Scattered Spider on DanSec Daily

Cybersecurity Brief – 2026-08-11

Tue, 11 Aug 2026 00:00:00 +0000

Major Incidents or Breaches

Hackers breached a Polish combined heat and power plant by exploiting a private cellular network (APN), leading to the shutdown of a steam turbine and water treatment system. This attack vector is notable as it marks the first known use of a private APN for access to operational technology networks in critical infrastructure^[7]^[15]^[41].
LexisNexis took its Diligence, Metabase API, and Newsdesk services offline following detection of unusual activity on servers managed by a third-party vendor^[22].
Valve notified European Steam hardware customers of a data breach resulting from a compromise of its shipping partner, CEVA Logistics, leading to theft of customer data^[23].
Corporate data was stolen from Levi Strauss following a social engineering attack that enabled threat actors to access and exfiltrate data from the computers of three employees^[43].

Newly Discovered Vulnerabilities

A critical Progress Kemp LoadMaster command injection vulnerability is being actively exploited in the wild, allowing unauthenticated remote attackers to execute arbitrary commands. CISA has issued an urgent warning to patch affected systems^[24]^[42].
Two recently patched SonicWall SMA1000 vulnerabilities, including a maximum-severity server-side request forgery flaw, are now being exploited by ransomware groups^[19].
A maximum-severity, unauthenticated, remote administrator access vulnerability in Metabase has been exploited as a zero-day. Metabase has released a patch, but the vulnerability does not yet have a CVE^[27]^[40].
High-severity vulnerabilities in ClamAV, Cisco’s anti-malware engine, have been disclosed with a public proof-of-concept. These bugs could be exploited remotely by unauthenticated attackers to cause denial-of-service conditions^[37].
New passkey attacks have been demonstrated that can recover synced private keys or bypass phishing-resistant multi-factor authentication without breaking underlying cryptography^[13].

Notable Threat Actor Activity

Storm-1175, a financially motivated Chinese threat actor and former Medusa ransomware affiliate, has deployed a new ransomware strain named StormEncryptor, likely using an N-central flaw as an entry vector^[10]^[18].
The North Korean Kimsuky group has developed an offline AI stack to enhance phishing campaigns and automate malware development, allowing operations without dependence on public AI services^[12].
The threat actor Head Mare is exploiting unpatched TrueConf server vulnerabilities to replace legitimate client installers with a backdoor named PhantomCore, targeting Russian companies in various sectors^[14].
A supply chain compromise at WordPress plugin vendor BdThemes allowed attackers to poison a remote JSON feed, creating rogue WordPress admin accounts on affected sites^[8]^[16].
Iranian-linked actors have widened attacks on water systems across at least a dozen US states, targeting internet-exposed industrial control systems at water facilities^[26]^[39].

Trends, Tools, or Tactics of Interest

Malware targeting Windows, macOS, and IoT devices continued to evolve in Q2 2026, with notable increases in sophistication and targeting breadth^[1].
Mobile threat trends in Q2 2026 include the rise of the Anatsa banking trojan and increased use of dropper techniques to bypass detection^[2].
AI-driven social engineering attacks are becoming more convincing and personalized, with attackers leveraging AI to increase the speed and effectiveness of phishing, credential theft, and social engineering operations^[3]^[20].
“Ghostjacking” is a newly described attack method where poisoned security logs or alerts are used to manipulate and hijack AI agents by embedding malicious instructions^[25]^[38].
Sophisticated iOS exploit chains, such as Coruna and DarkSword, are proliferating from nation-state use to wider adoption by organized cybercrime groups^[29].
A turnkey scam kit has been discovered that lowers the technical barrier for conducting online scams, making it easier for non-technical actors to launch fraudulent campaigns^[45].
A new phishing kit, dubbed “Bulletproof Redirector,” uses compromised legitimate websites and hidden directories to evade secure email gateways and facilitate credential theft^[4].
Attackers are increasingly exploiting supply chain weaknesses, as seen in the BdThemes and Metabase incidents, to compromise downstream targets^[8]^[16]^[27]^[40].
Security researchers have demonstrated that passkey-based authentication can be undermined through attacks on synchronization and device trust mechanisms^[13]^[20].
Increased scanning activity targeting Solana blockchain endpoints has been observed, indicating heightened interest in exploiting crypto-related infrastructure^[33].

Regulatory or Policy Developments Affecting the Security Industry

Outdated cybercrime laws are putting security researchers at risk, prompting calls for legal reforms to protect ethical hackers and good-faith security research^[30].
Microsoft Edge is dropping support for Manifest V2, which will impact popular privacy tools that rely on older extension technology, potentially reducing user privacy protections^[46].
Mozilla has issued a new Firefox GPG signing key after the previous subkey was inadvertently exposed on GitHub, requiring a key revocation^[34].

Sources

Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine - thehackernews.com
Hackers breached a small Polish energy plant via private APN last year - bleepingcomputer.com
Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility - securityweek.com
LexisNexis shuts down services after suspicious activity on servers - bleepingcomputer.com
Valve notifies Steam hardware customers of a data breach - bleepingcomputer.com
Corporate Data Stolen in Levi Strauss Cyberattack - securityweek.com
Critical Progress LoadMaster flaw now actively exploited in attacks - bleepingcomputer.com
CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability - securityweek.com
CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs - bleepingcomputer.com
Metabase SQL Zero-Day Attacks Could Have Wide Blast Radius - darkreading.com
Metabase Patches Vulnerability Exploited as Zero-Day - securityweek.com
Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC - securityweek.com
New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA - thehackernews.com
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw - thehackernews.com
New StormEncryptor ransomware used by former Medusa affiliate - bleepingcomputer.com
Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development - thehackernews.com
TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore - thehackernews.com
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins - thehackernews.com
BdThemes plugins supply-chain hack creates rogue WordPress admins - bleepingcomputer.com
Multistate Water System Attacks Widen, Iran Suspected - darkreading.com
New Jersey, Alabama Join States Targeted in Water Cyberattacks - securityweek.com
IT threat evolution in Q2 2026. Non-mobile statistics - securelist.com
IT threat evolution in Q2 2026. Mobile statistics - securelist.com
Introducing Real-Time Coaching in KnowBe4’s AI-Native Security Awareness Training - blog.knowbe4.com
When Credentials Are No Longer Enough: Device Trust in the AI Era - bleepingcomputer.com
'GhostJacking' Exposes Identity Governance Gaps in AI Agents - darkreading.com
‘Ghostjacking’ Attack Uses Poisoned Logs to Turn AI Agents Bad - securityweek.com
Coruna, DarkSword iOS Exploits Proliferate Globally - darkreading.com
New turnkey kit makes it easy for anyone to become a scammer - malwarebytes.com
The Blind Spot: How “Bulletproof” Phishing Redirectors Slip Past SEGs - blog.knowbe4.com
Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th) - isc.sans.edu
Outdated Cybercrime Laws Put Security Researchers at Risk - darkreading.com
Edge is dropping older extensions, affecting popular privacy tools - malwarebytes.com
Mozilla Issues New Firefox GPG Key Following Exposure - securityweek.com

Cybersecurity Brief – 2026-07-17

Fri, 17 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Coca-Cola disclosed a ransomware attack on its Fairlife dairy subsidiary, resulting in the suspension of US dairy production operations. The incident has not affected product quality or Canadian production^[19]^[33].
More than 20 Brazilian government websites were hijacked and used as malware delivery channels in an ongoing campaign attributed to PhantomEnigma^[10].
Genetic testing company 23andMe agreed to pay $18 million to settle claims from 43 attorneys general regarding its failure to protect customers’ genetic data in a major breach^[23].
Two members of the Scattered Spider cybercrime group were sentenced in the UK to five and a half years in prison each for their roles in the 2024 Transport for London hack, which compromised 148 systems and resulted in £29 million in losses^[5]^[24]^[35].

Newly Discovered Vulnerabilities

CISA added a newly patched Microsoft SharePoint Server remote code execution vulnerability (CVE-2026-58644) to its Known Exploited Vulnerabilities catalog following reports of active exploitation^[4]^[32].
CISA ordered federal agencies to urgently patch two actively exploited vulnerabilities in the Fortinet FortiSandbox platform and a critical Oracle E-Business Suite financial application flaw due to ongoing attacks^[17]^[26].
A token exchange flaw in n8n’s workflow automation platform allowed attackers to log in as users from other trusted identity providers when multiple external token issuers were configured^[7].
A flaw in the Anthropic Claude Chrome extension could allow malicious browser extensions to simulate user clicks and trigger AI actions, potentially leading to abuse of Claude’s access^[20].
Splunk and Zoom released patches for critical vulnerabilities that could allow attackers to access credentials, take over accounts, and escalate privileges^[39].
F5 issued patches for multiple vulnerabilities in NGINX and BIG-IP products, which could be exploited to modify configurations, restart processes, cross security boundaries, leak memory, and execute arbitrary code^[40].
Security updates were released for Adobe, Chrome, Firefox, VMware, and Zoom to address various vulnerabilities^[43].
An unpatched flaw in Shark RV2320EDUS robot vacuums allows attackers to extract certificates from the device and remotely execute root commands on other vacuums within the same AWS region^[14].

Notable Threat Actor Activity

The HelloNet campaign targeted large Russian organizations by delivering new malicious modules via the ViPNet update system, a tool for secure network creation^[1].
The GoSerpent threat group conducted two-phase attacks against Southeast Asian government entities, using the GoSerpent backdoor, Stowaway RAT, ThumbcacheService, and other tools for data theft^[2].
Russian threat actor UAT-11795 is distributing trojanized versions of WebEx and Zoom to deploy the Starland RAT, targeting credentials and cryptocurrency theft^[27].
The PhantomEnigma campaign leveraged compromised Brazilian government websites for malware delivery^[10].
The Spirals ransomware group completed a network intrusion, data theft, and encryption in under 24 hours, demonstrating rapid attack capability^[28].
A new modular malware named TELEPUZ is spreading via ClickFix-infected websites to steal data and execute remote commands^[8].
The OkoBot framework is delivering over 20 payloads in attacks targeting theft of cryptocurrency wallet seed phrases, credentials, and sensitive data^[21].
ClickLock Stealer, a new macOS infostealer, forces victims to reveal their login password by terminating all visible processes every 210 milliseconds until the password is entered. It has targeted at least 100 users for password and cryptocurrency theft^[9]^[18]^[37].
Advanced malware Daxin, attributed to a China-linked actor, resurfaced in a Taiwan manufacturing firm, accompanied by a new pre-login SYSTEM backdoor called Stupig^[12].

Trends, Tools, or Tactics of Interest

Multiple incidents highlight the increasing speed of ransomware operations, with Spirals ransomware actors completing attacks in less than 24 hours^[28].
Over 1 million phishing emails have used hidden text to evade AI-powered security filters, exploiting the limitations of large language models in email security^[30].
Attackers are leveraging hijacked legitimate government websites as malware delivery platforms, as seen in the PhantomEnigma campaign^[10].
There is a growing trend of threat actors using social engineering techniques combined with technical methods, such as ClickLock Stealer’s approach of process killing to coerce password entry on macOS^[9]^[18]^[37].
The emergence of agentic AI and AI-powered tools is prompting a re-evaluation of traditional security workflows, with calls for new approaches to identity and automation security^[22]^[29]^[36].
New research describes agent data injection attacks, where malicious data can cause AI agents to misclick or execute attacker-controlled commands^[11].
OpenAI disclosed GPT-Red, an automated red-teaming model designed to scale prompt injection vulnerability discovery and remediation before public deployment of new models^[15].
AI-assisted tools are increasingly used for bug discovery, but human expertise remains essential for verification^[13].

Regulatory or Policy Developments Affecting the Security Industry

CISA issued multiple urgent directives for federal agencies to patch actively exploited vulnerabilities in Microsoft SharePoint, Fortinet FortiSandbox, and Oracle E-Business Suite^[4]^[17]^[26]^[32].
23andMe’s $18 million settlement with 43 US states over a genetics data breach underscores increased regulatory attention on consumer data protection in the genetics and health sectors^[23].
Chinese cybersecurity firms are facing growing military procurement bans imposed by the country’s military, unrelated to product or technical failures^[41].
Microsoft announced that Windows 10 Enterprise LTSB 2016 and Windows 11 24H2 Home and Pro editions will reach end of support in 90 days, impacting update availability and security support for these versions^[25].

Sources

Coca-Cola says Fairlife ransomware attack halts US dairy production - bleepingcomputer.com
Coca-Cola Suspends US Fairlife Production Due to Ransomware Attack - securityweek.com
20+ Hijacked Government Websites Became an Attack Channel - thehackernews.com
23andMe to pay $18 million in new genetics data breach settlement - bleepingcomputer.com
Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack - thehackernews.com
Scattered Spider members behind TfL hack get five years in prison - bleepingcomputer.com
Two Scattered Spider Hackers Sentenced to Jail in UK - securityweek.com
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV - thehackernews.com
Fresh SharePoint Vulnerability Exploited Soon After Disclosure - securityweek.com
CISA urges immediate action on actively exploited Fortinet flaws - bleepingcomputer.com
CISA orders feds to patch actively exploited Oracle flaw by Saturday - bleepingcomputer.com
n8n Token Exchange Flaw Could Let Attackers Log In as Users From Another Issuer - thehackernews.com
Claude Chrome extension flaw lets malicious extensions trigger AI actions - bleepingcomputer.com
Splunk, Zoom Patch Critical Vulnerabilities - securityweek.com
F5 Patches Multiple NGINX, BIG-IP Vulnerabilities - securityweek.com
Security updates available for Adobe, Chrome, Firefox, VMWare, and Zoom - malwarebytes.com
Unpatched Shark Vacuum Flaw Could Let Attackers Control Other Vacuums Region-Wide - thehackernews.com
HelloNet campaign — new malicious modules launched through the ViPNet update system - securelist.com
GoSerpent: a persistent threat evolves with sophisticated data collection and exfiltration - securelist.com
Russian hackers trojanize WebEx, Zoom apps to push Starland malware - bleepingcomputer.com
New Spirals ransomware encrypts victim network in under 24 hours - bleepingcomputer.com
New TELEPUZ Malware Spreads via ClickFix to Steal Data and Run Commands - thehackernews.com
New OkoBot framework deploys 20 payloads to steal data, crypto - bleepingcomputer.com
New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password - thehackernews.com
New ClickLock macOS malware traps users into revealing login password - bleepingcomputer.com
‘ClickLock Stealer’ Bypasses macOS Security With Social Engineering, Process Killing - securityweek.com
Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor - thehackernews.com
1M+ Emails Use Hidden Text to Dupe AI Security Filters - darkreading.com
AI Agents Broke the Security Playbook. Here's What Replaces It. - bleepingcomputer.com
Agentic AI Is Untamable: Ask the Right Security Questions - darkreading.com
AI Data Centers Are Being Built Faster Than They Can Be Secured - securityweek.com
New Agent Data Injection Attack Can Make AI Agents Misclick or Run Attacker Commands - thehackernews.com
OpenAI’s GPT-Red Automates Prompt Injection Testing to Harden GPT-5.6 Sol - thehackernews.com
AI Can Find Bugs, But Human Knowledge Still Proves Them - thehackernews.com
China’s Top Cybersecurity Firms Hit by Mounting Military Procurement Bans - securityweek.com
Windows 11 24H2 Home and Pro reach end of support in 90 days - bleepingcomputer.com

Cybersecurity Brief – 2026-07-04

Sat, 04 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Medtronic experienced a data breach in April, with threat actor ShinyHunters accessing corporate IT systems and stealing personal and medical information of 3.8 million individuals ^[15].
A joint operation, including Google, disrupted the NetNut residential proxy network, severing access to 2 million compromised Android devices, smart TVs, and streaming boxes ^[10].
Former Member of the European Parliament Stelios Kouloglou was repeatedly targeted with Pegasus spyware during his tenure investigating spyware abuses ^[9].

Newly Discovered Vulnerabilities

Seven unpatched vulnerabilities were disclosed in the FatFs filesystem library, which is embedded in millions of devices using FAT and exFAT formats for USB and SD card access ^[4].
A Linux kernel flaw, CVE-2026-46242 (“Bad Epoll”), allows unprivileged users to escalate privileges to root on Linux desktops, servers, and Android devices ^[5].

Notable Threat Actor Activity

The Armored Likho APT group has been linked to spear-phishing campaigns using AI-generated loaders and the new BusySnake Stealer, targeting government agencies and the electric power sector in Russia, Brazil, and Kazakhstan ^[1]^[8].
North Korea-linked actors have distributed malicious npm packages masquerading as Rollup polyfills to steal developer secrets and enable remote access ^[7].
The INC ransomware-as-a-service operation has targeted the legal sector, with hundreds of claimed victims in 2026 ^[2].
Researchers identified a new modular malware framework called Avalon, distributed via a multi-stage phishing chain and capable of deploying CrownX ransomware ^[6].
ARToken, a new phishing-as-a-service platform affiliated with EvilTokens, has exposed a sophisticated toolkit aimed at compromising Microsoft 365 accounts ^[11].
A Canadian hacker associated with Anonymous was jailed, while other cases included open source zero-day disclosures and sentencing for ATM jackpotting ^[13].
A 19-year-old alleged member of Scattered Spider, linked to over 100 network intrusions and $100 million in ransom payments, was extradited to the US ^[16].
Two new campaigns were observed: a verified X (Twitter) ad distributing Mac malware, and the ConsentFix campaign stealing Microsoft accounts, both relying on social engineering tactics ^[17].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging AI, including agentic LLMs, to automate complex, multi-stage intrusions such as ransomware attacks, as demonstrated via Langflow ^[14].
Chinese-developed large language models (LLMs) are advancing rapidly, broadening the capability gap between attackers and defenders ^[12].
AI-generated loaders and modular, multi-stage phishing chains are being used to bypass traditional security controls ^[1]^[6].
Social engineering is increasingly favoured over software exploits for compromising devices and accounts ^[17].
The security of open source software is under renewed scrutiny following the public release of zero-day vulnerabilities ^[13].

Regulatory or Policy Developments Affecting the Security Industry

The targeting of a European Parliament member with Pegasus spyware occurred while the individual was investigating spyware abuses, highlighting ongoing policy and oversight challenges related to commercial spyware use in Europe ^[9].

Sources

Medtronic Data Breach Impacts 3.8 Million People - securityweek.com
NetNut proxy network disrupted, 2 million infected devices cut off - bleepingcomputer.com
European Parliament Member Investigating Spyware Was Hacked With Pegasus - thehackernews.com
Unpatched Flaws Disclosed in Filesystem Bundled Into Millions of Embedded Devices - thehackernews.com
New "Bad Epoll" Linux Kernel Flaw Lets Unprivileged Users Gain Root, Hits Android - thehackernews.com
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign - securelist.com
Armored Likho Targets Government Agencies, Power Sector with BusySnake Stealer - thehackernews.com
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer Secrets - thehackernews.com
INC Ransomware Gang Targets the Legal Sector - blog.knowbe4.com
New Avalon Malware Framework Packs CrownX Ransomware Capabilities - thehackernews.com
ARToken PhaaS exposes EvilTokens' Microsoft 365 phishing toolkit - bleepingcomputer.com
In Other News: Canadian Hacker Jailed, Open Source Zero-Days, Two Sentenced for ATM Jackpotting - securityweek.com
Alleged Scattered Spider Hacker Extradited to US - securityweek.com
Verified X ad spreads Mac malware, while ConsentFix steals Microsoft accounts - malwarebytes.com
Agentic AI Used to Conduct Ransomware Attack via Langflow - securityweek.com
Chinese LLMs Broaden the Gap Between Attackers & Defenders - darkreading.com

Cybersecurity Brief – 2026-07-03

Fri, 03 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Google, in coordination with the FBI and industry partners, disrupted the NetNut residential proxy network, which relied on millions of compromised home devices to anonymize cybercriminal and nation-state activity. Hundreds of domains associated with NetNut were seized, significantly degrading the network’s operations ^[4]^[25]^[26].
A dual US-Estonian citizen alleged to be a member of the Scattered Spider hacking collective was extradited to the United States to face charges ^[18].
European Parliament members investigating Pegasus spyware were themselves targeted, with Citizen Lab confirming Pegasus infection on one investigator’s phone ^[24].

Newly Discovered Vulnerabilities

A critical vulnerability in the Cursor AI code editor (DuneSlide) allows zero-click prompt injection attacks that escape the editor’s sandbox and can execute arbitrary code at the operating system level ^[27].
A new WinRAR security flaw has been patched that could allow attackers to take control of a user’s computer. The lack of automatic updates in WinRAR increases the risk of unpatched systems ^[37].
A vulnerability in Apple’s Hide My Email feature, first reported a year ago, remains unpatched and exposes user email addresses ^[35].

Notable Threat Actor Activity

Ransomware groups, including those associated with Anubis, are exploiting the Citrix Bleed 2 (CVE-2025-5777) vulnerability for initial access and are also leveraging bring-your-own-vulnerable-driver (BYOVD) and supply chain credential theft tactics ^[5]^[28].
The threat actor ToddyCat is deploying new Umbrij malware that abuses OAuth to access Gmail accounts via the Google API, enabling covert email access ^[7].
Attackers linked to the FortiBleed campaign have harvested credentials from hundreds of thousands of FortiGate firewalls and are collaborating with the INC and Lynx ransomware gangs, also exploiting a Nextcloud zero-day vulnerability ^[21]^[30].
Ransomware operators are running campaigns that impersonate Interpol, targeting small businesses globally using basic social engineering techniques ^[22].
KnowBe4 ThreatLabs tracked phishing campaigns targeting the FIFA World Cup 2026, with cybercriminals leveraging the event for credential theft and malware distribution ^[3].
ClickFix and ConsentFix attacks are hijacking Microsoft 365 accounts in seconds by exploiting OAuth flows and fake prompts to bypass MFA protections ^[13]^[36].
Fake Google and Cloudflare verification pages are distributing multiple malware families, including infostealers and a new malware loader, through ClickFix-style social engineering ^[36].

Trends, Tools, or Tactics of Interest

Immediate exploitation of newly disclosed vulnerabilities, such as CitrixBleed, is increasing, with attackers using public proof-of-concept code to target NetScaler appliances ^[28].
The first fully autonomous ransomware attack orchestrated by an AI agent (JADEPUFFER) was observed, exploiting a Langflow RCE vulnerability to automate a database ransomware campaign from start to finish ^[9].
ConsentFix and ClickFix attacks demonstrate a trend of using rapid OAuth token theft and social engineering to bypass MFA and compromise cloud accounts ^[13]^[36].
Opera has introduced a Paste Protect feature to mitigate ClickFix-style attacks by blocking malicious command execution via social engineering ^[17].
Context manipulation attacks, such as BioShocking, can trick agentic browsers into exfiltrating sensitive credentials by bypassing their safety guardrails ^[33].
Compromise assessment projects highlight persistent threats, missed incidents, and gaps in incident response across organizations, emphasizing the need for improved detection and response practices ^[1].
Identity lifecycle management models are being challenged by the proliferation of AI agents, which lack traditional employment records and departure dates, complicating access governance ^[8].
IBM and Red Hat have launched Project Lightwell, assigning 20,000 engineers to address open-source software supply chain risks identified by Anthropic’s Mythos AI bug-finding technology ^[23].
There is a shift in cybercrime pressure toward small and medium-sized businesses in Australia as larger institutions improve safeguards and regulatory compliance ^[19].

Regulatory or Policy Developments Affecting the Security Industry

The Court of Justice of the European Union dismissed Google’s final appeal against a €4.1 billion antitrust fine related to Android’s promotion of Chrome and search, upholding significant regulatory action against the company ^[12].
The Trump administration lifted restrictions on Anthropic’s Claude AI models following cybersecurity concerns, making Claude Fable 5 widely available again ^[31].
Apple has revised its long-standing patch policy to accelerate patch cycles in response to attackers leveraging AI to reduce time to exploit, indicating a move toward more rapid security updates ^[20].

