CVE-2025-55182 on DanSec Daily

Cybersecurity Brief – 2026-04-06

Mon, 06 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

Drift disclosed that the $285 million theft on April 1, 2026, resulted from a six-month social engineering campaign attributed to North Korean (DPRK) threat actors, involving targeted infiltration and operational planning.
Multiple Syrian government accounts were hijacked in March, exposing significant deficiencies in the state’s cybersecurity posture and basic operational security.

Newly Discovered Vulnerabilities

Fortinet released an emergency patch for a new critical vulnerability (CVE-2026-35616) in FortiClient Enterprise Management Server (EMS), which is being actively exploited in the wild.
Attackers are exploiting the React2Shell vulnerability (CVE-2025-55182) in vulnerable Next.js applications as part of a widespread, automated credential theft campaign.

Notable Threat Actor Activity

Germany’s Federal Criminal Police Office (BKA) identified and unmasked the main actors behind the REvil (Sodinokibi) ransomware group, including the individual known as “UNKN,” linked to both REvil and GandCrab ransomware operations. The primary suspect is named as Daniil Maksimov, a 31-year-old Russian national.
North Korean (DPRK) threat actors were responsible for the $285 million Drift hack, using prolonged and sophisticated social engineering tactics.

Trends, Tools, or Tactics of Interest

Phishing scams have shifted tactics by incorporating QR codes into fake “Notice of Default” traffic violation text messages, directing recipients to phishing sites to harvest payment and personal information.
The automated exploitation of React2Shell in Next.js applications highlights an ongoing trend towards large-scale, automated credential theft campaigns targeting web application vulnerabilities.

Regulatory or Policy Developments Affecting the Security Industry

No significant regulatory or policy developments were reported in the provided headlines.

Cybersecurity Brief – 2026-04-03

Fri, 03 Apr 2026 00:00:00 +0000

Major Incidents or Breaches

European Commission Cloud Hack: CERT-EU confirmed a breach attributed to the TeamPCP threat group, exposing data from at least 30 EU entities.
Drift Protocol Exploit: North Korean threat actors seized Security Council administrative powers in the Drift Protocol, resulting in a loss of at least $280 million in a coordinated attack.
Stryker Cyberattack: Stryker Corporation experienced a data-wiping attack, claimed by an Iranian-linked group. The company reports full operational recovery after three weeks.
Hasbro Breach: Hasbro disclosed “unauthorized access” to its systems, leading to business continuity activation and some systems being taken offline.
Nacogdoches Memorial Hospital Data Breach: A breach affecting 250,000 individuals occurred in January 2026, involving theft of personal and health information.
WhatsApp Spyware Incident: WhatsApp alerted approximately 200 users after a fake iOS app infected devices with spyware, with an Italian firm reportedly facing action.
Mercor Supply Chain Attack: AI recruiting firm Mercor is investigating a supply chain attack via LiteLLM, with Lapsus$ claiming theft of 4TB of data.
Claude Code Leak Abuse: Following the Claude Code source code leak, threat actors used fake GitHub repositories to distribute Vidar infostealer malware.
Adversaries Exploiting Vacant Homes: Threat actors are using vacant homes as mail drop addresses to intercept mail and facilitate fraud.

Newly Discovered Vulnerabilities

Cisco IMC and SSM Flaws: Cisco patched critical vulnerabilities in the Integrated Management Controller (IMC) and SSM, including an authentication bypass (CVSS 9.8) that allowed unauthenticated remote admin access.
Progress ShareFile Pre-Auth RCE Chain: Two vulnerabilities in Progress ShareFile can be chained for unauthenticated file exfiltration and remote code execution.
F5 BIG-IP APM RCE Exposure: Over 14,000 F5 BIG-IP APM instances remain exposed to a critical RCE vulnerability, with active exploitation ongoing.
Claude Code Critical Vulnerability: A critical vulnerability was identified in Claude Code days after its source code leak.
Apple DarkSword Exploit Kit: Apple expanded patches for vulnerabilities exploited by the DarkSword kit to iOS and iPadOS 18.7.7.
Vite (CVE-2025-30208) Exploitation: Active attempts to exploit the Vite frontend tooling vulnerability have been observed.
Next.js (CVE-2025-55182) Exploitation: Threat actors exploited the React2Shell vulnerability to breach 766 Next.js hosts, stealing credentials, SSH keys, and AWS secrets.

Notable Threat Actor Activity

TeamPCP: Attributed to the European Commission cloud breach affecting multiple EU entities.
North Korean Actors: Responsible for the $280 million theft from Drift Protocol via Security Council power compromise.
Lapsus$: Claimed responsibility for the Mercor LiteLLM supply chain attack.
Iranian-linked Group: Claimed the data-wiping attack on Stryker Corporation.
REF1695: Financially motivated group leveraging fake installers to distribute RATs and crypto miners since November 2023.
Vidar Infostealer Campaign: Threat actors are leveraging the Claude Code leak to distribute infostealer malware via GitHub.
Casbaneiro Banking Trojan: Ongoing campaigns targeting Latin American financial institutions, using advanced evasion and replication techniques.

