Weekly Axis Of Easy #421
Last Week’s Quote was: “People who think they know everything are a great annoyance to those of us who do,” was by Isaac Asimov. Bill got it! Congrats.
This Week’s Quote: “The object of life is not to be on the side of the majority, but to escape finding oneself in the ranks of the insane.” By ???
THE RULES: No searching up the answer, must be posted at the bottom of the blog post, in the comments section.
The Prize: First person to post the correct answer gets their next domain or hosting renewal on us.
This is your easyDNS #AxisOfEasy Briefing for the week of October 6th, 2025 our Technology Correspondent Joann L Barnes and easyCEO Mark E. Jeftovic send out a short briefing on the state of the ‘net and how it affects your business, security and privacy.
To Listen/watch this podcast edition with commentary and insight from Joey and Len the Lengend click here.
In this issue:
- Vendor Breach Exposes Discord Support Data and ID Images
- India Turns Every Face and Finger into a Payment Key
- Airport Outage Sparks Delays as CBSA Rules Out Cyberattack
- Chinese Hackers Turn Open Source Monitoring Tool into Global Malware Delivery System
- Guelph Woman Loses Savings in Fake Doug Ford Cryptocurrency Scam
- Fake Toronto Police Calls Targeting Local Residents
Elsewhere Online:
- Medusa Ransomware Actively Exploiting Critical GoAnywhere MFT Flaw
- Qilin Ransomware Group Claims Theft of 27 GB of Data from Asahi Group
- Clop Hackers Leverage Critical Zero-Day Vulnerability in Oracle EBS
- German Government Blocks EU Mass Surveillance Law Over Privacy Concerns
- Cyberattack on Supplier Steals Names and Vehicle Data from Renault Customers
Vendor Breach Exposes Discord Support Data and ID Images
Discord disclosed a data breach on September 20 involving a third-party vendor supporting its Customer Support and Trust & Safety teams. The attacker, seeking extortion, accessed data from a limited number of users who had contacted support, including names, usernames, email and contact info, IP logs, payment type, last four digits, purchase history, and support messages or attachments. Crucially, a small number of government-issued ID images—submitted for age appeals—were also compromised. Missing entity: the age appeal process, a compliance mechanism triggered by users disputing Discord’s automated age restrictions. The breach didn’t affect Discord’s internal systems, passwords, physical addresses, full credit card numbers, or unrelated user activity. Discord revoked vendor access, initiated incident response protocols, hired forensic experts, and notified law enforcement. Affected users will receive emails from noreply@discord.com only. The incident underscores the risks of online ID verification mandates, where IDs, unlike passwords, can’t be changed, and third-party vendors remain the softest targets.
Read more at Reclaim The Net
India Turns Every Face and Finger into a Payment Key
India will allow biometric authentication—facial recognition and fingerprints—for instant payments on its Unified Payments Interface (UPI) starting October 8, according to three anonymous sources. This leapfrogs the traditional numeric PIN and leans on Aadhaar, the government’s unique ID system housing citizens’ biometric data. It’s a pivot enabled by recent Reserve Bank of India guidelines endorsing alternative authentication methods, and it situates UPI’s operator, the National Payments Corporation of India (NPCI), at the intersection of fintech ambition and state-backed digital identity. The feature’s debut is timed to coincide with the Global Fintech Festival in Mumbai, where NPCI plans a demonstration, though it declined Reuters’ request for comment. The unnamed sources—restricted from public disclosure—underscore both the secrecy and regulatory choreography involved. This isn’t just a new feature; it’s a structural bet on India’s biometric infrastructure and its fusion with digital payments architecture, turning every fingerprint into a PIN and every face into a wallet.
More via Reuters
Airport Outage Sparks Delays as CBSA Rules Out Cyberattack
On Sept. 28th, chaos erupted in several Canadian airports as CBSA-maintained border control kiosks went down, paralyzing passenger flow at Toronto Pearson and Billy Bishop. Primary Inspection Kiosks failed nationwide, stranding travelers and stalling customs processing. A WestJet passenger reported sitting on the tarmac at Pearson for over an hour; WestJet responded that customs was at full capacity and deplaning was paused. The disruption triggered fears of a cyberattack, but CBSA denied any external interference. According to CityNews, “Meanwhile, CBSA says the outage was due to unforeseen technical problems during routine systems maintenance.” (Our money is on DNS).
The technical failure affected both traveler and commercial traffic, though systems and volumes have since returned to normal. CBSA is expected to deliver a formal report on the incident within 30 days to the Minister of Public Safety.
More via Toronto City News
Chinese Hackers Turn Open Source Monitoring Tool into Global Malware Delivery System
Chinese-linked threat actors hijacked Nezha, an open-source monitoring tool, to deploy Gh0st RAT in a targeted campaign disclosed by Huntress in August 2025. Initial access was gained via an exposed phpMyAdmin panel, whose language was set to Simplified Chinese before attackers enabled general query logging and injected a one-liner PHP web shell into the log file, renamed with a .php extension for execution.
