Major Incidents or Breaches

• Petróleos de Venezuela (PDVSA), Venezuela’s state-owned oil company, suffered a cyberattack that disrupted export operations over the weekend.
• SoundCloud disclosed a data breach affecting approximately 20% of its users, with attackers accessing user data.
• Askul, an e-commerce and logistics company, was targeted by the RansomHouse ransomware group in October, resulting in the compromise of 700,000 records.
• A new report highlights that most “parked” domains-largely expired or unused domains-now serve malicious content, increasing risks from direct navigation.
• Urban VPN Proxy, a popular Chrome extension with 8 million users, was found to be harvesting data from AI chatbot conversations, including ChatGPT, Claude, Gemini, and Copilot.
• A security flaw at a photo booth operator’s website exposed hundreds of private customer photos online.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• SoundCloud confirmed a security breach resulting in the theft of a user database containing member data and subsequent disruption of VPN access for users.
• Askul Corporation, a Japanese e-commerce company, disclosed that RansomHouse hackers stole approximately 740,000 customer records in an October ransomware attack.
• PornHub is being extorted by the ShinyHunters gang following the theft of Premium member search and watch history data, reportedly accessed via a Mixpanel data breach.
• 700Credit, a U.S.-based financial services provider, reported a data breach impacting 5.8 million individuals, with stolen data including names, addresses, dates of birth, and Social Security numbers.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Kaspersky researchers have identified a new Android banking Trojan, dubbed Frogblight, targeting Turkish users. The malware is distributed via a fake app impersonating an official Turkish government portal for accessing court case files.

Newly Discovered Vulnerabilities

• Wireshark 4.6.2 has been released, addressing two vulnerabilities and five bugs.

Notable Threat Actor Activity

• The pro-Russian hacktivist group CyberVolk (also known as GLORIAMIST) has launched a new ransomware-as-a-service (RaaS) operation called VolkLocker. The ransomware contains a hard-coded master decryption key, allowing free decryption of files.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Multiple South Korean CEOs have resigned following recent cyberattacks targeting their companies.

Newly Discovered Vulnerabilities

• A high-severity vulnerability affecting Sierra Wireless AirLink ALEOS routers has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalogue. The flaw enables remote code execution (RCE) and is currently being actively exploited.

Notable Threat Actor Activity

• ClickFix attacks continue to leverage the “Finger” protocol as part of their exploitation tactics.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Coupang suffered a data breach affecting 33.7 million customers, traced to a former employee who retained internal system access after departure.
• Fieldtex Products experienced a data breach impacting 238,000 individuals, with the Akira ransomware group claiming responsibility for stealing 14 GB of data.
• At least nine organizations were compromised through exploitation of a recently patched Gladinet CentreStack vulnerability.
• A fake torrent for “One Battle After Another” was used to distribute Agent Tesla RAT malware via malicious subtitle files.
• Google ads are being abused to direct Mac users to malicious AI chat sites, resulting in the distribution of the Atomic macOS Stealer (AMOS).
• The US government’s policy of publishing H-1B applicant social accounts has raised significant privacy concerns, exposing personal data to potential targeting, impersonation, and extortion.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• The Pierce County Library suffered a data breach in April 2025, resulting in the theft of personal information belonging to 340,000 patrons, employees, and their family members.
• The UK Information Commissioner’s Office fined LastPass £1.2 million over the 2022 data breach that impacted 1.6 million users, citing failure to implement adequate security measures.
• Over 700 internet-facing Gogs servers have been compromised via an unpatched zero-day vulnerability, with attackers exploiting the flaw for remote code execution and file overwrites outside repositories.
• Hackers exploited an undocumented cryptographic vulnerability in Gladinet CentreStack and Triofox products, enabling remote code execution attacks.
• Multiple malware campaigns have been observed:
  • Malicious Visual Studio Code Marketplace extensions (19 identified) have been distributing trojans hidden in fake PNG files since February, targeting developers.
  • React2Shell attacks are delivering a range of malware, including cryptocurrency miners, Linux backdoors, botnet malware, and post-exploitation implants.
  • DroidLock Android malware is locking users out of their devices and demanding ransom for file and device access restoration.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Threat actors are actively exploiting CVE-2025-55182, with observed attacks targeting honeypots and deploying malware.
• Multiple threat groups are exploiting WinRAR vulnerability CVE-2025-6218, which has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
• Gladinet’s CentreStack and Triofox products are under active attack due to hard-coded cryptographic keys, resulting in unauthorized access and code execution in at least nine organizations.
• React2Shell vulnerability in React Server Components is being heavily exploited to deliver cryptocurrency miners and other malware across multiple sectors.
• Over 10,000 Docker Hub container images have been found leaking sensitive credentials, including production system access, CI/CD database keys, and LLM model keys.
• A new AMOS infostealer malware campaign is using Google search ads to lure users into fake ChatGPT and Grok guides, resulting in macOS infections.
• A new Android malware, DroidLock, is locking devices for ransom, erasing data, and accessing sensitive information such as messages, contacts, and audio data.
• The GhostFrame phishing kit is enabling widespread phishing attacks using dynamic subdomains and hidden iframes to evade detection.
• A Ukrainian national has been charged and extradited to the US for assisting Russian hacktivist groups in attacks on critical infrastructure, including water, election, and nuclear systems.
• Pro-Russian hacktivists are targeting US critical infrastructure, primarily by compromising VNC connections in operational technology (OT) systems, with potential for increased destructiveness.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Spanish authorities arrested a 19-year-old in Barcelona for allegedly stealing and attempting to sell 64 million personal data records obtained from breaches at nine companies.
• Canadian organizations have been the primary target in a campaign by threat cluster STAC6565, with almost 40 incidents investigated. The Gold Blade group has been observed deploying QWCrypt ransomware in these attacks.
• Japanese manufacturers, retailers, and government entities continue to experience prolonged recovery periods following ransomware attacks, highlighting the long-term operational impact of such incidents.
• Microsoft Copilot experienced an outage affecting users in Europe, with investigation and mitigation ongoing.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Tri-Century Eye Care suffered a data breach attributed to the Pear ransomware group, impacting approximately 200,000 individuals and resulting in the theft of over 3 TB of data.
• The University of Pennsylvania and the University of California, San Diego were listed among recent victims in threat intelligence reporting, with details on the nature and impact of the incidents pending.
• Malicious Visual Studio Code extensions were discovered in Microsoft’s Marketplace, delivering infostealer malware capable of taking screenshots, stealing credentials, and hijacking browser sessions.
• Phishing campaigns are leveraging Cloudflare Pages to host fake banking login pages, with stolen credentials exfiltrated to attackers via Telegram.

Newly Discovered Vulnerabilities

Notable Threat Actor Activity

• The Iranian threat group MuddyWater has been observed deploying a new backdoor named UDPGangster in targeted attacks against entities in Turkey, Israel, and Azerbaijan. The backdoor leverages the User Datagram Protocol (UDP) for command-and-control (C2) communications, indicating a shift in their operational tactics.

Regulatory or Policy Developments Affecting the Security Industry

• Portugal has updated its cybercrime law to provide legal exemptions for security researchers conducting good-faith research. The amendments create a safe harbor and clarify that hacking is not punishable under strictly defined conditions, aiming to encourage responsible vulnerability disclosure and research.