Akira on DanSec Daily

Cybersecurity Brief – 2026-08-14

Fri, 14 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Trezor disclosed a data breach affecting nearly 14,000 customers after its shipping and logistics provider, ShipMonk, was compromised. Exposed data includes names, addresses, email addresses, and phone numbers, increasing the risk of targeted phishing attacks against Trezor users ^[12]^[20].
A former data analyst contractor for Brightly Software was sentenced to two years in prison after stealing company data and attempting to extort $2.5 million from his employer ^[4].
Apple sent new “Threat Notification” alerts to users who were targeted by mercenary spyware attacks, indicating ongoing campaigns leveraging sophisticated surveillance tools against high-risk individuals ^[5].
The Jewelbug hacker group has been observed breaching government webmail accounts for espionage purposes while simultaneously conducting cryptocurrency fraud operations ^[8]^[17].
Ukrainian authorities shut down 94 fraudulent call centers involved in investment scams and bank account access fraud, seizing millions in cash ^[6].

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2026-59310) in VMware vCenter Syslog Server is being actively exploited to deploy reverse SSH tools, providing attackers persistence and remote access. The vulnerability is the subject of a global threat campaign, and patching alone may not fully mitigate the threat ^[11]^[16]^[29].
An unpatched SQL injection vulnerability in GeoServer is being exploited in the wild, allowing attackers to achieve remote code execution ^[21].
WordPress 7.0.4 patched a remote code execution vulnerability that could be exploited by users with Author-level or higher permissions via malicious Postscript files ^[25].
Adobe Commerce released a patch for CVE-2026-71362, a vulnerability that saw exploitation attempts immediately after disclosure ^[24].
Fortinet released patches for authentication flaws in FortiWeb and FortiManager that could allow attackers to log in with arbitrary credentials or impersonate FortiGate appliances ^[27].
Microsoft patched the LegacyHive Windows zero-day vulnerability, which was disclosed after the July 2026 Patch Tuesday ^[9].

Notable Threat Actor Activity

The Iran-linked APT42 group is conducting AI-assisted spear phishing campaigns targeting US organizations, leveraging artificial intelligence to enhance the effectiveness of their attacks ^[3].
Akira ransomware affiliates have been observed disabling endpoint detection and response (EDR) by rebooting compromised systems into Safe Mode with Networking, enabling data theft even when encryption fails ^[7].
Initial access brokers are using vishing (voice phishing) attacks through Microsoft Teams to gain entry for ransomware gangs ^[2].
The Jewelbug group is simultaneously engaged in state espionage and financially motivated cybercrime, including cryptocurrency theft ^[8]^[17].

Trends, Tools, or Tactics of Interest

The rise of “Shadow AI” is being identified as a new dimension of Shadow IT, with employees using unapproved AI tools and services in the workplace, increasing organizational risk ^[1].
AI coding tools are introducing unvetted or hallucinated open source dependencies at a pace that exceeds current security review capabilities, raising supply chain risks ^[13].
Multiple “AI watermark remover” tools have appeared online following the introduction of watermarking in Anthropic’s Claude model, though most cannot reliably remove watermarks, highlighting rapid attempts to circumvent AI content authenticity measures ^[10].
AmnesiaStealer, a Rust-based macOS infostealer, is capable of harvesting passwords, keychain data, browser information, and cookies, expanding the threat landscape for macOS users ^[22].
New Android malware combines social engineering, a remote access trojan, and NFC relay capabilities to enable real-time fraudulent use of victims’ bank cards ^[31].
WhatsApp has rolled out a “Scam Alert” feature using a local machine learning model to flag potential scam messages for users ^[15].

Regulatory or Policy Developments Affecting the Security Industry

The White House issued a memo instructing the National Coordination Center to establish a program allowing private security companies to apply for approval to conduct offensive hack-back operations against foreign cybercrime gangs. Contracts may require a $1 million bond to ensure compliance with operational requirements ^[14]^[28].
Over 3,000 lawsuits have been filed by parents against Meta, TikTok, Google, and Snap, challenging the design of social media platforms and their impact on youth safety ^[32].

Sources

Trezor discloses data breach affecting nearly 14,000 customers - bleepingcomputer.com
14,000 Trezor Customers Impacted by Data Breach at ShipMonk - securityweek.com
Data analyst sent to prison for stealing data, extorting employer - bleepingcomputer.com
Apple sends new ‘Threat Notification’ alerts over mercenary spyware attacks - bleepingcomputer.com
Hackers breach govt webmail while running parallel crypto fraud - bleepingcomputer.com
'Jewelbug' APT Balances State Espionage & Cryptocurrency Theft - darkreading.com
Ukraine shuts down 94 fraudulent call centers, seize millions in cash - bleepingcomputer.com
Critical VMware vCenter RCE flaw exploited for reverse SSH access - bleepingcomputer.com
Global Threat Campaign Hits Critical VMware vCenter Flaw - darkreading.com
Critical VMware vCenter Vulnerability in Attackers’ Crosshairs - securityweek.com
Hackers Exploiting Unpatched GeoServer Zero-Day - securityweek.com
WordPress 7.0.4 Patches Remote Code Execution Vulnerability - securityweek.com
Adobe Commerce Bug Targeted Immediately After Disclosure - securityweek.com
Fortinet Patches Authentication Flaws in FortiWeb and FortiManager - securityweek.com
Microsoft patches LegacyHive Windows zero-day vulnerability - bleepingcomputer.com
Iranian APT Launches AI-Assisted Spear Phishing Attacks - blog.knowbe4.com
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt - bleepingcomputer.com
Warning: Vishing Attacks Open the Door to Ransomware Gangs - blog.knowbe4.com
Shadow AI: The New Frontier of Shadow IT - blog.knowbe4.com
Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion - bleepingcomputer.com
AI 'watermark removers' flood the web. Almost none can prove they work. - bleepingcomputer.com
AmnesiaStealer macOS Malware Steals Data, Controls Browser Sessions - securityweek.com
New Android malware lets criminals use your bank card in real time - malwarebytes.com
WhatsApp rolls out new feature that flags potential scam messages - bleepingcomputer.com
White House taps security firms for offensive hack-back operations - bleepingcomputer.com
White House Mobilizes Security Firms for Operations Against Foreign Cybercrime Gangs - securityweek.com
Parents take on Meta, TikTok, Google, and Snap in 3,000 youth safety lawsuits - malwarebytes.com

Cybersecurity Brief – 2025-12-13

Sat, 13 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang suffered a data breach affecting 33.7 million customers, traced to a former employee who retained internal system access after departure.
Fieldtex Products experienced a data breach impacting 238,000 individuals, with the Akira ransomware group claiming responsibility for stealing 14 GB of data.
At least nine organizations were compromised through exploitation of a recently patched Gladinet CentreStack vulnerability.
A fake torrent for “One Battle After Another” was used to distribute Agent Tesla RAT malware via malicious subtitle files.
Google ads are being abused to direct Mac users to malicious AI chat sites, resulting in the distribution of the Atomic macOS Stealer (AMOS).
The US government’s policy of publishing H-1B applicant social accounts has raised significant privacy concerns, exposing personal data to potential targeting, impersonation, and extortion.

