Major Incidents or Breaches

  • LKQ, a major auto parts supplier, confirmed a breach involving its Oracle E-Business Suite (EBS), resulting in the compromise of personal information for thousands of individuals.
  • France arrested a 22-year-old suspect linked to the recent cyberattack on the country’s Ministry of the Interior.
  • Amazon AWS GuardDuty reported an ongoing cryptomining campaign abusing compromised AWS credentials to hijack EC2 and ECS resources across multiple customer environments.
  • WhatsApp accounts are being hijacked via abuse of the device-linking feature in attacks dubbed “GhostPairing,” allowing threat actors to take over user accounts.
  • The NMFTA (National Motor Freight Traffic Association) warned of a surge in sophisticated cyber-enabled cargo theft targeting the transportation sector.

Newly Discovered Vulnerabilities

  • Cisco disclosed a maximum-severity zero-day vulnerability (CVE-2025-20393) in AsyncOS used by Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances, with active exploitation by a China-linked APT (UAT-9686/Jewelbug).
  • SonicWall released fixes for CVE-2025-40602 affecting SMA 100 series appliances, which had been actively exploited. A separate zero-day in SMA 1000 Appliance Management Console was also reported as exploited in privilege escalation attacks.
  • A critical flaw in ASUS Live Update was added to CISA’s Known Exploited Vulnerabilities catalog due to evidence of exploitation in the wild.
  • Critical vulnerabilities in Fortinet devices are under active attack, with attackers targeting admin accounts, exporting device configurations, and accessing sensitive data.
  • The React2Shell vulnerability (CVE-2025-55182) is being actively exploited by ransomware groups for rapid initial access and deployment of file-encrypting malware.
  • Google patched two critical Chrome browser vulnerabilities that could be exploited remotely simply by visiting a malicious website.

Notable Threat Actor Activity

  • The ForumTroll APT group continues targeted phishing attacks against Russian political scientists and scholars, delivering the Tuoni framework via fake eLibrary emails and malicious plagiarism reports.
  • Russian state-sponsored APT28 is conducting a sustained credential-harvesting campaign targeting users of the Ukrainian webmail/news portal UKR[.]net.
  • The China-linked threat actor Jewelbug (also referred to as Ink Dragon) has increased targeting of European government entities since July 2025, using ShadowPad and FINALDRAFT malware, while continuing attacks in Southeast Asia and South America.
  • The Kimwolf botnet has hijacked at least 1.8 million Android-based TVs, set-top boxes, and tablets, leveraging them for large-scale distributed denial-of-service (DDoS) attacks.
  • A new campaign, GhostPoster, embedded malware in 17 Firefox add-ons (over 50,000 downloads), hijacking affiliate links, injecting tracking code, and bypassing security controls.
  • The Cellik Android RAT, available for $150, is being used to remotely control victim devices and generate trojanized apps distributed via the Google Play Store.

Trends, Tools, or Tactics of Interest

  • Attackers are increasingly abusing legitimate features (e.g., WhatsApp device-linking, AWS IAM credentials) for account hijacking and cryptomining.
  • Ransomware groups are exploiting critical vulnerabilities (e.g., React2Shell) for rapid deployment of file-encrypting malware.
  • Malicious browser extensions (e.g., GhostPoster in Firefox) continue to be a vector for affiliate fraud, tracking, and security bypass.
  • The use of ShadowPad and FINALDRAFT malware by China-linked actors against government targets highlights continued investment in modular, stealthy toolsets.
  • Surge in cyber-enabled cargo theft demonstrates growing convergence of physical and cybercrime in logistics and transportation sectors.

Regulatory or Policy Developments

  • Mexico officially launched its first National Cybersecurity Plan, establishing a national framework for digital resilience and cybersecurity policy.
  • Microsoft announced plans to deprecate the RC4 encryption cipher, historically exploited for administrative authentication attacks in Windows environments.