Trends, Tools, or Tactics of Interest

Residential Proxy Evasion: 78% of 4 billion sessions using residential proxies successfully evaded IP reputation checks, complicating detection of malicious traffic.
Hybrid Cybercrime via Postal Fraud: Use of vacant homes as drop addresses is enabling hybrid cybercrime through mail interception.
CloudTrail Evasion Techniques: Noted as an emerging tactic for threat actors to avoid detection in cloud environments.
Mining Operations Using ISO Lures: Ongoing campaigns use ISO file lures to deliver RATs and cryptocurrency miners.
CrystalX RAT: Newly observed sophisticated RAT capable of spying, stealing data, and altering device configurations.
AI in Security Operations: CISOs and industry leaders at RSAC 2026 and in interviews report increased adoption and planned expansion of AI-driven security tools, with debates over automation versus human oversight.
Pre-Auth Exploitation Chains: Multiple vulnerabilities are being chained pre-authentication for remote code execution and data exfiltration.
Supply Chain Attacks via Open Source: The State of Trusted Open Source report and recent incidents highlight risks in open source software supply chains.

Regulatory or Policy Developments

WhatsApp/Italian Regulatory Action: Italian authorities are reportedly taking action following the spyware incident involving a fake WhatsApp iOS app.
Cybersecurity M&A Activity: 38 significant cybersecurity mergers and acquisitions were announced in March 2026, involving major firms such as Airbus, Cellebrite, Databricks, Quantum eMotion, Rapid7, and OpenAI.
Malwarebytes VPN Audit: Malwarebytes completed a third-party audit of its VPN infrastructure, with results published for transparency.

Cybersecurity Brief – 2026-01-01

Thu, 01 Jan 2026 00:00:00 +0000

Major Incidents or Breaches

Trust Wallet Chrome Extension Hack: Trust Wallet disclosed that a supply chain attack involving the Shai-Hulud worm in November 2025 compromised its Chrome extension, resulting in the theft of $8.5 million from 2,520 wallets. The attacker exploited exposed developer GitHub secrets to publish a backdoored browser extension.
Unleash Protocol Hack: The decentralized intellectual property platform Unleash Protocol suffered a loss of approximately $3.9 million in cryptocurrency after an unauthorized contract upgrade enabled asset withdrawals, attributed to a multisig hijack.
European Space Agency Breach: The European Space Agency confirmed that external science servers were compromised and that a hacker is offering to sell stolen data. An investigation is ongoing.
DarkSpectre Browser Extension Campaigns: The threat actor behind previous ShadyPanda and GhostPoster campaigns has been attributed to a third campaign, DarkSpectre, impacting 2.2 million users. In total, the campaigns have affected 8.8 million users worldwide.
Ivanti EPMM Attacks: April/May zero-day exploitations of Ivanti’s mobile device management platform resulted in the compromise of thousands of organisations by a Chinese APT.

Newly Discovered Vulnerabilities

IBM API Connect: IBM disclosed a critical authentication bypass vulnerability (CVE-2025-13915, CVSS 9.8) in API Connect that could allow remote attackers to access applications. Customers have been urged to patch immediately.
React2Shell Flaw in Next.js: The RondoDox botnet is actively exploiting the critical React2Shell vulnerability (CVE-2025-55182) to breach Next.js servers, deploying malware and cryptominers.

Notable Threat Actor Activity

North Korean Fraudulent Job Applicants: Amazon reported blocking more than 1,800 suspected North Korean job applicants since April 2024, indicating ongoing attempts by North Korean actors to infiltrate Western technology companies.
Shai-Hulud Worm Activity: Researchers have identified a new, modified strain of the Shai-Hulud worm on the npm registry, showing continued evolution and testing of payloads following the Trust Wallet supply chain attack.
RondoDox Botnet: Actively exploiting the React2Shell vulnerability to compromise Next.js servers.

Trends, Tools, or Tactics of Interest

Supply Chain Attacks on Browser Extensions: The Shai-Hulud campaign demonstrates continued targeting of browser extension supply chains, leveraging compromised developer credentials to distribute malicious updates.
Malicious Browser Extensions: Large-scale campaigns such as DarkSpectre, ShadyPanda, and GhostPoster highlight the persistent threat from malicious browser extensions, impacting millions of users globally.
Cryptocurrency Platform Targeting: Both Trust Wallet and Unleash Protocol incidents reflect ongoing targeting of cryptocurrency platforms through supply chain and contract manipulation attacks.
IoT and Cloud Reliance: Reports discuss the risks associated with IoT device dependence on cloud services, with outages causing widespread disruption to connected devices.
AI and Identity Security: Industry predictions for 2026 note increased adoption of agentic AI, expansion of identity governance and administration (IGA) in the mid-market, SOC-identity team collaboration, and identity platform consolidation. Growing skepticism about AI’s ROI and economic sustainability is also noted.

Regulatory or Policy Developments

Disney COPPA Settlement: Disney agreed to pay a $10 million civil penalty to settle claims of violating the Children’s Online Privacy Protection Act (COPPA) by mislabeling videos and allowing targeted advertising data collection on YouTube.
Age Verification Laws: Enforcement of age checks in 2025 led to widespread internet access issues, with some websites blocking entire countries and users increasingly turning to VPNs to bypass restrictions.
Device Bans at Public Events: The NYC mayoral inauguration explicitly banned Flipper Zero and Raspberry Pi devices, reflecting growing concerns about the use of hacking tools at high-profile events.

Cybersecurity Brief – 2025-12-18

Thu, 18 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

LKQ, a major auto parts supplier, confirmed a breach involving its Oracle E-Business Suite (EBS), resulting in the compromise of personal information for thousands of individuals.
France arrested a 22-year-old suspect linked to the recent cyberattack on the country’s Ministry of the Interior.
Amazon AWS GuardDuty reported an ongoing cryptomining campaign abusing compromised AWS credentials to hijack EC2 and ECS resources across multiple customer environments.
WhatsApp accounts are being hijacked via abuse of the device-linking feature in attacks dubbed “GhostPairing,” allowing threat actors to take over user accounts.
The NMFTA (National Motor Freight Traffic Association) warned of a surge in sophisticated cyber-enabled cargo theft targeting the transportation sector.