Newly Discovered Vulnerabilities

Apple released emergency security updates to patch two zero-day WebKit vulnerabilities, both exploited in sophisticated attacks targeting specific individuals.
Two new types of vulnerabilities in React Server Components (RSC) were patched by the React team; these could lead to denial-of-service or source code exposure.
The React2Shell vulnerability (CVE-2025-55182) is under widespread exploitation, prompting emergency mitigation efforts and a CISA directive for federal agencies to patch by 12 December 2025. Some proof-of-concept exploits can bypass web application firewall (WAF) rules.
A new Windows zero-day vulnerability affecting the Remote Access Connection Manager (RasMan) service has been disclosed, with unofficial patches made available.
A critical GeoServer vulnerability is being actively exploited in XML External Entity (XXE) injection attacks, with CISA ordering immediate patching.
Notepad++ patched a vulnerability in its updater mechanism that allowed for update file authentication bypass and potential traffic hijacking.
Kali Linux 2025.4 released with three new hacking tools and desktop environment updates.
Zigbee protocol security assessment revealed two application-level attack vectors that can be exploited to remotely turn Zigbee endpoints on or off.

Notable Threat Actor Activity

North Korean threat actors are conducting job invitation scams via social media platforms such as Threads, going beyond typical fake employer scams.
Fake OSINT and GPT utility repositories on GitHub are being used to distribute a new, previously undocumented JavaScript-based remote access trojan (PyStoreRAT).
Supply chain attacks targeting GitHub Actions have increased in 2025, with researchers urging adoption of a shared responsibility model for open source security.
At least nine organizations were compromised by threat actors exploiting the Gladinet CentreStack vulnerability.
Criminals are leveraging malicious subtitle files in torrents and poisoned AI chat sites via Google ads to spread Agent Tesla RAT and Atomic macOS Stealer, respectively.

Trends, Tools, or Tactics of Interest

Advanced phishing kits (BlackForce, GhostFrame, InboxPrime AI, Spiderman) are using AI and multi-factor authentication (MFA) bypass techniques to facilitate large-scale credential theft.
Email-based phishing kits now leverage Telegram bots and custom administration panels for managing stolen data.
There is an observed increase in attacks exploiting React2Shell, including the use of WAF bypass techniques in proof-of-concept exploits.
Shadow IT in the form of “shadow spreadsheets” is exposing sensitive data outside official controls.
The browser is increasingly the main interface for generative AI tools within enterprises, raising concerns about policy, isolation, and data controls.
$320,000 was awarded at Zeroday.Cloud for exploits against open source projects such as Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL.
The Akira ransomware group continues to claim responsibility for significant breaches.
A new Android in-the-wild exploit (DNG) has been identified through suspicious image files uploaded to VirusTotal.
Vibe coding and unmanaged code practices are highlighted as introducing significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the actively exploited GeoServer vulnerability immediately.
MITRE released its 2025 list of the top 25 most dangerous software weaknesses, with XSS, SQL injection, and CSRF at the top.
Microsoft has expanded its bug bounty program to include critical vulnerabilities in third-party and open source code that impact Microsoft services.
Microsoft will bundle Security Copilot with M365 Enterprise licenses, alongside the launch of 12 new security agents.
The US government’s publication of H-1B applicants’ social media accounts has sparked privacy concerns due to increased exposure to cyber threats.
The Pentagon has ordered an accelerated transition to post-quantum cryptography (PQC) for its systems.
The Trump administration reportedly dropped sanctions against Chinese actors for the Salt Typhoon attacks on US telecoms, raising concerns about prioritising trade over cybersecurity enforcement.

Cybersecurity Brief – 2025-11-15

Sat, 15 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Logitech confirmed a data breach following an attack by the Clop extortion group, which targeted Oracle E-Business Suite systems and resulted in data theft.
Checkout.com disclosed a breach of a legacy cloud storage system by the ShinyHunters threat group, which is now attempting to extort the company. The breach did not impact payment processing systems.
The Washington Post reported that nearly 10,000 employees were affected by a data breach linked to the Oracle hack, with attackers attempting extortion after stealing personal information.

Newly Discovered Vulnerabilities

Fortinet FortiWeb web application firewall is affected by a critical authentication bypass vulnerability (zero-day), which has been actively exploited in the wild to create admin accounts and compromise systems. Fortinet has issued a silent patch, and CISA has added the bug to its Known Exploited Vulnerabilities (KEV) catalog.
ASUS released firmware updates to address a critical authentication bypass flaw in several DSL series routers.
Researchers identified a vulnerability in ImunifyAV (part of Imunify360), allowing arbitrary code execution via malicious file uploads on shared servers, potentially exposing millions of websites.
Critical remote code execution vulnerabilities were discovered in AI inference engines from Meta, Nvidia, Microsoft, and others.
A macOS vulnerability was noted in industry roundups, though no further technical detail was provided.

Notable Threat Actor Activity

North Korean threat actors (linked to the Contagious Interview campaign) are now using JSON storage services to stage and deliver malware payloads as part of updated tactics.
The Iranian state-sponsored group APT42 launched a new espionage campaign, “SpearSpecter,” targeting individuals and organizations connected to the Islamic Revolutionary Guard Corps (IRGC), particularly in defense and government sectors.
Chinese state-sponsored actors leveraged Anthropic’s Claude AI to automate cyber-espionage operations against around 30 organizations worldwide. The campaign was described as highly sophisticated and largely automated via AI tools.
The Akira ransomware group has continued targeting critical organizations, including exploiting SonicWall vulnerabilities and encrypting Nutanix Acropolis Hypervisor (AHV) VM disk files. Akira ransomware operations have netted $244 million in proceeds.
Clop extortion group was responsible for the recent breaches at Logitech and The Washington Post (via Oracle E-Business Suite).
ShinyHunters were behind the Checkout.com extortion attempt following their breach of a legacy cloud storage system.
A financially motivated actor published 150,000 malicious packages to the NPM registry in an automated, self-replicating token farming campaign targeting the tea.xyz protocol.

