Major Incidents or Breaches

  • Allianz Life (US): Hackers stole personal information of 1.1 million individuals in a Salesforce data theft attack. Exposed data includes physical addresses, dates of birth, phone numbers, and other sensitive information for life insurance customers.
  • Business Council of New York State (US): Data breach in February led to theft of personal, financial, and health information of over 47,000 individuals.
  • Inotiv (US): Ransomware attack resulted in encryption of systems and data, impacting business operations.
  • Bragg Gaming Group (Global): Hackers accessed internal systems, though operations reportedly unaffected.
  • TPG Telecom/iiNet (Australia): Unauthorised access detected in iiNet order management system; investigation ongoing.
  • Highly Sensitive Medical Cannabis Data (US): Nearly one million records, including SSNs, government IDs, and health data, exposed due to an unsecured database.
  • Polish Power Plant (Poland): Russian hacktivists launched a cyberattack causing operational disruption at a power plant.
  • RapperBot DDoS Botnet: US authorities charged a 22-year-old Oregon man for operating the RapperBot botnet, which powered over 370,000 distributed denial-of-service attacks.

Newly Discovered Vulnerabilities

  • Apache ActiveMQ: Threat actors are exploiting a nearly two-year-old security flaw to gain persistent access to cloud Linux systems, deploying the DripDropper malware. Attackers have been observed patching the exploited vulnerability post-compromise to maintain exclusive access.
  • SAP NetWeaver: A public exploit chaining two critical, now-patched vulnerabilities has been released, exposing unpatched systems to remote code execution and data theft.
  • Windows CLFS (CVE-2025-29824): Previously zero-day flaw exploited in the wild as part of Play ransomware attack chains, enabling attackers to gain system-level privileges.
  • Windows Recovery/Reset: August 2025 security updates introduced an issue breaking reset and recovery operations on Windows 10 and some Windows 11 versions. Microsoft has released emergency out-of-band updates to address the problem.

Notable Threat Actor Activity

  • GodRAT: Financial institutions, especially trading and brokerage firms, are being targeted by a new remote access trojan dubbed GodRAT. The malware uses steganography and is based on Gh0st RAT code, likely as a successor to AwesomePuppet and attributed to the Winnti group.
  • ScarCruft (North Korea): The group has added ransomware to its toolset, distributing it via phishing emails.
  • PipeMagic Backdoor: Attackers are using the modular PipeMagic malware, which masquerades as a ChatGPT application, in conjunction with exploitation of Windows CLFS vulnerabilities as part of Play ransomware campaigns.
  • Russian Hacktivists: Conducted a disruptive cyberattack against a Polish power plant.
  • Yemen Cyber Army: UK courts sentenced Al-Tahery Al-Mashriky to 20 months in prison for hacktivist campaigns involving website defacement.

Trends, Tools, or Tactics of Interest

  • DripDropper Malware: Attackers exploiting Apache ActiveMQ are patching the same vulnerability after deploying their malware, a tactic to prevent other actors from leveraging the same entry point.
  • Linux Evasion: RingReaper, a sophisticated post-compromise tool, abuses the Linux kernel’s io_uring interface to evade endpoint detection and response (EDR) systems.
  • Darknet Communications: Criminal actors are increasingly migrating from traditional IRC forums to Telegram networks for operational security and resilience.
  • AI and Security: Increased discussion on the dual-use nature of AI helpers, with risks of AI-powered tools being leveraged for malicious purposes, including zero-click exploits against AI agents.
  • Supply Chain Attacks: Ongoing concern over GitHub risk vectors and supply chain compromise, with new research highlighting overlooked attack surfaces.
  • Increased Reconnaissance: Rise in scans targeting Elasticsearch instances, seeking misconfigurations or exposed data.
  • Vendor Security Requirements: Asian organizations, including a Japanese chipmaker and the Singaporean government, are mandating cybersecurity checks for suppliers in response to breach upticks.

Regulatory or Policy Developments

  • UK Encryption Policy: The UK government has dropped its demand for Apple to implement encryption backdoors following pressure from US civil liberties groups.
  • PyPI Security: The Python Package Index has implemented protections against domain resurrection attacks, reducing the risk of account hijacking through expired domain-based password resets.
  • Okta/Threat Detection: Okta has open-sourced a catalog of Sigma-based Auth0 detection rules to help customers identify account takeovers, misconfigurations, and suspicious behaviors in event logs.