Major Incidents or Breaches

  • The Pierce County Library suffered a data breach in April 2025, resulting in the theft of personal information belonging to 340,000 patrons, employees, and their family members.
  • The UK Information Commissioner’s Office fined LastPass £1.2 million over the 2022 data breach that impacted 1.6 million users, citing failure to implement adequate security measures.
  • Over 700 internet-facing Gogs servers have been compromised via an unpatched zero-day vulnerability, with attackers exploiting the flaw for remote code execution and file overwrites outside repositories.
  • Hackers exploited an undocumented cryptographic vulnerability in Gladinet CentreStack and Triofox products, enabling remote code execution attacks.
  • Multiple malware campaigns have been observed:
    • Malicious Visual Studio Code Marketplace extensions (19 identified) have been distributing trojans hidden in fake PNG files since February, targeting developers.
    • React2Shell attacks are delivering a range of malware, including cryptocurrency miners, Linux backdoors, botnet malware, and post-exploitation implants.
    • DroidLock Android malware is locking users out of their devices and demanding ransom for file and device access restoration.

Newly Discovered Vulnerabilities

  • A high-severity, actively exploited XXE (XML External Entity) vulnerability has been flagged in OSGeo GeoServer and added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
  • An unpatched zero-day in Gogs, a self-hosted Git service, allows attackers to overwrite files outside repositories, leading to remote code execution. The vulnerability is a bypass for a previously disclosed RCE flaw.
  • An undocumented cryptographic flaw in Gladinet CentreStack and Triofox enables remote code execution and is being actively exploited.
  • Notepad++ released version 8.8.9 to address a security weakness in its WinGUp update mechanism, which allowed attackers to push malicious update files.
  • Google released emergency patches for a new Chrome zero-day (the eighth in 2025), described as a V8 type-confusion issue already being exploited in the wild. The specific CVE and affected component remain undisclosed.
  • IBM patched over 100 vulnerabilities this week, including several critical issues in third-party dependencies.

Notable Threat Actor Activity

  • The WIRTE APT group is targeting government and diplomatic entities in the Middle East using a new malware suite named AshTag, installed via AshenLoader DLL sideloading.
  • Hamas-linked hackers are conducting espionage campaigns against Middle Eastern diplomats, deploying increasingly sophisticated malware.
  • Researchers detailed NANOREMOTE, a backdoor for Windows that uses the Google Drive API for covert command-and-control communications.

Trends, Tools, or Tactics of Interest

  • AI-driven cyberattacks are automating reconnaissance, generating malware variants, and evading detection at speeds that challenge traditional network defenses.
  • Attackers are leveraging trusted platforms for C2 communications, such as NANOREMOTE’s use of Google Drive API.
  • The Mythic post-exploitation framework’s network traffic and agent-to-C2 communication patterns have been analyzed, resulting in new detection rules for network defense.
  • ConsentFix, a new attack variant, abuses the Azure CLI OAuth app to hijack Microsoft accounts, bypassing passwords and, in some cases, multi-factor authentication.
  • Browser add-ons, software updates, and developer tool ecosystems (e.g., VSCode Marketplace) are increasingly being used as vectors for malware distribution.
  • DLL sideloading continues to be a favored technique for malware delivery, as seen in recent WIRTE activity.
  • Doxers are impersonating law enforcement to trick tech firms into handing over private user data using spoofed emails and falsified documents.

Regulatory or Policy Developments Affecting the Security Industry

  • The UK ICO imposed a £1.2 million fine on LastPass for inadequate security leading to the 2022 breach.
  • In the US, President Trump signed an executive order blocking individual states from enacting their own AI regulations, centralizing AI policy at the federal level.
  • Microsoft expanded its bug bounty program to reward reports of critical vulnerabilities in any of its online services, including those built on third-party code.