Major Incidents or Breaches

• Switzerland’s government reported that sensitive data from multiple federal offices was compromised following a ransomware attack on the third-party provider Radix.
• Europol, in coordination with Spanish authorities, dismantled a cryptocurrency investment fraud ring responsible for laundering approximately $540 million (€460 million) from over 5,000 victims. Five suspects were arrested.
• Over 1,200 Citrix NetScaler ADC and NetScaler Gateway servers remain unpatched against a critical authentication bypass vulnerability, which is reportedly being actively exploited.
• The hacker collective Scattered Spider continues its campaign targeting the airline sector, with Microsoft designating the group as a significant cyber threat.
• The FBI disclosed that cybercriminals are impersonating health fraud investigators to steal sensitive health information from US citizens.
• The US Justice Department revealed that the identities of more than 80 Americans were stolen to facilitate North Korean IT worker scams, with action taken against associated “laptop farms.”
• A government report indicated that a hacker was hired by the Sinaloa drug cartel to identify and target individuals connected to the FBI’s investigation, leading to fatal outcomes.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Hawaiian Airlines has confirmed a cyber incident linked to the cybercrime group Scattered Spider, which has expanded operations to target airlines following high-profile breaches at WestJet and insurers.

• Over 27% of UK businesses experienced cyber incidents in the past year, a significant increase from 16%. Vulnerable smart buildings and IoT systems pose significant risk factors, with 73% of leaders anticipating further disruptions.

• Nearly 16 billion login credentials have been leaked online, highlighting ongoing issues with password hygiene and the reuse of credentials.

Major Incidents or Breaches

• The FBI has reported that the cybercrime group Scattered Spider is expanding its attacks to target the airline sector, primarily using social engineering tactics.
• Hackers reportedly opened a valve at a Norwegian dam, indicating unauthorised access and potential risk to critical infrastructure.

Notable Threat Actor Activity

• Scattered Spider has broadened its targeting to include airlines, employing social engineering to gain access.
• The GIFTEDCROOK malware, operated by an unnamed threat actor, has evolved from a browser data stealer into a more advanced intelligence-gathering tool, with recent campaigns demonstrating enhanced data exfiltration capabilities.

Trends, Tools, or Tactics of Interest

Major Incidents or Breaches

• Ahold Delhaize, a global food retail chain, disclosed that a ransomware attack in November resulted in a data breach affecting 2.2 million individuals, compromising personal, financial, and health information.
• Cloudflare successfully mitigated the largest recorded DDoS attack to date.
• Russian ISPs began throttling access to websites and services protected by Cloudflare as of 9 June 2025, causing widespread inaccessibility.

Newly Discovered Vulnerabilities

• A critical vulnerability in NetScaler ADC and Gateway, dubbed “Citrix Bleed 2” (CVE-2025-5777), is now believed to be actively exploited. This flaw allows attackers to maintain undetected access for extended periods.
• Researchers identified security weaknesses in aftermarket smart tractor steering systems, allowing potential full takeover and surveillance of connected tractors.

