Major Incidents or Breaches

  • Tri-Century Eye Care suffered a data breach attributed to the Pear ransomware group, impacting approximately 200,000 individuals and resulting in the theft of over 3 TB of data.
  • The University of Pennsylvania and the University of California, San Diego were listed among recent victims in threat intelligence reporting, with details on the nature and impact of the incidents pending.
  • Malicious Visual Studio Code extensions were discovered in Microsoft’s Marketplace, delivering infostealer malware capable of taking screenshots, stealing credentials, and hijacking browser sessions.
  • Phishing campaigns are leveraging Cloudflare Pages to host fake banking login pages, with stolen credentials exfiltrated to attackers via Telegram.

Newly Discovered Vulnerabilities

  • A critical remote code execution vulnerability (CVE-2025-xxxx) in the Sneeit Framework plugin for WordPress is being actively exploited in the wild.
  • The Apache Software Foundation issued an updated advisory for a max-severity vulnerability in Apache Tika after the initial patch was found incomplete. The flaw enables XML External Entity (XXE) injection attacks via crafted XFA files embedded in PDFs.
  • A critical vulnerability in React (CVE-2025-55182, “React2Shell”) is seeing increased exploitation activity by multiple threat actors following recent public disclosure.
  • The ICTBroadcast platform contains a vulnerability currently being exploited to facilitate Frost botnet attacks.

Notable Threat Actor Activity

  • The “Scattered Lapsus$ Hunters” cybercriminal group is conducting social engineering attacks targeting organizations’ Zendesk instances.
  • Ransomware gangs are increasingly using the Shanya EXE packer-as-a-service to obfuscate malware and conceal EDR (Endpoint Detection and Response) killer modules.
  • The Pear ransomware group claimed responsibility for the Tri-Century Eye Care data breach.
  • A new Mirai variant, “Broadside,” is targeting DVR systems in the maritime logistics sector, exploiting command injection flaws for device hijacking and lateral movement.
  • JS#SMUGGLER campaign is distributing the NetSupport RAT via compromised websites.
  • Polish authorities arrested three Ukrainian nationals accused of using advanced hacking equipment to attempt attacks on Polish IT systems and acquire sensitive data.
  • Android malware families FvncBot and SeedSnatcher, along with an upgraded version of ClayRat, have been identified with enhanced data theft capabilities.

Trends, Tools, or Tactics of Interest

  • Ransomware activity peaked in 2023, with FinCEN and US Treasury reporting over $2.1 billion extorted from 2022 to 2024, and total ransomware payments since 2013 surpassing $4.5 billion.
  • Ransomware operators are adopting packer-as-a-service solutions like Shanya to better evade detection by security tools.
  • Threat actors are exploiting VSCode extensions as a vector to compromise developer environments and exfiltrate sensitive data.
  • There is a rise in the use of compromised websites and free hosting services (e.g., Cloudflare Pages) for malware delivery and phishing operations.
  • AI and agentic AI systems are being targeted by attackers, prompting vendors to introduce new security layers to mitigate indirect prompt injection and other AI-specific threats.
  • Phishing tactics now include leveraging publicly available social media photos for virtual kidnapping scams.

Regulatory or Policy Developments Affecting the Security Industry

  • Google Chrome is implementing a new security architecture to protect Gemini-powered agentic AI browsing, including user alignment critics, expanded origin isolation, and mandatory user confirmations.
  • Financial Crimes Enforcement Network (FinCEN) and the US Treasury released updated data on ransomware payments, providing insight into the evolving threat landscape and the impact of recent law enforcement actions.