Trends, Tools, or Tactics of Interest

Ransomware ecosystem fragmentation is at an all-time high, with 85 active ransomware and extortion groups observed in Q3 2025 and 1,590 victims disclosed on leak sites.
Malware-as-a-service continues to evolve, with the emergence of “Fantasy Hub,” a new platform enabling unskilled actors to deploy Android banking Trojans.
Increased use of AI by both attackers (e.g., Chinese espionage leveraging Anthropic’s Claude AI) and defenders (e.g., Burp AI supporting penetration testers).
Attackers are exploiting social engineering via fake job interviews to deliver malware.
Security researchers released new tools and datasets to bolster macOS malware analysis, addressing a historical lack of focus on Apple platforms.
Hardened container initiatives are underway to reduce vulnerabilities introduced by overly broad container builds.
Identity governance innovations are being developed to address the proliferation of enterprise applications and improve integration coverage.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of Justice announced the creation of a new strike force to disrupt Chinese cryptocurrency scam networks, which defraud Americans of nearly $10 billion annually. The DOJ is also targeting supporting infrastructure, such as satellite internet systems used at scam compounds.
Five individuals pleaded guilty in the U.S. to assisting North Korean IT worker fraud and cryptocurrency theft schemes.
The Pentagon unveiled “CYBERCOM 2.0,” a plan to address cyber talent shortages and build a force capable of countering major threats, including those from China.
Google reversed course on new Android developer registration rules, now allowing for limited app distribution accounts and user privacy controls.

Cybersecurity Brief – 2025-11-14

Fri, 14 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

DoorDash disclosed a data breach in October affecting user information across the US, Canada, Australia, and New Zealand.
The Washington Post is notifying nearly 10,000 employees and contractors of personal and financial data exposure following the Oracle data theft attack.
Synnovis confirmed patient information was stolen in a ransomware attack that disrupted pathology services at several London hospitals.
The NHS is investigating claims of an Oracle E-Business Suite (EBS) hack after hackers named over 40 alleged victims, with the National Cyber Security Centre involved.

Newly Discovered Vulnerabilities

Fortinet FortiWeb is affected by a path traversal vulnerability that allows unauthenticated attackers to create administrative users. The flaw is being actively exploited and a public proof-of-concept (PoC) is available.
ImunifyAV, a malware scanner for Linux servers used by tens of millions of websites, has a remote code execution vulnerability that could compromise hosting environments.
WatchGuard Firebox firewalls are impacted by CVE-2025-9242, a critical (CVSS 9.3) unauthenticated remote code execution vulnerability, which is being actively exploited.
Cisco Adaptive Security Appliances (ASA) and Firepower devices are subject to two actively exploited vulnerabilities, prompting urgent patching advisories from CISA.
Cisco Identity Services Engine (ISE) and Citrix products are affected by CVE-2025-20337 and CVE-2025-5777, both of which have been exploited as zero-days.
Uhale Android-based digital picture frames contain multiple critical vulnerabilities, including the ability to download and execute malware at boot time.
A vulnerability in ChatGPT’s custom GPTs allowed exploitation via server-side request forgery (SSRF) to obtain Azure access tokens.

Notable Threat Actor Activity

Russian-speaking threat actors have registered over 4,300 fake travel domains in a mass phishing campaign targeting hotel guests’ payment data.
A malicious Chrome extension, “Safery,” steals Ethereum wallet seed phrases and exfiltrates them using the Sui blockchain.
Indonesian threat actors are likely behind the ‘IndonesianFoods’ worm, which has spammed npm with over 100,000 self-replicating malicious packages.
The Coyote and Maverick banking trojans are active in Brazil, with Maverick terminating itself if run outside the country.
Google has taken legal action against the China-based Lighthouse phishing kit, disrupting a platform responsible for SMS phishing and toll-fee scams affecting over a million victims and 17,500 fake sites.

Trends, Tools, or Tactics of Interest

The Tycoon 2FA phishing kit has evolved, enabling unskilled actors to launch sophisticated social engineering attacks bypassing two-factor authentication.
Ransomware operators are increasingly targeting virtual environments: Akira ransomware is encrypting Nutanix AHV VMs; Kraken ransomware benchmarks systems to optimise encryption without overloading them.
Kerberoasting attacks remain a significant threat for Active Directory environments, with attackers stealing service account passwords to escalate privileges.
Formbook malware is being delivered through multiple scripting techniques to evade detection.
A surge in exploit weaponisation speed: 50–61% of new vulnerabilities in 2025 had exploit code available within 48 hours of disclosure.
Organisations are moving toward single sign-on (SSO) and passkeys to address persistent weak password usage among employees.
Microsoft Teams is rolling out screen capture prevention for Premium customers, blocking screenshots and recordings during meetings.
Attackers continue to leverage phishing-as-a-service platforms, with new kits and services supporting rapid deployment of phishing campaigns.

Law Enforcement and Regulatory Developments

Operation Endgame, coordinated by Europol and Eurojust, disrupted the Rhadamanthys, Venom RAT, and Elysium botnet operations, taking down over 1,025 servers and arresting at least one individual.
CISA, FBI, and partners have released updated guidance for defending against Akira ransomware, and have reiterated patching requirements for actively exploited Cisco and WatchGuard vulnerabilities.
Google’s legal actions have resulted in the disruption of the Lighthouse phishing kit infrastructure.
The UK’s National Cyber Security Centre is assisting the NHS following claims of an Oracle EBS breach.
New York State is investigating the use of algorithmic surveillance pricing in consumer markets, highlighting regulatory scrutiny over data-driven practices.

Cybersecurity Brief – 2025-11-07

Fri, 07 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The U.S. Congressional Budget Office (CBO) confirmed a cybersecurity incident attributed to a suspected foreign threat actor. Sensitive data may have been exposed.
SonicWall disclosed that a nation-state actor breached its cloud backup service, stealing firewall configuration files of all customers using the service. This incident is not connected to recent Akira ransomware activity.
Hyundai AutoEver America reported a data breach from February, with attackers stealing Social Security Numbers and other personal information.
The State of Nevada completed recovery from a ransomware attack that began as early as May 2025 and was discovered in August. The attack impacted 60 state agencies and disrupted critical health and public safety services.
The DeFi protocol Balancer began recovering funds after hackers exploited a vulnerability to steal $128 million in cryptocurrency.
New data revealed that UK water systems have been targeted by hackers five times since 2024, highlighting increased risks to critical infrastructure.

Newly Discovered Vulnerabilities

Cisco released patches for critical vulnerabilities in its Unified Contact Center Express (UCCX) software and Contact Center Appliance. The flaws (including CVE-2025-20333 and CVE-2025-20362) allow remote code execution and privilege escalation to root.
Multiple security vulnerabilities were identified in ChatGPT, including issues with memory and web search features. These bugs could allow data exfiltration, prompt injection, bypassing safety mechanisms, and other malicious actions.

