Major Incidents or Breaches

  • Threat actors are actively exploiting CVE-2025-55182, with observed attacks targeting honeypots and deploying malware.
  • Multiple threat groups are exploiting WinRAR vulnerability CVE-2025-6218, which has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
  • Gladinet’s CentreStack and Triofox products are under active attack due to hard-coded cryptographic keys, resulting in unauthorized access and code execution in at least nine organizations.
  • React2Shell vulnerability in React Server Components is being heavily exploited to deliver cryptocurrency miners and other malware across multiple sectors.
  • Over 10,000 Docker Hub container images have been found leaking sensitive credentials, including production system access, CI/CD database keys, and LLM model keys.
  • A new AMOS infostealer malware campaign is using Google search ads to lure users into fake ChatGPT and Grok guides, resulting in macOS infections.
  • A new Android malware, DroidLock, is locking devices for ransom, erasing data, and accessing sensitive information such as messages, contacts, and audio data.
  • The GhostFrame phishing kit is enabling widespread phishing attacks using dynamic subdomains and hidden iframes to evade detection.
  • A Ukrainian national has been charged and extradited to the US for assisting Russian hacktivist groups in attacks on critical infrastructure, including water, election, and nuclear systems.
  • Pro-Russian hacktivists are targeting US critical infrastructure, primarily by compromising VNC connections in operational technology (OT) systems, with potential for increased destructiveness.

Newly Discovered Vulnerabilities

  • PCIe 5.0+ systems are affected by three vulnerabilities in the Integrity and Data Encryption (IDE) protocol, exposing Intel and AMD processors to information disclosure, privilege escalation, and DoS via local attacks.
  • The .NET “SOAPwn” flaw allows remote code execution and arbitrary file writes via rogue WSDL files in enterprise applications.
  • Google patched a Gemini Enterprise zero-click vulnerability (“GeminiJack”) that could have exposed corporate data via crafted emails, calendar invites, or documents.
  • Fortinet released patches for two critical authentication bypass vulnerabilities impacting FortiOS, FortiWeb, FortiProxy, and FortiSwitchManager with FortiCloud SSO enabled.
  • Ivanti Endpoint Manager (EPM) update addresses a critical XSS vulnerability enabling remote code execution with admin privileges.
  • SAP’s December 2025 updates fix critical vulnerabilities in Solution Manager, Commerce Cloud, and jConnect SDK, which could lead to code injection and remote code execution.
  • Siemens, Rockwell, and Schneider have issued patches for multiple vulnerabilities across their industrial control system (ICS) products.
  • Microsoft issued fixes for 56 vulnerabilities, including three zero-days, one of which is under active exploitation, and introduced a PowerShell warning for unsafe code execution.
  • A possible new exploit variant for Kubernetes OS command injection vulnerability CVE-2024-9042 has been identified.

Notable Threat Actor Activity

  • Storm-0249, an initial access broker, is abusing endpoint detection and response (EDR) platforms and Windows utilities in stealthy attacks.
  • The Silver Fox APT, associated with ValleyRAT malware, continues to evolve, utilizing kernel rootkits and advanced builder techniques.
  • The Spiderman phishing kit is targeting customers of dozens of European banks and cryptocurrency holders with highly convincing cloned sites.
  • The AMOS infostealer campaign leverages SEO poisoning and legitimate AI domains for malware delivery to macOS systems.
  • US authorities indicted Victoria Dubranova for supporting Russia-backed CARR and NoName hacktivist groups in attacks on critical infrastructure.
  • Two individuals linked to China’s Salt Typhoon hacker group reportedly received training via a Cisco Academy prior to targeting Cisco devices in espionage campaigns.

Trends, Tools, or Tactics of Interest

  • Phishing attacks have surged 400% year-over-year, with a focus on corporate accounts.
  • Social engineering campaigns are exploiting Microsoft Teams’ “Chat with Anyone” feature to conduct phishing attacks via external DMs.
  • Attackers are increasingly exploiting cloud misconfigurations across AWS, AI models, and Kubernetes, bypassing standard security tools.
  • Supply-chain attacks in manufacturing environments are leveraging compromised credentials, malicious NPM packages, and development tool exploits.
  • Microsoft Teams is developing a feature to warn IT administrators about suspicious traffic with external domains.
  • The GhostFrame phishing kit is enabling large-scale, evasive phishing campaigns using dynamic infrastructure.
  • The Spiderman phishing kit demonstrates sophistication in targeting European financial institutions with pixel-perfect phishing sites.

Regulatory or Policy Developments Affecting the Security Industry

  • Israeli cybersecurity sector investment reached a record $4.4 billion, reflecting over 500% growth in the past decade.
  • CISA added the WinRAR CVE-2025-6218 vulnerability to its KEV catalog, mandating remediation for US federal agencies.