Newly Discovered Vulnerabilities

Cisco disclosed a maximum-severity zero-day vulnerability (CVE-2025-20393) in AsyncOS used by Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances, with active exploitation by a China-linked APT (UAT-9686/Jewelbug).
SonicWall released fixes for CVE-2025-40602 affecting SMA 100 series appliances, which had been actively exploited. A separate zero-day in SMA 1000 Appliance Management Console was also reported as exploited in privilege escalation attacks.
A critical flaw in ASUS Live Update was added to CISA’s Known Exploited Vulnerabilities catalog due to evidence of exploitation in the wild.
Critical vulnerabilities in Fortinet devices are under active attack, with attackers targeting admin accounts, exporting device configurations, and accessing sensitive data.
The React2Shell vulnerability (CVE-2025-55182) is being actively exploited by ransomware groups for rapid initial access and deployment of file-encrypting malware.
Google patched two critical Chrome browser vulnerabilities that could be exploited remotely simply by visiting a malicious website.

Notable Threat Actor Activity

The ForumTroll APT group continues targeted phishing attacks against Russian political scientists and scholars, delivering the Tuoni framework via fake eLibrary emails and malicious plagiarism reports.
Russian state-sponsored APT28 is conducting a sustained credential-harvesting campaign targeting users of the Ukrainian webmail/news portal UKR[.]net.
The China-linked threat actor Jewelbug (also referred to as Ink Dragon) has increased targeting of European government entities since July 2025, using ShadowPad and FINALDRAFT malware, while continuing attacks in Southeast Asia and South America.
The Kimwolf botnet has hijacked at least 1.8 million Android-based TVs, set-top boxes, and tablets, leveraging them for large-scale distributed denial-of-service (DDoS) attacks.
A new campaign, GhostPoster, embedded malware in 17 Firefox add-ons (over 50,000 downloads), hijacking affiliate links, injecting tracking code, and bypassing security controls.
The Cellik Android RAT, available for $150, is being used to remotely control victim devices and generate trojanized apps distributed via the Google Play Store.

Trends, Tools, or Tactics of Interest

Attackers are increasingly abusing legitimate features (e.g., WhatsApp device-linking, AWS IAM credentials) for account hijacking and cryptomining.
Ransomware groups are exploiting critical vulnerabilities (e.g., React2Shell) for rapid deployment of file-encrypting malware.
Malicious browser extensions (e.g., GhostPoster in Firefox) continue to be a vector for affiliate fraud, tracking, and security bypass.
The use of ShadowPad and FINALDRAFT malware by China-linked actors against government targets highlights continued investment in modular, stealthy toolsets.
Surge in cyber-enabled cargo theft demonstrates growing convergence of physical and cybercrime in logistics and transportation sectors.

Regulatory or Policy Developments

Mexico officially launched its first National Cybersecurity Plan, establishing a national framework for digital resilience and cybersecurity policy.
Microsoft announced plans to deprecate the RC4 encryption cipher, historically exploited for administrative authentication attacks in Windows environments.

Cybersecurity Brief – 2025-12-16

Tue, 16 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

SoundCloud confirmed a security breach resulting in the theft of a user database containing member data and subsequent disruption of VPN access for users.
Askul Corporation, a Japanese e-commerce company, disclosed that RansomHouse hackers stole approximately 740,000 customer records in an October ransomware attack.
PornHub is being extorted by the ShinyHunters gang following the theft of Premium member search and watch history data, reportedly accessed via a Mixpanel data breach.
700Credit, a U.S.-based financial services provider, reported a data breach impacting 5.8 million individuals, with stolen data including names, addresses, dates of birth, and Social Security numbers.

Newly Discovered Vulnerabilities

FreePBX patched multiple critical vulnerabilities, including an authentication bypass, SQL injection, and file upload flaws, all of which could enable remote code execution.
Atlassian released updates for Bamboo, Bitbucket, Confluence, Crowd, Fisheye/Crucible, and Jira to address a critical Apache Tika vulnerability.
Apple patched two actively exploited WebKit zero-days in macOS and iOS, which are linked to a previously patched Chrome flaw. The vulnerabilities were used in sophisticated attacks.
React2Shell (CVE-2025-55182) remote code execution vulnerability continues to be actively exploited, with new exploits surfacing.
Microsoft confirmed that December 2025 security updates are causing failures in Message Queuing (MSMQ) and breaking VPN networking for Windows Subsystem for Linux (WSL) users.

Notable Threat Actor Activity

Five additional Chinese threat groups have been linked by Google to ongoing exploitation of the React2Shell vulnerability for malware delivery. Iranian threat actors have also been observed leveraging the same flaw.
The ShadyPanda threat group was identified as responsible for a large-scale campaign hijacking popular Chrome and Edge browser extensions.
Phantom Stealer is being distributed via phishing emails with malicious ISO attachments, targeting various sectors in Russia.
The pro-Russia CyberVolk ransomware group’s VolkLocker variant was found to contain a flaw that allows victims to decrypt their files without paying ransom.
SantaStealer, a new information stealer malware offered as malware-as-a-service, is being promoted on Telegram and hacker forums, featuring in-memory operation to evade file-based detection.

