Digital Forensics Magazine — 48h News Roundup

Window: 22-12-2025 08:54 to 24-12-2025 08:54 (UTC)

Snapshot Summary

Sector / Section	Headline Highlights	Count
DFIR & Incident Response	NHS supplier ransomware containment; Romanian water agency BitLocker recovery	2
Cyber Investigations	Coupang securities suit over breach; French prosecutors probe La Poste attack	2
Major Cyber Incidents	Kuaishou livestream hijack; La Poste DDoS outage; Nissan data exposed via Red Hat	3
Exploits & Threat Intelligence	WatchGuard RCE under exploitation; Malicious npm WhatsApp library; Notarized MacSync dropper; New Year lure phishing	4
Law Enforcement	INTERPOL Operation Sentinel arrests; US bank-account takeover disruption; Nefilim affiliate guilty plea	3
Policy	UK cyber resilience bill response; Korea face-scan SIM rule; US foreign-drone import ban	3
Standards & Compliance	NIST draft on token protection; ISO/IEC 27701 privacy certification milestone	2
Consumer App Data Leaks	Aflac breach impact expands; Baker University breach notifications	2

Digital Forensics & Incident Response

NHS England tech provider DXS International confirms ransomware incident — DXS International disclosed a ransomware attack detected on 14-12-2025 that affected internal office servers while clinical services remained operational, with external responders engaged and regulators notified (23-12-2025) [EMEA]. For DFIR teams, the case reinforces rapid segregation of business systems from service delivery, disciplined evidence preservation for extortion claims, and early coordination with sector bodies to manage downstream supplier risk and notification obligations (Source: TechRadar, 23-12-2025).

Romanian Waters confirms ransomware using BitLocker; operations continue — Romania’s national water administration confirmed a ransomware event that encrypted endpoints with BitLocker and disrupted IT across regional offices while water operations stayed up, with national responders advising against engagement with attackers (23-12-2025) [EMEA]. Responders can use this as a playbook for critical infrastructure: prioritize OT/IT separation validation, restore identity and endpoint trust chains, and collect ransom-note and disk-state artefacts to support attribution, reporting, and hardening against repeat access (Source: Security Affairs, 23-12-2025).

Cyber Investigations

Coupang faces U.S. securities class action tied to disclosed customer data exposure — Investors filed a U.S. securities class action alleging Coupang misled markets about cyber risk controls and disclosure timing after a breach discovered on 18-11-2025 exposed customer profile and order data, with parallel scrutiny continuing in South Korea (22-12-2025) [AMER]. For investigators, the pleadings spotlight how incident timelines, internal control attestations, and post-breach comms become discoverable artefacts—making log retention, executive briefing notes, and disclosure decision records pivotal evidence (Source: Reuters, 22-12-2025).

French prosecutors investigate DDoS disruption impacting La Poste and La Banque Postale — A cyberattack described as a DDoS knocked key online services offline at La Poste and its banking arm during the Christmas rush, triggering an investigation under Paris prosecutors while service restoration continued (23-12-2025) [EMEA]. For investigative teams, the incident underlines the need to preserve upstream telemetry (CDN/WAF logs, peering data, bot signatures) and to correlate customer-impact windows with infrastructure-layer indicators to distinguish nuisance flooding from diversionary activity (Source: AP News, 23-12-2025).

Major Cyber Incidents

Kuaishou livestreaming service hit by cyberattack; recovery underway — Kuaishou said a cyberattack around 22:00 local time disrupted livestreaming and triggered an emergency response plan, with gradual restoration and reports of abusive content surfacing as the company notified police and regulators (23-12-2025) [APAC]. For cyber responders, the event highlights platform integrity controls—rapid revocation of compromised publishing keys, real-time content pipeline forensics, and post-incident hardening of account/session security to prevent repeat hijacks (Source: Reuters, 23-12-2025).

DDoS incident disrupts France’s postal and banking online services — France’s La Poste reported a DDoS that made online services inaccessible and delayed tracked-package workflows while La Banque Postale’s online banking was also impaired, with officials stating customer data was not impacted (23-12-2025) [EMEA]. For incident leads, this is a reminder to treat DDoS as a resilience and fraud-risk event: monitor for parallel credential stuffing, protect payment flows, and validate incident claims with independent network evidence (Source: AP News, 23-12-2025).