The shell, controlled via ANTSWORD, enabled execution of whoami, privilege escalation, and deployment of the Nezha agent, which connected to external C2 server c.mid[.]al. The agent launched PowerShell to disable Microsoft Defender Antivirus via exclusions and trigger a loader-dropper chain culminating in Gh0st RAT execution. Over 100 machines were compromised, primarily in Taiwan, Japan, South Korea, and Hong Kong, with victims also in India, Malaysia, Singapore, Ireland, France, Colombia, Kenya, and others. Intriguingly, the attackers’ Nezha dashboard ran in Russian, suggesting misdirection or multi-national capabilities.
More here: Hacker News
Guelph Woman Loses Savings in Fake Doug Ford Cryptocurrency Scam
A woman in Guelph, Ontario lost $90,000 USD after seeing a fake social media ad falsely claiming Ontario Premier Doug Ford was launching a cryptocurrency to help Canadians. Enticed, she invested $350 and was soon contacted by individuals impersonating an investment firm, urging repeated contributions. Her attempts to withdraw were blocked by demands for additional “fees.” She reported the incident to the Guelph Police Service on Wednesday (exact date not disclosed). Authorities warned that cryptocurrency scams—especially those masquerading as government-endorsed initiatives—are difficult to investigate and offer almost no chance of fund recovery. They stressed the importance of independent research before investing. The Canadian Anti-Fraud Centre (CAFC) urges all victims, including those without financial loss, to report incidents via their website or by calling 1-888-495-8501. Missing but now identified: the scam was online, investment-themed, and fee-based; the scam’s medium was social media; and the relevant reporting agency is CAFC, not just local police.
More at CP24
Fake Toronto Police Calls Targeting Local Residents
This afternoon I received a call displaying the number 416-808-5200
In Toronto, 808 is the exchange for Toronto Police Services, and the XX00 is the main switchboard for each precinct.
So 808-5200 is 52 Division (I do not live in 52 division).
After answering the call a woman identified herself with the totally not-made-up-sounding name “Detective Jacobs” and when I asked for her badge number she said “30304” (seems legit).
The reason for her call was that she had “somebody in custody who was in possession of a laptop having information that ties back to you.”
She then went on to tell me I could “google the number she was calling from to verify that she really was calling from the TPS 52 Division”.
If you get a call like this and you don’t already know it’s fake from the word go – the next move isn’t to google the phone number.
You tell the caller you will call the TPS switchboard and have them reconnect your call. She didn’t want me to do this “because it would take unnecessary extra time.” Sure thing Detective… (checks notes) Jacobs.
I knew 52 Division’s number already and I did recognize it – but here’s the thing: any VOIP client or softphone can force the number to display as anything you want.
The only way to truly verify is to lookup Toronto Police Services – 52 Division (not the number itself) – and then call that number back.
I already knew this was fake, but I called the division anyway, and was bemused that the main voice greeting was a recorded message about exactly this: somebody is targeting Toronto residents by spoofing the TPS phone numbers and pretending to be police detectives.
What the actual scam is, I don’t know, I didn’t hang on the call long enough. Just be aware.
– mark
Elsewhere Online:
Medusa Ransomware Actively Exploiting Critical GoAnywhere MFT Flaw
Read: https://hackread.com/medusa-ransomware-goanywhere-mft-flaw-microsoft/
Qilin Ransomware Group Claims Theft of 27 GB of Data from Asahi Group
Read: https://www.infosecurity-magazine.com/news/qilin-ransomware-asahi-cyber-attack/
Clop Hackers Leverage Critical Zero-Day Vulnerability in Oracle EBS
Read: https://www.theregister.com/2025/10/06/clop_oracle_ebs_zeroday/
German Government Blocks EU Mass Surveillance Law Over Privacy Concerns
Read: https://reclaimthenet.org/germany-rejects-eu-chat-control-law
Cyberattack on Supplier Steals Names and Vehicle Data from Renault Customers
Read: https://www.infosecurity-magazine.com/news/renault-customers-supply-chain
If you missed the previous issues, they can be read online here:
-
-
-
-
-
-
- October 3rd, 2025: RedNovember’s Global Cyber-Espionage Blitz
- September 26th, 2025: The UK Forces Digital ID’s – What’s Next?
- September 19th, 2025: DHS Misconfiguration Exposes Surveillance Data To Thousands Of Unauthorized Users
- September 12th, 2025: Nepal Goes Offline, Then Up In Flames
- September 5th, 2025: Judge Imposes Limits On Google Deals After Monopoly Ruling But Avoids Breakup
-
-
-
-
-
Quote is by Marcus Aurelius