Trends, Tools, or Tactics of Interest

Phishing attacks are increasingly abusing free Cloudflare Pages to host phishing portals, aiding in evasion of security scanners.
Phishing trends in 2025 show a shift beyond email, with increased use of social platforms, search ads, and browser-based techniques to bypass multi-factor authentication and steal session tokens.
Deepfake attacks are becoming more realistic and compelling, raising concerns about their use in social engineering and disinformation.
Militant and extremist groups are experimenting with AI technologies, including propaganda and deepfakes, to expand their influence.
A Chrome browser extension with a “Featured” badge and six million users was discovered intercepting and collecting user prompts from AI chatbots.
PayPal closed a loophole that allowed scammers to send legitimate-looking emails from service@paypal.com, which were used to push tech support scams.
Pig butchering scams are being highlighted as a growing global crisis, involving large-scale, long-term social engineering fraud.

Regulatory or Policy Developments Affecting the Security Industry

Google announced the discontinuation of its dark web monitoring/report tool in early 2026, impacting users’ ability to monitor exposure of personal information on the dark web.
The French Ministry of the Interior confirmed a cyberattack that compromised its email servers.
Cyber insurance managing general agents (MGAs) are increasingly shaping policies to better reflect real-world cyber risk, with a focus on sector-specific expertise.
A third individual pleaded guilty in the U.S. for involvement in a credential stuffing attack against DraftKings, underlining ongoing law enforcement activity against cybercrime.

Cybersecurity Brief – 2025-12-13

Sat, 13 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Coupang suffered a data breach affecting 33.7 million customers, traced to a former employee who retained internal system access after departure.
Fieldtex Products experienced a data breach impacting 238,000 individuals, with the Akira ransomware group claiming responsibility for stealing 14 GB of data.
At least nine organizations were compromised through exploitation of a recently patched Gladinet CentreStack vulnerability.
A fake torrent for “One Battle After Another” was used to distribute Agent Tesla RAT malware via malicious subtitle files.
Google ads are being abused to direct Mac users to malicious AI chat sites, resulting in the distribution of the Atomic macOS Stealer (AMOS).
The US government’s policy of publishing H-1B applicant social accounts has raised significant privacy concerns, exposing personal data to potential targeting, impersonation, and extortion.

Newly Discovered Vulnerabilities

Apple released emergency security updates to patch two zero-day WebKit vulnerabilities, both exploited in sophisticated attacks targeting specific individuals.
Two new types of vulnerabilities in React Server Components (RSC) were patched by the React team; these could lead to denial-of-service or source code exposure.
The React2Shell vulnerability (CVE-2025-55182) is under widespread exploitation, prompting emergency mitigation efforts and a CISA directive for federal agencies to patch by 12 December 2025. Some proof-of-concept exploits can bypass web application firewall (WAF) rules.
A new Windows zero-day vulnerability affecting the Remote Access Connection Manager (RasMan) service has been disclosed, with unofficial patches made available.
A critical GeoServer vulnerability is being actively exploited in XML External Entity (XXE) injection attacks, with CISA ordering immediate patching.
Notepad++ patched a vulnerability in its updater mechanism that allowed for update file authentication bypass and potential traffic hijacking.
Kali Linux 2025.4 released with three new hacking tools and desktop environment updates.
Zigbee protocol security assessment revealed two application-level attack vectors that can be exploited to remotely turn Zigbee endpoints on or off.

Notable Threat Actor Activity

North Korean threat actors are conducting job invitation scams via social media platforms such as Threads, going beyond typical fake employer scams.
Fake OSINT and GPT utility repositories on GitHub are being used to distribute a new, previously undocumented JavaScript-based remote access trojan (PyStoreRAT).
Supply chain attacks targeting GitHub Actions have increased in 2025, with researchers urging adoption of a shared responsibility model for open source security.
At least nine organizations were compromised by threat actors exploiting the Gladinet CentreStack vulnerability.
Criminals are leveraging malicious subtitle files in torrents and poisoned AI chat sites via Google ads to spread Agent Tesla RAT and Atomic macOS Stealer, respectively.

Trends, Tools, or Tactics of Interest

Advanced phishing kits (BlackForce, GhostFrame, InboxPrime AI, Spiderman) are using AI and multi-factor authentication (MFA) bypass techniques to facilitate large-scale credential theft.
Email-based phishing kits now leverage Telegram bots and custom administration panels for managing stolen data.
There is an observed increase in attacks exploiting React2Shell, including the use of WAF bypass techniques in proof-of-concept exploits.
Shadow IT in the form of “shadow spreadsheets” is exposing sensitive data outside official controls.
The browser is increasingly the main interface for generative AI tools within enterprises, raising concerns about policy, isolation, and data controls.
$320,000 was awarded at Zeroday.Cloud for exploits against open source projects such as Grafana, Linux Kernel, Redis, MariaDB, and PostgreSQL.
The Akira ransomware group continues to claim responsibility for significant breaches.
A new Android in-the-wild exploit (DNG) has been identified through suspicious image files uploaded to VirusTotal.
Vibe coding and unmanaged code practices are highlighted as introducing significant security risks.