Notable Threat Actor Activity

Major Incidents or Breaches

• United Natural Foods Inc. (UNFI), a major supplier to Whole Foods, has restored its core systems and electronic ordering/invoicing platforms after a cyberattack. Details of the attack vector or threat actor have not been disclosed.
• Hawaiian Airlines reported a cyberattack that disrupted access to some systems. Flight operations were not affected. The investigation is ongoing.
• The U.S. Department of Justice charged a British national, alleged to be the threat actor “IntelBroker,” in connection with several high-profile breaches.
• New South Wales Police arrested a former Western Sydney University student accused of repeatedly hacking university systems for personal gain, including manipulating parking and accessing data.
• A Kansas City man pleaded guilty to hacking multiple organizations to promote his own cybersecurity services.
• AT&T has agreed to a $177 million settlement following a data breach that resulted in customer information being leaked and sold on the dark web.
• The “Cyber Fattah” hacktivist group leaked data from Saudi Games, amid increased hacktivist activity linked to regional tensions.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Citrix NetScaler ADC Vulnerability (CVE-2025-6543): Citrix released emergency patches for a critical vulnerability in NetScaler ADC appliances, which has been actively exploited in the wild for denial of service and session hijacking attacks. The flaw, dubbed “CitrixBleed 2,” allows unauthenticated attackers to steal authentication tokens and disrupt services.
• SonicWall NetExtender Trojan: Unknown threat actors have distributed a trojanized version of SonicWall’s NetExtender SSL VPN client, enabling credential theft from users who install the compromised application.
• Pro-Iranian Hacktivist Data Leak: The Cyber Fattah group, aligned with Iranian interests, leaked thousands of personal records related to athletes and visitors of the 2024 Saudi Games.
• BreachForums Operator Arrests: French authorities reportedly arrested five operators of the BreachForums cybercrime forum, which facilitated the trade and exposure of stolen data.
• ‘IntelBroker’ Charged: A British national known as “IntelBroker” has been charged in the US for stealing and selling sensitive data from global victims, causing $25 million in damages.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• Steel producer Nucor confirmed that data was stolen during a cyberattack first disclosed in May. Systems were taken offline to investigate and contain malicious activity.
• AT&T is settling a data breach affecting millions of customers, offering compensation to those impacted.
• Trezor warned users of a phishing campaign abusing its official support platform to send deceptive emails aimed at stealing cryptocurrency.
• Threat actors have distributed a trojanized version of SonicWall’s NetExtender SSL VPN client, designed to steal VPN credentials.
• Over 70 Microsoft Exchange servers were targeted by unidentified threat actors who injected malicious code into login pages to harvest credentials.

Newly Discovered Vulnerabilities

Major Incidents or Breaches

• McLaren Health Care reported a data breach impacting 743,000 patients following a July 2024 attack by the INC ransomware gang.
• Nucor, North America’s largest steel producer, confirmed data theft in a recent cyber incident.
• A database containing 184 million plaintext passwords from platforms including Facebook and Google was discovered exposed online without encryption or protection.

Newly Discovered Vulnerabilities

• Citrix released patches for critical vulnerabilities in NetScaler ADC and Gateway appliances, urging customers to update to prevent exploitation.
• A Windows LNK flaw was exploited by the XDigo malware in attacks against Eastern European government entities.
• Scanning activity targeting Ichano AtHome IP Cameras was observed, indicating potential exploitation attempts.

Notable Threat Actor Activity

Major Incidents or Breaches

• CoinMarketCap experienced a website supply chain attack that injected a malicious Web3 popup, exposing site visitors to a wallet drainer campaign designed to steal cryptocurrency from connected wallets.
• Oxford City Council suffered a data breach affecting legacy systems, resulting in unauthorised access to personally identifiable information spanning two decades.
• Reports indicate that 16 billion passwords have been leaked from various platforms, including Apple and Google, as a result of cumulative data breaches. The scale of exposure increases the risk of credential stuffing and related attacks.

Notable Threat Actor Activity

Major Incidents or Breaches

• The April 2025 cyberattacks on UK retailers Marks & Spencer and Co-op have been attributed to the threat group Scattered Spider. The incidents have been classified as a “single combined cyber event,” with estimated damages reaching up to $592 million.
• The UK Information Commissioner’s Office (ICO) has imposed a significant fine on 23andMe following its 2023 data breach.

Notable Threat Actor Activity

• Scattered Spider has been identified as the group behind the coordinated attacks on Marks & Spencer and Co-op.
• Israeli authorities have accused Iranian state-linked actors of hacking security cameras in Israel for espionage purposes.
• Ukrainian hackers have reportedly disrupted a major Russian internet provider.
• China’s Salt Typhoon threat group has claimed responsibility for another cyberattack, details of which were not specified.

Trends, Tools, or Tactics of Interest