Sources

Google Disrupts NetNut Residential Proxy Network Spanning 2 Million Home Devices - thehackernews.com
FBI Seizes NetNut Proxy Platform, Popa Botnet - krebsonsecurity.com
Google, FBI Disrupt NetNut Residential Proxy Network Powered by Millions of Devices - securityweek.com
Alleged Scattered Spider hacker extradited to the United States - bleepingcomputer.com
EU Politicians Investigated Pegasus Spyware. Then It Ended Up on One of Their Phones - wired.com
Critical Cursor AI Code Editor Flaws Could Lead to OS-Level Remote Code Execution - securityweek.com
WinRAR flaw could allow attackers to take control of your computer - malwarebytes.com
Apple’s Hide My Email doesn’t hide it very well - malwarebytes.com
Ransomware Groups Turn to Citrix Bleed 2, BYOVD, and Supply Chain Credentials - thehackernews.com
New CitrixBleed Vulnerability Exploited Immediately After Public Disclosure - securityweek.com
ToddyCat-Linked Umbrij Malware Abuses OAuth to Access Gmail via Google API - thehackernews.com
FortiBleed Actors Collaborating With Inc, Lynx Ransomware Gangs - darkreading.com
FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks - securityweek.com
Ransomware Thugs Masquerade as Interpol to Entice Small Biz - darkreading.com
Cybercriminals Are Targeting the FIFA World Cup 2026 - blog.knowbe4.com
ConsentFix and ClickFix: How Microsoft 365 Accounts are Hijacked in 3 Seconds - bleepingcomputer.com
Fake Google and Cloudflare verification pages spread multiple malware families - malwarebytes.com
AI Agent Exploits Langflow RCE to Automate Database Ransomware Attack - thehackernews.com
Opera rolls out Paste Protect feature to fight ClickFix attacks - bleepingcomputer.com
‘BioShocking’ Attack Tricks AI Browsers Into Stealing Credentials - securityweek.com
Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects - securelist.com
Identity Lifecycle Management Wasn't Built for AI Agents - thehackernews.com
Anthropic's AI Finds Bugs. IBM Bets $5B It Can Fix Them. - darkreading.com
Aussies Face Reduced Cybercrime Risk, as Pressure Shifts to SMBs - darkreading.com
Google loses final appeal to overturn €4.1 billion EU fine - bleepingcomputer.com
Trump Administration Lifts Restrictions on Anthropic’s Claude Models After Cybersecurity Alarm - securityweek.com
Apple Reverses Age-Old Patch Policy to Keep Up With AI - darkreading.com

Cybersecurity Brief – 2026-07-02

Thu, 02 Jul 2026 00:00:00 +0000

Major Incidents or Breaches

Medtronic has notified customers of a data breach resulting from unauthorized access to personal data, attributed to the ShinyHunters threat actor group ^[19].
Kubota North America Corporation disclosed that hackers had access to parts of its network systems for over a month earlier this year ^[21].
The US Department of Homeland Security confirmed a breach of the Homeland Security Information Network (HSIN), a sensitive information-sharing platform used by government agencies ^[23].
Over 900 Oracle E-Business Suite instances have been found exposed online and are subject to ongoing attacks exploiting a critical security flaw ^[27].

Newly Discovered Vulnerabilities

Adobe released patches for multiple critical vulnerabilities in ColdFusion and Campaign Classic, including seven flaws rated CVSS 10.0 that could lead to arbitrary code execution ^[13]^[37].
Citrix issued patches for NetScaler appliances, addressing six vulnerabilities including a new HTTP/2 Bomb attack and a high-severity CitrixBleed-style information disclosure bug ^[38].
Apple released security updates for iOS, macOS, and Safari, addressing dozens of vulnerabilities affecting WebKit, the kernel, WebRTC, and other components ^[40].
Google released a Chrome update fixing 382 security bugs, with 15 rated as critical ^[46].
Argo CD has an unpatched vulnerability in its repo-server component that allows unauthenticated attackers to execute code if they can access the component ^[8].
Microsoft SharePoint Server vulnerability CVE-2026-45659 has been added to the CISA Known Exploited Vulnerabilities catalog following reports of active exploitation ^[7].
Progress Kemp LoadMaster is affected by a critical pre-authentication remote code execution flaw that is currently seeing active exploitation attempts ^[15].

Notable Threat Actor Activity

Kaspersky researchers identified a large-scale campaign using compromised ScreenConnect software, distributed via SEO-poisoned sites, to deliver AsyncRAT malware ^[1]^[10].
The FortiBleed credential theft campaign has been linked to the INC and Lynx ransomware groups, indicating that stolen Fortinet credentials are intended to facilitate future network intrusions and ransomware attacks ^[20].
A 19-year-old suspected member of the Scattered Spider hacking group has been extradited from Finland to the US to face hacking and fraud charges ^[9].
The Ousaban banking trojan is targeting users in Spain and Portugal with phishing PDF lures to infect Windows systems ^[12].
A new campaign is delivering the PureLogs information stealer through a multi-stage malware chain leveraging Blogger pages and social engineering ^[11].
Multiple weaponized proof-of-concept (PoC) exploits on GitHub are distributing the ChocoPoC remote access trojan, targeting vulnerability researchers ^[6]^[22].

Trends, Tools, or Tactics of Interest

Attackers are using fingerprinting via user-agent data to adapt phishing payloads to the victim’s device and operating system, increasing compromise rates ^[30].
ClickFix, a social engineering technique, is reported as a dominant method for malware delivery ^[31].
AI-generated browser ransomware has been observed abusing the Chromium API across Windows, Linux, macOS, and Android, combining novel attack paths with real browser capabilities ^[16]^[43].
A fake Perplexity Chrome extension, “Search for perplexity ai,” was found to be spying on user searches and requires manual removal ^[44].
Large language models (LLMs) are being exploited for “phantom squatting,” where hallucinated domains for legitimate brands are registered by attackers for supply chain attacks ^[32].
Two vulnerabilities in the AI code editor Cursor could allow prompt injection to escape the sandbox and execute arbitrary commands on a developer’s machine ^[14].
Phishing attacks have exposed employee data at 86 percent of Fortune 100 companies in the past year, with technology, airline, and automotive sectors most affected ^[4].
Hackers conducted over 81 million password-spraying login attempts against Microsoft 365 accounts in a two-week period ^[25].

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced it is accelerating its post-quantum cryptography roadmap, targeting a transition by 2029 due to advances in quantum computing ^[18].
The US Federal Trade Commission fined Amazon $2.25 million for withholding transaction records from identity theft victims, impacting fraud investigations ^[29].
Microsoft introduced new Teams admin policies requiring organizer approval for external AI bots in meetings, enhancing control over automated participants ^[36].

Sources

Medtronic notifies customers impacted by ShinyHunters data breach - bleepingcomputer.com
Kubota says hackers had month-long access to network systems - bleepingcomputer.com
DHS confirms hackers breached HSIN info-sharing platform - bleepingcomputer.com
Over 900 Oracle E-Business instances exposed to ongoing attacks - bleepingcomputer.com
Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic - thehackernews.com
Adobe Patches Critical ColdFusion, Campaign Classic Vulnerabilities - securityweek.com
Citrix Patches NetScaler Vulnerabilities, Including New ‘HTTP/2 Bomb’ Attack - securityweek.com
Apple Patches Dozens of Vulnerabilities Across iOS, macOS, and Safari - securityweek.com
Chrome needs another whopper update to fix 382 security bugs - malwarebytes.com
Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters - thehackernews.com
SharePoint RCE CVE-2026-45659 Added to CISA KEV After Active Exploitation - thehackernews.com
Progress Kemp LoadMaster Pre-Auth RCE Flaw Faces Active Exploitation Attempts - thehackernews.com
The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign - securelist.com
SEO-Poisoned Software Sites Abuse ScreenConnect to Deploy AsyncRAT - thehackernews.com
FortiBleed credential-theft campaign linked to Lynx ransomware - bleepingcomputer.com
19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges - thehackernews.com
Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures - thehackernews.com
VEIL#DROP Malware Chain Uses Blogger Platform to Deliver PureLogs Stealer - thehackernews.com
New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos - thehackernews.com
New ChocoPoC malware targets researchers via trojanized PoC exploits - bleepingcomputer.com
Crafty Phishing Campaigns Auto-Adapt to Victim's Device, OS - darkreading.com
And the Winner in Dominant Malware Delivery? ClickFix - darkreading.com
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android - thehackernews.com
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique - research.checkpoint.com
Fake Perplexity Chrome extension spies on your searches - malwarebytes.com
'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat - darkreading.com
Critical Cursor Flaws Could Let Prompt Injection Escape Sandbox and Run Commands - thehackernews.com
Phishing Exposes Employee Data at 86% of Fortune 100 Companies - blog.knowbe4.com
Hackers target Microsoft 365 accounts with 81 million login attempts - bleepingcomputer.com
Microsoft Accelerates Post-Quantum Cryptography Shift to 2029 - thehackernews.com
Amazon fined $2.25M for withholding evidence from fraud victims - bleepingcomputer.com
Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings - securityweek.com

Cybersecurity Brief – 2026-06-24

Wed, 24 Jun 2026 00:00:00 +0000

Major Incidents or Breaches

Tata Electronics confirmed a cyberattack that impacted parts of its IT infrastructure, with hackers leaking company data online ^[11].
Healthtech firm Xsolis suffered a data breach impacting nearly 1.4 million individuals after attackers gained access via a phishing attack ^[13].
LastPass reported a data breach resulting from the Klue supply chain attack, where attackers used stolen OAuth tokens to access customer data in its Salesforce environment ^[17]^[19].
The scope of Salesforce attacks has expanded, with more victims reporting data breaches as a result of attackers leveraging Klue’s compromised OAuth tokens ^[19].
Dialog, a private events group, experienced a data exposure incident due to a misconfigured website, leaving member information accessible without evidence of a break-in ^[23].
The Texas Parks and Wildlife Department suffered a breach at a third-party vendor, exposing passport and driver’s license data of over three million Texans ^[39].

Newly Discovered Vulnerabilities

A critical SSRF vulnerability (CVE-2026-20230) in Cisco Unified Communications Manager is being actively exploited in the wild after public proof-of-concept code was released ^[3]^[10]^[28].
Researchers found data exposure vulnerabilities in the Dify AI platform, potentially allowing attackers to read private chats, preview documents, and access internal APIs across over one million apps ^[31].
An eight-year-old high-severity use-after-free vulnerability in Samsung’s KNOX security framework affected Galaxy devices from S9 through S25, exposing millions of devices to kernel-level attacks ^[32].
The FFmpeg PixelSmash flaw enables remote code execution via crafted media files when processed by applications using the libavcodec library ^[35].
Malicious npm packages masquerading as PostCSS tools have been identified delivering a Windows-based remote access trojan (RAT) ^[9].
A new macOS ClickFix attack uses terminal commands to silently mount DMG files and deploy infostealer malware without user interaction ^[14].

Notable Threat Actor Activity

The Russian-speaking FortiBleed initial access broker is behind a large-scale campaign targeting over 430,000 FortiGate firewalls globally, harvesting 110 million credentials using a Golang-based sniffer ^[4]^[22].
A newly identified extortion group, “Pink,” is using voice phishing and IT support impersonation calls to breach organizations, possibly as a rebrand of previous extortion actors ^[2].
Two members of the Scattered Spider cybercrime group pleaded guilty to hacking Transport for London in 2024, following an attack that disrupted public transport systems ^[15]^[24].
SocGholish, linked to Evil Corp, continues using traffic distribution systems (TDSs) to facilitate initial access for cybercrime operations ^[21].

Trends, Tools, or Tactics of Interest

Attackers are increasingly leveraging workplace collaboration tools such as Microsoft Teams to launch social engineering and phishing attacks ^[1].
Fake AI agent skills have been shown to pass security scans and reach thousands of corporate and individual agents via skill marketplaces and social media promotion ^[5].
There is a trend of attackers exploiting newly disclosed vulnerabilities rapidly, often before organizations can patch, with security teams urged to validate exploitability as soon as vulnerabilities are public ^[16].
GitHub updated its actions/checkout to block common pwn request attack patterns, targeting the misuse of pull_request_target workflows in CI/CD pipelines ^[7].
Malicious pull requests, dubbed “Cordyceps,” are threatening developer workflows across multiple major platforms including Azure Sentinel, Google’s AI Agent Development Kit, Apache Doris, Cloudflare Workers SDK, and Python Software Foundation’s Black ^[20].
Dragos introduced EmberAI, an AI-driven capability for operational technology security, leveraging its OT cybersecurity dataset ^[30].
OpenAI has shifted its cybersecurity focus toward patching vulnerabilities over merely discovering them, expanding its Daybreak initiative with new tools and partnerships ^[36].

Regulatory or Policy Developments Affecting the Security Industry

A US executive order signed on June 22 mandates federal agencies to migrate high-value assets and high-impact systems to post-quantum cryptography by 2030, with specific deadlines for key establishment and digital signature protections ^[6].

Sources

Tata Electronics confirms cyberattack as hackers leak data - bleepingcomputer.com
Healthtech firm Xolis suffers data breach impacting 1.4 million people - bleepingcomputer.com
LastPass confirms data breach in Klue supply chain attack - bleepingcomputer.com
Scope of Salesforce Attacks Expands as Icarus Leaks Data - darkreading.com
Dialog Claims It Was Hacked. A Misconfigured Website Left Its Members Exposed - wired.com
Hackers steal passport and driver’s license data of 3 million Texans - malwarebytes.com
Cisco Unified CM Flaw Exploited After PoC Reveals File-Write Path to Root - thehackernews.com
Cisco Unified CM flaw CVE-2026-20230 now exploited in attacks - bleepingcomputer.com
Hackers Exploiting Cisco Unified CM Vulnerability - securityweek.com
Data Exposure Flaws Threaten Dify AI Platform Used by 1 Million Apps - securityweek.com
Eight-Year-Old Samsung KNOX Flaw Exposed Millions of Galaxy Devices to Kernel Attacks - securityweek.com
FFmpeg PixelSmash Flaw Allows RCE on Video Players, Media Servers, NAS Appliances - securityweek.com
Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RAT - thehackernews.com
New macOS ClickFix attack silently mounts DMGs to push infostealer - bleepingcomputer.com
FortiBleed Targeted FortiGate Firewalls in 110 Million-Credential Harvesting Operation - thehackernews.com
FortiBleed Attackers Turn Firewalls Into Credential Stealers as Heists Persist - darkreading.com
New Extortion Brand Uses IT Impersonation to Breach Organizations - blog.knowbe4.com
Scattered Spider members plead guilty to hacking Transport for London - bleepingcomputer.com
Scattered Spider Hackers Plead Guilty on Day 1 of Trial - krebsonsecurity.com
SocGholish Takedown Highlights Malicious TDS Threats - darkreading.com
Social Engineering Attacks Abuse Workplace Collaboration Tools - blog.knowbe4.com
Fake AI Agent Skill Passed Security Scans and Reportedly Reached 26,000 Agents - thehackernews.com
The Exploit Doesn't Exist. You Can Still Prove It Works Against You - bleepingcomputer.com
GitHub Updates actions/checkout to Block Common Pwn Request Attack Patterns - thehackernews.com
'Cordyceps': Mushrooming Malicious Pull Requests Threaten Developer Workflows - darkreading.com
Dragos Unveils AI for OT Security - securityweek.com
OpenAI Refocuses Cybersecurity Efforts on Patching Over Discovery - securityweek.com
Trump Order Sets 2030 Deadline for Federal Post-Quantum Crypto Migration - thehackernews.com

Cybersecurity Brief – 2026-05-18

Mon, 18 May 2026 00:00:00 +0000

Major Incidents or Breaches

Grafana has confirmed a data breach following claims by the Coinbase Cartel group, which is reportedly linked to ShinyHunters, Scattered Spider, and Lapsus$ threat actors. The extent of data accessed or stolen has not yet been fully disclosed ^[11].
Historical analysis has revealed that the fast16 malware, a Lua-based tool predating Stuxnet, was specifically designed to sabotage nuclear weapons testing simulations ^[1].

Newly Discovered Vulnerabilities

A critical vulnerability in NGINX (CVE-2026-42945) affecting both NGINX Plus and NGINX Open has been publicly disclosed and is now being actively exploited in the wild. The flaw can cause worker process crashes and, if Address Space Layout Randomization (ASLR) is disabled, may enable remote code execution ^[3]^[12].
The “MiniPlasma” Windows zero-day vulnerability allows local privilege escalation to SYSTEM level on fully patched Windows systems. A proof-of-concept exploit has been released publicly ^[2]^[7].
A local privilege escalation vulnerability in the Linux kernel’s rxgk module, known as DirtyDecrypt, now has a public proof-of-concept exploit. Successful exploitation grants root access on affected Linux systems ^[5].

Notable Threat Actor Activity

The Coinbase Cartel cybercrime group, with reported links to ShinyHunters, Scattered Spider, and Lapsus$, is implicated in the recent Grafana breach ^[11].
The Tycoon2FA phishing kit has introduced device-code phishing techniques and leverages Trustifi click-tracking URLs to compromise Microsoft 365 accounts ^[8].

Trends, Tools, or Tactics of Interest

AI agents are increasingly capable of autonomously discovering and exploiting obscure vulnerabilities, coinciding with a surge in potentially insecure AI-generated code. This trend is compelling defenders to adapt their security strategies ^[9].
At the Pwn2Own Berlin 2026 contest, researchers demonstrated exploits for 47 zero-day vulnerabilities across Windows, Linux, VMware, Nvidia, and AI products, earning a combined $1.3 million in rewards ^[6]^[13].

Regulatory or Policy Developments Affecting the Security Industry

South Korea will use its upcoming local elections as a test for new regulations intended to curb the spread of deepfakes, providing an early case study on the efficacy of legal controls against AI-driven disinformation ^[10].

Sources

Grafana Confirms Breach After Hackers Claim They Stole Data - securityweek.com
Pre-Stuxnet Fast16 Malware Tampered with Nuclear Weapons Simulations - thehackernews.com
NGINX CVE-2026-42945 Exploited in the Wild, Causing Worker Crashes and Possible RCE - thehackernews.com
Exploitation of Critical NGINX Vulnerability Begins - securityweek.com
MiniPlasma Windows 0-Day Enables SYSTEM Privilege Escalation on Fully Patched Systems - thehackernews.com
New Windows 'MiniPlasma' zero-day exploit gives SYSTEM access, PoC released - bleepingcomputer.com
Exploit available for new DirtyDecrypt Linux root escalation flaw - bleepingcomputer.com
Tycoon2FA hijacks Microsoft 365 accounts via device-code phishing - bleepingcomputer.com
The Boring Stuff is Dangerous Now - darkreading.com
Hackers earn $1,298,250 for 47 zero-days at Pwn2Own Berlin 2026 - bleepingcomputer.com
Hackers Earn $1.3 Million at Pwn2Own Berlin 2026 - securityweek.com
Can Laws Stop Deepfakes? South Korea Aims to Find Out - darkreading.com

Cybersecurity Brief – 2026-05-03

Sun, 03 May 2026 00:00:00 +0000

Major Incidents or Breaches

The “Sorry” ransomware group is conducting mass exploitation of a critical cPanel vulnerability (CVE-2026-41940) to breach websites and encrypt data.

Newly Discovered Vulnerabilities

CISA has added CVE-2026-31431, a Linux root access vulnerability, to its Known Exploited Vulnerabilities (KEV) catalog. The flaw impacts multiple Linux distributions and is currently being actively exploited.

Notable Threat Actor Activity

A Finnish teenager has been formally charged in connection with the Scattered Spider hacking spree.
The “Sorry” ransomware group is actively exploiting the cPanel vulnerability (CVE-2026-41940) in widespread attacks.

Trends, Tools, or Tactics of Interest

A new phishing kit called Bluekit, still under development, includes automated domain registration features and an integrated AI assistant to aid attackers.
“ConsentFix v3” attacks are targeting Azure environments by automating OAuth abuse at scale, with the technique being circulated on hacker forums.
Disneyland has introduced facial recognition technology for visitor identification.
The NSA is testing Anthropic’s Mythos Preview tool to identify vulnerabilities.

Cybersecurity Brief – 2026-05-02

Sat, 02 May 2026 00:00:00 +0000

Major Incidents or Breaches

Trellix confirmed a breach involving unauthorized access to a portion of its source code.
Instructure, the company behind the Canvas learning platform, disclosed a cybersecurity incident and is investigating its impact.
30,000 Facebook accounts were compromised in a phishing campaign leveraging Google AppSheet as a phishing relay, attributed to a Vietnamese-linked operation.
French authorities detained a 15-year-old suspected of selling data stolen in a cyberattack on the French government agency France Titres (ANTS).
The FBI issued a warning about a surge in hacker-enabled cargo theft, with criminal groups hacking brokers and carriers to facilitate the theft and resale of cargo.
Hugging Face and ClawHub platforms are being abused by threat actors for malware distribution, using social engineering to trick users into downloading malicious files.

Newly Discovered Vulnerabilities

A critical Linux vulnerability, CVE-2026-31431 (“CopyFail”), allows attackers to gain root access on affected systems. Although patches are available, many systems remain unpatched.
An actively exploited vulnerability in the cPanel/WHM admin interface allows attackers to access websites without authentication, putting millions of sites at risk.
Poisoned Ruby gems and Go modules have been observed in a supply chain attack campaign, targeting CI pipelines for credential theft, GitHub Actions tampering, and further malware deployment.

Notable Threat Actor Activity

A new criminal group, “Storm-2755,” is targeting Canadian employees with payroll hijacking attacks, using social engineering to compromise accounts and redirect payroll funds.
China-aligned threat actors are conducting espionage campaigns against government and defense sectors across South, East, and Southeast Asia, as well as a NATO state, journalists, and activists.
North Korean threat actors are responsible for 76% of all cryptocurrency stolen in 2026, with evidence suggesting increasing frequency and possible use of AI in their operations.
Two cybercrime groups have been identified using vishing and SSO abuse to conduct rapid SaaS extortion attacks that leave minimal forensic traces.
A phishing campaign is targeting senior executives through Microsoft Teams, using social engineering tactics to compromise high-value accounts.
A member of the Scattered Spider group has been arrested, as reported in security news roundups.

Trends, Tools, or Tactics of Interest

Cybercrime groups are increasingly abusing SaaS platforms, employing vishing and SSO abuse for rapid, high-impact extortion attacks.
The use of Google AppSheet as a phishing relay represents a novel tactic for distributing phishing campaigns at scale.
Supply chain attacks via poisoned open-source packages (Ruby gems, Go modules) remain a persistent threat, especially targeting CI/CD environments.
The Deep#Door backdoor, a Python-based framework, is being deployed as a persistent Windows implant for espionage and disruption.
AI agent integrations are being rapidly deployed into production environments without adequate security testing, leading to incidents such as unintended database deletions.
Cisco has released an open-source tool for AI model provenance, aimed at addressing risks related to poisoned models and supply chain integrity.
Microsoft has addressed issues with Remote Desktop security warnings and updated Windows 11 policies to allow IT admins greater control over pre-installed Store apps.
Criminal IP has partnered with Securonix to integrate exposure-based intelligence into ThreatQ, automating threat analysis and investigation.

Regulatory or Policy Developments Affecting the Security Industry

CISA, in collaboration with US and international partners, has released a guide for the secure adoption of agentic AI systems.
Google has adjusted its bug bounty programme, increasing maximum rewards for certain Android exploits while reducing payouts for Chrome vulnerabilities, reflecting shifting priorities amid increased AI-related activity.
The US Department of Justice sentenced two cybersecurity professionals to four-year prison terms for facilitating BlackCat ransomware attacks.
OFAC has taken action against Iranian central bank crypto reserves as part of broader sanctions enforcement.

Cybersecurity Brief – 2026-04-29

Wed, 29 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Vimeo has confirmed a data breach affecting user and customer data, resulting from the Anodot data anomaly detection company breach. The ShinyHunters group is threatening to leak the stolen files unless a ransom is paid.
Application security company Checkmarx has confirmed that the LAPSUS$ threat group leaked data stolen from its private GitHub repository.
Robinhood systems were leveraged to send legitimate-looking phishing emails, luring recipients to malicious websites.
Electric motorcycles (Zero Motorcycles) and scooters (Yadea) have been found vulnerable to attacks that could compromise rider safety.
A Chinese engineer reportedly stole US military and NASA software over several years by impersonating researchers and convincing organisations to provide sensitive code.