Regulatory or Policy Developments Affecting the Security Industry

CISA has mandated that US federal agencies patch the actively exploited GeoServer vulnerability immediately.
MITRE released its 2025 list of the top 25 most dangerous software weaknesses, with XSS, SQL injection, and CSRF at the top.
Microsoft has expanded its bug bounty program to include critical vulnerabilities in third-party and open source code that impact Microsoft services.
Microsoft will bundle Security Copilot with M365 Enterprise licenses, alongside the launch of 12 new security agents.
The US government’s publication of H-1B applicants’ social media accounts has sparked privacy concerns due to increased exposure to cyber threats.
The Pentagon has ordered an accelerated transition to post-quantum cryptography (PQC) for its systems.
The Trump administration reportedly dropped sanctions against Chinese actors for the Salt Typhoon attacks on US telecoms, raising concerns about prioritising trade over cybersecurity enforcement.

Cybersecurity Brief – 2025-12-11

Thu, 11 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Threat actors are actively exploiting CVE-2025-55182, with observed attacks targeting honeypots and deploying malware.
Multiple threat groups are exploiting WinRAR vulnerability CVE-2025-6218, which has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
Gladinet’s CentreStack and Triofox products are under active attack due to hard-coded cryptographic keys, resulting in unauthorized access and code execution in at least nine organizations.
React2Shell vulnerability in React Server Components is being heavily exploited to deliver cryptocurrency miners and other malware across multiple sectors.
Over 10,000 Docker Hub container images have been found leaking sensitive credentials, including production system access, CI/CD database keys, and LLM model keys.
A new AMOS infostealer malware campaign is using Google search ads to lure users into fake ChatGPT and Grok guides, resulting in macOS infections.
A new Android malware, DroidLock, is locking devices for ransom, erasing data, and accessing sensitive information such as messages, contacts, and audio data.
The GhostFrame phishing kit is enabling widespread phishing attacks using dynamic subdomains and hidden iframes to evade detection.
A Ukrainian national has been charged and extradited to the US for assisting Russian hacktivist groups in attacks on critical infrastructure, including water, election, and nuclear systems.
Pro-Russian hacktivists are targeting US critical infrastructure, primarily by compromising VNC connections in operational technology (OT) systems, with potential for increased destructiveness.

Newly Discovered Vulnerabilities

PCIe 5.0+ systems are affected by three vulnerabilities in the Integrity and Data Encryption (IDE) protocol, exposing Intel and AMD processors to information disclosure, privilege escalation, and DoS via local attacks.
The .NET “SOAPwn” flaw allows remote code execution and arbitrary file writes via rogue WSDL files in enterprise applications.
Google patched a Gemini Enterprise zero-click vulnerability (“GeminiJack”) that could have exposed corporate data via crafted emails, calendar invites, or documents.
Fortinet released patches for two critical authentication bypass vulnerabilities impacting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager with FortiCloud SSO enabled.
Ivanti Endpoint Manager (EPM) update addresses a critical XSS vulnerability enabling remote code execution with admin privileges.
SAP’s December 2025 updates fix critical vulnerabilities in Solution Manager, Commerce Cloud, and jConnect SDK, which could lead to code injection and remote code execution.
Siemens, Rockwell, and Schneider have issued patches for multiple vulnerabilities across their industrial control system (ICS) products.
Microsoft issued fixes for 56 vulnerabilities, including three zero-days, one of which is under active exploitation, and introduced a PowerShell warning for unsafe code execution.
A possible new exploit variant for Kubernetes OS command injection vulnerability CVE-2024-9042 has been identified.

Notable Threat Actor Activity

Storm-0249, an initial access broker, is abusing endpoint detection and response (EDR) platforms and Windows utilities in stealthy attacks.
The Silver Fox APT, associated with ValleyRAT malware, continues to evolve, utilizing kernel rootkits and advanced builder techniques.
The Spiderman phishing kit is targeting customers of dozens of European banks and cryptocurrency holders with highly convincing cloned sites.
The AMOS infostealer campaign leverages SEO poisoning and legitimate AI domains for malware delivery to macOS systems.
US authorities indicted Victoria Dubranova for supporting Russia-backed CARR and NoName hacktivist groups in attacks on critical infrastructure.
Two individuals linked to China’s Salt Typhoon hacker group reportedly received training via a Cisco Academy prior to targeting Cisco devices in espionage campaigns.

Trends, Tools, or Tactics of Interest

Phishing attacks have surged 400% year-over-year, with a focus on corporate accounts.
Social engineering campaigns are exploiting Microsoft Teams’ “Chat with Anyone” feature to conduct phishing attacks via external DMs.
Attackers are increasingly exploiting cloud misconfigurations across AWS, AI models, and Kubernetes, bypassing standard security tools.
Supply-chain attacks in manufacturing environments are leveraging compromised credentials, malicious NPM packages, and development tool exploits.
Microsoft Teams is developing a feature to warn IT administrators about suspicious traffic with external domains.
The GhostFrame phishing kit is enabling large-scale, evasive phishing campaigns using dynamic infrastructure.
The Spiderman phishing kit demonstrates sophistication in targeting European financial institutions with pixel-perfect phishing sites.

Regulatory or Policy Developments Affecting the Security Industry

Israeli cybersecurity sector investment reached a record $4.4 billion, reflecting over 500% growth in the past decade.
CISA added the WinRAR CVE-2025-6218 vulnerability to its KEV catalog, mandating remediation for US federal agencies.

Cybersecurity Brief – 2025-12-10

Wed, 10 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Spanish authorities arrested a 19-year-old in Barcelona for allegedly stealing and attempting to sell 64 million personal data records obtained from breaches at nine companies.
Canadian organizations have been the primary target in a campaign by threat cluster STAC6565, with almost 40 incidents investigated. The Gold Blade group has been observed deploying QWCrypt ransomware in these attacks.
Japanese manufacturers, retailers, and government entities continue to experience prolonged recovery periods following ransomware attacks, highlighting the long-term operational impact of such incidents.
Microsoft Copilot experienced an outage affecting users in Europe, with investigation and mitigation ongoing.