Notable Threat Actor Activity

Russian state-backed group Sandworm deployed multiple data-wiping malware families in attacks targeting Ukraine’s education, government, and grain sectors.
A previously unknown threat cluster impersonated ESET in phishing campaigns against Ukrainian entities, distributing trojanized installers that deploy the Kalambur backdoor.
State-sponsored actors were responsible for the SonicWall cloud backup breach.
Phishing campaigns are actively targeting LastPass users with fake death notifications to gain account access, and Microsoft Help Desk-themed phishing emails continue to circulate.

Trends, Tools, or Tactics of Interest

A malicious Visual Studio Code (VS Code) extension with ransomware capabilities was discovered on the official marketplace. The extension, apparently created with AI assistance, can encrypt files on a victim’s system.
ClickFix malware attacks have evolved to include multi-OS support, video tutorials to guide victims through self-infection, countdown timers to pressure users, and automatic OS detection.
Android malware leveraging NFC technology is being used to steal card details and PINs for instant ATM withdrawals.
Deepfake and synthetic video technologies are increasingly being abused for fraud, requiring enhanced verification protocols.
Cybercrime is increasingly funding organized crime, with online scams supporting real-world criminal activities and violence-as-a-service models.
Continuous purple teaming and breach and attack simulation (BAS) are being promoted as effective ways to validate security controls and close detection gaps in enterprise environments.
Agentic AI tools are being integrated into attack chains, requiring stronger oversight, least privilege, and red-teaming to mitigate risks.

Regulatory or Policy Developments Affecting the Security Industry

Financial services are now subject to prescriptive regulatory requirements for cyber-resilience, moving beyond best practices to operational mandates.
New initiatives are being launched to increase transparency in social media advertising, aiming to address the proliferation of scam ads.
Increased focus on privacy controls, as evidenced by updates to consumer security products, reflects evolving regulatory and user expectations.

Cybersecurity Brief – 2025-09-30

Tue, 30 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Harrods experienced a data breach via a compromised third-party supplier, resulting in the theft of 430,000 customer records containing sensitive e-commerce information.
Jaguar Land Rover (JLR) halted production following a catastrophic cyberattack impacting its supply chain; the UK government has provided a £1.5 billion loan guarantee to support recovery.
Asahi Group Holdings, Japan’s largest brewer, suspended operations due to a cyberattack disrupting multiple business functions.
RemoteCOM spyware breach exposed sensitive personal details of suspects (including sex offenders, terrorists, and drug dealers) and law enforcement personnel.
Stellantis, the automotive group owning Citroën, Fiat, and Peugeot, was among the organizations targeted in recent attacks, according to Check Point’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

CISA added a critical vulnerability in the Sudo command-line utility for Linux and Unix-like systems to its Known Exploited Vulnerabilities Catalog; the flaw is being actively exploited.
Apple released a security update addressing CVE-2025-43400, a vulnerability in its latest operating system.
Increased scanning activity detected for Palo Alto Networks GlobalProtect vulnerability (CVE-2024-3400).
Akira ransomware actors are exploiting a SonicWall firewall vulnerability discovered in 2024, targeting customers who have not patched affected devices.
Researchers identified the first malicious Model Context Protocol (MCP) server, which exfiltrates secrets via BCC in automated email workflows, raising new software supply chain risks.
Researchers found that Tile tracking tags broadcast unencrypted data, making users vulnerable to location tracking by malicious actors.

Notable Threat Actor Activity

Akira ransomware continues a broad campaign targeting SonicWall VPNs, using the Datto RMM utility and other legitimate tools for lateral movement and evasion.
The Medusa ransomware gang attempted to recruit a BBC correspondent as an insider to facilitate an attack on a media organization.
Trend Micro reported the “EvilAI” malware campaign, in which threat actors disguise malicious payloads as legitimate AI tools to infiltrate global organizations.
Ukrainian law enforcement was impersonated in fileless phishing campaigns targeting Kyiv, delivering Amatera Stealer and PureMiner via malicious SVG files.
Dutch authorities arrested two teenagers accused of assisting Russian hackers, with one reportedly using a Wi-Fi sniffer near government and embassy offices.

Trends, Tools, or Tactics of Interest

Microsoft observed phishing campaigns leveraging large language models (LLMs) to generate obfuscated SVG file payloads, bypassing email security.
AI-powered voice cloning frameworks have been demonstrated as a tool for vishing, enabling real-time simulated conversations to extract sensitive information.
Security leaders are increasingly integrating AI into SOC operations for triage, detection engineering, and threat hunting, as reported in a study of 282 organizations.
AI-generated code is being used to automate vulnerability checks, but research indicates human oversight remains essential to ensure accuracy.
Increased attacks on IoT devices reported, with US government initiatives to improve IoT security currently stalled.
Supply chain attacks are on the rise, exemplified by the malicious MCP server and the Harrods breach via a third-party supplier.

Regulatory or Policy Developments Affecting the Security Industry

The Cybersecurity Information Sharing Act (CISA) is set to expire on 30 September 2025, raising concerns about the future of threat intelligence sharing in the US.
The UK government’s intervention in the JLR cyberattack demonstrates a willingness to provide significant financial support to critical industries affected by cyber incidents.
Amazon agreed to a $2.5 billion settlement over deceptive practices related to Prime subscriptions, highlighting regulatory scrutiny of consumer protection in digital services.

Cybersecurity Brief – 2025-09-29

Mon, 29 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Harrods, a British department store, has notified customers of a data breach involving the compromise of some personal details. Four individuals were arrested in July in connection with cyberattacks targeting Harrods, Marks & Spencer, and the Co-op.

Newly Discovered Vulnerabilities

Akira ransomware operators have been observed breaching SonicWall SSL VPN devices even when One-Time Password (OTP) Multi-Factor Authentication (MFA) is enabled. Attackers are successfully logging in to accounts protected by MFA, indicating a potential vulnerability or bypass method affecting SonicWall VPNs.

Notable Threat Actor Activity

Akira ransomware activity continues to evolve, with threat actors specifically targeting SonicWall SSL VPN appliances and demonstrating the capability to circumvent MFA protections.

Regulatory or Policy Developments Affecting the Security Industry

The European Commission has launched an investigation into SAP over potential anti-competitive practices related to aftermarket services for its on-premise ERP software. This regulatory action may impact support models and third-party service providers in the enterprise software sector.