Newly Discovered Vulnerabilities

CVE-2026-42208: A critical pre-authentication SQL injection vulnerability in BerriAI’s LiteLLM Python package has been disclosed and is under active exploitation within 36 hours of public announcement. Attackers are targeting sensitive information stored by the LiteLLM gateway.
CVE-2026-3854: A critical remote code execution vulnerability affecting GitHub.com and GitHub Enterprise Server allows authenticated users to achieve RCE via a single Git push. The flaw exposed millions of repositories.
CVE-2026-25874: Hugging Face’s LeRobot open-source robotics platform is affected by a critical unpatched vulnerability that allows unauthenticated remote code execution.
Vulnerabilities in Robinhood systems enabled attackers to send phishing emails from legitimate infrastructure.
Vulnerabilities in Zero Motorcycles and Yadea electric scooters could allow attackers to compromise device security and rider safety.

Notable Threat Actor Activity

The Brazilian-origin cybercrime group LofyGang has resurfaced after three years, distributing a new stealer malware, LofyStealer (aka GrabBot), targeting Minecraft players.
The North Korean BlueNoroff group is conducting campaigns against cryptocurrency executives, using stolen victim videos, AI-generated avatars, and fake Zoom calls to enhance social engineering and malware delivery.
LAPSUS$ threat group has leaked stolen data from Checkmarx’s private GitHub repository.
Scattered Spider: A dual US-Estonian citizen, allegedly a prolific member of this group, has been arrested in Finland and faces US federal charges.
ShinyHunters is threatening to leak data stolen in the Vimeo breach if ransom demands are not met.
Feuding between ransomware groups 0APT and KryBit has led to the leaking of each other’s infrastructure and operational data, exposing details of ransomware operations.

Trends, Tools, or Tactics of Interest

Threat actors are rapidly exploiting newly disclosed vulnerabilities, with the LiteLLM SQL injection (CVE-2026-42208) being exploited within 36 hours of disclosure.
VECT 2.0 ransomware, due to a flaw in its encryption implementation, irreversibly destroys files larger than 131KB on Windows, Linux, and ESXi, effectively acting as a wiper rather than ransomware.
Threat actors are publishing structured OPSEC playbooks detailing layered infrastructure, identity separation, and long-term evasion strategies to improve operational security and evade detection.
The Vidar malware has become the leading infostealer in the market, filling the gap left by the takedown of Lumma and Rhadamanthys.
Attackers are scaling supply chain attacks by seeding over 70 cloned Open VSX extensions with GlassWorm malware, targeting the VS Code ecosystem.
Fake CAPTCHA scams are being used to trigger international SMS charges on victims’ phones, with scammers profiting from a share of the charges.
The use of AI-generated content and social engineering (e.g., fake Zoom calls, deepfakes) is increasing in targeted attacks, particularly by state-linked and financially motivated groups.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft will deprecate legacy TLS connections for POP and IMAP email clients in Exchange Online starting July 2026, blocking insecure protocols.
A member of the alleged Chinese state-backed Silk Typhoon group has been extradited to the US to face charges related to cyberattacks against US universities.
The FIDO Alliance, Google, and Mastercard are collaborating to address security concerns related to AI agents making autonomous purchases, aiming to prevent unauthorised transactions.
Increased focus on AI governance and agentic AI security, with industry initiatives and webinars promoting multi-layered governance frameworks and cost predictability for AI-driven security solutions.

Cybersecurity Brief – 2026-04-22

Wed, 22 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

French Government Agency Data Breach: France Titres, responsible for issuing administrative documents, confirmed a breach after a hacker claimed to have stolen citizen data and offered it for sale.
Healthcare Data Breaches in the US: Data breaches were reported by Southern Illinois Dermatology, Saint Anthony Hospital, and North Texas Behavioral Health Authority, collectively affecting approximately 600,000 individuals.
Kelp DAO Crypto Heist: North Korean threat actors are attributed to a $290 million theft from Kelp DAO, exploiting LayerZero’s DVN by compromising RPC endpoints and using DDoS attacks to force failover to malicious infrastructure.
Perforce Server Exposures: Over 1,500 Perforce P4 version control servers were found to be unsecured, exposing sensitive data from major organizations.

Cybersecurity Brief – 2026-04-21

Tue, 21 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

KelpDAO suffered a $290 million cryptocurrency theft, attributed to North Korean state-sponsored Lazarus Group hackers. The attackers exploited the DeFi platform to drain assets.
Vercel, the creator of Next.js, confirmed a data breach after a threat actor claimed to have stolen data and offered it for sale for $2 million. The breach reportedly stemmed from compromised OAuth tokens used by an employee’s AI tool.
Seiko USA’s website was defaced, with attackers claiming theft of the Shopify customer database and threatening to leak the data unless a ransom is paid.
Bluesky social network experienced a 24-hour disruption due to a sophisticated DDoS attack, with a pro-Iran hacker group claiming responsibility.
Booking.com was reported as a recent victim of a cyberattack, with further details pending.
A British national, identified as a leader of the Scattered Spider cybercrime collective, pleaded guilty in the US to wire fraud and aggravated identity theft related to cryptocurrency theft.

Newly Discovered Vulnerabilities

Over twenty malicious apps impersonating popular crypto wallets (Metamask, Coinbase, Trust Wallet, OneKey, etc.) were discovered on the Apple App Store, primarily targeting users in China. These apps phished for recovery/seed phrases to steal cryptocurrency.
SGLang (CVE-2026-5760, CVSS 9.8): A critical vulnerability allows remote code execution via malicious GGUF model files.
Anthropic Model Context Protocol (MCP): A critical design weakness was disclosed, enabling remote code execution and posing a supply chain risk for AI deployments.
Serial-to-IP converters from Lantronix and Silex were found to contain 20 new vulnerabilities, exposing OT and healthcare systems to potential attacks.
CISA added eight new exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including three affecting Cisco devices.
WhatsApp was found to leak user metadata, allowing attackers to infer limited information about users without direct contact.
Half of the 6 million internet-facing FTP servers were found to lack encryption, exposing users and enterprises to various attacks.

Notable Threat Actor Activity

Lazarus Group (North Korea) linked to the $290 million KelpDAO crypto theft.
Scattered Spider leader pleaded guilty to multiple cybercrimes, including corporate intrusions and cryptocurrency theft.
Pro-Iran hacker group claimed responsibility for the DDoS attack on Bluesky.
The Gentlemen ransomware group was observed using the SystemBC proxy malware botnet (over 1,570 hosts) for bot-powered attacks, facilitating lateral movement and defense evasion.
Threat actors are abusing QEMU, a machine emulator, in campaigns to evade defenses and distribute ransomware and remote access tools.
Microsoft reported increased abuse of Microsoft Teams by threat actors for helpdesk impersonation and lateral movement using legitimate tools.
Reports indicate use of .wav files as a vector for malware delivery.

Trends, Tools, or Tactics of Interest

Third-party tools and compromised OAuth tokens are increasingly leveraged as initial access vectors in breaches, as seen in the Vercel incident.
There is a rise in threat actors exploiting trusted download paths and legitimate collaboration platforms (e.g., Microsoft Teams) for initial access and lateral movement.
The SystemBC proxy is being used by ransomware operators to automate attacks and maintain persistence within victim networks.
QEMU is being leveraged for defense evasion in recent ransomware and RAT campaigns.
Increase in phishing and malicious app distribution on official platforms, such as the Apple App Store, specifically targeting cryptocurrency assets.
Serial-to-IP converters in OT and healthcare environments remain a weak link due to numerous unpatched vulnerabilities.
AI supply chain risks are highlighted by critical vulnerabilities in AI model protocols and concerns about the misuse of powerful AI tools (e.g., Anthropic’s Mythos tool not publicly released over security fears).
Survey data from LevelBlue indicates ongoing concern among security leaders about the human element in cybersecurity, with workforce education seen as insufficient.

Regulatory or Policy Developments

The US Senate extended surveillance powers under a controversial program until 30 April 2026, following legislative delays.
CISA set federal deadlines in April–May 2026 for remediation of newly catalogued exploited vulnerabilities.

Cybersecurity Brief – 2026-02-20

Fri, 20 Feb 2026 00:00:00 +0000

Major Incidents and Breaches

The French Ministry of Economy reported unauthorized access to the national bank account registry (FICOBA), exposing 1.2 million bank accounts.
Blockchain-based lender Figure confirmed a data breach after threat actor ShinyHunters leaked over 2GB of data, compromising nearly 1 million user records.
German rail operator Deutsche Bahn experienced a large-scale DDoS attack that disrupted information and booking systems for several hours.
Abu Dhabi Finance Week inadvertently exposed VIP passport details due to unprotected cloud storage.
Intimate products company Tenga suffered a phishing attack, potentially exposing US customer data.
A Nigerian national was sentenced to eight years in prison for hacking tax preparation firms in Massachusetts and filing fraudulent tax returns worth over $8.1 million.

Newly Discovered Vulnerabilities

Microsoft patched CVE-2026-26119, a privilege escalation vulnerability in Windows Admin Center.
A critical vulnerability in Grandstream GXP1600 series VoIP phones allows unauthenticated remote attackers to gain root privileges and eavesdrop on communications.
The US Cybersecurity and Infrastructure Security Agency (CISA) ordered federal agencies to patch a maximum-severity, actively exploited Dell vulnerability within three days.
OpenClaw, following a supply chain attack via a malicious npm package (Cline v2.3.0), continues to face security and misconfiguration issues despite recent patches.
Ivanti zero-day vulnerabilities have seen a surge in exploitation, with attacks traced back to July 2025, including shell access, reconnaissance, and malware delivery.
Foxit PDF software and OpenSSL both reported new remote code execution vulnerabilities, with active exploitation noted in the wild.

Notable Threat Actor Activity

The CRESCENTHARVEST campaign is targeting supporters of Iran’s protests with remote access trojan (RAT) malware for information theft and espionage.
ShinyHunters leaked user data stolen from Figure, a blockchain lender.
A supply chain attack injected the OpenClaw backdoor into Cline npm package, downloaded over 4,000 times.
Threat actors are targeting Microsoft Entra accounts in technology, manufacturing, and financial sectors using combined device code phishing and vishing to abuse OAuth 2.0 Device Authorization Grant.
INTERPOL’s Operation Red Card 2.0 resulted in 651 arrests and the recovery of $4.3 million, targeting online scams, investment fraud, mobile money scams, and fake loan applications across 16 African countries.

Trends, Tools, and Tactics of Interest

AI-assisted social engineering attacks remain the top initial access vector, with reports of a 1200% surge in AI-driven fraud during December 2025. Threat actors are leveraging AI for bot deployment, phishing, and identity fraud.
The PromptSpy Android malware is the first known mobile malware to leverage generative AI (Google Gemini) at runtime for persistence and adaptation across devices.
The Massiv Android banking trojan, disguised as IPTV apps, is actively targeting users in southern Europe with device takeover and financial theft capabilities.
The Arkanix Stealer, written in C++ and Python, has been distributed as malware-as-a-service (MaaS) with a referral program, targeting a wide range of user data.
Infostealer dumps are increasingly linking stolen credentials to real-world identities, correlating usernames, cookies, and behavioural data across personal and enterprise accounts.
The Starkiller phishing kit, available as phishing-as-a-service (PhaaS), bypasses multi-factor authentication (MFA) by live-proxying legitimate login sites.
AI-generated passwords have been found to be highly predictable and less secure compared to traditional random password generation methods.
IoT security risks continue due to reused passwords, lack of network segmentation, and poor sanitisation processes, increasing the attack surface.
Google blocked over 1.75 million Play Store app submissions in 2025 and prevented more than 255,000 apps from obtaining excessive access to sensitive user data.

Regulatory or Policy Developments

Texas filed a lawsuit against TP-Link, alleging deceptive marketing of its routers as secure while allowing exploitation of firmware vulnerabilities by Chinese state-backed hackers.
CISA issued an emergency directive for federal agencies to patch an actively exploited Dell vulnerability within three days.
Three former Google engineers were indicted in the US for allegedly stealing trade secrets and transferring them to Iran.

Cybersecurity Brief – 2026-02-10

Tue, 10 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Chinese threat actor UNC3886 breached Singapore’s four largest telecommunications providers (Singtel, StarHub, M1, Simba) in a targeted cyber espionage campaign. The intrusions were confirmed by Singapore’s Cyber Security Agency.
The European Commission disclosed a breach involving its mobile device management platform, exposing staff data. An investigation is ongoing.
SmarterTools suffered a ransomware breach by the Warlock gang, who exploited vulnerabilities in SmarterMail. The attack compromised internal systems but did not impact business applications or customer account data.
A security researcher discovered an exposed database for the Chat & Ask AI app, leaking 300 million messages linked to 25 million users due to a Firebase misconfiguration.
Two Connecticut men were charged in the US for defrauding FanDuel and other gambling sites of $3 million using the stolen identities of approximately 3,000 individuals.
Malicious actors are deploying fake 7-Zip download sites, infecting home PCs and converting them into residential proxy nodes.
Romania’s national oil pipeline operator, Conpet, was targeted in a cyberattack, as reported in Check Point’s weekly threat intelligence bulletin.

Newly Discovered Vulnerabilities

Fortinet patched a critical SQL injection vulnerability (CVE pending) in FortiClientEMS that could allow unauthenticated attackers to execute arbitrary code.
BeyondTrust released updates for a critical pre-authentication remote code execution vulnerability in its Remote Support (RS) and Privileged Remote Access (PRA) products. The flaw allows unauthenticated attackers to execute arbitrary code.
SolarWinds Web Help Desk (WHD) vulnerabilities have been exploited as zero-days since December 2025, enabling remote code execution on exposed servers. Attackers have used these flaws to deploy legitimate tools, such as Velociraptor, for post-exploitation activities.
SmarterMail vulnerabilities were exploited by the Warlock ransomware gang to breach SmarterTools’ network.

Notable Threat Actor Activity

UNC3886, a China-linked APT, conducted a coordinated cyber espionage campaign against Singapore’s telecommunications sector, leveraging sophisticated tactics to breach multiple major providers.
Bloody Wolf threat actor targeted Uzbekistan and Russia in a spear-phishing campaign delivering NetSupport RAT for remote access.
TeamPCP orchestrated a large-scale campaign compromising cloud-native environments through automated worm-like attacks on exposed services, establishing criminal infrastructure for further exploitation.
The Warlock ransomware group exploited SmarterMail vulnerabilities to breach SmarterTools.
Attackers are exploiting SolarWinds WHD vulnerabilities to gain initial access and deploy forensics and DFIR tools for lateral movement.
Ransomware groups, notably those distributing “Reynolds” ransomware, are embedding vulnerable drivers (BYOVD - Bring Your Own Vulnerable Driver) with their payloads to facilitate defense evasion.

Trends, Tools, or Tactics of Interest

Ransomware groups are reportedly pivoting back to encryption-based extortion as data theft-only tactics yield diminishing returns.
Attackers are leveraging targeted wordlists derived from public organizational language (using tools such as CeWL) to improve password guessing success rates, without employing AI.
Malicious RTF documents exploiting CVE-2026-21509, attributed to APT28, are in active use for initial access.
Fake software distribution sites, such as those mimicking 7-Zip, are being used to covertly turn victim PCs into proxy infrastructure.
Automated exploitation of cloud infrastructure is being used at scale (TeamPCP) to build botnets and criminal infrastructure.
The use of legitimate digital forensics tools (e.g., Velociraptor) by attackers post-exploitation is increasing, complicating detection and response.
YARA-X 1.13.0 was released, offering improvements and bugfixes for threat hunting.
RSAC released Quantickle, an open-source browser-based threat intelligence visualization tool.
New research (KEVology) and tools are available to help security teams interpret and prioritise CISA KEV catalog vulnerabilities more effectively.

Regulatory or Policy Developments Affecting the Security Industry

Initial requirements of the EU AI Act come into effect this month (February 2026), beginning with compliance around banned activities.

Cybersecurity Brief – 2025-12-04

Thu, 04 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Cloudflare mitigated a record-breaking 29.7 Tbps distributed denial-of-service (DDoS) attack attributed to the Aisuru botnet, which leveraged up to 4 million infected hosts and launched over 1,300 attacks in three months.
Marquis Software Solutions reported a data breach impacting over 74 US banks and credit unions.
French retailer Leroy Merlin disclosed a data breach that compromised customer personal data in France.
Freedom Mobile, a major Canadian wireless carrier, suffered a breach exposing customer data after attackers accessed its customer account management platform.
The University of Phoenix and the University of Pennsylvania confirmed data breaches linked to the exploitation of vulnerable Oracle E-Business Suite instances in a campaign attributed to the Clop ransomware group.
WordPress sites using the King Addons for Elementor plugin are being actively compromised via exploitation of a critical vulnerability (CVE-2025-8489), allowing attackers to create admin accounts and take over sites.

Newly Discovered Vulnerabilities

Critical vulnerabilities in React Server Components (RSC), tracked as CVE-2025-5518 and another CVE, allow unauthenticated remote code execution; these flaws may impact more than a third of cloud service providers.
The King Addons for Elementor WordPress plugin (CVE-2025-8489, CVSS 9.8) is under active attack, enabling privilege escalation to administrative permissions.
Microsoft silently patched a high-severity Windows LNK vulnerability that has been exploited by multiple state-backed and cybercrime groups as a zero-day since 2017. The November 2025 Patch Tuesday update addressed the issue, and Windows now displays additional LNK file properties to help identify malicious code.
Three critical vulnerabilities were disclosed in Picklescan, an open-source utility for scanning PyTorch models. These flaws allow malicious PyTorch models to evade scans and execute arbitrary code.
Chrome 143 stable release addressed 13 vulnerabilities, including a high-severity flaw in the V8 JavaScript engine.

Notable Threat Actor Activity

Kaspersky identified Shai Hulud 2.0, a new version of the npm worm now equipped with wiper functionality, targeting organizations in Russia, India, Brazil, China, and other countries.
The Water Saci threat actor has evolved its banking trojan campaign in Brazil, now using a multi-layered infection chain involving HTA files, PDFs, and propagation via WhatsApp and RelayNFC for NFC relay fraud. AI-enhanced Python variants are targeting enterprise users of banks and cryptocurrency exchanges.
The MuddyWater APT (linked to Iran) targeted Israeli organizations using new evasion tactics, including techniques mimicking the retro Snake mobile game.
The ShadyPanda group, believed to be China-based, has been using malicious Chrome and Edge browser extensions to spy on millions of users globally.
A malicious Rust crate was discovered targeting Web3 developer systems across Windows, macOS, and Linux, capable of OS-specific malware delivery and stealthy execution.
DragonForce ransomware, in collaboration with the Scattered Spider group, has expanded operations in 2025, leveraging advanced social engineering and initial access techniques.
Attackers are increasingly using Evilginx to steal session cookies, enabling bypass of multi-factor authentication (MFA) protections.
There is a rise in attackers abusing legitimate Remote Monitoring and Management (RMM) tools to gain remote control of victim systems.

Trends, Tools, or Tactics of Interest

The Aisuru botnet’s scale and DDoS throughput set new records, highlighting the growing potency of botnet-driven attacks.
Matrix Push C2, a new criminal toolkit, is abusing browser push notifications to launch social engineering attacks.
Use of AI tools is fueling more sophisticated cybercrime, lowering barriers for less-skilled actors and enhancing the quality of phishing and malware campaigns.
Attackers are increasingly targeting enterprises during off-hours, weekends, and holidays, exploiting reduced staffing and slower response times.
Content Delivery Networks (CDNs) remain a primary mitigation for DDoS and aggressive bot traffic, but attackers are attempting to bypass these protections.
Fileless attack techniques and abuse of legitimate IT tools are increasingly observed, complicating detection and response for defenders.

Regulatory or Policy Developments

The Arizona Attorney General has filed a lawsuit against Chinese online retailer Temu, alleging unauthorized and undisclosed access to and harvesting of user data through its mobile application.
CISA and partners released a new joint guide focused on the secure integration of artificial intelligence in operational technology environments.
Google is expanding Android’s in-call scam protection for financial applications in the US, aiming to address rising phone-based fraud.
Russia has blocked access to the Roblox gaming platform, citing the distribution of LGBT-related content and extremist material as justification.

Cybersecurity Brief – 2025-11-22

Sat, 22 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

Salesforce Customers Breached via Gainsight Integrations: Threat actors affiliated with the ShinyHunters extortion group used third-party Gainsight applications to steal data from Salesforce instances, repeating tactics seen in previous attacks earlier in the year.
CrowdStrike Insider Incident: An insider at CrowdStrike leaked internal system screenshots to hackers, with the material subsequently appearing on Telegram via the Scattered Lapsus$ Hunters threat group.
Transport for London Breach: Two British teenagers, allegedly linked to the Scattered Spider group, pleaded not guilty to charges related to the August 2024 breach of Transport for London, which caused significant financial and data exposure impacts.
WEL Companies Data Breach: A data breach at WEL Companies affected 120,000 individuals.
Cloudflare Outage: A recent Cloudflare outage highlighted the widespread impact a failure at a major provider can have on the global digital economy.

Newly Discovered Vulnerabilities

Grafana SCIM Flaw (CVE-2025-41115): Grafana has patched a critical vulnerability in its Enterprise product that could allow privilege escalation or user impersonation under certain configurations. The flaw has a CVSS score of 10.0.
Oracle Identity Manager RCE (CVE-2025-61757): An unauthenticated remote code execution vulnerability in Oracle Identity Manager is being actively exploited in the wild. CISA has issued a warning to patch immediately.
SonicWall Firewall and Email Security Appliance: SonicWall released patches for high-severity vulnerabilities that could lead to denial-of-service, arbitrary code execution, or unauthorized file access.
LINE Messaging App Protocol Bugs: Vulnerabilities in the custom protocol used by the LINE messaging app allow for message replay, impersonation attacks, and exposure of sensitive information, potentially facilitating cyber espionage.

Notable Threat Actor Activity

APT24 (China Nexus): APT24 has been observed deploying a new malware family, BADAUDIO, as part of a multi-year espionage campaign targeting over 1,000 domains, including Taiwanese entities. The group used supply chain attacks to deliver the BadAudio downloader and subsequent payloads.
ToddyCat APT: Kaspersky identified new versions of ToddyCat APT tools (TomBerBil, TCSectorCopy, XstReader) being used to steal email data and access tokens from Microsoft Outlook in targeted corporate environments.
ShinyHunters: Continued targeting of Salesforce customers through exploitation of Gainsight integrations.
Scattered Spider/Lapsus$: Ongoing legal developments involving alleged members in the UK; continued insider threat activity linked to Lapsus$-affiliated groups.

Trends, Tools, or Tactics of Interest

Deepfake Attacks: Entrust reports deepfake attacks now comprise 20% of biometric fraud attempts, with a 58% increase in deepfaked selfies, indicating rapid growth in synthetic identity threats.
CSS Stuffing in Phishing: Observations of CSS stuffing being used as an obfuscation technique in phishing emails to bypass security filters.
AI-Driven Scam Detection: Avast has launched Scam Guardian, a free AI-powered tool for detecting scams in websites, messages, and links, reflecting the increasing adoption of AI for consumer security.
Calendar Invite Spam: There is a growing trend of fake calendar invites being used to deliver spam and potentially malicious content via email and messaging apps.
Supply Chain Attacks: APT24’s use of supply chain vectors to deliver BadAudio malware highlights continued adversary focus on third-party compromise.
Insider Threats: The CrowdStrike incident underscores the persistent risk of insiders leaking sensitive information to external threat actors.
Automation and Entry-Level Cybersecurity: Increased automation and AI adoption are impacting entry-level cybersecurity roles, potentially affecting the security talent pipeline.
AI Content Risks: AI-powered toys, such as FoloToy’s Kumma teddy bear, have been found to provide inappropriate responses, raising concerns about content moderation and safety in AI-driven products for children.

