NEWS ROUNDUP – 13th August 2025 – Digital Forensics Magazine

🔍 Digital Forensics & Incident Response Insights

BadCam turns Linux webcams into persistent BadUSB tools: Eclypsium’s DEF CON research shows certain webcams can be reflashed for keystroke injection and persistence—expanding DFIR scope to peripheral firmware and chain-of-custody checks. (SecurityWeek)
Research details and mitigation for BadCam: Technical write-up with firmware risks, demo scenarios, and practical detection/containment recommendations for incident responders. (Eclypsium)
Vendor firmware update released for impacted webcams: Report highlights CVE-2025-4371 and a Lenovo firmware fix; reinforces DFIR playbooks for imaging/testing USB peripherals post-incident. (TechRadar)

Microsoft Patch Tuesday (Aug 2025): 107 flaws fixed, 1 zero-day: Prioritize Kerberos, RCE, and critical components; validate coverage across servers/endpoints and verify successful remediation. (BleepingComputer)
Windows message center confirms August security update: Official release-health notes for rollout states and known issues—useful for IR teams coordinating change windows. (Microsoft)
3,000+ NetScaler devices still unpatched against CitrixBleed-2: Active exploitation persists; validate session hijack exposure and review appliance hardening. (BleepingComputer)
ICS Patch Tuesday: Siemens, Schneider, ABB & others ship fixes: Multiple code-execution issues in OT/ICS stacks—coordinate with operations for safe windows and post-patch monitoring. (SecurityWeek)

Interlock claims attack on City of Saint Paul (US): Gang adds 43GB of alleged city data to its leak site; officials confirm disruption, data exposure under review. (The Record)
Saint Paul confirms Interlock involvement: Mayor says no resident financial data impacted; city refuses to pay ransom as leak begins. (BleepingComputer)
Allianz Life data leaked in Salesforce attack wave: 2.8M records tied to partner/customer data reportedly exposed as threat actors expand Salesforce-focused intrusions. (BleepingComputer)
Manpower discloses breach impacting ~145,000 people: Staffing giant begins notifications after late-2024 compromise; underscores long dwell time and delayed discovery risks. (BleepingComputer)

DOJ: Disruption actions against BlackSuit (Royal) ransomware: Takedown includes server/domain seizures and ~$1M crypto; reinforces ongoing pressure on affiliate ecosystems. (US DOJ)
Coverage: $1M in crypto tied to BlackSuit seized: Additional reporting on scope/impact of coordinated action and reminder that gangs often rebrand post-takedown. (Axios)

US judiciary breach prompts calls for tighter court cyber rules: Fresh reporting ties the long-running US federal courts compromise to Russia and highlights deficiencies in legacy systems and controls. (Reuters)
UK: Cyber financial sanctions list updated: OFSI re-confirms that facilitating ransomware payments to designated persons risks civil/criminal penalties; page updated Aug 12. (UK HMT/OFSI)

OT/ICS vendors issue Patch Tuesday advisories: Coordinated updates from Siemens, Schneider, ABB, Honeywell, Phoenix Contact, etc.—track SBOM changes and compensating controls during rollout. (SecurityWeek)
Enterprise Windows security updates available: Align workstation/server baselines with the latest release-health guidance; ensure rollback plans and monitoring. (Microsoft)

Section	Highlight	Why it matters
DFIR & IR	BadCam peripheral persistence	Extend evidence collection to USB firmware; update IR playbooks for device reflashing risks.
Exploits & TI	Patch Tuesday + CitrixBleed-2 exposure	Prioritize Kerberos/critical RCEs; audit NetScaler sessions and enforce appliance hardening.
Major Incidents	Saint Paul ransomware; Allianz data leak	Municipal ops disruption and SaaS data theft highlight recovery + third-party risk.
Law Enforcement	BlackSuit disruption actions	Pressure on affiliates continues; anticipate rebrands and copycats.
Policy	US court breach scrutiny; UK sanctions update	Expect stronger judiciary controls; keep ransom-payment legal exposure in view.
Standards	ICS + Windows security releases	Coordinate OT/IT patch windows; validate telemetry and fallback plans.

Peripherals are part of the battleground. BadCam shows DFIR must include firmware checks on “innocent” USB devices (webcams, docks, hubs) for persistence.
Appliance risk remains acute. Citrix/NetScaler exposure and ICS advisories reinforce the need for appliance inventory, session hygiene, and segmentation.
Ransomware pressure ≠ resolution. BlackSuit disruption helps, but affiliates pivot quickly—tighten initial access controls and backup isolation to blunt rebrands.
Policy teeth are sharpening. Sanctions and potential judicial system reforms raise the cost of weak controls and illegitimate payments.