Nissan confirms customer data exposure tied to Red Hat GitLab compromise — Nissan said roughly 21,000 customers were affected after unauthorized access to a self-managed GitLab instance used by a Red Hat consulting team led to data theft, extending fallout from the earlier Red Hat breach (23-12-2025) [APAC]. For enterprises, the incident reinforces third-party SDLC visibility: audit shared dev platforms, rotate secrets and tokens rapidly, and verify data minimization in partner repositories to limit breach blast radius (Source: SecurityWeek, 23-12-2025).

Exploits & Threat Intelligence

WatchGuard updates advisory for exploited Firebox IKEv2 RCE (CVE-2025-14733) — WatchGuard updated its PSIRT advisory for CVE-2025-14733, a critical unauthenticated RCE affecting Fireware OS VPN configurations, after confirming real-world exploitation and publishing patched firmware guidance (23-12-2025) [AMER]. For defenders, this is high-priority perimeter triage: hunt for anomalous IKE/iked behavior, validate firmware provenance, and treat suspected compromise as requiring credential and configuration integrity checks beyond simple patch-and-reboot (Source: WatchGuard PSIRT, 23-12-2025).

Malicious npm package masquerades as WhatsApp API to steal chats and hijack accounts — Researchers flagged a malicious npm package posing as a WhatsApp Web API library that siphons messages and contacts and can persist by abusing the device-linking flow after victims install it in development environments (22-12-2025) [AMER]. This matters because software supply-chain telemetry is now IR-critical: lock down dependency controls, monitor build pipelines for unexpected outbound traffic, and add automated detection for typosquatting and token exfiltration in CI logs (Source: BleepingComputer, 22-12-2025).

Notarized MacSync dropper shifts macOS infection chain to bypass Gatekeeper friction — A new MacSync delivery method uses a code-signed and notarized Swift app to reduce user friction and evade common macOS trust prompts while deploying an information-stealing payload (22-12-2025) [AMER]. For SOC and DFIR teams, prioritize Apple notarization trust analytics, tighten application allowlisting, and capture installer metadata and execution traces quickly—signed droppers can blend into normal endpoint software inventories (Source: BleepingComputer, 22-12-2025).

Cyber spies use New Year concert invites as lures in targeted phishing — A reported espionage campaign used themed New Year concert invitations to lure targets, illustrating continued refinement of social-engineering tradecraft around seasonal events and trusted cultural hooks (22-12-2025) [EMEA]. For threat hunters, the takeaway is to baseline “event invite” attachment behaviors, enforce macro and link-sandboxing controls, and preserve email headers and file hashes early to support clustering against known actor TTPs (Source: The Record, 22-12-2025).

Law Enforcement

INTERPOL-backed Operation Sentinel reports hundreds of arrests and multiple decryptors — Operation Sentinel, coordinated with INTERPOL, reported 574 arrests across 19 countries and the recovery of funds linked to BEC, extortion, and ransomware, alongside the release of decryptors for several ransomware strains (22-12-2025) [EMEA]. For practitioners, this affects live cases: refresh victim comms with new decryption options, validate decryptor integrity in controlled labs, and track seized infrastructure indicators that may map to active affiliate ecosystems (Source: BleepingComputer, 22-12-2025).

U.S. disrupts bank account takeover operation targeting Americans — U.S. authorities disrupted an operation described as targeting Americans through large-scale bank account takeovers, according to reporting that cites a coordinated enforcement action and victimization at meaningful scale (23-12-2025) [AMER]. The operational lesson is practical: financial-sector defenders should cross-check IOC releases, tighten beneficiary-change workflows, and preserve authentication and device-fingerprint logs to accelerate recovery and support follow-on prosecutions (Source: The Record, 23-12-2025).

Nefilim ransomware affiliate pleads guilty to computer fraud in New York — A former ransomware hacker tied to Nefilim pleaded guilty to a computer fraud charge in the Eastern District of New York following extradition, closing a case tied to attacks on organizations in multiple countries (22-12-2025) [AMER]. For DFIR teams, court filings often surface valuable artifacts—TTP summaries, infrastructure, and monetization flows—so track docket updates and map disclosed indicators into detection engineering and retrospective hunting (Source: The Record, 22-12-2025).