Newly Discovered Vulnerabilities

Microsoft’s December 2025 Patch Tuesday addressed 57 vulnerabilities, including three zero-days (one actively exploited, two publicly disclosed) affecting Windows and supported software.
Adobe released patches for nearly 140 vulnerabilities, including 117 in Experience Manager (116 XSS bugs).
SAP issued patches for 14 vulnerabilities across multiple products, including three critical-severity flaws.
Fortinet released updates for two critical authentication bypass vulnerabilities affecting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager, and warned of critical SSO login flaws in FortiCloud that could allow authentication bypass.
Ivanti disclosed and patched a critical remote code execution vulnerability in Endpoint Manager.
Google patched a critical “no-click” vulnerability in Gemini Enterprise that allowed attackers to exfiltrate sensitive data via malicious document instructions.
Microsoft added PowerShell warnings for scripts using Invoke-WebRequest to help prevent risky code execution.
Google introduced new layered defenses in Chrome to block indirect prompt injection threats following the addition of agentic AI capabilities.
Researchers identified malicious extensions in Microsoft Visual Studio Code Marketplace and malicious packages in Go, npm, and Rust ecosystems, designed to steal developer data.

Notable Threat Actor Activity

North Korea-linked actors exploited the React2Shell (CVE-2025-55182) vulnerability in React Server Components to deploy new EtherRAT malware, which implements multiple Linux persistence mechanisms and uses Ethereum smart contracts for command and control.
Four distinct threat clusters are leveraging the CastleLoader malware loader, indicating it is being offered as a service for broader cybercriminal use.
Storm-0249, previously known as an initial access broker, has escalated to direct ransomware operations using advanced techniques such as domain spoofing, DLL side-loading, fileless PowerShell, and abusing endpoint detection and response (EDR) solutions for stealthy malware execution.
A phishing campaign leveraging the Evilginx open-source phishing framework is targeting at least 18 U.S. universities, aiming to bypass MFA and steal credentials.
Multi-stage phishing attacks have been observed evading Microsoft 365 security controls.
Kaspersky researchers report that Telegram’s crackdown on illicit channels is pushing cybercriminal activity to other platforms.
Shanya, a “packer-as-a-service,” is being used to obfuscate ransomware payloads and disable EDR, supporting ransomware operators in evading detection.

Trends, Tools, or Tactics of Interest

Increased abuse of EDR and trusted Windows utilities by threat actors for stealthy malware deployment and persistence.
Growing adoption of malware loaders and packer-as-a-service offerings (e.g., CastleLoader, Shanya) to facilitate ransomware and malware campaigns.
Surge in malicious packages and extensions targeting developer environments (VS Code, Go, npm, Rust) to steal sensitive data and credentials.
Attackers are leveraging deepfakes, AI-generated resumes, and social engineering to impersonate job applicants and infiltrate organizations.
Prompt injection vulnerabilities in AI-powered tools remain a persistent and difficult-to-mitigate risk, as highlighted by the UK’s NCSC.
Zero Trust adoption is hindered by lack of interoperability among security tools, with 88% of organizations experiencing challenges in sharing security signals.
Ongoing migration of cybercriminal communities away from Telegram due to increased enforcement and platform blocks.

Regulatory or Policy Developments Affecting the Security Industry

The UK government imposed sanctions on Russian and Chinese firms suspected of conducting malign information warfare and hybrid threats targeting critical infrastructure and democratic processes.
The EU fined X (formerly Twitter) $140 million for verification rules that facilitate impostor scams by allowing anyone to purchase a verified checkmark.
CISA, FBI, and international partners issued a joint advisory urging immediate action to defend critical infrastructure from pro-Russia hacktivist threats.
The US announced a $10 million bounty for information on Iranian hackers associated with Emennet Pasargad.
Microsoft announced new operating CISOs as part of a strategic shift toward AI-driven cyber defense and enhanced operational oversight.

Cybersecurity Brief – 2025-12-09

Tue, 09 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Tri-Century Eye Care suffered a data breach attributed to the Pear ransomware group, impacting approximately 200,000 individuals and resulting in the theft of over 3 TB of data.
The University of Pennsylvania and the University of California, San Diego were listed among recent victims in threat intelligence reporting, with details on the nature and impact of the incidents pending.
Malicious Visual Studio Code extensions were discovered in Microsoft’s Marketplace, delivering infostealer malware capable of taking screenshots, stealing credentials, and hijacking browser sessions.
Phishing campaigns are leveraging Cloudflare Pages to host fake banking login pages, with stolen credentials exfiltrated to attackers via Telegram.

Newly Discovered Vulnerabilities

A critical remote code execution vulnerability (CVE-2025-xxxx) in the Sneeit Framework plugin for WordPress is being actively exploited in the wild.
The Apache Software Foundation issued an updated advisory for a max-severity vulnerability in Apache Tika after the initial patch was found incomplete. The flaw enables XML External Entity (XXE) injection attacks via crafted XFA files embedded in PDFs.
A critical vulnerability in React (CVE-2025-55182, “React2Shell”) is seeing increased exploitation activity by multiple threat actors following recent public disclosure.
The ICTBroadcast platform contains a vulnerability currently being exploited to facilitate Frost botnet attacks.

