Aggregator
CVE-2025-38747 | Dell SupportAssist OS Recovery up to 5.5.14.0 temp file (dsa-2025-315)
CVE-2025-51058 | Bottinelli Informatical Vedo Suite 2024.17 URL Parameter /api_vedo/video/preview api_vedo File server-side request forgery
CVE-2025-51052 | Bottinelli Informatical Vedo Suite 2024.17 /api_vedo/template file_get_contents path traversal
Click Here to Serve: How Volunteering Builds Cyber Careers
When people think about a career in cybersecurity, they often picture certifications, technical exams and entry-level jobs that require years of preparation. For those coming from non-traditional backgrounds, the journey can feel like a dead end. But what if there were other ways to explore it?
On the Rise: Ransomware Victims, Breaches, Infostealers
Cybercrime so far this year can be summarized as featuring "more of everything," with researchers tracking increases in the number of ransomware and data breach victims, credentials stolen by infostealers, and new vulnerability disclosures with exploits coming to light.
Five-Year-Old D-Link Bugs Under Active Exploitation
Hackers are actively exploiting years-old flaws in obsolete Wi-Fi cameras and video recorders made by D-Link, warn U.S. cybersecurity authorities. Possibly Chinese hackers have used one of the flaws to implant HiatusRAT malware. "Attackers don’t care if a vulnerability is new or old."
MCP Protocol Bug Let Attackers Execute Code in Cursor
Check Point researchers found a RCE flaw in Cursor, an AI-powered code editor, by manipulating a previously approved model context protocol configuration. Once a developer approved a configuration file for an MCP server, any future changes to that file could be executed without further prompts.
Critical Zero-Day Bugs Crack Open CyberArk, HashiCorp Password Vaults
CVE-2025-38746 | Dell SupportAssist OS Recovery up to 5.5.14.0 information disclosure (dsa-2025-315)
CVE-2025-47908 | rs cors up to 1.10.x Access-Control-Request-Headers improperly controlled sequential memory allocation (ID 170)
CVE-2025-51054 | Bottinelli Informatical Vedo Suite 2024.17 API Endpoint /autologin/ access control
CVE-2025-51052 | Bottinelli Informatical Vedo Suite 2024.17 /api_vedo/template file_get_contents path traversal
CVE-2025-6634 | Autodesk 3ds Max up to 2026.1 TGA File Parser buffer overflow
CVE-2025-6633 | Autodesk 3ds Max 2020/2021/2021.3.8/2022/2022.3.3 RBG File Parser out-of-bounds write
CVE-2025-6632 | Autodesk 3ds Max 2020/2021/2021.3.8/2022/2022.3.3 PSD File Parser out-of-bounds
Startup Spotlight: Twine Security Tackles the Execution Gap
Chinese Groups Stole 115 Million US Cards in 16-Month Smishing Campaign
#BHUSA: Security Researchers Uncover Critical Flaws in Axis CCTV Software
Project Red Hook: Chinese Gift Card Fraud at Scale
Project Red Hook is a Homeland Security Investigations operation examining how Chinese Organized Crime is committing wholesale Gift Card Fraud by using Chinese illegal immigrants to steal gift cards, reveal their PIN, reseal the cards, and return them to store racks. When the card is later purchased and activated, operators are standing by to quickly drain the card before the customer can use it. How many cards are we talking about? More than $1 Billion worth!
Here are a few cases of interest to me - especially the first one!
Birmingham, Alabamahttps://www.justice.gov/usao-ndal/pr/chinese-nationals-charged-illegally-possessing-counterfeit-and-unauthorized-gift-cards
25JUN2025 - the Hoover Alabama Police Department put out a BOLO for two Asian males in a gray Lexus SUV with California tag DE53Y62 who were switching gift cards in racks at local CVS stores. Jiadong Cao, 36, and Xuejun Zheng, 48, were stopped and arrested the following day in Pelham, Alabama and found to possess more than 5,000 gift cards. Portions of the gift card numbers had been destroyed on the cards, which would allow the cards to be activated at the register, but not used by the customer who purchased them. 300 altered cards for Home Depot, Amazon, Sephora, Macy's and Nike were found in their car. Home Depot reviewed their cards and confirmed they had not been sold.