Policy

UK ICO publishes response around Cyber Security and Resilience Bill — The UK Information Commissioner’s Office published its response to the Cyber Security and Resilience (NIS) Bill, framing expectations for stronger cyber resilience measures that ultimately protect people’s data as the legislation progresses (23-12-2025) [EMEA]. For security leaders, this signals tighter governance alignment between cyber controls and data protection outcomes, so evidence-ready risk assessments, supplier oversight, and incident reporting workflows should be treated as regulatory-critical (Source: ICO, 23-12-2025).

South Korea moves to require facial verification for new mobile numbers — South Korea announced plans to require face scans when obtaining new mobile numbers, citing pervasive stolen personal data and the downstream abuse of SIMs in fraud and account takeover ecosystems (22-12-2025) [APAC]. This policy matters to defenders because telecom identity controls directly affect MFA resilience; anticipate attacker migration to synthetic identity and mule channels, and review onboarding and recovery paths for “SIM-linked” account security (Source: The Register, 22-12-2025).

FCC places foreign-made drones on Covered List, restricting new imports — The U.S. FCC added foreign-made drones and components to its Covered List, restricting new imports unless cleared by defense agencies, citing national security risks including surveillance and data exfiltration concerns (22-12-2025) [AMER]. For enterprises and public safety operators, the decision reshapes procurement and fleet lifecycle planning, so inventory affected systems, verify update and telemetry controls, and document compensating safeguards for any grandfathered platforms (Source: The Verge, 22-12-2025).

Standards & Compliance

NIST issues draft guidance on protecting identity tokens and assertions — NIST published the initial public draft of IR 8587 with implementation recommendations to protect tokens and assertions from forgery, theft, and misuse across agencies and cloud service providers (22-12-2025) [AMER]. This is directly actionable for IAM programs: align signing and key management practices, reduce replay risk, and validate session-bound token controls—then feed gaps into audit evidence and cloud shared-responsibility documentation (Source: NIST CSRC, 22-12-2025).

Precisely announces ISO/IEC 27701 certification for privacy information management — Precisely announced completion of ISO/IEC 27701 certification covering software, services, and SaaS/hosted platforms as part of its global privacy framework and audited operating scope (23-12-2025) [AMER]. For buyers and compliance teams, this is a useful due-diligence signal—request the certification scope and statement of applicability, map it to your data processing inventory, and confirm how subcontractors and support operations are governed (Source: Precisely, 23-12-2025).

Consumer App Data Leaks

Aflac breach impact expands to more than 22 million customers — New reporting said more than 22 million Aflac customers were impacted by a June data breach, indicating a large-scale consumer data exposure with ongoing notification and remediation implications (23-12-2025) [AMER]. For incident responders and privacy teams, large retroactive impact assessments demand rigorous identity correlation: validate affected population logic, preserve evidence for regulator queries, and tune fraud monitoring for reused identifiers across insurance and finance ecosystems (Source: The Record, 23-12-2025).

Baker University says prior-year intrusion exposed data for 53,000 people — Baker University disclosed that attackers accessed its network about a year earlier and stole personal, health, and financial information affecting more than 53,000 individuals, prompting breach notifications and follow-up actions (23-12-2025) [AMER]. The takeaway for defenders is the cost of delayed detection: strengthen long-retention logging, ensure EDR coverage across legacy systems, and rehearse historical incident reconstruction so late-discovered events still produce defensible timelines and containment evidence (Source: BleepingComputer, 23-12-2025).

Editorial Perspective

This cycle underscores how “routine” disruptions—DDoS against national services, supplier ransomware, and platform hijacks—still generate complex forensic workloads when continuity pressures collide with public reporting expectations.

At the same time, the threat surface continues to shift left: malicious packages and notarized droppers show why DFIR can’t be separated from build pipelines and endpoint trust ecosystems.

Policy and standards signals are tightening the loop between cyber controls and evidentiary readiness, so teams that can prove timelines, controls, and third-party governance will move faster in both containment and accountability.

Reference Reading

• WatchGuard PSIRT: WGSA-2025-00027 (CVE-2025-14733)
• NIST IR 8587 (IPD): Protecting Tokens and Assertions
• Malicious npm package steals WhatsApp accounts and messages
• Operation Sentinel: arrests and ransomware decryptors
• ICO: Response to the Cyber Security and Resilience Bill
• France: La Poste and La Banque Postale disruption investigation

Tags

ransomware, BitLocker, DDoS, supply-chain security, npm, macOS malware, VPN RCE, incident response, cyber policy, NIS regulation, token security, ISO/IEC 27701