Notable Threat Actor Activity

The “Scattered Lapsus$ Hunters” cybercriminal group is conducting social engineering attacks targeting organizations’ Zendesk instances.
Ransomware gangs are increasingly using the Shanya EXE packer-as-a-service to obfuscate malware and conceal EDR (Endpoint Detection and Response) killer modules.
The Pear ransomware group claimed responsibility for the Tri-Century Eye Care data breach.
A new Mirai variant, “Broadside,” is targeting DVR systems in the maritime logistics sector, exploiting command injection flaws for device hijacking and lateral movement.
JS#SMUGGLER campaign is distributing the NetSupport RAT via compromised websites.
Polish authorities arrested three Ukrainian nationals accused of using advanced hacking equipment to attempt attacks on Polish IT systems and acquire sensitive data.
Android malware families FvncBot and SeedSnatcher, along with an upgraded version of ClayRat, have been identified with enhanced data theft capabilities.

Trends, Tools, or Tactics of Interest

Ransomware activity peaked in 2023, with FinCEN and US Treasury reporting over $2.1 billion extorted from 2022 to 2024, and total ransomware payments since 2013 surpassing $4.5 billion.
Ransomware operators are adopting packer-as-a-service solutions like Shanya to better evade detection by security tools.
Threat actors are exploiting VSCode extensions as a vector to compromise developer environments and exfiltrate sensitive data.
There is a rise in the use of compromised websites and free hosting services (e.g., Cloudflare Pages) for malware delivery and phishing operations.
AI and agentic AI systems are being targeted by attackers, prompting vendors to introduce new security layers to mitigate indirect prompt injection and other AI-specific threats.
Phishing tactics now include leveraging publicly available social media photos for virtual kidnapping scams.

Regulatory or Policy Developments Affecting the Security Industry

Google Chrome is implementing a new security architecture to protect Gemini-powered agentic AI browsing, including user alignment critics, expanded origin isolation, and mandatory user confirmations.
Financial Crimes Enforcement Network (FinCEN) and the US Treasury released updated data on ransomware payments, providing insight into the evolving threat landscape and the impact of recent law enforcement actions.

Cybersecurity Brief – 2025-12-07

Sun, 07 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Attackers have exploited the critical React2Shell vulnerability (CVE-2025-55182) in React Server Components, resulting in breaches at 30 organisations. Over 77,000 internet-exposed IP addresses remain vulnerable to this flaw.
Kohler’s smart toilet cameras have been found to lack true end-to-end encryption, raising concerns about potential unauthorised access to video feeds.

Newly Discovered Vulnerabilities

Over 30 security vulnerabilities have been identified in AI-powered Integrated Development Environments (IDEs). These flaws enable data theft and remote code execution attacks via prompt injection and related primitives.
The React2Shell flaw (CVE-2025-55182), now added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue, allows remote code execution in React Server Components and is under active exploitation.

Notable Threat Actor Activity

A new campaign is targeting Palo Alto GlobalProtect VPN portals with credential stuffing and brute-force login attempts. The same actors are conducting scanning activity against SonicWall SonicOS API endpoints.
Officials have issued warnings regarding a stealthy Chinese malware specimen exhibiting advanced evasion capabilities.

Trends, Tools, or Tactics of Interest

The exploitation of vulnerabilities in AI coding tools and IDEs through prompt injection highlights a trend towards targeting AI-assisted development environments.
The scale and speed of exploitation of the React2Shell vulnerability demonstrates increased attacker focus on supply chain and framework-level flaws in widely used web technologies.

Regulatory or Policy Developments Affecting the Security Industry

CISA has formally added the React2Shell vulnerability (CVE-2025-55182) to its Known Exploited Vulnerabilities catalogue, mandating accelerated remediation timelines for U.S. federal agencies and influencing global patch management priorities.
The U.S. administration has declined to issue sanctions in response to the Salt Typhoon hacking campaign, indicating a restrained policy stance on certain nation-state cyber activities.

Cybersecurity Brief – 2025-12-06

Sat, 06 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite, resulting in the theft of database files.
American pharmaceutical company Inotiv reported a ransomware attack in August 2025 that led to the theft of personal information affecting thousands of individuals.
An AI image generator startup exposed a database containing over 1 million images and videos, including nude and “nudified” photos of real people, due to misconfigured internet access.
A human rights lawyer in Pakistan was targeted by Intellexa’s Predator spyware via a malicious WhatsApp link, marking the first known civil society targeting in the region.
Cloudflare experienced a major outage, causing widespread 500 Internal Server Errors, attributed to emergency mitigations for the React2Shell vulnerability.

Newly Discovered Vulnerabilities

React2Shell (CVE-2025-55182): A maximum-severity remote code execution vulnerability in React and Next.js was disclosed. The flaw is under active exploitation, particularly by China-linked threat actors, and has prompted emergency patching efforts including by Cloudflare.
Apache Tika (CVE-2025-66516): A critical XML external entity (XXE) injection vulnerability, rated CVSS 10.0, was disclosed in Apache Tika, requiring urgent patching.
Perplexity’s Comet Browser: A new agentic browser attack was disclosed, allowing a crafted email to trigger deletion of a user’s entire Google Drive contents via a zero-click exploit.
Akamai HTTP Smuggling: Akamai patched a vulnerability allowing HTTP smuggling attacks.

