Cybersecurity Brief – 2025-09-14

Sun, 14 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Apple has issued a fourth round of spyware attack notifications to users in France in 2025, confirmed by CERT-FR. These alerts relate to targeted campaigns using sophisticated spyware, with at least four notification waves sent this year.
The U.S. FBI has issued a flash alert regarding cybercriminal groups UNC6040 and UNC6395, which have conducted data theft attacks targeting Salesforce platforms. Indicators of compromise have been released to assist in detection and response.
A critical remote code execution vulnerability (CVE-2025-5086) in Dassault Systèmes DELMIA Apriso Manufacturing Operations Management software is being actively exploited. The vulnerability arises from deserialization of untrusted data, allowing attackers to achieve RCE. CISA has issued a warning regarding ongoing exploitation.
A payment system vendor, KioSoft, took over a year to patch a serious NFC card vulnerability that allowed infinite card top-ups, despite being notified in 2023. The patch has only recently been released.

Samsung has patched a critical zero-day vulnerability (CVE-2025-21043) affecting its Android devices, which was being actively exploited in the wild. The flaw enabled remote code execution and was initially reported via WhatsApp.
Researchers have identified a new ransomware strain, HybridPetya, which mimics Petya/NotPetya and exploits CVE-2024-7344 to bypass UEFI Secure Boot protections. The malware installs a malicious application on the EFI System Partition.
Academics have disclosed VMScape, a new variant of the Spectre attack that breaks cloud isolation by exploiting incomplete mitigations in the branch predictor state, enabling leakage of arbitrary memory between virtual machines.

The ransomware group Yurei, first observed on 5 September 2025, has been identified as a new actor leveraging open-source ransomware. The group has begun listing victims on its leak site.
AI-powered phishing and social engineering attacks are being leveraged by threat actors to increase the success rate of ransomware campaigns, as highlighted in a report from Resilience.

AI-driven phishing campaigns are demonstrating higher success rates than traditional methods, fueling increased ransomware losses.
HybridPetya represents an evolution in ransomware tactics by targeting UEFI Secure Boot, indicating a shift toward lower-level system attacks.
Cloud-native security is increasingly focused on runtime visibility due to the widespread adoption of containers, Kubernetes, and serverless technologies.
Security researchers are combining tools like Burp Suite Professional with bug bounty platforms such as HackerOne to efficiently identify and report high-impact vulnerabilities.
The emergence of agentic and AI browsers is being discussed, with attention to their safety and implications for the future of web browsing.

CISA has announced that the CVE Program will focus on enhancing the quality, trust, and responsiveness of vulnerability data.
Microsoft has reminded users that Windows 11 23H2 Home and Pro editions will reach end of support in 60 days, after which they will no longer receive security updates.
F5 has announced the acquisition of CalypsoAI for $180 million, aiming to integrate adaptive AI inference security solutions into its Application Delivery and Security Platform.

Sat, 13 Sep 2025 00:00:00 +0000

Apple has sent a fourth round of spyware notifications to users in France in 2025, with CERT-FR confirming a targeted spyware campaign against Apple device users in the country.
Dassault Systèmes DELMIA Apriso Manufacturing Operations Management (MOM) software is being actively exploited via a critical remote code execution vulnerability (CVE-2025-5086), with multiple advisories and warnings from CISA.
A payment system vendor (KioSoft) reportedly took over a year to patch a critical NFC card vulnerability that enabled infinite card top-ups, despite being notified in 2023.
A new ransomware group called Yurei was identified, with initial victim data published.

Samsung has patched a critical zero-day vulnerability (CVE-2025-21043) in its Android devices, which was exploited in the wild, including attacks reported via WhatsApp.
A new ransomware strain, HybridPetya, has been discovered. It is a Petya/NotPetya copycat that can bypass UEFI Secure Boot protections by exploiting CVE-2024-7344.
Academics have disclosed VMScape, a new Spectre variant attack capable of breaking cloud isolation by leaking arbitrary memory through speculative execution flaws.
DELMIA Apriso MOM software is affected by CVE-2025-5086, a deserialization of untrusted data flaw allowing remote code execution, currently under active exploitation.
Undocumented radios have been found in solar-powered devices used in US highway infrastructure, raising concerns about unreported communications capabilities.

A new ransomware group, Yurei, was discovered on 5 September, with evidence of at least one victim being targeted.
HybridPetya ransomware demonstrates advanced capabilities by bypassing UEFI Secure Boot and targeting the EFI System Partition, indicating continued adaptation of malware based on known destructive strains.

AI-powered phishing and social engineering attacks are reported to be significantly more successful than traditional methods, contributing to increased ransomware losses.
HybridPetya’s use of a UEFI Secure Boot bypass highlights a trend towards targeting firmware-level security mechanisms.
The security of cloud-native applications is being challenged by the proliferation of containers, Kubernetes, and serverless technologies, with an increased emphasis on runtime visibility.
Bug bounty hunters are combining tools like Burp Suite Professional and HackerOne to uncover high-impact vulnerabilities more efficiently.
Agentic and AI-powered browsers are emerging, raising questions about their security implications.

CISA announced a renewed focus for the CVE Program on improving the quality, trust, and responsiveness of vulnerability data.
Microsoft reminded customers that Windows 11 23H2 Home and Pro editions will reach end of support in 60 days, after which they will stop receiving security updates.