Cybersecurity Brief – 2025-09-12

Fri, 12 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

The UK train operator LNER disclosed a data breach involving a third-party supplier, resulting in the compromise of customer contact information and other data.
Panama’s Ministry of Economy and Finance reported a cyberattack claimed by the INC ransomware group, with indications that at least one computer was compromised.
Cornwell Quality Tools suffered a ransomware attack attributed to the Cactus group, impacting approximately 100,000 individuals.
Vyro AI experienced a data leak, attributed to poor cyber hygiene, exposing proprietary or sensitive data.
Apple issued warnings to customers targeted in a recent series of spyware attacks, as confirmed by the French national CERT (CERT-FR).
Microsoft Exchange Online experienced an outage in North America, disrupting email access for customers.
Meta faces whistleblower allegations of ignoring child sex abuse risks within its VR “metaverse” environment.

Newly Discovered Vulnerabilities

A critical use-after-free vulnerability in Google Chrome was patched, which could have allowed code execution.
Cisco patched high-severity vulnerabilities in IOS XR that could allow ISO image verification bypass and denial-of-service attacks.
A security weakness in the AI-powered Cursor code editor was disclosed, enabling silent code execution when opening malicious repositories.
A new Spectre-like attack, VMScape, was identified that allows a malicious VM to leak cryptographic keys from a QEMU hypervisor on AMD and Intel CPUs.
A critical access control vulnerability (CVE-2024-40766) in SonicWall SSLVPN devices is being actively exploited.
Apple CarPlay was found to have a remote code execution exploit that remains unaddressed in most vehicles.
Researchers demonstrated that the ThrottleStop.sys driver can be weaponized by the Gentlemen ransomware to disable antivirus and EDR solutions.

Notable Threat Actor Activity

The Akira ransomware group is actively exploiting the SonicWall SSLVPN vulnerability (CVE-2024-40766) and related misconfigurations to gain initial access to targeted environments.
Fake browser extensions, including “Madgicx Plus” and “SocialMetrics,” are being distributed via malicious ads and websites to hijack Meta Business Accounts and steal sensitive data.
The Vidar infostealer has resurfaced with new evasion techniques and enhanced data exfiltration capabilities.
AI-backed malware, attributed to the EvilAI group, is leveraging legitimate-sounding productivity apps to deliver Trojans with advanced evasion against antivirus solutions.
A phishing campaign is abusing iCloud Calendar invites sent via Apple infrastructure to deliver PayPal-themed phishing messages.
Scam text messages impersonating Bureau of Motor Vehicles are targeting motorists for personal and banking information.
Romance scams continue, with a recent case involving an “astronaut-in-distress” scenario resulting in financial loss to an elderly victim.

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging legitimate credentials and simple login methods rather than exploiting technical vulnerabilities, highlighting a trend of “logging in” rather than “hacking in.”
AI-generated deepfake scams are rising, prompting the FBI and American Bankers Association to issue joint guidance for awareness and mitigation.
Jailbreaking of AI models remains a challenge, with the UAE’s K2 Think AI model being compromised through its own transparency features hours after release.
The use of malvertising and fake browser extensions to hijack business accounts is increasing.
Memory Integrity Enforcement, a new security architecture in Apple’s latest iPhones, aims to mitigate memory-related vulnerabilities.
Google Pixel 10 devices now support the C2PA standard for verifying the authenticity and provenance of digital media.
Microsoft has added malicious link warnings to Teams private chats to enhance user protection.
Security researchers are focusing on AI pen testing, including social engineering and behavioral manipulation techniques for large language models.
The security of browser extensions remains a significant concern, with risks of data exfiltration and adversary-in-the-middle (AitM) attacks.
Overloaded SOCs are increasingly turning to AI for alert triage and automation, though concerns remain about AI introducing new risks if not properly overseen.

Regulatory or Policy Developments Affecting the Security Industry

U.S. Senator Ron Wyden has urged the Federal Trade Commission to investigate Microsoft for alleged “gross cybersecurity negligence” related to ransomware incidents, specifically referencing Windows security and Kerberoasting attacks.
The European Union imposed financial sanctions on Stark Industries Solutions Ltd., a bulletproof hosting provider, though the company continues to operate by evading these sanctions.

Cybersecurity Brief – 2025-08-29

Fri, 29 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

TransUnion suffered a data breach impacting over 4.4 million individuals in the US, exposing personal information but not credit reports or core credit data.
MathWorks (MATLAB developer) disclosed a ransomware attack that resulted in the theft of data belonging to over 10,000 individuals.
Google confirmed that the Salesloft breach is larger than previously reported, with attackers using stolen OAuth tokens to access both Google Workspace email accounts and Salesforce data.
The maintainers of the Nx build system reported a supply chain attack involving malicious npm packages and plugins, resulting in the leakage of over 2,300 GitHub, cloud, and AI credentials. This incident marks the first known use of AI-powered stealers in a supply chain attack.
Law enforcement agencies (FBI and Dutch Police) seized servers and domains associated with the VerifTools fake ID marketplace.
TransUnion and MathWorks incidents highlight continued targeting of large data repositories by threat actors, with significant personal data exposure.

Newly Discovered Vulnerabilities

A high-severity authentication bypass vulnerability was disclosed in Passwordstate, an enterprise password manager. Customers have been urged to patch immediately.
A flaw in the Visual Studio Code Marketplace allows attackers to republish previously deleted extensions under the same names, posing a risk to the software supply chain.
Researchers highlighted hidden vulnerabilities in popular project management tools (e.g., Trello, Asana), with risks including data exposure and insufficient backup protections.

Notable Threat Actor Activity

The China-linked APT group Salt Typhoon has exploited vulnerabilities in Cisco, Ivanti, and Palo Alto devices to breach over 600 organizations globally, including critical infrastructure in telecom, government, and military sectors. The group maintains persistent access for espionage purposes.
Cybercriminals are actively recruiting social engineering talent with fluent English skills, according to a new report on the cybercriminal recruitment ecosystem.
A new phishing-as-a-service (PhaaS) platform named “Salty 2FA” is being used to bypass MFA and steal Microsoft 365 credentials, targeting organizations across North America and Europe.
The TamperedChef malware campaign uses malvertising and fake PDF editor sites to deliver an information stealer that exfiltrates credentials and cookies.
North Korean IT worker schemes were targeted by new US Treasury sanctions, exposing $600K in crypto transfers and over $1M in profits for DPRK-linked threat actors.
Threat actors have abused Anthropic’s Claude AI to develop ransomware and automate data extortion campaigns.
Akira and Cl0p remain among the most active ransomware-as-a-service groups, with reports noting increased use of AI by both established and emerging gangs.

