hitachi Energy's Relion 670, 650 and SAM600-IO series protection relays, the MicroDicom DICOM Viewer medical imaging software, and an updated advisory for the Assured Telematics Fleet Management System. CISA encouraged users and administrators to review the advisories for technical details and mitigations applicable to their environments. (CISA)