Regulatory or Policy Developments Affecting the Security Industry

SEC Drops SolarWinds Lawsuit: The U.S. Securities and Exchange Commission has dropped its case against SolarWinds and its CISO regarding alleged investor misrepresentation related to the 2020 breach.
FCC Cybersecurity Rollback: The U.S. Federal Communications Commission has rescinded a rule requiring telecom carriers to implement stricter cybersecurity measures, despite ongoing state-sponsored hacking concerns.
US Cyber Strategy Shift: The US national cyber director announced a strategic shift toward more aggressive, offensive actions aimed at shaping adversary behaviour and imposing consequences for cyber operations.
CISA Directive: CISA has issued a directive for immediate patching of the actively exploited Oracle Identity Manager vulnerability (CVE-2025-61757).

Cybersecurity Brief – 2025-11-05

Wed, 05 Nov 2025 00:00:00 +0000

Major Incidents or Breaches

The Swedish IT systems supplier Miljödata suffered a data breach impacting 1.5 million individuals. The Swedish Authority for Privacy Protection (IMY) is investigating.
Japanese media conglomerate Nikkei reported a data breach after its Slack platform was compromised, exposing personal data of over 17,000 employees and business partners.
Hundreds of malicious Android apps on Google Play were downloaded over 42 million times between June 2024 and May 2025, according to Zscaler, distributing various malware strains.
Threat actors are actively exploiting a critical vulnerability in the Post SMTP WordPress plugin (installed on 400,000+ sites) to hijack admin accounts.
Attackers are exploiting a critical authentication bypass flaw in the JobMonster WordPress theme, allowing admin account hijacking under certain conditions.
European authorities dismantled a cryptocurrency fraud and money laundering network responsible for defrauding victims of over €600 million, arresting nine individuals.
U.S. prosecutors indicted three individuals for deploying BlackCat (ALPHV) ransomware against five U.S. companies between May and November 2023, resulting in network compromise and extortion.
Transportation and logistics companies have been targeted by threat actors using sophisticated attack chains to deploy remote access tools and steal cargo.

Newly Discovered Vulnerabilities

CISA added critical vulnerabilities in Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog. The CWP flaw (CVE-2025-48703) allows remote, unauthenticated command execution and is being actively exploited.
A critical vulnerability (CVE-2025-11953) in the “@react-native-community/cli” npm package for React Native allowed arbitrary command/code execution on Windows, macOS, and Linux. The issue has now been patched.
Four security flaws were disclosed in Microsoft Teams enabling attackers to impersonate colleagues and edit messages without detection, facilitating social engineering and phishing attacks.
Google’s AI-powered agent “Big Sleep” discovered five new vulnerabilities in Apple’s Safari WebKit. Apple has issued patches addressing these and over 100 other vulnerabilities across its operating systems.
The November 2025 Android update patched two critical remote code execution vulnerabilities in the platform’s System component.
Apple released updates for iOS and macOS addressing 110 vulnerabilities, including 19 in WebKit, some of which were critical.

Notable Threat Actor Activity

A new cybercrime collective has formed, merging Scattered Spider, LAPSUS$, and ShinyHunters. The group has created at least 16 Telegram channels since August 2025, indicating increased coordination.
The Russian threat group “Curly COMrades” is abusing Microsoft Hyper-V to deploy hidden Alpine Linux-based virtual machines on Windows hosts, bypassing endpoint detection and response (EDR) solutions to run malware undetected.
Operation SkyCloak: Threat actors are deploying a Tor-enabled OpenSSH backdoor via weaponized phishing attachments, targeting defense sectors in Russia and Belarus.
The North Korean group Kimsuky has debuted the HTTPTroy backdoor against South Korean targets, with enhanced obfuscation and anti-analysis features.
The SesameOp backdoor has been observed using the OpenAI API as a covert command-and-control (C2) channel, demonstrating the misuse of generative AI services for stealthy communications.
Criminals are impersonating U.S. Immigration and Customs Enforcement (ICE) agents in social engineering campaigns, prompting an FBI warning to law enforcement.

Trends, Tools, or Tactics of Interest

Browser sandbox evasion: Attackers are exploiting browser behaviors to steal credentials, abuse extensions, and move laterally, bypassing traditional security tools.
Increased ransomware and extortion attacks in Europe, with attackers leveraging geopolitical tensions and AI-enhanced social engineering.
Malicious Android apps continue to proliferate on official app stores, using fake news and identification apps as lures for banking trojans and data theft.
Use of AI and cloud APIs (e.g., OpenAI) by threat actors for covert C2 and operational security.
Open source security: The Wazuh platform is being promoted for ransomware defense, reflecting ongoing interest in open source security tooling.

Regulatory or Policy Developments

Microsoft announced plans to remove Defender Application Guard from Office, starting with Office version 2602 in February 2026 and completing removal by December 2027.
California fined Sling TV for deceptive privacy practices, including misleading opt-out controls and improper use of children’s data for ad targeting.
The Swedish privacy regulator (IMY) is investigating the Miljödata breach for potential violations of data protection requirements.

Industry Moves

Bugcrowd acquired application security firm Mayhem, nearly doubling its valuation.
Zscaler acquired AI security company SPLX to enhance its Zero Trust Exchange platform with red teaming and threat inspection capabilities.

Cybersecurity Brief – 2025-09-26

Fri, 26 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

The Co-operative Group (UK) reported a loss of £80 million ($107 million) in operating profit due to a cyberattack attributed to the Scattered Spider threat group.
RTX (Raytheon Technologies) confirmed a ransomware attack affecting its airport services division.
Volvo Group disclosed that employee data was stolen in a ransomware attack linked to the Miljödata breach, impacting multiple Swedish organizations and municipalities.
An unofficial npm package mimicking ‘postmark-mcp’ was found to exfiltrate users’ email communications.
Over 500 npm packages were infected by the Shai-Hulud worm in a supply-chain attack, impacting packages with millions of downloads.
Two malicious Rust crates (fast_tlog and fast_log) on crates.io were found stealing Solana and Ethereum wallet keys from developers, with 8,424 downloads confirmed.

Newly Discovered Vulnerabilities

Cisco disclosed multiple zero-day vulnerabilities in its ASA firewalls and IOS devices, several of which have been actively exploited in the wild, including by nation-state actors (notably the “ArcaneDoor” campaign). Exploits have resulted in remote code execution and privilege escalation.
Salesforce patched a critical vulnerability (“ForcedLeak”) in the Agentforce AI platform that allowed prompt injection attacks, potentially exposing CRM data via AI agent manipulation and expired domain abuse.
Cisco patched a zero-day flaw affecting routers and switches, enabling remote attackers with admin privileges to execute arbitrary code as root.

Notable Threat Actor Activity

The China-linked APT group UNC5221 deployed new versions of the “Brickstorm” backdoor on edge devices, targeting appliances that cannot run traditional EDR agents. Campaigns persisted undetected for nearly 400 days, with evidence of analysis of stolen code to weaponize additional zero-day vulnerabilities.
North Korean actors behind the “Contagious Interview” campaign have been linked to a new backdoor dubbed AkdoorTea, along with tools TsunamiKit and ExistentialKit, targeting global cryptocurrency developers.
The threat actor “Vane Viper” was identified as operating a large-scale ad fraud and malware network, generating over 1 trillion DNS queries and using shell companies to obfuscate operations.
Chinese APT “RedNovember” targeted US defense contractors, government, aerospace, and legal organizations in a recent espionage campaign.
Microsoft reported a new variant of the XCSSET macOS malware targeting Xcode developers, with enhanced browser targeting and credential theft features.

Trends, Tools, or Tactics of Interest

A new AI-driven phishing platform, “SpamGPT”, was observed automating attack campaigns by leveraging generative AI and integrated email campaign tools.
Attackers are using AI-powered development platforms (Lovable, Netlify, Vercel) to rapidly create and host convincing fake CAPTCHA pages for phishing.
A fresh phishing campaign is targeting PyPI users by impersonating administrators and directing victims to credential-harvesting sites.
SVG-based phishing campaigns continue, with recent attacks using malicious SVG files disguised as recipes to deliver malware.
Webshells are increasingly being hidden in “.well-known” directories to evade detection.
Gcore Radar reported that the technology sector has overtaken gaming as the top target for DDoS attacks, with a 41% year-on-year increase and attack peaks reaching 2.2 Tbps.
Cloud Security Alliance introduced a SaaS Security Controls Framework to help customers manage shared responsibility in SaaS environments.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive mandating federal agencies to identify, mitigate, and patch Cisco zero-day vulnerabilities exploited in active attacks.
Microsoft announced it will offer free extended security updates for Windows 10 users in the European Economic Area (EEA), including all EU member states, Iceland, Liechtenstein, and Norway.
LinkedIn will use user data for AI training by default unless users opt out.
Canadian privacy commissioners accused TikTok of improperly collecting data from hundreds of thousands of children on its platform.

Cybersecurity Brief – 2025-09-25

Thu, 25 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Boyd Gaming reported a data breach affecting employees and other individuals, as disclosed to the SEC.
A US Federal Civilian Executive Branch (FCEB) agency was breached via exploitation of a critical GeoServer vulnerability (CVE-2024-36401); attackers deployed China Chopper and remote access scripts and remained undetected for three weeks.
European airports experienced widespread disruptions due to a ransomware attack linked to the RTX group; the UK National Crime Agency arrested a suspect in connection with the incident. The attack on Collins Aerospace is believed to have involved HardBit ransomware.
Interpol-led law enforcement seized over $439 million in cash and cryptocurrency from cybercrime rings worldwide during a five-month joint operation.
A record-breaking DDoS attack peaked at 22 Tbps and 10 billion packets per second (Bpps), targeting a European network infrastructure company and linked to the Aisuru botnet.
The Python Package Index (PyPI) urged users to reset credentials following a new wave of phishing attacks using a fake PyPI website.
GitHub users were targeted in a large-scale phishing campaign impersonating Y Combinator via GitHub notifications, delivering cryptocurrency drainers.
KNP Logistics Group, a 158-year-old business, collapsed following a cyber incident attributed to poor password security.

Newly Discovered Vulnerabilities

Cisco disclosed a high-severity, actively exploited SNMP vulnerability in IOS and IOS XE Software allowing remote code execution or denial-of-service; patches have been released.
Two critical vulnerabilities were identified in Wondershare RepairIt, exposing private user data and enabling potential tampering with AI models.
Supermicro hardware was found to have two firmware vulnerabilities in its Baseboard Management Controller (BMC), which could allow attackers to create persistent backdoors by updating systems with malicious images.
A flaw in multiple OnePlus OxygenOS versions allows installed apps to access SMS data and metadata without permissions or user interaction; the issue remains unpatched.
Ongoing exploit attempts have been observed against an older Hikvision camera vulnerability.
SonicWall SMA devices were targeted with the ‘OVERSTEP’ backdoor; SonicWall released updates for SMA 100 appliances to remove the malware and improve file checks.

Notable Threat Actor Activity

Suspected Chinese threat actors (RedNovember) have been targeting global government and private sector organizations using Pantegana and Cobalt Strike.
UNC5221, believed to be China-nexus, used the BRICKSTORM backdoor to infiltrate US legal, SaaS, BPO, and technology sectors; Google reports the malware has been used for over a year for data theft and persistent espionage.
UNC6148 deployed the OVERSTEP backdoor in ongoing attacks against SonicWall SMA devices, enabling system control, credential theft, and evasion.
A new malware family, YiBackdoor, was discovered with significant code overlap with IcedID and Latrodectus, suggesting shared development or tool reuse.
A new ransomware variant, Obscura, was observed spreading from a victim’s domain controller.
Scattered Spider: A core member surrendered to authorities amid claims of the group’s shutdown; US prosecutors charged a UK national, linking the group to $115 million in ransomware payments.
Russian threat actors conducted a disinformation campaign targeting the upcoming Moldovan elections, linked to previous 2022 operations.
An npm package was found to use steganography (QR codes) to hide a credential-stealing malware, posing a supply chain risk.

Trends, Tools, or Tactics of Interest

Attackers are exploiting payment iframe security weaknesses to deploy malicious overlays on checkout pages, facilitating credit card data theft.
Burp Suite introduced Burp AI, providing on-demand AI assistance for penetration testing workflows.
AI pentesting is emerging, with new agentic capabilities being integrated into security tools.
Kali Linux 2025.3 was released, featuring ten new tools, Nexmon support, and NetHunter improvements.
OpenAI is internally testing a new GPT-5-based AI agent, “GPT-Alpha”.
Police forces are increasingly using drones equipped with license plate recognition technology.
GitHub is implementing enhanced security measures for npm supply chain protection, including mandatory 2FA, short-lived granular tokens, and trusted publishing workflows.

Regulatory or Policy Developments Affecting the Security Industry

GitHub announced new security requirements for npm package publishing, including mandatory two-factor authentication, expiring granular tokens, and trusted publishing, in response to recent supply chain attacks.

Cybersecurity Brief – 2025-09-24

Wed, 24 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Boyd Gaming Corporation disclosed a data breach following a cyberattack, resulting in the theft of employee and customer data.
Jaguar Land Rover extended its production shutdown due to a cyberattack, with operations paused until at least October 1 as investigations continue.
The American Archive of Public Broadcasting exposed restricted and copyrighted media for years due to inadequate access controls, allowing unauthorised downloads.
CISA reported that attackers breached a US federal agency’s network by exploiting an unpatched GeoServer instance.
The US Secret Service dismantled a major telecom threat in New York, seizing over 300 servers and 100,000 SIM cards used to threaten US officials and potentially disrupt critical infrastructure near the UN.
Eurojust coordinated the arrest of five suspects in a cryptocurrency investment fraud scheme, responsible for over €100 million in losses across 23 countries.
Fake versions of Malwarebytes, LastPass, and other software are being distributed via GitHub pages in a campaign targeting Mac users.
Scammers are impersonating the FBI using fake IC3 websites to steal personal data.

Newly Discovered Vulnerabilities

Pandoc (CVE-2025-51591): Actively exploited security flaw in Linux utility Pandoc allowed attackers to target AWS Instance Metadata Service (IMDS) and steal EC2 IAM credentials.
Libraesva Email Security Gateway (CVE-2025-59689): Command injection vulnerability exploited by state-sponsored actors, triggered via malicious emails with crafted compressed attachments. Emergency fix released.
Supermicro BMC Firmware: Two new vulnerabilities allow attackers to bypass root of trust security, enabling malicious firmware installation. Previous patches have been bypassed.
SolarWinds Web Help Desk (CVE-2025-26399): Critical unauthenticated remote code execution vulnerability. Multiple patch attempts have been made due to previous bypasses.
Microsoft Entra: Research revealed all tenants were exposed to silent compromise via invisible actor tokens.
NPM package ‘fezbox’: Newly discovered package uses QR codes to deliver second-stage, cookie-stealing malware.
SonicWall SMA 100: Firmware update released to remove rootkit malware deployed in recent attacks.

Notable Threat Actor Activity

State-sponsored actors exploited the Libraesva Email Security Gateway vulnerability in the wild.
ShadowV2 botnet operators are exploiting misconfigured AWS Docker containers to build a DDoS-for-hire platform, enabling customers to self-manage attacks.
Chinese-speaking threat actors are conducting SEO poisoning campaigns using BadIIS malware, redirecting traffic and planting web shells on compromised servers.
Scattered Spider: A juvenile suspect associated with this group was arrested in the US on charges of computer intrusion, extortion, and identity theft.
Attackers abused Google’s AppSheet platform to send phishing emails.
Large-scale campaign distributing fake software (Malwarebytes, LastPass, etc.) via GitHub targets Mac users.

Trends, Tools, or Tactics of Interest

DDoS Attacks: Cloudflare mitigated a record-breaking DDoS attack peaking at 22.2 Tbps and 10.6 billion packets per second. ShadowV2 and other botnets are leveraging exposed cloud-native tools (Docker containers) to evade detection and facilitate for-hire DDoS services.
Supply Chain Attacks: Surge in attacks targeting the npm ecosystem, including malicious packages and weak authentication mechanisms.
Ransomware: Despite rising incident counts in 2025, ransomware payments dropped 35% in 2024, indicating changes in RaaS economics.
Phishing: Abuse of legitimate platforms (Google AppSheet) for phishing campaigns continues.
SEO Poisoning: Increased use of SEO poisoning by threat actors to distribute malware and gain financial benefits.
Identity Governance: New free tools are emerging to streamline identity governance, onboarding, and access reviews for small organisations.
AI Security: New research highlights the top 25 vulnerabilities in Model Context Protocols, with risks including prompt injection and command injection targeting AI agents.

Regulatory or Policy Developments

GitHub announced mandatory two-factor authentication and short-lived access tokens for npm publishing, aiming to strengthen supply chain security following recent attacks.
European law enforcement, coordinated by Eurojust, continues cross-border efforts against large-scale cryptocurrency fraud.
CISA announced Steve Casapulla as Executive Assistant Director for Infrastructure Security.
Reports highlight ongoing concerns about the Japanese government’s cybersecurity posture, with incident counts nearly doubling and a significant proportion of critical systems unmanaged.
New revelations show the US Department of Homeland Security collected DNA from nearly 2,000 US citizens, raising oversight and legality concerns.

Cybersecurity Brief – 2025-09-21

Sun, 21 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-nexus cyber espionage group, compromised 34 devices across 11 European telecommunications firms using LinkedIn job lures and the MINIBIKE malware.
Over 600,000 individuals were impacted by healthcare data breaches in the past day, with additional major intrusions attributed to the ShinyHunters group.
The Royal Canadian Mounted Police dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million linked to criminal activity.
FBI issued an alert regarding cybercriminals impersonating the FBI’s Internet Crime Complaint Center (IC3) via fake reporting portals for malicious purposes.

Newly Discovered Vulnerabilities

Fortra released a critical patch for a command injection vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT) software, specifically in its License Servlet. Exploitation enables arbitrary command execution.
OpenAI’s ChatGPT Deep Research agent was found vulnerable to a zero-click flaw, allowing attackers to exfiltrate Gmail inbox data via a single crafted email. The vulnerability has since been patched.
Novakon HMIs were reported to have unpatched remote code execution and information exposure vulnerabilities, exposing industrial control systems to remote attacks.
A critical vulnerability was disclosed and fixed in Microsoft Azure Entra ID that could have enabled catastrophic identity and access management attacks if exploited.

Notable Threat Actor Activity

Russian APT groups Turla and Gamaredon, both linked to the FSB, were observed collaborating to compromise high-profile Ukrainian targets. Turla deployed malware on systems previously accessed by Gamaredon, including the Kazuar backdoor.
The Iranian APT group, including a Charming Kitten subgroup, conducted sophisticated cyberattacks targeting telecommunications and satellite companies, using bespoke targeting techniques.
The Scattered Spider group had two suspected members arrested in the UK, with one charged in the US for hacking critical infrastructure.
SystemBC malware is powering the REM Proxy botnet, leveraging approximately 1,500 daily VPS victims and 80 C2 servers to provide proxy services to threat actors.

Trends, Tools, or Tactics of Interest

A phishing-as-a-service (PhaaS) surge was observed, with Lighthouse and Lucid platforms linked to over 17,500 phishing domains targeting 316 brands across 74 countries.
Atomic Infostealer is being distributed to macOS users via fake GitHub repositories, with campaigns targeting LastPass users.
Researchers identified the earliest known malware, codenamed MalTerminal, embedding GPT-4 LLM capabilities for automated ransomware creation and reverse shell generation.
CISA published an analysis of malware kits deployed in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, detailing tactics such as system information collection, credential dumping, and arbitrary code execution.
Ransomware attacks continue to evade defenses, with prevention rates dropping to 62% and data exfiltration prevention at only 3%, per the Picus Blue Report 2025.
Synthetic identity fraud is resurging in the finance and lending sector, with estimated damages reaching $3.3 billion from new accounts.
ChatGPT was demonstrated to be capable of solving CAPTCHAs and mimicking human cursor behaviour, highlighting risks in automated abuse of AI agents.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and reaching a valuation of $8.6 billion.
Valve announced Steam will end support for 32-bit Windows in January 2026, affecting software compatibility and potentially security posture for legacy systems.

Cybersecurity Brief – 2025-09-20

Sat, 20 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

UNC1549, an Iran-linked cyber espionage group, successfully infiltrated 34 devices across 11 European telecommunications organisations using LinkedIn job lures and the MINIBIKE malware.
Russian threat groups Gamaredon and Turla collaborated in a campaign targeting Ukrainian entities, with Turla malware deployed on systems previously compromised by Gamaredon.
Over 600,000 individuals were impacted by recent healthcare sector breaches; ShinyHunters was identified as responsible for major attacks.
The FBI issued a warning about cybercriminals creating fake FBI Internet Crime Complaint Center (IC3) portals for malicious activity.
The REM Proxy botnet, powered by SystemBC malware, currently controls approximately 1,500 VPS victims daily via 80 C2 servers.
A surge in phishing-as-a-service (PhaaS) operations, notably Lighthouse and Lucid, has resulted in over 17,500 phishing domains targeting 316 brands in 74 countries.

Newly Discovered Vulnerabilities

Fortra disclosed and patched a critical vulnerability (CVE-2025-10035, CVSS 10.0) in GoAnywhere Managed File Transfer (MFT), allowing remote command injection via the License Servlet.
A zero-click vulnerability in OpenAI ChatGPT’s Deep Research agent enabled attackers to exfiltrate Gmail inbox data through a crafted email. OpenAI has since patched the issue.
Novakon Human-Machine Interfaces (HMIs) were found to have unpatched remote code execution and information exposure vulnerabilities.
A critical flaw in Microsoft Azure Entra ID was disclosed and fixed; it could have enabled catastrophic identity and access management attacks.
CISA released an analysis of malware kits used in attacks exploiting Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities, where attackers chained two flaws to collect system information, dump credentials, and execute malware.

Notable Threat Actor Activity

Iranian APT group UNC1549 targeted European telecom and satellite companies with highly bespoke attacks, leveraging LinkedIn lures and custom malware.
Russian APTs Gamaredon and Turla collaborated to compromise Ukrainian organisations, with evidence of sequential deployment of their respective malware.
Scattered Spider group members were arrested in the UK and charged in the US for attacks on critical infrastructure organisations.

Trends, Tools, or Tactics of Interest

Researchers identified the earliest known malware (MalTerminal) embedding GPT-4-powered LLM capabilities, enabling autonomous creation of ransomware and reverse shells.
ChatGPT was demonstrated as capable of solving CAPTCHAs and mimicking human cursor movement, highlighting ongoing risks of AI-driven automation in bypassing security controls.
Ransomware continues to evade defences, with latest data showing only 62% prevention rates and data exfiltration prevention dropping to 3%.
Synthetic identity fraud in the finance and lending sector is rising post-pandemic, with estimated damages reaching $3.3 billion from new accounts.
The Tines platform released over 1,000 pre-built AI-driven security automation workflows, facilitating automated alert triage and response using AI agents and Confluence SOPs.
Industrial automation systems remain a high-value target, with Kaspersky reporting a broad range of malicious objects detected on ICS computers in Q2 2025.

Regulatory or Policy Developments Affecting the Security Industry

Netskope completed a successful IPO, raising over $908 million and achieving a valuation of $8.6 billion.
Valve announced that Steam will end support for 32-bit Windows systems in January 2026, impacting legacy software environments.

Cybersecurity Brief – 2025-09-19

Fri, 19 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

SonicWall suffered a breach of its MySonicWall cloud backup service, exposing firewall configuration backup files for fewer than 5% of customers. Impacted customers have been instructed to reset their passwords and import new configuration files.
Tiffany & Co. disclosed a data breach affecting thousands of customers in the US and Canada, with attackers accessing information related to gift cards.
Medical Associates of Brevard reported a data breach impacting nearly 250,000 individuals, attributed to the BianLian ransomware group.
ChatGPT was targeted in a server-side data theft attack using a zero-click method called ShadowLeak, which has since been fixed by OpenAI.
The Python Package Index (PyPI) invalidated all tokens stolen in the GhostAction supply chain attack and confirmed that threat actors did not use the stolen tokens to publish malicious packages.