Trends, Tools, or Tactics of Interest

First documented AI-weaponized supply chain attack occurred via the Nx build system, where AI-powered stealers were used to rapidly exfiltrate developer secrets.
There is a notable rise in requests for ZIP files in web honeypot logs, indicating a possible trend in attackers seeking to exploit ZIP-based delivery or exfiltration methods.
Shadow IT continues to expand organizational attack surfaces, with researchers finding widespread exposed backups, open Git repositories, and accessible admin panels containing sensitive data.
RedExt, a browser extension-based C2 framework, has been released for red team operations, enabling data collection and command-and-control via Chromium-based browsers.
Meta reported shutting down millions of WhatsApp accounts linked to scam centers, reflecting ongoing large-scale anti-fraud operations.
Increasing use of malvertising and fake software download sites to deliver malware, as seen in the TamperedChef campaign.
Affiliates are flocking to scam gambling sites that lure victims with free credits and steal cryptocurrency deposits.
Microsoft Word for Windows will soon autosave and default to cloud storage for new documents.
CISA, FBI, and NSA issued a global advisory on the widespread espionage activities of Chinese nation-state actors targeting network devices.

Regulatory or Policy Developments

The US Treasury’s Office of Foreign Assets Control (OFAC) imposed new sanctions on individuals and entities associated with North Korean IT worker schemes.
The FCC disconnected over a thousand voice operators from the public telephone network for failing to combat robocalling.
CISA released updated Software Bill of Materials (SBOM) guidelines, receiving mixed industry reviews regarding their effectiveness and practical utility.

Cybersecurity Brief – 2025-08-08

Fri, 08 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Bouygues Telecom confirmed a data breach affecting 6.4 million customers, exposing personal information.
Air France and KLM disclosed a breach via a third-party customer service platform, compromising customer names, email addresses, phone numbers, and other non-financial data.
Chanel notified clients of a third-party breach impacting customer data, joining other luxury brands affected by similar incidents.
Google, Adidas, and other organisations suffered breaches after employees were tricked via phone calls into granting access to Salesforce data, attributed to ShinyHunters.
Mozilla’s Firefox add-on store was targeted by the “GreedyBear” campaign, which uploaded 150 malicious extensions that drained cryptocurrency wallets, stealing an estimated $1 million.
TeaOnHer, a dating advice app, was found leaking user personal data.
Recent ransomware attacks against SonicWall Gen 7 firewalls with SSL VPN enabled were linked to exploitation of an older, patched vulnerability, not a zero-day.

Newly Discovered Vulnerabilities

Microsoft disclosed CVE-2025-53786, a high-severity privilege escalation flaw in on-premise Exchange Server hybrid deployments, allowing attackers to gain elevated privileges in Exchange Online. Both Microsoft and CISA have issued advisories; CISA mandated emergency patching for US federal agencies.
Security flaws were reported in Axis Communications video surveillance products, exposing over 6,500 servers to potential remote takeover.
Researchers discovered a privilege escalation issue in Amazon ECS, allowing IAM hijacking and cross-resource access via an undocumented protocol.
New HTTP request smuggling/desync attacks exploiting HTTP/1.1 vulnerabilities impacted major CDNs and millions of websites.
Two malicious npm packages masquerading as WhatsApp developer tools were discovered, containing destructive data-wiping code targeting developer systems.
Researchers found that encryption algorithms used in law enforcement and military radios may be easily cracked, potentially allowing eavesdropping.

Notable Threat Actor Activity

SocGholish malware operators are utilising Traffic Distribution Systems (Parrot TDS, Keitaro TDS) to redirect users to malicious content, delivering access to ransomware groups including LockBit and Evil Corp.
ShinyHunters resurfaced, conducting low-tech social engineering attacks to breach Salesforce data at major corporations.
The Silver Fox APT group demonstrated operations blending espionage and cybercrime, attributed to Chinese threat actors.
North Korean IT scammers’ operational details were leaked, revealing structured targeting and internal surveillance.
Eight ransomware groups, including RansomHub, have adopted a new EDR killer tool, an evolution of EDRKillShifter, to disable endpoint detection and response solutions during attacks.
Akira ransomware attacks targeting SonicWall firewalls exploited a known vulnerability, not a zero-day.

Trends, Tools, or Tactics of Interest

The FBI warned of attackers sending physical packages containing malicious QR codes (“quishing”) to initiate phishing campaigns via postal mail.
Surge in vishing scams, where attackers impersonate service providers offering discounts in exchange for upfront fees.
Rise in Python and Go supply chain attacks, with malicious packages discovered that deliver cross-platform malware and trigger remote data wipes.
Increased use of AI in both offensive and defensive cloud security operations, with AI now central to evolving attack and defence strategies.
150+ malicious Firefox extensions highlight the ongoing risk in browser extension ecosystems.
Clickjacking campaigns on adult sites are being used to manipulate Facebook user engagement.
EDR killer tools are being actively distributed across multiple ransomware operations for disabling security controls.

Regulatory or Policy Developments Affecting the Security Industry

CISA issued an emergency directive requiring all US Federal Civilian Executive Branch agencies to patch Microsoft Exchange Server CVE-2025-53786 by Monday.
The founders of Samourai Wallet pleaded guilty to laundering over $200 million for cybercriminals and agreed to forfeit the proceeds.
A court found Meta accessed sensitive health data from the Flo app without user consent.
The Alliance for Creativity and Entertainment (ACE) took offline Rare Breed TV, a major illegal IPTV service, following a financial settlement.

Cybersecurity Brief – 2025-08-07

Thu, 07 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Google has suffered a data breach as part of an ongoing campaign targeting Salesforce CRM data, attributed to the ShinyHunters extortion group. Several major companies have been impacted by this wave of attacks.
DaVita has notified over 1 million individuals that their personal and health information was stolen in a ransomware attack.
WhatsApp has taken down 6.8 million accounts linked to criminal scam centres, with Meta attributing the activity to a scam centre in Cambodia.
A hacker, Chukwuemeka Victor Amachukwu, has been extradited from France to the US for spearphishing attacks on US tax preparers, resulting in the theft of $3.3 million from taxpayers.

Newly Discovered Vulnerabilities

Trend Micro has confirmed active exploitation of critical security flaws (including zero-days) in on-premise Apex One Management Console, with mitigations released. The vulnerabilities have reportedly been exploited by Chinese threat actors.
Researchers have uncovered multiple vulnerabilities in Dell’s ControlVault3 firmware (ReVault flaws), impacting over 100 laptop models. These flaws allow attackers to bypass Windows login and install persistent malware.
Amazon ECS is affected by a newly discovered “ECScape” flaw, enabling cross-task credential theft and lateral movement within container environments.
CyberArk Conjur contained multiple vulnerabilities that could be chained for unauthenticated remote code execution. Patches have been issued.
CISA has issued an alert regarding a vulnerability affecting Microsoft Exchange.
Security researchers have demonstrated that a single malicious document can exploit weaknesses in OpenAI’s Connectors to extract data from Google Drive without user interaction.
Multiple reports from Black Hat USA and DEFCON 2025 highlight that HTTP request smuggling vulnerabilities (notably in HTTP/1.1) remain prevalent and are evolving, with many defences proving inadequate.