The Federal criminal complaint was written up by a former student of mine! USSS Special Agent Scott Easterwood! Jiadong Cao is a Chinese citizen who entered the US in September 2024 and is illegally in the country now. Xuejun Zheng also entered the US in September and has filed for asylum in the US. In the CVS store that started this investigation, they had added altered gift cards to the rack, including six Nike cards, ten Macy's cards, and nine Best Buy cards.
Louisville, Kentucky https://www.wlky.com/article/men-arrested-gift-card-scam-louisville-millions-lost/62673181 19OCT2024 - Kroger security personnel observed Chaoming Lin placing gift cards back on a rack at a store on North Hubbards Lane. He was stopped shortly thereafter by St. Matthews Police, who found him in the car with Zhiqiang Huang. Around 5,000 gift cards were found in a search of the vehicle, with at least 2,000 appearing to have been altered. That same day, Kroger loss prevention reported another instance and that an Asian man was seen leaving in a black Dodge Charger. That car was also stopped with Tianlong Chen and Huixing Yu in the car with several cell phones and 658 gift cards in the car. These four had hit stores in Ohio, Pennsylvania, and New York before being arrested in Kentucky.St. Matthew's Police chief Barry Wilkerson said the gift cards they recovered were worth at least $1 million. Tianlong Chen entered a guilty plea on 11JUL2025 and will remain in custody until sentencing on 16OCT2025.
Gainesville, Florida
https://www.documentcloud.org/documents/24536188-gainesville-case-detailed-arrest-report/
24AUG2024 - The Alachua County Sheriff's office pulled over a Hertz rental vehicle being driven by Cheng Li, 25, with female passenger Jiaxin Jiang, 24. The car was rented by Jiang despite him only possessing a New York Learner's permit. After a narcotics K-9 hit on the car, the car was searched and found to contain 1,764 gift cards from Apple, Target, Visa, Mastercard, and American Express. A GPS review provided by Hertz confirmed that the pair had left Long Island, New York, stopping at two Target stores in Laurel, Virginia, ten Target stores in the Duluth/Atlanta Georgia area, two Target stores in Knoxville, Tennessee, and a Target store in Johnson City, North Carolina before being arrested after a stop at the Target store in Gainesville, Florida. Their mapping software indicated they were headed to a Target store in Ocala, Florida next.
A review of Cheng's cell phones (after a search warrant) revealed that he had been involved in "Target fraud" chats on WeChat since as far back as December 2022. Ledgers on Jiang's computer showed they had been collecting gift card numbers and their associated PINs going back as far as 09AUG2022. WeChat groups retrieved by the phone show groups with as many as 1558 messages and 257 photos with some groups having as many as eleven members who all seemed involved in the same types of activities.
The Chinese language website "https://www.uscardforum.com/t/topic/321165" shared a Chinese version of the traffic stop, complete with opening the trunk and finding the cards!
The couple tell the police they are in Florida because they wanted to see a crocodile!
(Watch on YouTube here: https://www.youtube.com/watch?v=YChGKg2KrDo - jump to 16:40 for the "trunk reveal." )Ventura, California
15MAY2024 - Ventura County detectives are part of the Ventura County Organized Retail Theft Task Force (VCORTTF). They were operating a "blitz" against organized retail crime, deploying detectives in coordination with loss prevention specialists in retail stores. when they arrested Tingxiang Yang, 39, and Lingyu Chen, 35. They were in possession of 800 gift cards stolen from a Moorpark Target store. They were released after posting $20,000 bail.
Ocala, Floridahttps://www.ice.gov/news/releases/chinese-national-pleads-guilty-gift-card-fraud-scheme
17OCT2023 - a police officer in Ocala, Florida arrested Donghui Liao, age 32. Liao was observed taking gift cards from his black shoulder back and placing those gift cards on a gift card display in a Target store. Seventy-one cards on the rack were found to have been altered. The cards had been shop-lifted, scratched to reveal their PIN, "re-silvered" so that they did not appear to have been scratched, and then returned to card racks in stores. Liao was found to be on surveillance camera imagery at stores in Ohio, Georgia, North Carolina, and Florida.
When police searched his car, they found 6,032 additional gift cards with a face value of $1,886,000!
Donghui was sentenced to 33 months in prison with 3 years supervised release to follow.
The post Project Red Hook: Chinese Gift Card Fraud at Scale appeared first on Security Boulevard.