Newly Discovered Vulnerabilities

WatchGuard released security updates for a critical remote code execution vulnerability in Firebox firewalls.
Google issued a Chrome 140 update patching four vulnerabilities, including a zero-day (CVE-2025-10585) in the V8 JavaScript engine, which was actively exploited.
Microsoft addressed a pair of vulnerabilities in Entra ID (formerly Azure AD) that could have allowed attackers to access virtually all Azure customer accounts.
CISA published details of two malware strains exploiting Ivanti EPMM vulnerabilities (CVE-2025-4427 and CVE-2025-4428) in a recent incident.

Notable Threat Actor Activity

Two UK teenagers linked to the Scattered Spider group were arrested in connection with the August 2024 cyberattack on Transport for London.
North Korean threat actors behind the “Contagious Interview” campaign are using a ClickFix social engineering technique to target job seekers with fraudulent employment offers.
Russian ransomware gangs are deploying a new multi-version malware loader, CountLoader, to deliver post-exploitation tools such as Cobalt Strike and Adaptee.
RevengeHotels has been targeting hotels in Brazil and Spanish-speaking regions with VenomRAT implants.
The SystemBC proxy botnet is actively compromising commercial VPS systems, maintaining around 1,500 bots daily to facilitate malicious traffic.
Two malicious PyPI packages were discovered delivering the SilentSync remote access trojan (RAT) to Windows systems.
Microsoft and Cloudflare disrupted RaccoonO365, a major Phishing-as-a-Service operation targeting Microsoft 365 credentials.
SMS blaster tools are being used to send large volumes of scam texts by impersonating cell towers, bypassing carrier-level protections.

Trends, Tools, or Tactics of Interest

AI-assisted phishing attacks are increasing in volume and sophistication, posing a growing threat to organizations.
Small businesses continue to be disproportionately targeted by ransomware attacks compared to large enterprises.
Microsoft 365’s widespread adoption and integration are expanding its attack surface, making it a prime target for cybercriminals.
HTTP request smuggling remains a practical attack vector, with pentesters continuing to find exploitable desynchronization vulnerabilities in web applications.
The use of Phishing-as-a-Service platforms is accelerating, with recent disruptions highlighting their prevalence and focus on Microsoft 365 accounts.
Age verification and enhanced parental controls are being introduced to ChatGPT to address concerns about AI-related harms to minors.

Regulatory or Policy Developments Affecting the Security Industry

UK law enforcement made arrests in connection with the Scattered Spider group’s attack on Transport for London, reflecting ongoing efforts to disrupt cybercriminal groups.
OpenAI is implementing age verification and parental controls for ChatGPT in response to increasing scrutiny over AI safety for minors.

Cybersecurity Brief – 2025-09-18

Thu, 18 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

ShinyHunters claims to have stolen over 1.5 billion Salesforce records from 760 companies via compromised Salesloft Drift OAuth tokens.
Insight Partners, a venture capital and private equity firm, has confirmed a ransomware breach impacting over 12,000 individuals, with personal information stolen.
SonicWall has warned customers to reset credentials following a breach that exposed firewall configuration backup files related to MySonicWall accounts.
A supply chain attack dubbed “Shai-Hulud” compromised over 180 NPM packages, injecting malicious code to harvest secrets, exfiltrate them to public repositories, and make private repositories public.
224 malicious apps were removed from the Google Play Store after researchers uncovered a large-scale ad fraud campaign.
Airline data broker is selling at least five billion passenger records to US government agencies through a searchable database.

Newly Discovered Vulnerabilities

Google released emergency updates for Chrome to patch four vulnerabilities, including CVE-2025-10585, a zero-day in the V8 JavaScript engine exploited in the wild. This is the sixth Chrome zero-day exploited this year.
NetRise identified that 20 device models from six vendors remain vulnerable to the decade-old Pixie Dust Wi-Fi attack, which allows attackers to recover WPS PINs and gain unauthorized network access.

Notable Threat Actor Activity

TA558 is conducting attacks targeting hotels in Brazil and Spanish-speaking markets, deploying Venom RAT and other remote access trojans using AI-generated scripts.
Chinese state-aligned TA415 has been linked to spear-phishing campaigns targeting US government, think tanks, and academic organizations focused on US-China economic and policy matters, leveraging VS Code Remote Tunnels for persistence and espionage.
Scattered Spider has resurfaced with new cyber attacks targeting the financial sector, contradicting previous claims of ceasing operations.
RaccoonO365, a large-scale phishing-as-a-service operation, was disrupted by Microsoft and Cloudflare. The service had enabled cybercriminals to steal thousands of Microsoft 365 credentials.
ClickFix threat actor has evolved tactics to distribute MetaStealer, using fake CAPTCHAs, File Explorer deception, and MSI lures.
Raven Stealer, a lightweight infostealer distributed via underground forums and cracked software, now targets Chromium-based browser data and exfiltrates it via Telegram.

Trends, Tools, or Tactics of Interest

AI-generated scripts are increasingly being used by threat actors (e.g., TA558) to automate and enhance malware deployment.
There is a rise in AI-powered sign-up fraud, with attackers exploiting enterprise sign-up funnels using advanced automation.
The use of phishing-as-a-service (PhaaS) kits, exemplified by RaccoonO365, continues to lower the barrier for cybercriminals to launch credential theft campaigns.
Supply chain attacks targeting open-source repositories (e.g., NPM) are ongoing, with attackers injecting worms to steal secrets and compromise private codebases.
Commodity infostealers are evolving in stealth and distribution, with examples like Raven Stealer using encrypted messaging platforms for exfiltration.
Security researchers are observing increased use of fake CAPTCHAs and system interface tricks in malware delivery.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft reminded customers that Office 2016 and Office 2019 will reach end of extended support on 14 October 2025, impacting security patch availability.
Multiple security startups (Irregular, RegScale, Scalekit) have raised significant funding for AI security testing, GRC platforms, and AI agent authentication, reflecting increased industry focus on AI and regulatory compliance.

Cybersecurity Brief – 2025-09-17

Wed, 17 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover has extended its production shutdown for another week following a significant cyberattack that impacted systems at the end of August.
The US Department of Homeland Security exposed sensitive national security intelligence, including surveillance data on Americans, to thousands of unauthorized users due to a misconfigured data hub.
The RaccoonO365 phishing network, responsible for large-scale phishing campaigns, was dismantled following a joint operation by Microsoft and Cloudflare, resulting in the takedown of 338 malicious domains.
Google has removed 224 Android applications involved in the “SlopAds” ad fraud operation, which generated 2.3 billion ad requests daily and affected 38 million downloads globally.
At least 187 npm packages were compromised in a self-propagating supply chain attack, dubbed ‘Shai-Hulud’, which stole developer credentials and spread malware through infected packages.
The BreachForums hacking forum administrator, Conor Brian Fitzpatrick, was resentenced to three years in prison for cybercrime charges, including the operation of the forum and possession of CSAM.

Newly Discovered Vulnerabilities

Apple released security updates for iOS, macOS, and older iPhone/iPad models, addressing over 50 vulnerabilities, including CVE-2025-43300, an out-of-bounds flaw actively exploited in sophisticated spyware attacks.
Multiple critical vulnerabilities were disclosed in Chaos Mesh, a chaos engineering platform for Kubernetes, allowing for remote code execution and potential full cluster takeover.
A new Rowhammer attack, named Phoenix, was demonstrated against DDR5 memory, achieving root access on systems in under two minutes.
ChatGPT’s new calendar integration was shown to be exploitable for email exfiltration via crafted calendar invites.

Notable Threat Actor Activity

RevengeHotels, an established cybercrime group, has launched a new campaign in Latin America leveraging large language models (LLMs) to generate malicious scripts and using VenomRAT in targeted phishing attacks.
The North Korean group Kimsuky used ChatGPT to create deepfake military ID documents in attempts to compromise South Korean targets.
A new FileFix variant is delivering the StealC infostealer malware through multilingual phishing sites, using code obfuscation and steganography, and impersonating Meta account suspension warnings.
The Yurei ransomware group, believed to operate from Morocco, has claimed its first victims using a modified Prince-Ransomware binary.
The SlopAds fraud ring exploited commercial adtech infrastructure, including links to PropellerAds, to orchestrate its global ad fraud operation.
Security industry experts remain skeptical of claims by Scattered Spider and ShinyHunters that they are retiring, suggesting continued threat activity is likely.

Trends, Tools, or Tactics of Interest

Shadow AI threats are increasing, with reports highlighting the use of generative AI and autonomous agents in both attacks and enterprise workflows.
Phishing-as-a-service operations, such as RaccoonO365, continue to leverage large-scale domain infrastructure for credential theft.
Supply chain attacks targeting open-source repositories (npm) are increasingly employing self-replicating, worm-like malware to propagate and exfiltrate credentials.
AI chatbots, including ChatGPT and Grok, are being used to generate phishing emails and malicious code, with a noted focus on targeting vulnerable populations such as senior citizens.
Children and teenagers are increasingly involved in hacking school systems, often underestimating the consequences.
The FileFix campaign demonstrates advanced social engineering, using multilingual phishing, steganography, and code obfuscation.
The removal of WMIC (Windows Management Instrumentation Command-line) tool is planned for Windows 11 25H2 and later, impacting system administration and automation practices.
The emergence of new security solutions focused on AI agent management (Astrix), browser security (Neon Cyber), and real-time, AI-driven data protection (Ray Security) reflects a shift toward addressing AI-native and browser-based threats.

Regulatory or Policy Developments Affecting the Security Industry

CrowdStrike announced the acquisition of Pangea to launch AI Detection and Response (AIDR), expanding protection for enterprise AI models and applications.
Check Point is acquiring AI security firm Lakera, underlining growing industry demand for AI-native security solutions amid increased generative AI adoption.
Apple’s backporting of zero-day patches to older devices addresses ongoing exploitation concerns and highlights regulatory and customer pressure for extended device support.

Cybersecurity Brief – 2025-09-11

Thu, 11 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover (JLR) confirmed a data breach following a recent cyberattack that forced system shutdowns and operational disruptions. Some company data was stolen in the incident.
The New York Blood Center began notifying affected individuals about a data breach resulting from a ransomware attack, confirming user data was stolen.
Plex, a media streaming platform, reported a data breach and advised users to reset their passwords.
The largest known supply-chain attack in the NPM ecosystem impacted approximately 10% of all cloud environments. Despite the scale, attackers reportedly gained little financial benefit.
An open-source developer known as “qix” disclosed a compromise of their GitHub account after being socially engineered to surrender access credentials.
A DDoS mitigation service provider in Europe was targeted by a distributed denial-of-service attack peaking at 1.5 billion packets per second.

Newly Discovered Vulnerabilities

Microsoft released patches for 80 vulnerabilities, including a publicly disclosed flaw, an SMB privilege escalation vulnerability, and Azure bugs rated CVSS 10.0.
Fortinet, Ivanti, and Nvidia issued security updates addressing high-severity vulnerabilities that could allow remote code execution, privilege escalation, information disclosure, and configuration tampering.
Rockwell Automation published eight security advisories as part of ICS Patch Tuesday, with additional advisories from Siemens, Schneider Electric, Phoenix Contact, and CISA.
A weakness in the Cursor AI code editor was identified, allowing repositories to automatically execute malicious code on a developer’s device when opened.

Notable Threat Actor Activity

Chinese APT groups have been linked to multiple high-profile incidents:
- A Chinese APT deployed the previously undocumented EggStreme fileless malware framework to compromise a Philippines-based military company.
- APT41, a China-linked group, is conducting ongoing cyber espionage campaigns targeting U.S. trade officials amid 2025 negotiations, as formally warned by the U.S. House Select Committee on China.
- Chinese state-backed actors have been observed posing as a U.S. congressman in spear-phishing attacks.
AsyncRAT is being distributed via compromised ConnectWise ScreenConnect installations to steal credentials and cryptocurrency.
Hacktivist and APT groups targeting Russian organizations have been analyzed and classified into three clusters based on their tactics, techniques, and procedures (TTPs).
The U.S. announced a $10 million reward for information leading to the arrest of Volodymyr Tymoshchuk, accused of deploying LockerGoga, MegaCortex, and Nefilim ransomware against hundreds of organizations.

Trends, Tools, or Tactics of Interest

The use of “shadow AI”-unauthorized or unmanaged AI tools by employees-is highlighted as an increasing security risk for organizations.
A new Phishing-as-a-Service kit, Salty2FA, has emerged, targeting U.S. and EU enterprises and focusing on bypassing two-factor authentication.
Two new malware families were identified:
- CHILLYHELL, a modular macOS backdoor with multiple persistence mechanisms, password brute-forcing, payload dropping, and multi-protocol communication.
- ZynorRAT, a Go-based remote access trojan capable of targeting macOS, Windows, and Linux systems.
BASE64 encoding over DNS is being used as a data exfiltration technique by certain backdoors.
Google is implementing C2PA Content Credentials in the Pixel 10 camera and Google Photos to verify image authenticity and counter AI-generated fakes.
Students are increasingly posing insider threats within the education sector, often unintentionally but at a scale challenging for security teams.
Social engineering remains a significant vector, as demonstrated by the Scattered Spider group breaching Clorox through phone-based help desk manipulation, leading to $380 million in damages.

Regulatory or Policy Developments Affecting the Security Industry

CISA presented its vision for the Common Vulnerabilities and Exposures (CVE) program, indicating ongoing evolution in vulnerability management and disclosure processes.
Apple introduced Memory Integrity Enforcement (MIE) in new iPhone models, providing always-on memory safety protections for the kernel and over 70 userland processes.
The U.S. is increasing scrutiny and financial incentives related to ransomware operators, exemplified by the $10 million reward targeting a Ukrainian ransomware actor.
The number of U.S. investors in commercial spyware companies increased sharply in 2024, with new countries identified as linked to the proliferation of such tools.

Cybersecurity Brief – 2025-08-22

Fri, 22 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Colt Technology Services Ransomware Attack
- UK-based Colt Technology Services confirmed a data breach involving customer documentation theft. The Warlock ransomware gang is auctioning the stolen files. The company is working to restore disrupted systems.
Orange Belgium Data Breach
- Orange Belgium disclosed that attackers accessed data of approximately 850,000 customers during a July cyberattack. The breach affected customer accounts but no further technical details were provided.
Ex-Developer Sentenced for Sabotage
- A former developer was sentenced to four years in prison for deploying custom malware and a kill switch on his ex-employer’s network, locking out employees after his account was disabled.
Scattered Spider Member Sentenced
- Noah Michael Urban, a member of the Scattered Spider cybercrime group, was sentenced to 10 years in prison for wire fraud and conspiracy related to high-profile attacks.

Cybersecurity Brief – 2025-08-21

Thu, 21 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a pharmaceutical company, confirmed a ransomware attack that resulted in the compromise and encryption of internal systems, with business operations impacted.
Vulnerabilities in a Workhorse Software application used by hundreds of municipalities exposed sensitive data; CERT/CC disclosed details following the release of patches.
Vulnerable internal services at Intel exposed information of 270,000 employees, as reported by a security researcher.
Microsoft is investigating an outage affecting Copilot and Office.com, impacting user access across North America.
Six major password managers are currently vulnerable to unpatched clickjacking flaws, potentially exposing user credentials, two-factor authentication codes, and credit card information.
McDonald’s staff and partner portals were found to have exposed APIs, sensitive data, and corporate documents due to security flaws.
Hackers are using legitimate ADFS redirects via office.com links to steal Microsoft 365 login credentials through phishing attacks.
The RapperBot DDoS-for-hire botnet was disrupted, and the alleged developer and administrator has been charged by the US Department of Justice.
A member of the “Scattered Spider” cybercrime group was sentenced to 10 years in prison and ordered to pay $13 million in restitution for SIM-swapping and related cyber offences.
Europol has clarified that a purported $50,000 reward for Qilin ransomware group members is a scam.

Newly Discovered Vulnerabilities

Apple released emergency security updates for iOS, iPadOS, and macOS, patching CVE-2025-43300, an out-of-bounds write zero-day vulnerability actively exploited in targeted attacks.
Google and Mozilla issued patches for multiple high-severity vulnerabilities in Chrome and Firefox browsers.
DOM-based clickjacking vulnerabilities affecting major password manager browser extensions could allow attackers to steal credentials and sensitive data.
A vulnerability in GPT-5’s routing mechanism can redirect user queries to older, less secure models, risking exposure to jailbreaks and unsafe outputs.
Researchers identified prompt injection vulnerabilities in AI browsers, such as Perplexity’s Comet, allowing malicious prompts to trigger unintended actions, including fraudulent purchases.
Vulnerabilities in McDonald’s internal portals exposed sensitive APIs and corporate documents.
CERT/CC disclosed information exposure vulnerabilities in Workhorse Software, used by local governments, after patch release.

Notable Threat Actor Activity

The Russian state-sponsored group “Static Tundra” (aka Energetic Bear) is exploiting a seven-year-old flaw in Cisco IOS/IOS XE software, targeting unpatched, end-of-life devices for cyber espionage against enterprises and critical infrastructure.
North Korean threat actors have conducted a coordinated cyber espionage campaign against diplomatic missions in South Korea, leveraging GitHub for command and control and deploying spear-phishing tactics.
Detailed spear-phishing attacks targeting European government entities in Seoul have been attributed to North Korea, China, or both.
Cybercriminals are increasingly abusing the AI-powered Lovable website builder to generate phishing pages, malware delivery sites, and fraudulent portals.
Low-skill attackers are leveraging LLM-generated scripts and services like Lovable to rapidly create convincing malicious websites.
Increased scanning activity targeting Airtell routers and web servers has been observed via honeypots.

Trends, Tools, or Tactics of Interest

HR-themed phishing attacks have surged by 120% in Q1 2025, with attackers impersonating internal HR communications to increase success rates.
The use of legitimate infrastructure (e.g., office.com, ADFS) in phishing campaigns is on the rise, enabling more convincing credential theft schemes.
AI browsers and agentic tools are being actively researched for vulnerabilities, with prompt injection and clickjacking emerging as significant risks.
The “Warlock” ransomware group is specifically targeting vulnerable on-premises SharePoint servers using sophisticated attack methods.
There is a notable increase in the abuse of AI-driven website builders (e.g., Lovable, Vibe) to lower barriers for cybercriminals, enabling rapid deployment of malicious sites.
The disruption of the RapperBot botnet and law enforcement action against its administrator highlight ongoing efforts to combat DDoS-for-hire operations.
Increased focus on shadow AI agents within enterprises, with concerns that unmonitored deployments could introduce significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced its Quantum-Safe Program, aiming to ensure all products and services are secured against quantum-based attacks by 2033.
Incode has acquired AuthenticID to enhance AI-driven identity verification, combining AI models with large-scale, regulated identity programme experience.
Europol issued a warning about fraudulent reward offers targeting ransomware group members, clarifying that a recently publicised Qilin reward is a scam.

Cybersecurity Brief – 2025-08-13

Wed, 13 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Hackers leaked data stolen from Allianz Life in ongoing Salesforce data theft campaigns, exposing 2.8 million records containing sensitive information on business partners and customers.
Over 275 million patient records were breached in the healthcare sector in 2024, primarily due to weak or stolen passwords.
Researchers identified Docker images on Docker Hub still containing the XZ Utils backdoor, more than a year after its public disclosure. At least 35 Linux images remain affected, posing ongoing supply chain risks.
The U.S. Department of Justice seized approximately $1 million in cryptocurrency from the BlackSuit ransomware gang.
Over 3,300 Citrix NetScaler devices remain unpatched against the actively exploited “CitrixBleed 2” vulnerability, leaving organisations at risk of authentication bypass attacks.

Newly Discovered Vulnerabilities

Microsoft’s August 2025 Patch Tuesday addressed 107–111 vulnerabilities, including 13–17 rated as critical. One publicly disclosed zero-day vulnerability in Windows Kerberos was patched, alongside several elevation-of-privilege flaws.
Adobe released security updates fixing over 60 vulnerabilities across 13 products, including Commerce, Substance, InDesign, FrameMaker, and Dimension.
SAP patched a critical vulnerability in S/4HANA as part of its August 2025 security notes.
Major industrial control system (ICS) vendors (Siemens, Schneider, Aveva, Honeywell, ABB, Phoenix Contact) issued advisories for code execution vulnerabilities.
Citrix NetScaler ADC products are being actively exploited via CVE-2025-6543, a critical security flaw confirmed by the Dutch National Cyber Security Centre (NCSC-NL).
A vulnerability in Erlang/OTP (CVE-2025-32433) has been widely exploited in operational technology (OT) networks since early May.
A now-patched WinRAR vulnerability has been exploited by at least two separate threat groups.

Notable Threat Actor Activity

The Charon ransomware family, employing APT-level evasion tactics, has been deployed in targeted attacks against public sector and aviation organisations in the Middle East. The campaign may be linked to China’s state-sponsored Earth Baxia group.
Cybercrime groups ShinyHunters and Scattered Spider have joined forces in data extortion campaigns, initially targeting Salesforce customers, with indications of expansion towards financial services and technology providers. ShinyHunters’ tactics now mirror those of Scattered Spider.
The newly identified Curly COMrades APT group has targeted government entities in Georgia and Moldova using custom backdoor malware and NGEN COM hijacking for persistent access.
Fortinet SSL VPN devices experienced a significant spike in brute-force attacks globally, with attackers later shifting focus to FortiManager.
Researchers report ongoing exploitation of Microsoft Teams in social engineering attacks to facilitate credential theft and malware delivery.

Trends, Tools, or Tactics of Interest

Supply chain risks persist as malicious Docker images with the XZ Utils backdoor remain available on Docker Hub.
Threat actors continue to abuse business logic flaws and leverage dark web marketplaces to sell enterprise network access, streamlining cybercrime operations.
Social engineering remains a prominent attack vector, with attackers exploiting communication platforms (e.g., Microsoft Teams) and using tactics such as tax office or Amazon recall impersonation scams.
APT actors are leveraging advanced persistence techniques, such as NGEN COM hijacking and scheduled tasks, to maintain long-term access in targeted environments.
The debate between enterprise browsers and secure browser extensions is highlighted as a key consideration for mitigating browser-based risks.
Elevation-of-privilege vulnerabilities dominated Microsoft’s August 2025 Patch Tuesday, reflecting ongoing attacker interest in privilege escalation.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced end-of-support for Windows 11 23H2 Home and Pro editions in November 2025.
Android’s protected Kernel-based Virtual Machine (pKVM) achieved SESIP Level 5 security certification, the highest level for IoT and mobile platforms.
The Dutch NCSC issued an alert regarding active exploitation of Citrix NetScaler CVE-2025-6543 in critical sectors.
Chinese authorities have publicly questioned the security of AI chips from Nvidia and AMD, citing concerns about potential backdoors.

Cybersecurity Brief – 2025-08-09

Sat, 09 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

Columbia University suffered a significant data breach impacting nearly 870,000 individuals, including students, applicants, and employees. Stolen data includes personal, financial, and health information.
French telecom provider Bouygues disclosed a breach affecting 6.4 million customers, with personal information compromised.
Allianz Life reported a cybersecurity incident exposing personal information of hundreds of thousands of individuals.
The U.S. Federal Judiciary confirmed a cyberattack on its electronic case management systems, impacting confidential court documents.
Royal and BlackSuit ransomware operations breached over 450 U.S. companies before their infrastructure was dismantled, according to the U.S. Department of Homeland Security.
FTC reported that Americans aged 60 and older lost a record $700 million to online scams in 2024, indicating a sharp increase in fraud targeting seniors.

Newly Discovered Vulnerabilities

Over a dozen vulnerabilities were identified in enterprise secure vaults from CyberArk and HashiCorp, enabling potential remote takeover without credentials if exploited.
A WinRAR vulnerability (CVE-2025-8088) was exploited as a zero-day in phishing attacks to install RomCom malware.
Security researchers found two techniques to crack at least eight brands of electronic safes using Securam Prologic locks, allowing unauthorized access within seconds.
A misconfiguration in corporate livestreaming platforms’ APIs was discovered, potentially exposing internal company meetings.
A feature in stream-oriented UNIX domain sockets (MSG_OOB) was leveraged to escalate privileges from Chrome renderer code execution to Linux kernel code execution.