Notable Threat Actor Activity

The ShinyHunters group is behind the recent wave of Salesforce data theft attacks, including the breach at Google.
VexTrio, an ad fraud and subscription scam group, has been distributing fake VPN and spam blocker apps on Apple and Google app stores.
The threat actor UAC-0099 is targeting Ukrainian government agencies, defence forces, and enterprises with C# malware delivered via HTA files using court summons lures.
Europol, led by French Police, has arrested a 38-year-old administrator of the Russian-language XSS cybercrime forum.

Trends, Tools, or Tactics of Interest

Social engineering attacks have surged, with incidents nearly tripling in the first half of 2025 compared to late 2024 (from 6% to 17% of all incidents), per LevelBlue.
Akira ransomware and other malware campaigns are abusing legitimate drivers (e.g., Intel CPU tuning/ThrottleStop) to disable antivirus and EDR processes, including Microsoft Defender.
A new C2 evasion technique, “Ghost Calls,” uses TURN servers from conferencing apps (Zoom, Microsoft Teams) to tunnel traffic through trusted infrastructure.
Security researchers have demonstrated that major enterprise AI assistants (ChatGPT, Copilot, Gemini, Salesforce Einstein) can be manipulated via crafted prompts to exfiltrate or manipulate data.
Splunk researchers have developed PLoB, a behavioural fingerprinting system using AI to detect subtle post-login intrusion signals.
AI tools are increasingly used to automate security operations: Microsoft launched Project Ire, an autonomous AI agent for malware classification, and Ox Security announced an AI agent that generates code to fix vulnerabilities.
AI is significantly reducing workloads for vCISOs (by 68%), with SMBs increasingly relying on virtual CISO services.
Sextortion scams remain persistent but are now considered background noise by security professionals.
Perplexity AI is reportedly ignoring robots.txt directives and crawling websites regardless of opt-out signals.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft paid out a record $17 million in bug bounties over the past 12 months, rewarding 344 security researchers across 59 countries.
WhatsApp has introduced a new security feature to help users identify potential scams when added to group chats by unknown contacts.

Cybersecurity Brief – 2025-08-05

Tue, 05 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Chanel has suffered a data breach as part of a broader wave of attacks targeting Salesforce data, joining other organisations affected by this campaign.
Northwest Radiologists disclosed a data breach impacting 350,000 individuals, with personal information stolen in an incident dating back to January 2025.
Russia’s largest airline, Aeroflot, was reportedly attacked, according to Check Point’s latest threat intelligence report.

Newly Discovered Vulnerabilities

SonicWall is investigating a potential zero-day vulnerability in its SSL VPN devices after a surge in targeted attacks, notably by the Akira ransomware group.
NVIDIA patched multiple critical vulnerabilities in its Triton Inference Server for Windows and Linux. These flaws could allow unauthenticated remote code execution, model theft, data leaks, and response manipulation on AI servers.
A previously undocumented Linux backdoor, dubbed “Plague,” was discovered. The malware, implemented as a malicious PAM module, enables persistent SSH access, bypasses authentication, and removes traces of SSH sessions. It is reported to have evaded detection for over a year.
Proton fixed a vulnerability in its Authenticator iOS app where TOTP secrets were logged in plaintext, potentially exposing multi-factor authentication codes.
Several vulnerabilities were patched in the AI code editor Cursor, which previously allowed attackers to modify sensitive MCP files and execute arbitrary code without user approval.

Notable Threat Actor Activity

Vietnamese threat actors are distributing a Python-based information stealer known as PXA Stealer. The campaign has compromised over 4,000 IP addresses and stolen 200,000 passwords globally.
Akira ransomware operators have escalated attacks using SonicWall SSL VPN devices, leveraging a suspected zero-day for initial access.
Ransomware gangs are exploiting a Microsoft SharePoint vulnerability chain, resulting in breaches of at least 148 organisations.
North Korean IT workers continue to seek fraudulent employment at Western companies, as highlighted in a new FBI advisory.
The “ClickTok” campaign is targeting TikTok Shop users with phishing and trojanised apps, leading to crypto wallet theft and spyware infections.
Mozilla warned of an ongoing phishing campaign targeting add-on developers via its official AMO repository.

Trends, Tools, or Tactics of Interest

Attackers are leveraging Microsoft Teams calls for social engineering, convincing users to install the Matanbuchus malware loader, which is often a precursor to ransomware deployment.
Threat actors are increasingly utilising generative AI tools to enhance offensive cyber operations, including social engineering and malware development.
Recent malware campaigns are adopting advanced evasion techniques, such as blending into legitimate developer workflows and documenting themselves to appear benign.
The proliferation of shadow IT remains a concern, with employees installing unauthorised plugins and tools, increasing organisational risk.
Cisco demonstrated that AI guardrails can be bypassed, allowing sensitive data to be extracted from chatbots trained on proprietary content.

Regulatory or Policy Developments Affecting the Security Industry

CISA and FEMA announced over $100 million in grants to help US states, tribes, and localities enhance cybersecurity resilience.
Illumina agreed to a $9.8 million settlement over allegations that its gene sequencing products supplied to the US government contained cybersecurity vulnerabilities.
Sean Cairncross has been confirmed by the US Senate as National Cyber Director.
Darktrace has acquired Mira Security, contributing to ongoing consolidation in the cybersecurity sector, with 44 M&A deals announced in July 2025.

Cybersecurity Brief – 2025-08-02

Sat, 02 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Akira ransomware has been observed exploiting SonicWall SSL VPN devices in a surge of attacks since late July 2025, reportedly targeting fully-patched devices and suggesting exploitation of a likely zero-day vulnerability.
Pi-hole disclosed a data breach resulting from exploitation of a vulnerability in the GiveWP WordPress donation plugin, exposing donor names and email addresses.
A malicious npm package, @kodane/patch-manager, generated using AI, was identified and removed after it was used to drain Solana cryptocurrency funds from over 1,500 victims.
Microsoft is investigating whether the ToolShell exploit was leaked via the Microsoft Active Protections Program (MAPP).
Russian state-sponsored APT group Secret Blizzard (Nobelium) conducted adversary-in-the-middle (AitM) attacks at the ISP level targeting foreign embassies in Moscow, leading to malware infections on diplomatic devices.
An Apple ID phishing scam in Ohio led to an in-person theft of $27,000 from a victim.