Notable Threat Actor Activity

Multiple China-nexus threat groups began exploiting the React2Shell vulnerability within hours of its public disclosure, targeting React and Next.js applications.
State-sponsored actors from the People’s Republic of China (PRC), including the group Warp Panda, have been observed deploying the BRICKSTORM, Junction, and GuestConduit malware families for long-term persistence in US systems.
Clop ransomware group exploited an Oracle E-Business Suite zero-day in the Barts Health NHS breach.
Intellexa, operators of Predator spyware, continue to leverage newly acquired zero-day exploits and alternative vectors such as ad-based delivery to bypass security controls and target individuals.

Trends, Tools, or Tactics of Interest

Malicious AI Tools: Researchers at Palo Alto Networks’ Unit 42 identified WormGPT 4 and KawaiiGPT, malicious AI tools enabling threat actors to automate the creation of phishing lures and ransomware code.
DDoS Attacks: The Aisuru botnet launched a record-breaking distributed denial-of-service (DDoS) attack, peaking at 29 Tbps and 14.1 billion packets per second, recently mitigated by Cloudflare.
Virtual Kidnapping Scams: The FBI warned of criminals using altered social media images as fake “proof of life” in virtual kidnapping ransom scams.
Attack Surface Management: Emphasis on continuous, automated attack surface visibility as cloud assets and exposures change rapidly.
Detection Tools: Burp Suite has added automated scanning capabilities for React2Shell vulnerabilities in Next.js applications.
Predator Spyware: Leaked Intellexa documents show ongoing use of high-priced zero-day exploits to maintain Predator spyware effectiveness.

Regulatory or Policy Developments

The European Commission fined X (formerly Twitter) €120 million ($140 million) for violating transparency obligations under the Digital Services Act (DSA), specifically related to deceptive blue checkmarks.
India has rolled back its proposed mandate requiring citizens to install a government cybersecurity app, following surveillance and privacy concerns.

Cybersecurity Brief – 2025-12-05

Fri, 05 Dec 2025 00:00:00 +0000

Major Incidents or Breaches

Inotiv, a US-based company, disclosed a ransomware attack resulting in the theft of names, addresses, Social Security numbers, and financial and medical information of 9,542 individuals.
Freedom Mobile reported a data breach involving the compromise of customer personal information through its account management platform.
Marquis suffered a data breach impacting over 780,000 people, with compromised data including names, addresses, Social Security numbers, and card numbers.

Newly Discovered Vulnerabilities

A critical command injection vulnerability in Array Networks AG Series secure access gateways (ArrayOS AG VPN devices) has been actively exploited since August 2025. Threat actors are deploying webshells and creating rogue users.
A maximum-severity vulnerability, CVE-2025-55182 (“React2Shell”), exists in React Server Components’ ‘Flight’ protocol, enabling remote code execution without authentication in React and Next.js applications. AWS and other sources confirm active exploitation attempts, including by China-linked threat groups. Only instances using a newer feature are affected.
Google released a Chrome update addressing 13 security issues, including a high-severity vulnerability in Digital Credentials.

Notable Threat Actor Activity

Chinese state-sponsored actors are actively exploiting the React2Shell vulnerability and targeting VMware vSphere servers with BrickStorm malware, as warned by CISA, NSA, and international partners. The BrickStorm malware is being used to backdoor VMware servers in government and technology sectors.
The Predator spyware, developed by Intellexa, is leveraging a new zero-click infection vector (“Aladdin”) that compromises targets via malicious advertisements without user interaction.
The financially motivated group GoldFactory is distributing modified banking apps in Southeast Asia (Indonesia, Thailand, Vietnam), resulting in over 11,000 mobile infections.
The Silver Fox threat actor is conducting a false flag campaign in China, distributing ValleyRAT malware via fake Microsoft Teams installers and search engine optimization (SEO) poisoning.
Russian state-sponsored hackers targeted Reporters Without Borders (RSF) using phishing emails to deliver malware.
China-based SMS phishing groups have shifted tactics to promote scams involving loyalty points, taxes, and fake retailers during the holiday season.
A student was found selling access to compromised government and university websites to Chinese threat actors for low prices.

Trends, Tools, or Tactics of Interest

Sophisticated fraud attacks are increasing, driven by the accessibility of AI tools and fraud-as-a-service platforms, making advanced techniques available to unskilled attackers.
Multi-stage phishing campaigns targeting Microsoft 365 credentials have been observed since November 2025, employing advanced evasion techniques.
AutoIT3 compiled scripts are being used to deliver shellcode payloads in Windows environments.
There is a marked increase in AI-powered attacks, evolving injection techniques, and the use of automation in both offensive and defensive cyber operations.
Cloudflare reported blocking 416 billion AI bot requests since July 1, indicating a surge in automated scraping and reconnaissance activity.
SMS phishing campaigns are adapting to current events and seasonal trends, with new lures targeting points, taxes, and fake retailers.

Regulatory or Policy Developments Affecting the Security Industry

The UK National Cyber Security Centre (NCSC) announced the testing of a “Proactive Notifications” service to alert UK organizations about vulnerabilities in exposed devices.
CISA, NSA, and allied cyber agencies published security guidance for the integration of AI in operational technology (OT) environments, outlining principles for secure AI deployment in critical infrastructure.
India’s Ministry of Communications rescinded an order that would have required smartphone manufacturers to preinstall a government cybersecurity app (“Sanchar Saathi”) and prevent users from disabling it.
Canadian police are trialing facial recognition body cameras, raising potential privacy and accuracy concerns.
The US Inspector General’s report on the “Signalgate” incident recommended a single procedural change to improve the handling of classified material.
ServiceNow acquired Veza, a provider of non-human identity (NHI) access control, to enhance its governance and AI Control Tower offerings.