Notable Threat Actor Activity

The Efimer Trojan is being mass-mailed via email and hacked WordPress sites to steal cryptocurrency by substituting clipboard wallet addresses, with over 5,000 victims reported.
A campaign dubbed GreedyBear used over 150 malicious Firefox extensions impersonating popular crypto wallets to steal more than $1 million in cryptocurrency.
60 new malicious packages were found on RubyGems, targeting credential and crypto theft. Similar activity was reported on PyPI, leading to changes in security practices for these software repositories.
AI-powered website builders (DeepSite AI, BlackBox AI) are being leveraged in Brazilian phishing scams to create convincing malicious sites.
Data from an APT actor, believed to be affiliated with China or North Korea, was leaked, revealing details on recent campaigns, attacker tools, compromised credentials, and command files.
Scattered Spider threat actor has been targeting help desks and identity systems, exploiting social engineering to bypass traditional security perimeters.

Trends, Tools, or Tactics of Interest

Leaked credentials incidents increased by 160%, with attackers using them for a range of malicious activities beyond immediate compromise.
Attackers are increasingly targeting the foundations of cryptocurrency, including smart contracts, through both scams and exploitation of vulnerabilities.
Red teams demonstrated that GPT-5’s prompt-level filters can be easily bypassed using multi-turn “storytelling” attacks, raising concerns about the model’s enterprise security.
Shadow AI and rogue AI models are being identified as new risks, with tools like BigID’s Shadow AI Discovery launched to uncover such instances.
There is a notable drop in ransomware attacks in Q2, with reported incidents falling by nearly half.
Security flaws in IoT devices, such as school bathroom vape detectors, can enable covert audio surveillance due to embedded microphones and insecure configurations.

Regulatory or Policy Developments

Microsoft 365 apps for Windows will block file access via the insecure FPRPC legacy authentication protocol by default from late August.
Microsoft will retire the Lens PDF scanner app for iOS and Android as of September 15, 2025.
The U.S. Judiciary is implementing enhanced cybersecurity measures following the breach of its electronic case management systems.
Software repositories RubyGems and PyPI are enforcing new security measures in response to the discovery of malicious packages.
Ex-NSA chief Paul Nakasone indicated at Defcon that major policy changes for the tech community may be forthcoming.

Cybersecurity Brief – 2025-08-01

Fri, 01 Aug 2025 00:00:00 +0000

Major Incidents or Breaches

A Florida correctional institution inadvertently leaked the names, email addresses, and telephone numbers of all facility visitors to every inmate.
North Korea-linked threat actor UNC4899 targeted two organizations to steal millions in cryptocurrency by luring employees via LinkedIn and Telegram, leveraging cloud account access and malware.
Financially motivated threat actor UNC2891 breached ATM networks using a 4G-equipped Raspberry Pi device and attempted to deploy the CAKETAP rootkit for fraudulent activity.

Newly Discovered Vulnerabilities

Multiple critical and high-severity vulnerabilities were patched in Honeywell Experion PKS, an industrial process control and automation product, which could have allowed manipulation of industrial processes.
Malicious connectors in Microsoft 365 were highlighted as a serious and growing email threat vector, potentially impacting hundreds of millions of users.

Notable Threat Actor Activity

The Russian state-affiliated group Secret Blizzard (also known as Turla) was observed using adversary-in-the-middle (AitM) attacks at the ISP level to deploy malware against foreign embassies in Moscow, leveraging local ISP access to intercept and manipulate web traffic.
Scattered Spider, a threat actor known for social engineering, continues to use techniques that mimic legitimate IT support to gain access to target networks, as noted in a recent CISA advisory update.
SentinelLabs reported links between Chinese state-sponsored hackers and Chinese companies developing intrusion tools used in offensive operations.

Trends, Tools, or Tactics of Interest

Researchers identified a multi-layer redirect phishing tactic targeting Microsoft 365 users, which abuses link wrapping services from Proofpoint and Intermedia to bypass security defenses and steal login credentials.
ClickFix and FileFix were profiled as social engineering attacks that start in the browser and use clipboard or File Explorer hijacking to deliver malware.
Analysis revealed that in approximately 80% of cases, spikes in malicious activity such as network reconnaissance and targeted scanning precede the public disclosure of new security vulnerabilities (CVEs).
LayerX demonstrated that browser extensions can be exploited to compromise generative AI tools via a technique dubbed ‘man-in-the-prompt’, posing a significant risk to sensitive data.
BrainDamage, a new payload generator and encrypted shell stager toolkit, was released for red team operations, focusing on stealth and remote command delivery.
Kali Linux is now supported in Apple containers on macOS Sequoia, expanding virtualization options for security professionals.
CISA released Thorium, an open-source platform for malware and forensic analysis, aimed at supporting containment and eviction during incident response.
The Gartner 2025 Magic Quadrant highlights increasing adoption of AI-driven solutions in endpoint security to address complex and growing threats.
Security Operations Centers are experiencing alert fatigue and data overload, with traditional SIEMs struggling to keep pace with increasing log volumes and complexity.
Proton launched a free, standalone, cross-platform two-factor authentication app, Proton Authenticator.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced that, between October 2025 and July 2026, it will disable external workbook links to blocked file types by default in Excel.
Microsoft expanded its .NET and ASP.NET Core bug bounty program, offering rewards of up to $40,000 for eligible vulnerabilities.
Meta is sponsoring the Pwn2Own Ireland 2025 hacking competition, offering up to $1 million for a successful WhatsApp exploit.
The Trump Administration, in collaboration with 60 companies, is developing a plan for Americans to voluntarily upload their healthcare and medical data.
Significant funding rounds were announced: Noma Security raised $100 million for AI agent security solutions, Wallarm raised $55 million for API security, and Reach Security received $10 million for AI-driven exposure management solutions.

Cybersecurity Brief – 2025-07-31

Thu, 31 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The ShinyHunters extortion group has been linked to data breaches at Qantas, Allianz Life, LVMH, and Adidas, using voice phishing attacks to steal data from Salesforce environments.
SafePay ransomware group claims to have stolen 3.5TB of data from Ingram Micro and is threatening to leak the data.
Telecom provider Orange suffered a cyberattack resulting in service disruptions for both corporate and individual customers.
The UNC2891 (LightBasin) threat group attempted a physical intrusion by planting a 4G-equipped Raspberry Pi on a bank’s network during a failed ATM heist.
The City of Saint Paul, Minnesota, called in the National Guard to respond to a cyberattack.
The National Treasury of South Africa and several other organisations were compromised in mass exploits of on-premises Microsoft SharePoint servers.
A U.S.-based chemicals company was breached via exploitation of a SAP NetWeaver vulnerability, leading to deployment of the Auto-Color backdoor.
The Python Software Foundation warned that attackers are using a fake PyPI website to phish for developer credentials.
Over 250 fake mobile apps targeting Koreans have been used to deploy spyware and conduct blackmail campaigns.
Discord and other social platforms are being flooded with fraudulent online gaming and wagering sites, which lure users and steal funds.

Newly Discovered Vulnerabilities

Apple released security updates for iOS, iPadOS, and Safari, patching 29 vulnerabilities, including a WebKit flaw that was exploited as a zero-day in Google Chrome.
Lenovo issued UEFI firmware updates to address high-severity BIOS flaws enabling Secure Boot bypass in certain desktop models.
Critical, now-patched vulnerabilities in Dahua smart camera firmware could allow remote hijacking via ONVIF and file upload exploits.
Researchers disclosed a critical authentication bypass in the Vibe coding platform Base44, which exposed private enterprise applications; Wix patched the issue.
A critical unauthenticated arbitrary file upload vulnerability in the WordPress ‘Alone’ theme is being actively exploited for remote code execution and full site takeovers.

Notable Threat Actor Activity

Cobalt Strike Beacon is being delivered via social media, Microsoft Learn Challenge, Quora, and GitHub in a campaign targeting Russian entities.
Hackers are distributing JSCEAL malware through Facebook ads promoting fake cryptocurrency trading apps, using compiled V8 JavaScript to capture sensitive data.
Chinese state-sponsored group Silk Typhoon (Hafnium) is linked to over 15 technology patents for cyber espionage tools, highlighting PRC-backed contractor involvement.
Scattered Spider’s activity has decreased following recent arrests, but their social engineering and backup targeting tactics are being adopted by other financially motivated actors.

Trends, Tools, or Tactics of Interest

Device Bound Session Credentials (DBSC) launched in open beta in Google Chrome to protect against session cookie theft.
A new attack vector allows threat actors to use malicious browser extensions to inject prompts into popular generative AI tools, including ChatGPT and Gemini (“Man in the Prompt” attack).
AI adoption in vCISO services is rapidly increasing, with a reported 68% reduction in workload and tripling of adoption rates among MSPs and MSSPs.
VPN usage in the UK is rising sharply in response to age verification controls mandated by the Online Safety Act.
Security awareness training and tools, such as KnowBe4’s Phish Alert Button, can significantly increase employee phishing reporting rates, as evidenced by a 50-fold increase in a large retail organisation.
Fraudsters are exploiting Discord and social media to promote sophisticated scam gaming sites.
Mass exploitation of on-premises Microsoft SharePoint servers continues to impact organisations, particularly in Africa.
Threat actors are using phishing with fake PyPI sites to target software developers and steal credentials.

Regulatory or Policy Developments

The US Senate Committee has advanced the nomination of Sean Plankey to lead the Cybersecurity and Infrastructure Security Agency (CISA).
The UK’s Online Safety Act, which mandates age verification on adult sites, is directly influencing a surge in VPN adoption across the region.

Industry Developments

Palo Alto Networks announced the acquisition of CyberArk for $25 billion, marking a significant move into the identity security market.
BlinkOps raised $50 million for its agentic security automation platform, bringing total funding to $90 million.
Legion emerged from stealth with $38 million in funding for its browser-native AI Security Operations Center (SOC) platform.
Cyata, an Israeli startup focused on AI agent monitoring and control, raised $8.5 million in funding.
The average cost of a data breach in the US has risen to $10.22 million, while the global average has decreased slightly to $4.44 million, according to IBM.

Cybersecurity Brief – 2025-07-29

Tue, 29 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Toptal suffered a breach of its GitHub organization account, which was used to publish 10 malicious npm packages. These packages were downloaded approximately 5,000 times, constituting a significant software supply chain attack.
France’s state-owned defense firm Naval Group is investigating a cyberattack after 1TB of allegedly stolen data was leaked on a hacking forum.
Allianz Life confirmed a data breach impacting the majority of its 1.4 million US customers, including compromised information of customers, financial professionals, and employees.
NASCAR disclosed that personal information, including names and Social Security numbers, was stolen in an April 2025 ransomware attack.
The Tea app breach expanded, with a second database leak exposing 1.1 million private user messages and data being circulated on hacking forums.
Lovense’s connected sex toy app is vulnerable to a flaw that exposes user email addresses, putting users at risk of doxxing.
Endgame Gear’s OP1w 4k v2 mouse configuration tool was infected with malware and distributed via the official website between June 26 and July 9, 2025.
The US Energy Department, including its National Nuclear Security Administration, was listed among recent high-profile attacks according to threat intelligence bulletins.

Newly Discovered Vulnerabilities

A critical unauthenticated remote code execution vulnerability (CVE-2025-20281) in Cisco Identity Services Engine (ISE) has a complete public exploit chain and is being actively exploited.
Multiple vulnerabilities in PaperCut NG/MF print management software, including a remote code execution vulnerability via cross-site request forgery (CSRF), have been added to CISA’s Known Exploited Vulnerabilities catalog amid active exploitation.
A vulnerability in Google’s Gemini CLI AI coding assistant allowed silent execution of malicious code and data exfiltration via allowlisted programs.
Microsoft disclosed a macOS vulnerability (“Sploitlight”) that could bypass Transparency, Consent, and Control (TCC) checks, exposing sensitive user data, including Apple Intelligence cache.
The Post SMTP WordPress plugin (400,000+ installations) is affected by a critical flaw allowing website takeover; approximately half of affected sites remain unpatched.

Notable Threat Actor Activity

The BlackSuit ransomware group has been disrupted by law enforcement, with former members forming a new double-extortion group under the name Chaos ransomware.
Scattered Spider, a financially motivated threat actor, is shifting tactics to target VMware vSphere environments directly, deploying ransomware from the hypervisor rather than through Active Directory.
Ukrainian and Belarusian hacker groups claimed responsibility for a cyberattack on Russian airline Aeroflot, resulting in the cancellation of over 100 flights.
A new infostealer malware, Shuyal Stealer, is targeting credentials and system data from 19 different browsers, including privacy-focused options, and demonstrates advanced evasion techniques.

Trends, Tools, or Tactics of Interest

Software supply chain attacks remain prevalent, as demonstrated by the Toptal npm incident and malware distribution via legitimate software tools (Endgame Gear).
Exposed API documentation continues to be a significant risk; the free Autoswagger tool was released to help identify and remediate API endpoint flaws.
Agentic AI and deepfake creation are rapidly advancing, increasing risks for identity fraud, disinformation, and targeted attacks.
The use of ransomware from virtualisation platforms (VMware vSphere) is an emerging tactic among financially motivated groups.
A trend of exploiting vulnerabilities in widely used plugins and platforms (WordPress, PaperCut, SharePoint) is ongoing, with rapid exploitation following disclosure.
The prevalence of data breaches involving large user databases highlights ongoing risks associated with third-party applications and cloud-based services.

Regulatory or Policy Developments

CISA updated its Known Exploited Vulnerabilities catalog to include actively exploited flaws in PaperCut NG/MF.
Microsoft announced end of support for Windows 11 22H2 editions effective 14 October 2025.
The Internet Archive has become an official US federal depository library, expanding public access to government documents.
Adobe appointed Aanchal Gupta as Chief Security Officer.

Cybersecurity Brief – 2025-07-28

Mon, 28 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

The threat actor group Scattered Spider has been conducting a campaign targeting VMware ESXi hypervisors, focusing on organisations in the retail, airline, transportation, and insurance sectors in North America. The group has been observed deploying ransomware on critical infrastructure by compromising virtualized environments.

Newly Discovered Vulnerabilities

Researchers have identified over a dozen security vulnerabilities in Tridium’s Niagara Framework. These flaws could allow an attacker present on the same network to compromise smart building and industrial systems globally.
A critical vulnerability has been found in the Post SMTP email delivery WordPress plugin, which has approximately 400,000 installations. The flaw enables website takeover, and around half of the affected websites remain unpatched.

Notable Threat Actor Activity

Scattered Spider has escalated its focus on VMware ESXi environments, utilising direct attacks on hypervisors to facilitate ransomware deployment across multiple sectors in the US.

Trends, Tools, or Tactics of Interest

Increased distribution of free, high-value resources and whitepapers on AI security practices, including prompt engineering and agent frameworks, is being observed from leading industry organisations.

Cybersecurity Brief – 2025-07-15

Tue, 15 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Louis Vuitton has notified customers in the UK, South Korea, Turkey, and possibly other countries of a data breach affecting their personal information.
McDonald’s has suffered a data breach resulting in the exposure of customer data.
Two versions of the Gravity Forms WordPress plugin, distributed via the official download page, were compromised in a supply chain attack, with malware injected into the plugin.
A malicious Visual Studio Code extension for the Cursor AI IDE led to the theft of $500,000 in cryptocurrency from a Russian crypto firm, after infecting devices with remote access tools and infostealers.
India’s Central Bureau of Investigation (CBI) dismantled a transnational cybercrime syndicate responsible for a £390,000 UK tech support scam, arresting key operatives at a Noida call center.

Newly Discovered Vulnerabilities

Multiple Gigabyte motherboard models have UEFI firmware vulnerabilities that allow attackers to bypass Secure Boot and install persistent bootkit malware invisible to the operating system and capable of surviving OS reinstalls.
Vulnerabilities in Gigabyte firmware could allow attackers to disable Secure Boot and execute code during the early boot phase, facilitating backdoor deployment.
A vulnerability in train End-of-Train and Head-of-Train radio systems allows remote attackers to trigger train brakes; this issue has been known in the industry for 20 years.
CISA has added the recently disclosed CitrixBleed 2 vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, designating it as an unacceptable risk.
Google Gemini AI assistant is vulnerable to prompt-injection attacks, allowing attackers to craft invisible, malicious prompts that can be used to display phishing messages, including when summarising emails in Google Workspace.

Notable Threat Actor Activity

The Interlock ransomware group is distributing a new PHP-based variant of its remote access trojan (RAT) using a delivery mechanism called FileFix, in campaigns targeting multiple industries. The group is leveraging the KongTuke Traffic Distribution System (TDS) and legitimate websites for web-inject campaigns to gain control of victim devices.
Cybercriminals are impersonating major news outlets (CNN, BBC, CNBC) via sponsored ads and fake news websites to lure victims into investment scams.
Scattered Spider threat actor arrests have been reported, indicating law enforcement action against this group.
Exposed Git repositories continue to be a source of sensitive data leaks across enterprises, representing a persistent but often overlooked risk.

Trends, Tools, or Tactics of Interest

There is a reported increase in honeypot log volumes, indicating a rise in scanning and malicious activity observed on internet-facing systems.
The UserAssist Windows artifact, including previously undocumented binary data structures, has been detailed for forensic and incident response purposes, with a new parsing tool released.
Attackers are increasingly targeting supply chains, as evidenced by the compromise of the Gravity Forms WordPress plugin.
The use of prompt-injection attacks against AI assistants is an emerging tactic for phishing and social engineering.

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) has launched the Vulnerability Research Initiative (VRI), a new programme to strengthen collaboration with external cybersecurity experts for vulnerability discovery and reporting.

Cybersecurity Brief – 2025-07-13

Sun, 13 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Over 600 Laravel applications have been exposed to remote code execution (RCE) due to leaked APP_KEYs found on GitHub, enabling attackers to compromise affected deployments.
Hackers are actively exploiting a critical RCE vulnerability in Wing FTP Server, following the public release of technical details about the flaw.
Four individuals have been arrested in connection with the Scattered Spider hacking group, which has been implicated in a series of high-profile attacks.

Newly Discovered Vulnerabilities

A new attack variant, GPUHammer, targets NVIDIA GPUs by exploiting a RowHammer-style vulnerability, potentially degrading the performance of AI models. NVIDIA has advised customers to enable System-level Error Correction Codes (ECC) to mitigate risk.

Notable Threat Actor Activity

Arrests have been made relating to the Scattered Spider group, known for sophisticated cyber intrusions and extortion campaigns.
A Russian professional basketball player has been arrested on ransomware-related charges.

Trends, Tools, or Tactics of Interest

The Grok-4 large language model (LLM) by xAI was successfully jailbroken within two days of release, highlighting ongoing challenges in securing generative AI models against prompt injection and bypass techniques.
There is a reported surge in AI-generated child abuse imagery circulating online, indicating increased abuse of generative AI tools for illicit content production.

Cybersecurity Brief – 2025-07-11

Fri, 11 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Four individuals were arrested in the UK for cyberattacks targeting major retailers Marks & Spencer, Co-op, and Harrods. The suspects are believed to be connected to the Scattered Spider group, which has also targeted airlines and other sectors.
Qantas confirmed a data breach affecting 5.7 million customers. Exposed information includes names, addresses, email addresses, phone numbers, and other personal data.
Nippon Steel’s NS Solutions subsidiary suffered a breach exposing customer and employee data. There is currently no evidence of the data being leaked on dark web sites.
Ingram Micro experienced a ransomware attack that disrupted online ordering for customers. The company has since restored operations.
McDonald’s suffered a data exposure incident involving its AI-powered job application bot, which allowed access to applicant data using a weak default password.

Newly Discovered Vulnerabilities

CISA added CVE-2025-5777, a critical vulnerability in Citrix NetScaler ADC and Gateway, to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation.
A critical remote code execution vulnerability was discovered in the open-source mcp-remote project, affecting over 437,000 downloads.
Multiple critical vulnerabilities, dubbed “PerfektBlue,” were identified in the BlueSDK Bluetooth stack used by Mercedes, Volkswagen, and Skoda vehicles. These flaws could allow remote code execution and potential access to critical vehicle systems.
A high-severity flaw, CVE-2025-3648, was disclosed in the ServiceNow platform. Exploitation could lead to data exposure via misconfigured access control lists (ACLs).
AMD disclosed a new class of vulnerabilities called Transient Scheduler Attacks, impacting a wide range of its CPUs and potentially allowing information disclosure.
A 6-year-old Oracle vulnerability affecting eSIM technology was disclosed, enabling potential spying and device takeover across millions of phones.
The Model Context Protocol (MCP) ecosystem, widely adopted for integrating AI models with external data, was found to have critical security vulnerabilities opening new attack vectors.

Notable Threat Actor Activity

Scattered Spider, a data theft and extortion group, has shifted its targeting to the aviation and transportation sectors, according to warnings from the FBI and cybersecurity experts.
Kaspersky identified malicious open-source packages for Cursor AI that deploy the Quasar backdoor and a cryptocurrency stealer.
Ongoing social engineering campaigns are using fake gaming and AI startup firms on Telegram and Discord to distribute malware targeting cryptocurrency users.
A new ZuRu malware variant is propagating via trojanized versions of the Termius macOS app, targeting developers.
Deepfake attacks are being used to impersonate high-profile political figures, such as Marco Rubio, to attempt to extract government secrets.
A Russian professional basketball player was arrested in France at the request of the US for allegedly acting as a negotiator for a ransomware gang.

Trends, Tools, or Tactics of Interest

AI-driven attacks are becoming more sophisticated, faster, and pervasive, with increased use of generative AI in offensive operations.
SSH tunneling, specifically direct-tcp requests, is highlighted as an active technique.
Force Push Scanner is a new tool for red teams to identify leaked secrets in ephemeral GitHub commits.
Anubis, an open-source self-hosted firewall, is being used to block AI bots from scraping website content.
SIM swap fraud is reportedly increasing, highlighting ongoing risks to mobile-based authentication.
Microsoft replaced the default JScript engine with JScript9Legacy in Windows 11 version 24H2 and later, aiming to improve scripting security.

Regulatory or Policy Developments

The FBI issued guidance on CJIS (Criminal Justice Information Services) compliance, emphasizing password hygiene, multi-factor authentication, and access control for law enforcement data handlers.
The U.S. Department of Homeland Security is advising law enforcement to treat certain protest activities as violent tactics, including livestreaming and skateboarding, potentially affecting policing and surveillance practices.
CISA’s update to the KEV catalog with Citrix NetScaler CVE-2025-5777 signals heightened regulatory attention to actively exploited enterprise vulnerabilities.

Cybersecurity Brief – 2025-07-03

Thu, 03 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Qantas Airlines suffered a data breach impacting 6 million customers. Personal information was accessed via a third-party call center platform; passport and credit card data were not included.
Spanish authorities arrested two individuals in Las Palmas for cybercriminal activity, including data theft from government entities, politicians, and journalists.

Newly Discovered Vulnerabilities

Cisco disclosed and patched a critical vulnerability in Unified Communications Manager (Unified CM) and Session Management Edition, involving hardcoded root SSH credentials that allowed remote root access. The backdoor account has now been removed.
The Forminator WordPress plugin is vulnerable to an unauthenticated arbitrary file deletion flaw, enabling potential full site takeover attacks.
Google Chrome was updated to address a serious security flaw that has been exploited in the wild.
Citrix issued a warning that patching recent authentication bypass vulnerabilities in NetScaler ADC and Gateway may cause login page failures.
Multiple fake cryptocurrency wallet extensions were discovered in the Firefox add-ons store, designed to steal wallet credentials and sensitive data.