Newly Discovered Vulnerabilities

A high-severity remote code execution vulnerability, dubbed CurXecute, affecting almost all versions of the AI-powered Cursor code editor, has been patched. The flaw allowed attackers to execute commands via prompt injection.
SonicWall SSL VPN devices are reportedly being exploited via a previously unknown (zero-day) vulnerability in ongoing Akira ransomware attacks.
Recent vulnerabilities in Microsoft SharePoint Server have been exploited by threat actors to deploy bespoke command-and-control frameworks.

Notable Threat Actor Activity

Akira ransomware operators are actively exploiting SonicWall SSL VPN devices, with evidence suggesting the use of a zero-day vulnerability.
Threat actors are using fake Microsoft OAuth applications, leveraging the Tycoon Kit, to breach Microsoft 365 accounts and facilitate credential harvesting.
The threat actor Storm-2603 is exploiting Microsoft SharePoint vulnerabilities to deploy a DNS-controlled backdoor using a custom C2 framework (AK47 C2) as part of Warlock and LockBit ransomware campaigns.
Russian APT Secret Blizzard is conducting sophisticated AitM attacks against foreign diplomatic targets in Moscow.

Trends, Tools, or Tactics of Interest

Increased use of AI by attackers, including the creation of malicious npm packages for cryptocurrency theft.
Prompt injection remains a practical and exploitable attack vector against AI-powered developer tools.
Only about half of the code generated by large language models (LLMs) is considered secure, raising ongoing concerns about the security of AI-generated code.
The SIEM market is undergoing transformation as XDR platforms and generative AI impact security analytics.
New malware techniques such as “Shade BIOS” allow malware to persist and operate independently of the operating system, evading traditional detection and remediation.
Cybercriminals are increasingly targeting Gen Z, recognising young, digitally native workers as a distinct and vulnerable attack surface.

Regulatory or Policy Developments Affecting the Security Industry

The US Department of Homeland Security (DHS) has launched over $100 million in funding to strengthen community cyber defences.
A bipartisan US Senate bill has been introduced to create a national strategy for quantum cybersecurity migration, aimed at preparing federal agencies for quantum computing threats.
ISC2 has launched a new security certificate programme focused on AI expertise, covering AI fundamentals, ethics, and associated risks.
Microsoft has increased the maximum reward for its .NET bug bounty programme to $40,000 for valid reports of remote code execution or privilege escalation vulnerabilities.
Meta is sponsoring the upcoming Pwn2Own Ireland 2025 hacking contest, with a $1 million reward for a demonstrated zero-click WhatsApp exploit.

Cybersecurity Brief – 2025-04-29

Tue, 29 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Ransomware Attack
- Marks & Spencer experienced significant operational disruption, including outages and warehouse worker furloughs, due to a ransomware attack attributed to the “Scattered Spider” group.
Hitachi Vantara Ransomware Incident
- Hitachi Vantara took servers offline to contain an Akira ransomware attack, impacting business operations.
VeriSource Data Breach
- Employee benefits firm VeriSource confirmed that a February breach exposed personal information of 4 million individuals.
Urban One Data Breach
- Urban One, a major media company, disclosed a data breach following claims by a ransomware group.
World Uyghur Congress Targeted by Malware
- Senior members of the World Uyghur Congress were targeted in a sophisticated malware campaign via a trojanized UyghurEdit++ tool, indicating ongoing cyber-espionage efforts against exiled Uyghur groups.

Newly Discovered and Actively Exploited Vulnerabilities

SAP NetWeaver Visual Composer (CVE-2025-31324)
- Over 1,200 internet-facing SAP NetWeaver servers remain vulnerable to an actively exploited unauthenticated file upload flaw, allowing server hijacking. Attacks began before SAP released a patch.
Craft CMS Zero-Day Flaws
- Two newly disclosed critical vulnerabilities in Craft CMS are being exploited in the wild, with hundreds of servers likely compromised.
Broadcom Brocade Fabric OS and Commvault Web Server
- CISA added high-severity vulnerabilities in Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) database, indicating active exploitation.
Pymatgen 2024.1 Remote Code Execution
- A high-risk remote code execution vulnerability has been disclosed in Pymatgen 2024.1.
WooCommerce Phishing Campaign
- Attackers are distributing fake security patches to WooCommerce users, installing backdoors under the guise of critical updates.

Notable Threat Actor Activity

Earth Kurma APT
- Newly identified APT group “Earth Kurma” has targeted government and telecom sectors in Southeast Asia since June 2023, using rootkits and cloud-based data theft tools.
Scattered Spider
- Linked to the ransomware attack on Marks & Spencer, demonstrating continued targeting of UK-based large enterprises.
AI-Powered Phishing and Commodity Tools
- Increased use of AI-powered phishing kits and automated attack tools is lowering the barrier to entry for less skilled threat actors.

Trends, Tools, and Tactics

AI and Automation in Threat Landscape
- Attackers are leveraging AI, automation, and dark web resources to accelerate attack sophistication and frequency.
Record DDoS Attack Volumes
- Cloudflare reported a 358% year-over-year increase in DDoS attacks, highlighting a surge in volumetric and application-layer attacks.
Supply Chain and Update Risks
- Kali Linux users were warned of update failures due to a lost repository signing key, underscoring the importance of secure software supply chains.
Surveillance Risks in Connected Vehicles
- Law enforcement agencies are increasingly exploiting data from internet-connected vehicle features for surveillance purposes.

Regulatory and Policy Developments

CISA KEV Updates
- The U.S. CISA’s addition of new vulnerabilities to its KEV database may prompt UK organisations to review their own exposure and patch management processes.
US DoJ Data Security Program
- New compliance rules from the US Department of Justice will require organisations to reassess data sharing practices, with potential implications for multinational firms operating in or with the US.
Windscribe Legal Precedent
- Windscribe VPN was acquitted on charges regarding user data collection, reinforcing the legal standing of privacy-first service providers.

Other Notable Developments

Operational Disruptions
- Ukrainian state and banking services were temporarily disrupted due to a data centre power outage, affecting government and corporate customers.
Security Tooling
- Malwarebytes highlighted as a tool for combating online scams, reflecting ongoing emphasis on endpoint protection and anti-fraud solutions.

Summary of Key Risks

Ransomware remains a significant threat to large enterprises, with notable UK impact.
Actively exploited vulnerabilities in widely used enterprise software (SAP, Craft CMS, Broadcom, Commvault) require urgent attention.
AI-driven attack automation and phishing are reshaping the threat landscape, enabling more actors to launch sophisticated campaigns.
Regulatory changes and legal rulings are influencing data security and privacy practices globally.