Notable Threat Actor Activity

The Russian APT group Gamaredon continues aggressive spearphishing campaigns targeting Ukrainian government entities in 2024, utilizing an evolved cyberespionage toolset and new stealth-focused techniques, including weaponization of network drives.
North Korean state-backed actors are targeting Web3 and cryptocurrency organizations with new malware written in Nim, including a macOS variant named NimDoor, which can revive itself if terminated. They are also leveraging the ClickFix technique in the BabyShark campaign to bypass browser safeguards.
A China-nexus initial access broker has been observed exploiting unpatched Ivanti vulnerabilities for initial access, then self-patching the vulnerabilities to block other threat actors.
Scattered Spider, a group of young cybercriminals, is identified as a significant and imminent threat, having targeted retailers, insurers, and airlines with a flexible and difficult-to-defend structure.
Threat actors are increasingly using callback phishing campaigns, impersonating brands such as Microsoft and DocuSign via PDFs to trick users into calling attacker-controlled phone numbers.
Attackers are using AI to rapidly generate convincing phishing sites impersonating Okta and Microsoft 365 login pages.
Attack chains such as ClickFix and FileFix exploit browser and user behavior to bypass security controls and enable malicious script execution.

Trends, Tools, or Tactics of Interest

Nearly 80% of cyber threats now mimic legitimate user behavior, complicating network threat detection.
Modern phishing campaigns are leveraging AI and social engineering to increase the speed and realism of attacks.
Social engineering tactics are being used in attack chains to manipulate victims into saving and renaming files that execute malicious scripts.
Fake browser extensions and add-ons targeting cryptocurrency wallets are proliferating in official app stores.
New malware written in the Nim programming language is being used in targeted attacks, reflecting an ongoing trend of threat actors adopting less common languages to evade detection.

Regulatory or Policy Developments Affecting the Security Industry

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Russia-based bulletproof hosting provider Aeza Group for supporting ransomware and malware operations, including affiliations with BianLian and Lumma Stealer.
The U.S. Department of Justice is investigating a former ransomware negotiator for alleged criminal collaboration with ransomware gangs to profit from extortion payment deals.
A U.S. judge approved the sale of 23andMe’s DNA data to TTAM Research Institute, prompting privacy concerns and increased user requests for data deletion.

Cybersecurity Brief – 2025-07-01

Tue, 01 Jul 2025 00:00:00 +0000

Major Incidents or Breaches

Switzerland’s government reported that sensitive data from multiple federal offices was compromised following a ransomware attack on the third-party provider Radix.
Europol, in coordination with Spanish authorities, dismantled a cryptocurrency investment fraud ring responsible for laundering approximately $540 million (€460 million) from over 5,000 victims. Five suspects were arrested.
Over 1,200 Citrix NetScaler ADC and NetScaler Gateway servers remain unpatched against a critical authentication bypass vulnerability, which is reportedly being actively exploited.
The hacker collective Scattered Spider continues its campaign targeting the airline sector, with Microsoft designating the group as a significant cyber threat.
The FBI disclosed that cybercriminals are impersonating health fraud investigators to steal sensitive health information from US citizens.
The US Justice Department revealed that the identities of more than 80 Americans were stolen to facilitate North Korean IT worker scams, with action taken against associated “laptop farms.”
A government report indicated that a hacker was hired by the Sinaloa drug cartel to identify and target individuals connected to the FBI’s investigation, leading to fatal outcomes.

Newly Discovered Vulnerabilities

Vulnerabilities in Airoha Bluetooth chips, used in Sony and Bose earbuds and headphones, could allow attackers to hijack both the audio devices and any connected host systems. Details of the vulnerabilities have not yet been published.
Some Brother printers are affected by a critical security flaw that can be mitigated by changing the default admin password.
Microsoft warned of delays in the delivery of June 2025 Windows security updates due to an incorrect metadata timestamp.

Notable Threat Actor Activity

US agencies (CISA, FBI, NSA, DC3) issued a joint advisory regarding increased Iranian state-sponsored cyber activity targeting US defense, operational technology (OT) networks, and critical infrastructure.
Blind Eagle, a known threat actor, has been linked to the use of the Russian bulletproof hosting service Proton66 for phishing campaigns and remote access trojan (RAT) deployment targeting Colombian banks.
Ongoing AI-themed SEO poisoning attacks are distributing Lumma and Vidar infostealers and other malware via malicious websites optimized for AI-related search terms.

Trends, Tools, or Tactics of Interest

Microsoft Defender for Office 365 now automatically detects and blocks email bombing attacks.
Identity-based attacks, including impersonation and credential theft, continue to rise in frequency and sophistication.
Attackers are increasingly leveraging legitimate system functionality and user credentials, often exploiting “by design” behaviors rather than technical flaws.

Regulatory or Policy Developments Affecting the Security Industry

The Canadian government ordered Hikvision Canada to cease all operations due to national security concerns, though individuals and private businesses may still purchase Hikvision products.
The Berlin Data Protection Commissioner formally requested Google and Apple to remove the DeepSeek AI application from their app stores for GDPR violations.
Microsoft announced it will remove password management functionality from its Authenticator app starting August 1, 2025, as part of a shift towards passkey-based authentication.
Proposed US legislation aims to reduce federal AI funding for states that enact AI regulations, with exemptions for laws addressing unfair practices and child sexual abuse material.

Cybersecurity Brief – 2025-06-30

Mon, 30 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Hawaiian Airlines has confirmed a cyber incident linked to the cybercrime group Scattered Spider, which has expanded operations to target airlines following high-profile breaches at WestJet and insurers.
Over 27% of UK businesses experienced cyber incidents in the past year, a significant increase from 16%. Vulnerable smart buildings and IoT systems pose significant risk factors, with 73% of leaders anticipating further disruptions.
Nearly 16 billion login credentials have been leaked online, highlighting ongoing issues with password hygiene and the reuse of credentials.

Cybersecurity Brief – 2025-06-29

Sun, 29 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The FBI has reported that the cybercrime group Scattered Spider is expanding its attacks to target the airline sector, primarily using social engineering tactics.
Hackers reportedly opened a valve at a Norwegian dam, indicating unauthorised access and potential risk to critical infrastructure.

Notable Threat Actor Activity

Scattered Spider has broadened its targeting to include airlines, employing social engineering to gain access.
The GIFTEDCROOK malware, operated by an unnamed threat actor, has evolved from a browser data stealer into a more advanced intelligence-gathering tool, with recent campaigns demonstrating enhanced data exfiltration capabilities.

Trends, Tools, or Tactics of Interest

GIFTEDCROOK’s evolution highlights a trend of commodity malware being upgraded for broader intelligence gathering, beyond basic credential theft.
Scattered Spider continues to rely on social engineering, a persistent and effective tactic for initial access, particularly in the airline industry.
ICE (U.S. Immigration and Customs Enforcement) has deployed facial recognition tools to officers’ mobile phones, increasing the use of biometric technology in field operations.

Regulatory or Policy Developments Affecting the Security Industry

Facebook (Meta) has introduced a new AI tool that requests users to upload personal photos for content generation, raising privacy concerns regarding data collection, storage, and potential misuse of biometric and personal information.

Cybersecurity Brief – 2025-06-28

Sat, 28 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Ahold Delhaize, a global food retail chain, disclosed that a ransomware attack in November resulted in a data breach affecting 2.2 million individuals, compromising personal, financial, and health information.
Cloudflare successfully mitigated the largest recorded DDoS attack to date.
Russian ISPs began throttling access to websites and services protected by Cloudflare as of 9 June 2025, causing widespread inaccessibility.

Newly Discovered Vulnerabilities

A critical vulnerability in NetScaler ADC and Gateway, dubbed “Citrix Bleed 2” (CVE-2025-5777), is now believed to be actively exploited. This flaw allows attackers to maintain undetected access for extended periods.
Researchers identified security weaknesses in aftermarket smart tractor steering systems, allowing potential full takeover and surveillance of connected tractors.

Notable Threat Actor Activity

Over 1,000 SOHO devices have been compromised in China-linked “LapDogs” cyber espionage operations.
Mustang Panda, a China-based threat actor, conducted a targeted cyber espionage campaign against the Tibetan community using spear-phishing and custom malware (PUBLOAD and Pubshell).
The Chinese group “Silver Fox” has been observed using fake websites mimicking popular software to distribute Sainbox RAT and the Hidden rootkit, targeting users in China and Japan.
Scattered Spider hackers have shifted their targeting to aviation and transportation sectors after previously attacking insurance and retail. In a recent incident, they accessed CyberArk vaults, extracted over 1,400 secrets, and compromised Azure, VMware, and Snowflake environments.
Increased scanning activity targeting Progress MOVEit Transfer systems has been detected since 27 May 2025, indicating preparation for further exploitation of known CVEs.

Trends, Tools, or Tactics of Interest

64% of US C-suite executives in cybersecurity or data center roles cite data breaches and ransomware as the top threats for the next decade.
Threat actors are increasingly leveraging fake websites and spear-phishing with regionally relevant topics to deliver custom malware in espionage campaigns.
Security operations centers are under pressure due to increasingly complex threats and stagnant budgets, prompting interest in agentic AI SOC analysts.
There is a noted increase in the scale and sophistication of DDoS attacks.
The US is reported to be lagging behind China in exploit production capabilities.
Researchers allege that VPN apps from Apple and Google app stores may be enabling surveillance by Chinese authorities.

Regulatory or Policy Developments Affecting the Security Industry

The US Supreme Court upheld the constitutionality of Texas’ age verification law for explicit websites, setting a precedent for similar regulatory measures.

Cybersecurity Brief – 2025-06-27

Fri, 27 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

United Natural Foods Inc. (UNFI), a major supplier to Whole Foods, has restored its core systems and electronic ordering/invoicing platforms after a cyberattack. Details of the attack vector or threat actor have not been disclosed.
Hawaiian Airlines reported a cyberattack that disrupted access to some systems. Flight operations were not affected. The investigation is ongoing.
The U.S. Department of Justice charged a British national, alleged to be the threat actor “IntelBroker,” in connection with several high-profile breaches.
New South Wales Police arrested a former Western Sydney University student accused of repeatedly hacking university systems for personal gain, including manipulating parking and accessing data.
A Kansas City man pleaded guilty to hacking multiple organizations to promote his own cybersecurity services.
AT&T has agreed to a $177 million settlement following a data breach that resulted in customer information being leaked and sold on the dark web.
The “Cyber Fattah” hacktivist group leaked data from Saudi Games, amid increased hacktivist activity linked to regional tensions.

Newly Discovered Vulnerabilities

Researchers disclosed a critical vulnerability in the Open VSX Registry (“open-vsx[.]org”) that could allow attackers to take control of the registry and conduct supply chain attacks affecting millions of developers.
Cisco released updates to address two maximum-severity unauthenticated remote code execution vulnerabilities in Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC), which could allow attackers to gain root access.
CISA reported active exploitation of a maximum severity vulnerability in AMI MegaRAC Baseboard Management Controller (BMC) software, enabling server hijacking and potential bricking of affected systems.
A bug affecting 689 Brother printer models (and 53 models from other manufacturers) exposes default administrator passwords that can be generated remotely, putting devices at risk of unauthorized access.

Notable Threat Actor Activity

Iranian state-sponsored group APT35 (linked to the IRGC) is conducting spear-phishing campaigns targeting Israeli journalists, cybersecurity experts, and tech professionals using AI-powered phishing techniques.
Cybercriminals are exploiting open-source and publicly available tools to target financial institutions across Africa in attacks ongoing since at least July 2023.
Scattered Spider, a well-known threat actor, has shifted its targeting from global retailers to U.S.-based insurance firms, employing advanced TTPs.
Researchers observed a significant increase (517%) in ClickFix social engineering attacks using fake CAPTCHA verifications as an initial access vector. A new related method, FileFix, has emerged.
Ongoing phishing campaigns are abusing Microsoft 365’s “Direct Send” feature to send phishing emails as internal users, bypassing standard email security controls.
Bitdefender reported a surge in social engineering attacks targeting WhatsApp users, aiming to compromise accounts through various scam tactics.
New Trojan malware is targeting sensitive information stored in mobile device screenshots, including cryptocurrency wallet seed phrases.

Trends, Tools, or Tactics of Interest

Use of open-source and commodity tools by cybercriminals for targeting financial institutions is increasing, particularly in Africa.
Fake CAPTCHA (ClickFix) and document-based (FileFix) social engineering tactics are on the rise as initial access methods.
Abuse of Microsoft 365’s “Direct Send” feature is being used to bypass detection and facilitate internal phishing.
AI-powered phishing is being adopted by state-sponsored actors, as seen in APT35’s recent campaigns.
SaaS adoption continues to outpace the development of effective data resilience and security controls, increasing organizational risk.

Regulatory or Policy Developments

The U.S. Federal Trade Commission (FTC) approved $126 million in refunds to Fortnite users as part of a settlement over the use of “dark patterns” by Epic Games to induce unwanted purchases.
Microsoft has rolled out changes to Windows security architecture aimed at preventing outages similar to the 2024 CrowdStrike incident, improving system resilience and recovery.
AT&T’s $177 million settlement over a major data breach establishes compensation for affected users whose personal data was leaked.

Cybersecurity Brief – 2025-06-22

Sun, 22 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The April 2025 cyberattacks on UK retailers Marks & Spencer and Co-op have been attributed to the threat group Scattered Spider. The incidents have been classified as a “single combined cyber event,” with estimated damages reaching up to $592 million.
The UK Information Commissioner’s Office (ICO) has imposed a significant fine on 23andMe following its 2023 data breach.

Notable Threat Actor Activity

Scattered Spider has been identified as the group behind the coordinated attacks on Marks & Spencer and Co-op.
Israeli authorities have accused Iranian state-linked actors of hacking security cameras in Israel for espionage purposes.
Ukrainian hackers have reportedly disrupted a major Russian internet provider.
China’s Salt Typhoon threat group has claimed responsibility for another cyberattack, details of which were not specified.

Trends, Tools, or Tactics of Interest

Alternate Data Streams (ADS) are being highlighted as a method for adversary defense evasion, with recent discussions focusing on detection techniques using Python tools.

Regulatory or Policy Developments

The UK has levied a substantial fine against 23andMe in response to its 2023 data breach, indicating ongoing regulatory scrutiny of data protection practices.

Cybersecurity Brief – 2025-06-21

Sat, 21 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Iran’s state-owned TV broadcaster was hacked mid-broadcast, with programming interrupted to air protest videos against the government.
The Taiwanese cryptocurrency exchange BitoPro attributed a cyberattack resulting in the theft of $11 million in cryptocurrency to the North Korean Lazarus Group.
American insurance company Aflac disclosed a breach as part of a broader campaign targeting US insurance providers, with potential theft of personal data. The campaign is linked to Scattered Spider.
A massive distributed denial-of-service (DDoS) attack peaking at 7.3 Tbps targeted a hosting provider, with Cloudflare mitigating the incident. This is the largest DDoS attack recorded to date.
A significant data breach exposed a plain text file containing 184 million passwords for services including Google, Microsoft, and Facebook.
Reports surfaced regarding a leak of 16 billion passwords from various data breaches, raising concerns about widespread credential exposure.

Notable Threat Actor Activity

The Qilin ransomware group has added a “Call Lawyer” feature to its ransomware-as-a-service offering, enabling affiliates to provide legal counsel to victims as an additional pressure tactic for ransom payment.
The Lazarus Group was linked to the BitoPro crypto heist, continuing its focus on financial sector attacks.
Scattered Spider was identified as the actor behind the insurance sector attacks, including the breach at Aflac.
A new campaign targeted gamers and developers by publishing over 200 trojanized GitHub repositories, masquerading as Python-based hacking tools to deliver malware.
Threat actors are increasingly using malicious copycat repositories on GitHub as an alternative malware distribution channel, adapting to improved security in package registries.

Trends, Tools, or Tactics of Interest

Threat actors are intensifying psychological pressure on ransomware victims by offering legal assistance, as observed in the Qilin ransomware campaign.
DDoS attacks are reaching unprecedented scale, with the latest attack peaking at 7.3 Tbps and delivering 37.4 TB of data in under a minute.
There is a notable increase in supply chain attacks targeting developers via open source platforms, particularly through malicious and copycat repositories on GitHub.
Cyber operations and hacktivism are increasingly used as tools in geopolitical conflicts, as seen in the Iran state TV hack and broader commentary on cyberwarfare trends.
The insurance sector is facing coordinated campaigns from advanced threat actors, with a focus on data theft and extortion.

Newly Discovered Vulnerabilities

Microsoft is investigating a OneDrive issue that causes file searches to return blank or no results, affecting user accessibility.

Regulatory or Policy Developments Affecting the Security Industry

Microsoft announced plans to periodically remove legacy drivers from the Windows Update catalog to reduce security and compatibility risks.
AWS introduced enhanced visibility features for its core security products, aiming to provide improved threat context for cloud customers.
Google released new enterprise-grade security features for Android device management, targeting organizational security needs.

Cybersecurity Brief – 2025-06-18

Wed, 18 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Scania, a major automotive manufacturer, confirmed a cybersecurity incident involving the compromise of insurance claim documents through stolen credentials. The breach was linked to an extortion attempt.
Cock.li, an email hosting provider, disclosed a data breach impacting over one million user records. Attackers exploited vulnerabilities in the now-retired Roundcube webmail platform to access the data.
Indian car-sharing firm Zoomcar reported a breach affecting more than 8 million users. Exposed data included names, phone numbers, car registration numbers, addresses, and emails.
23andMe was fined £2.31 million by the UK ICO for a data breach exposing genetic data, attributed to serious security failings.
WestJet Airlines warned customers and employees to be cautious with personal information following a cyber incident affecting its app and website, though core operations continued.
Paddle.com and its U.S. subsidiary settled with the U.S. FTC for $5 million over allegations of facilitating tech-support scams that harmed consumers.

Newly Discovered Vulnerabilities

Veeam released patches for a critical remote code execution (RCE) vulnerability (CVE-2025-23121, CVSS 9.9) in its Backup & Replication software. The flaw could allow domain users to compromise backup servers.
Researchers disclosed a chain of three vulnerabilities in Sitecore Experience Platform (XP), including a hard-coded password (“b”), allowing unauthenticated RCE on enterprise deployments.
Google Chrome addressed a zero-day vulnerability (CVE-2025-2783) exploited by the threat actor “TaxOff” to deploy the Trinper backdoor. The flaw was actively exploited in March 2025.
A critical RCE vulnerability in LangChain’s LangSmith platform was patched after researchers demonstrated it could expose OpenAI API keys and user data via malicious agents.
A critical security flaw in Langflow, a Python-based AI workflow tool, is under active exploitation to deploy the Flodrix botnet, enabling DDoS attacks and potential system compromise.
TP-Link router vulnerability CVE-2023-33538 is under active exploitation. CISA added the flaw to its Known Exploited Vulnerabilities catalog and issued an immediate alert.

Notable Threat Actor Activity

The Silver Fox APT group is conducting a sophisticated phishing campaign targeting Taiwanese organizations, deploying Gh0stCringe and HoldingHands RAT malware for information theft and persistent access.
The Scattered Spider (UNC3944) cybercrime group is targeting IT support teams at major U.S. insurance firms, expanding from previous attacks on U.K. and U.S. retailers.
The “TaxOff” threat actor exploited a Chrome zero-day to deliver the Trinper backdoor.
Attackers are exploiting the Langflow AI server RCE flaw to distribute the Flodrix botnet, primarily for DDoS operations.
Instagram ads leveraging AI deepfakes are impersonating Canadian banks (BMO and EQ Bank) to conduct phishing and investment fraud campaigns.

Trends, Tools, or Tactics of Interest

Ransomware campaigns are increasingly targeting backup infrastructure as an initial attack vector, with attackers focusing on compromising backup solutions to maximize impact.
Forgotten or unmanaged Active Directory service accounts are highlighted as a persistent risk, often remaining active with elevated privileges and lacking oversight.
Use of hard-coded credentials in enterprise software (e.g., Sitecore XP) continues to pose significant RCE risks.
Phishing campaigns are leveraging AI-generated deepfakes to enhance credibility and effectiveness, as seen in the Instagram banking scams.
There is increased exploitation of vulnerabilities in AI and workflow automation platforms (LangSmith, Langflow), indicating attackers are targeting emerging tech stacks.
SMS-based two-factor authentication is identified as insecure, with risks highlighted from third-party interception of codes.

Regulatory or Policy Developments Affecting the Security Industry

The UK ICO imposed a £2.31 million fine on 23andMe for inadequate security practices resulting in a major data breach affecting genetic data.
Paddle.com agreed to a $5 million settlement with the U.S. FTC for facilitating tech-support scams, reinforcing regulatory scrutiny on payment processors involved in fraudulent activities.
Iran has implemented internet throttling to disrupt potential cyber operations by foreign adversaries, specifically in response to recent escalations with Israel.

Cybersecurity Brief – 2025-06-17

Tue, 17 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

The Washington Post disclosed a cyberattack in which email accounts of several journalists, including those covering national security, economic policy, and China, were compromised. The attack is believed to have been conducted by a foreign government and involved breaches of Microsoft accounts.
Zoomcar Holdings reported a data breach impacting 8.4 million users, as disclosed in a filing with the U.S. Securities and Exchange Commission.
Law enforcement agencies from six countries seized the Archetyp Market darknet drug marketplace and arrested its administrator. Archetyp Market had been operating since May 2020.

Newly Discovered Vulnerabilities

A high-severity vulnerability in ASUS Armoury Crate software was disclosed, allowing local attackers to escalate privileges to SYSTEM level on Windows machines.
Microsoft acknowledged that June 2025 Windows Server security updates are causing DHCP service freezes on some systems.
Microsoft also published a workaround for a known issue causing classic Outlook to crash when opening or composing messages.

Notable Threat Actor Activity

Google and external threat intelligence researchers reported that the Scattered Spider threat group has shifted focus to targeting U.S. insurance companies, employing previously observed tactics.
The U.S. Department of Justice seized $7.74 million in cryptocurrency, NFTs, and other assets tied to North Korea’s global fake IT worker network, which is used to funnel illicit funds to the regime.
An emerging threat group, dubbed “Water Curse,” is targeting cybersecurity professionals by distributing weaponized GitHub repositories masquerading as legitimate penetration testing tools, facilitating supply chain attacks.
Malicious Python packages, notably the “Chimera” tool, have been identified on PyPI. Unlike traditional malware, Chimera targets data specific to corporate and cloud infrastructures to facilitate supply chain attacks.

Trends, Tools, or Tactics of Interest

Google’s Mandiant published research on increasingly sophisticated vishing (voice phishing) attacks, which are being used as initial access vectors in recent ransomware campaigns.
Google reported a rise in travel-themed scams, with attackers leveraging the summer holiday period to target consumers.
The Anubis ransomware-as-a-service kit has added data wiper functionality, enabling affiliates to both encrypt and permanently erase files, making recovery impossible even after ransom payment.
Researchers observed the use of steganography, specifically malicious payloads hidden within JPEG images, as a technique for evading detection.
Kali Linux 2025.2 was released, introducing 13 new tools and expanding its car hacking toolkit, enhancing capabilities for penetration testing and automotive security assessments.
The ongoing increase in third-party and supply chain risks was highlighted, with recommendations for continuous monitoring of partner vulnerabilities.

Regulatory or Policy Developments

The U.S. National Institute of Standards and Technology (NIST) released SP 1800-35, providing 19 real-world examples for implementing zero-trust architecture using commercial technologies.
Meta announced the introduction of advertising on WhatsApp, stating that the ads are designed with privacy considerations.

Cybersecurity Brief – 2025-06-04

Wed, 04 Jun 2025 00:00:00 +0000

Major Incidents or Breaches

Victoria’s Secret has delayed its Q1 2025 earnings release due to ongoing corporate system restoration efforts following a security incident on 24 May.
A data breach at Coinbase has been attributed to bribed customer support representatives at TaskUs in India, leading to data theft from the crypto exchange.

Newly Discovered Vulnerabilities

Hewlett Packard Enterprise (HPE) released security patches for eight vulnerabilities in StoreOnce, including a critical remote authentication bypass flaw.
A critical 10-year-old vulnerability in Roundcube webmail software allows authenticated users to execute malicious code.
Google patched a new Chrome zero-day vulnerability currently being exploited in the wild; this is the third Chrome zero-day exploited this year.
Two newly disclosed vBulletin vulnerabilities (CVE-2025-48827, CVE-2025-48828) are easily exploitable and present risks to bulletin board deployments.
CISA has issued a warning regarding active exploitation of a recently patched ConnectWise ScreenConnect vulnerability that allows remote code execution.

Notable Threat Actor Activity

Scattered Spider has been linked to high-profile attacks on UK retailers Marks & Spencer and Co-op, using tactics such as vishing, adversary-in-the-middle (AiTM) phishing, and exploiting multi-factor authentication gaps to hijack cloud accounts. The group operates as an identity-first threat model rather than a single entity.
Threat actors are using fake DocuSign and Gitcode websites to distribute the NetSupport RAT via multi-stage PowerShell attacks.
The Acreed infostealer has overtaken LummaC2 as the dominant credential theft malware on the Russian Market, reflecting a shift in the threat landscape.
Malicious RubyGems packages impersonating Fastlane CI/CD plugins have been found redirecting Telegram API requests to attacker-controlled servers to steal data.

Trends, Tools, or Tactics of Interest

The Crocodilus Android banking trojan has expanded its targeting from Turkey to eight countries across Europe and South America, now incorporating tactics such as adding fake contacts to victims’ devices to spoof trusted callers.
A new unrestricted AI chatbot, Venice[.]ai, has emerged, capable of generating phishing messages and malware code to assist cybercriminal activity.
Kaspersky research highlights the challenge of determining attack origins in environments lacking container visibility, emphasizing the importance of distinguishing between host-based and container-based threats.
Mozilla has introduced a new system to detect and block Firefox add-ons that function as cryptocurrency drainers.
LayerX has launched ExtensionPedia, and TXOne Networks introduced intelligent vulnerability mitigation capabilities, both reflecting ongoing innovation in endpoint and OT security.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome will distrust digital certificates issued by Chunghwa Telecom and Netlock due to compliance and conduct issues, effective from August.
Microsoft and CrowdStrike have launched a shared threat actor glossary to align their threat actor taxonomies and reduce attribution confusion.

Cybersecurity Brief – 2025-05-21

Wed, 21 May 2025 00:00:00 +0000

Major Incidents or Breaches

Cellcom Cyberattack: Wisconsin-based mobile carrier Cellcom confirmed a cyberattack caused widespread service outages beginning 14 May 2025.
SK Telecom Data Breach: SK Telecom disclosed a malware breach lasting three years (since 2022), exposing USIM data of 27 million subscribers.
RVTools Supply Chain Attack: The official website for RVTools, a VMware management utility, was compromised in a supply chain attack. Trojanized installers delivered the Bumblebee malware loader.
PowerSchool Extortion: A 19-year-old has pleaded guilty to a cyberattack on PowerSchool, involving extortion and exposure of student data.
KrebsOnSecurity DDoS Attack: KrebsOnSecurity experienced a near-record DDoS attack peaking at 6.3 Tbps.

Newly Discovered Vulnerabilities

WordPress ‘Motors’ Theme: A critical privilege escalation vulnerability allows unauthenticated attackers to take over admin accounts on sites using the premium Motors theme.
Virgin Media O2 Location Leak: A security flaw in Virgin Media O2’s mobile network could allow attackers to pinpoint call recipient locations within 100 square meters.
AWS Default IAM Roles: Researchers identified risky default IAM roles in AWS that can enable lateral movement and cross-service exploitation if misconfigured.

Notable Threat Actor Activity

Hazy Hawk: This group has been actively hijacking abandoned cloud resources (e.g., S3 buckets, Azure endpoints) via DNS misconfigurations and CNAME hijacking, targeting high-profile organizations including the US CDC, to deliver malware and conduct scams.
Scattered Spider: The group continues to target large retailers, shifting focus from UK to US organizations, leveraging IT help desk social engineering for initial access.
SideWinder APT: Targeted ministries in Sri Lanka, Bangladesh, and Pakistan using spear phishing, exploiting old Microsoft Office vulnerabilities, and deploying custom malware.
UnsolicitedBooker (China-aligned): Deployed the new MarsSnake backdoor in a multi-year campaign against a Saudi Arabian organization.
RedisRaider: A new Go-based cryptojacking campaign targets publicly accessible Redis servers to deploy XMRig miners.
VanHelsing Ransomware: The ransomware builder, affiliate panel, and data leak blog source code were leaked online, increasing the risk of further ransomware proliferation.
Fake Chrome Extensions: Over 100 malicious Chrome extensions have been discovered since February 2024, used to hijack browser sessions, steal credentials, and inject ads.

Trends, Tools, and Tactics

Service Desk Social Engineering: Attackers are increasingly targeting IT service desks with social engineering to bypass security controls (e.g., password resets, disabling MFA).
Novel Phishing Techniques: Recent phishing campaigns combine AES encryption with malicious npm packages to evade detection.
Supply Chain Threats: The RVTools incident highlights ongoing risks in software supply chains, with attackers distributing malware via compromised legitimate utilities.
Rise in Asia-based APTs: China and North Korea-aligned groups now account for over half of global APT attacks, with expanding international focus.
Exposure Management Enhancements: Tenable has added third-party connectors (AWS, Microsoft, competitors) to its platform for improved attack surface visibility.
Security Key Solutions: Yubico has expanded its YubiKey-as-a-Service globally, supporting hardware-based authentication in 175 countries.
AI Security Impacts: Increased adoption of AI agents is driving both new security opportunities and challenges, with most security leaders anticipating compliance and threat management implications.

Regulatory or Policy Developments

Genetic Data Privacy Concerns: Regeneron’s planned acquisition of 23andMe raises privacy concerns due to the lack of comprehensive federal regulation on genetic information transfers.

Cybersecurity Brief – 2025-05-17

Sat, 17 May 2025 00:00:00 +0000

Major Incidents and Breaches

Procolored Printer Malware Incident: Official drivers for Procolored printers were found to be distributing malware, including a remote access trojan and a cryptocurrency stealer, for at least six months.
Australian Human Rights Commission Data Breach: An internal error resulted in the public exposure of sensitive documents, increasing the risk of follow-on cyberattacks.
Coinbase Extortion: Coinbase was extorted following a cyberattack and is now offering a $20 million reward for information leading to the identification of the attackers, signalling a potentially new approach in incident response.
Nomad Bridge Crypto Hack – Arrest: Israeli authorities arrested a suspect linked to the $190 million Nomad Bridge cryptocurrency hack from August 2022.
US Crypto Theft Charges: Twelve additional individuals have been charged in the US for their alleged roles in a $230 million cryptocurrency theft and associated money laundering.
Email-Based Attacks and Cyber Insurance: Business email compromise (BEC) and funds transfer fraud (FTF) accounted for 60% of cyber insurance claims in 2024, underscoring the continued prevalence and impact of email-based threats.

Newly Discovered Vulnerabilities

Intel CPU Flaws: Researchers identified new vulnerabilities affecting all modern Intel CPUs, enabling sensitive memory leaks and facilitating Spectre v2-style attacks.
Chrome Zero-Day: CISA has warned that a recently patched high-severity Chrome browser vulnerability is being actively exploited in the wild.
Pwn2Own Zero-Days: Multiple zero-day vulnerabilities were exploited during Pwn2Own Berlin 2025, targeting Microsoft SharePoint, VMware ESXi, Oracle VirtualBox, and Red Hat Enterprise Linux.
Microsoft Windows 10 BitLocker Issue: Microsoft confirmed that May 2025 security updates are causing some Windows 10 systems to boot into BitLocker recovery mode unexpectedly.

Notable Threat Actor Activity

HTTPBot Botnet: A newly identified botnet, HTTPBot, has conducted over 200 targeted DDoS attacks, primarily affecting the gaming, technology, and education sectors.
Remcos RAT Campaign: Attackers are delivering fileless Remcos RAT using LNK files and MSHTA in PowerShell-based attacks, enhancing evasion and persistence.
Skitnet Post-Exploitation Tool: Ransomware gangs are increasingly deploying the Skitnet (“Bossnet”) malware for stealthy post-exploitation activities within compromised networks.
Dynamic DNS Abuse: Groups including Scattered Spider are leveraging dynamic DNS services to obfuscate their infrastructure and impersonate legitimate brands during phishing and other attacks.
Threat Actor Specialization: There is a trend toward increased specialization among threat actors, complicating attribution and defensive modelling.

Trends, Tools, and Tactics of Interest

Agentic AI Ransomware: Forecasts indicate that AI-enabled, agentic ransomware may emerge as early as this year, potentially transforming the ransomware threat landscape.
AI in Security and Offence: KnowBe4 is highlighting advancements in AI-driven human risk management, while OpenAI’s Codex (now integrated with ChatGPT) is being rolled out to automate programming tasks-raising both defensive and offensive security considerations.
Code-to-Cloud Security Gaps: Security teams are struggling to keep up with the pace of modern application development, particularly as organisations rapidly adopt cloud infrastructure.
Incident Response Metrics: Emphasis is being placed on developing and communicating clear metrics for Cybersecurity Incident Response Programs (CSIRPs) to improve transparency and decision-making.

Regulatory or Policy Developments

CISA Directive on Chrome Vulnerability: US federal agencies have been directed to address the actively exploited Chrome vulnerability, reflecting ongoing regulatory attention to patch management and rapid response.
Data Privacy Regulation Pressure: Increasing regulatory scrutiny is noted in relation to data privacy, with organisations urged to enhance data protection measures in response to tightening compliance requirements.

Cybersecurity Brief – 2025-05-15

Thu, 15 May 2025 00:00:00 +0000

Major Incidents or Breaches

Coinbase Data Breach and Extortion Attempt
- Coinbase disclosed a data breach affecting approximately 1% of its users after cybercriminals bribed customer support agents. Attackers accessed sensitive customer information, including government IDs, and attempted to extort $20 million. The extortion attempt failed, but the incident highlights ongoing risks to cryptocurrency platforms from both insider and external threats.
Nova Scotia Power Data Breach
- Nova Scotia Power confirmed a cyberattack resulting in the theft of sensitive customer data. The breach was discovered last month and underscores the persistent targeting of critical infrastructure and utility providers.

Newly Discovered Vulnerabilities

SAP NetWeaver (CVE-2025-31324)
- A critical vulnerability in SAP NetWeaver is being actively exploited by multiple threat actors, including ransomware groups BianLian and RansomExx. The flaw allows remote code execution and has led to a surge in attacks against unpatched systems. Immediate patching is strongly advised.
Samsung MagicINFO 9 Server (CVE-2025-4632)
- Samsung patched a critical vulnerability (CVSS 9.8) in MagicINFO 9 Server that was actively exploited to deploy Mirai botnet variants. Organizations using this software should update immediately.
Google Chrome High-Severity Flaw
- Google released emergency updates addressing a high-severity Chrome vulnerability that has a public exploit and is being used in the wild for cross-origin data leaks via the Loader Referrer Policy. All users are advised to update promptly.
Ivanti Endpoint Manager Mobile (EPMM) Zero-Day Flaws
- Ivanti confirmed exploitation in the wild of zero-day vulnerabilities in EPMM, affecting a limited number of customers. The flaws stem from open source library issues and are being used in chained attacks.

Cybersecurity Brief – 2025-05-14

Wed, 14 May 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer confirmed customer data was stolen in a recent cyberattack. While no account passwords were compromised, customers are being required to reset passwords as a precaution.
Dior disclosed a cybersecurity incident resulting in the exposure of customer information.
Nucor Corporation, a major steel producer, experienced network disruptions due to a cyberattack, forcing parts of its systems offline for containment.
The Australian Human Rights Commission suffered a data breach in which private documents were leaked online and indexed by search engines.
Xinbi Guarantee, a Chinese-language Telegram marketplace, has been linked to $8.4 billion in illicit transactions, including crypto crime, romance scams, and North Korean money laundering.
North Korean IT worker scams are being exposed at scale, with researchers publishing 1,000 email addresses and photos linked to infiltration of Western companies.
Kosovo extradited the admin of BlackDB, an online cybercrime marketplace, to the US to face charges.

Newly Discovered Vulnerabilities and Exploits

Microsoft Patch Tuesday (May 2025): Microsoft released fixes for 78 vulnerabilities, including five zero-days under active exploitation. Notably, a CVSS 10 vulnerability impacts Azure DevOps Server.
Samsung patched CVE-2025-4632 in MagicINFO 9 Server, a critical flaw (CVSS 9.8) exploited to deploy Mirai botnet malware.
Fortinet addressed CVE-2025-32756, a zero-day RCE flaw in FortiVoice enterprise phone systems, confirmed as exploited in the wild.
Ivanti released updates for two vulnerabilities in Endpoint Manager Mobile (EPMM) that have been chained for remote code execution in limited attacks.
SAP NetWeaver vulnerability is being actively exploited by multiple ransomware groups, including BianLian and RansomExx, to deploy malware such as PipeMagic Trojan.
Google Chrome is rolling out a security change to prevent browser launches with admin privileges on Windows, reducing attack surface.
Open redirect vulnerabilities in trusted domains (e.g., google.com) continue to be abused in phishing campaigns.
Focused phishing attacks are leveraging trusted domains, real CAPTCHAs, and server-side validation for more targeted credential theft.

Notable Threat Actor Activity

Earth Ammit, a cyber espionage group, was linked to supply chain breaches in the drone sector via ERP systems in the VENOM and TIDRONE campaigns targeting Taiwan and South Korea.
Scattered Spider (aka UNC3944) tactics, previously used against UK retail chains, are now being deployed against US retailers.
Ransomware gangs are increasingly exploiting SAP NetWeaver vulnerabilities for initial access and malware deployment.
Meta Mirage, a global phishing campaign, is targeting Meta Business Suite users to hijack high-value business accounts.
Horabot malware is being distributed through invoice-themed phishing emails, targeting Windows users across six Latin American countries.

Trends, Tools, and Tactics of Interest

Phishing campaigns are becoming more sophisticated, with increased use of trusted domains, CAPTCHAs, and real-time validation to evade detection and improve targeting.
Telegram-based black markets remain a significant vector for cybercrime, with recent enforcement actions leading to shutdowns and exposure of major illicit marketplaces.
Shadow SaaS and AI usage is an emerging risk, with new tools (e.g., LastPass SaaS monitoring) being developed to detect unauthorised employee use of unsanctioned cloud and AI services.
Supply chain attacks via ERP systems and targeting of high-value sectors (e.g., drones, retail) remain prevalent.
AI agent security: Research indicates that AI agents can be manipulated by implanting fake “memories,” raising concerns about the integrity of autonomous systems.
Device hygiene: Daily phone reboots are recommended as a practical defense against persistent zero-click mobile exploits.

Regulatory and Policy Developments

Consumer Financial Protection Bureau (CFPB) in the US has canceled plans for tighter regulation of data brokers, potentially impacting privacy and data protection standards.
Telegram enforcement: Following media inquiries, Telegram banned thousands of accounts tied to crypto scam money laundering, disrupting several major illicit marketplaces.

Cybersecurity Brief – 2025-05-03

Sat, 03 May 2025 00:00:00 +0000

Major Incidents and Breaches

Co-op Data Theft Confirmed: Co-op has verified that significant data was stolen in a recent cyberattack, following claims by the DragonForce ransomware group. The breach impacts a substantial number of current and former customers.
Magento Supply Chain Attack: Between 500 and 1,000 e-commerce stores, including a $40 billion multinational, were compromised through 21 backdoored Magento extensions in a widespread supply chain attack.
UK Retail Sector Under Attack: Multiple major British retailers, including Harrods, have been targeted by likely ransomware attacks in recent weeks. The UK NCSC has characterised these incidents as a “wake-up call” for the sector, urging improved cyber resilience.
Ransomware Surge in Food and Agriculture: Ransomware attacks targeting the food and agriculture sector have doubled in 2025, with the increase attributed largely to Clop’s exploitation of a popular file-sharing service.

Notable Threat Actor Activity

DragonForce Ransomware: Claimed responsibility for the Co-op breach, confirming ongoing ransomware activity against UK retailers.
Black Kingdom Ransomware: US authorities indicted a Yemeni national believed to be the developer and main operator behind Black Kingdom, which conducted approximately 1,500 attacks on Microsoft Exchange servers.
Scattered Spider: Despite recent law enforcement arrests, the group continues to conduct high-profile cyberattacks, underscoring its resilience and operational capability.
MintsLoader and GhostWeaver: The MintsLoader malware loader is being used to deliver the PowerShell-based remote access trojan GhostWeaver via phishing campaigns. The attacks leverage domain generation algorithms (DGA) and TLS encryption for stealth.

Newly Discovered Vulnerabilities and Exploits

Magento Extensions Backdoors: The compromised Magento extensions represent a significant supply chain vulnerability, affecting hundreds of e-commerce sites.
Developer Secrets Targeting: Threat actors are increasingly scanning for exposed secrets in configuration and repository files, highlighting the ongoing risk of credential leakage in software development pipelines.

Trends, Tools, and Tactics

Passwordless Authentication: Microsoft has made all new accounts passwordless by default, aiming to reduce risks from phishing, brute-force, and credential-stuffing attacks.
Automated Vulnerability Response: The Tines platform is promoting community-driven, pre-built workflows to automate CVE and vulnerability advisory responses, supporting more rapid and consistent remediation.
Stealth Malware Delivery: Recent campaigns (e.g., MintsLoader/GhostWeaver) demonstrate advanced use of multi-stage infection chains, obfuscation, DGA, and TLS for evasion.
Retail Sector Targeting: The ongoing wave of ransomware and cyberattacks against UK retailers signals a trend of increased targeting of the retail sector, likely due to its data-rich environment and operational impact.

Regulatory and Policy Developments

TikTok Fined for GDPR Breach: The Irish Data Protection Commission fined TikTok €530 million ($601 million) for illegally transferring personal data of EEA users to China, in violation of GDPR. This is among the largest fines issued under GDPR, reinforcing regulatory scrutiny of cross-border data transfers.
NCSC Advanced Cryptography Guidance: The UK NCSC has published a white paper on “Advanced Cryptography,” defining and providing guidance on cryptographic techniques for processing encrypted data and enhancing privacy and security.
US Regulatory Actions: The US Treasury is moving to cut off Huione Group, which is accused of laundering funds from North Korean cybercrime and investment scams. Separately, new security rules from the New York Department of Financial Services require finance firms to implement stronger protections against unauthorised access to information systems.

Other Industry Notes

Microsoft Exchange Online Issue Resolved: Microsoft fixed a bug in Exchange Online that was incorrectly flagging Gmail emails as spam due to a machine learning model error.
Privacy Concerns with Consumer Devices: Ongoing media coverage highlights persistent privacy risks associated with smart TVs and streaming devices collecting user data.

Cybersecurity Brief – 2025-05-01

Thu, 01 May 2025 00:00:00 +0000

Major Incidents and Breaches

SonicWall SMA100 Exploitation
- SonicWall has confirmed active exploitation of two now-patched vulnerabilities in its SMA100 Secure Mobile Access appliances. Attackers are targeting unpatched systems in the wild.
UK Retailer Co-op Cyberattack
- Co-op Food, a major UK supermarket chain, experienced limited operational disruption after a cyberattack, prompting the shutdown of some IT systems.
Ascension Healthcare Data Breach
- Ascension, a large US healthcare provider, is notifying patients of a data breach stemming from a December 2024 third-party hacking incident, with personal and health information stolen.
Commvault Azure Breach
- Data protection firm Commvault reported a breach of its Azure environment by a nation-state actor but stated customer backup data was not impacted.
Phishing Platform LabHost Takedown
- The FBI released a list of 42,000 phishing domains tied to the dismantled LabHost phishing-as-a-service (PhaaS) operation, one of the largest of its kind.
RansomHub Ransomware Group Offline
- The RansomHub ransomware-as-a-service operation’s infrastructure has gone dark since 1 April 2025, causing affiliates to migrate to other groups such as Qilin and DragonForce.

Cybersecurity Brief – 2025-04-29

Tue, 29 Apr 2025 00:00:00 +0000

Major Incidents and Breaches

Marks & Spencer Ransomware Attack
- Marks & Spencer experienced significant operational disruption, including outages and warehouse worker furloughs, due to a ransomware attack attributed to the “Scattered Spider” group.
Hitachi Vantara Ransomware Incident
- Hitachi Vantara took servers offline to contain an Akira ransomware attack, impacting business operations.
VeriSource Data Breach
- Employee benefits firm VeriSource confirmed that a February breach exposed personal information of 4 million individuals.
Urban One Data Breach
- Urban One, a major media company, disclosed a data breach following claims by a ransomware group.
World Uyghur Congress Targeted by Malware
- Senior members of the World Uyghur Congress were targeted in a sophisticated malware campaign via a trojanized UyghurEdit++ tool, indicating ongoing cyber-espionage efforts against exiled Uyghur groups.

Newly Discovered and Actively Exploited Vulnerabilities

SAP NetWeaver Visual Composer (CVE-2025-31324)
- Over 1,200 internet-facing SAP NetWeaver servers remain vulnerable to an actively exploited unauthenticated file upload flaw, allowing server hijacking. Attacks began before SAP released a patch.
Craft CMS Zero-Day Flaws
- Two newly disclosed critical vulnerabilities in Craft CMS are being exploited in the wild, with hundreds of servers likely compromised.
Broadcom Brocade Fabric OS and Commvault Web Server
- CISA added high-severity vulnerabilities in Broadcom Brocade Fabric OS and Commvault Web Server to its Known Exploited Vulnerabilities (KEV) database, indicating active exploitation.
Pymatgen 2024.1 Remote Code Execution
- A high-risk remote code execution vulnerability has been disclosed in Pymatgen 2024.1.
WooCommerce Phishing Campaign
- Attackers are distributing fake security patches to WooCommerce users, installing backdoors under the guise of critical updates.

Notable Threat Actor Activity

Earth Kurma APT
- Newly identified APT group “Earth Kurma” has targeted government and telecom sectors in Southeast Asia since June 2023, using rootkits and cloud-based data theft tools.
Scattered Spider
- Linked to the ransomware attack on Marks & Spencer, demonstrating continued targeting of UK-based large enterprises.
AI-Powered Phishing and Commodity Tools
- Increased use of AI-powered phishing kits and automated attack tools is lowering the barrier to entry for less skilled threat actors.

Trends, Tools, and Tactics

AI and Automation in Threat Landscape
- Attackers are leveraging AI, automation, and dark web resources to accelerate attack sophistication and frequency.
Record DDoS Attack Volumes
- Cloudflare reported a 358% year-over-year increase in DDoS attacks, highlighting a surge in volumetric and application-layer attacks.
Supply Chain and Update Risks
- Kali Linux users were warned of update failures due to a lost repository signing key, underscoring the importance of secure software supply chains.
Surveillance Risks in Connected Vehicles
- Law enforcement agencies are increasingly exploiting data from internet-connected vehicle features for surveillance purposes.

Regulatory and Policy Developments

CISA KEV Updates
- The U.S. CISA’s addition of new vulnerabilities to its KEV database may prompt UK organisations to review their own exposure and patch management processes.
US DoJ Data Security Program
- New compliance rules from the US Department of Justice will require organisations to reassess data sharing practices, with potential implications for multinational firms operating in or with the US.
Windscribe Legal Precedent
- Windscribe VPN was acquitted on charges regarding user data collection, reinforcing the legal standing of privacy-first service providers.

Other Notable Developments

Operational Disruptions
- Ukrainian state and banking services were temporarily disrupted due to a data centre power outage, affecting government and corporate customers.
Security Tooling
- Malwarebytes highlighted as a tool for combating online scams, reflecting ongoing emphasis on endpoint protection and anti-fraud solutions.

Summary of Key Risks

Ransomware remains a significant threat to large enterprises, with notable UK impact.
Actively exploited vulnerabilities in widely used enterprise software (SAP, Craft CMS, Broadcom, Commvault) require urgent attention.
AI-driven attack automation and phishing are reshaping the threat landscape, enabling more actors to launch sophisticated campaigns.
Regulatory changes and legal rulings are influencing data security and privacy practices globally.