Major Incidents or Breaches

  • Encrypted vault backups stolen during the 2022 LastPass breach have enabled threat actors to compromise weak master passwords and steal cryptocurrency assets, with thefts continuing through 2025.

Newly Discovered Vulnerabilities

  • Fortinet has reported active exploitation of CVE-2020-12812, a five-year-old FortiOS SSL VPN vulnerability that allows two-factor authentication bypass under certain configurations.
  • CISA has added a vulnerability affecting Digiever DS-2105 Pro network video recorders to its Known Exploited Vulnerabilities (KEV) catalogue. This flaw allows remote code execution and is being actively exploited.

Notable Threat Actor Activity

  • Attackers are increasingly leveraging stealth loaders, hijacking legitimate tools, trusted applications, and AI assistants to blend malicious activity with normal operations, complicating detection and response.
  • Cryptocurrency thefts linked to the LastPass breach highlight persistent threat actor interest in exploiting compromised credentials and vault data over extended periods.

Trends, Tools, or Tactics of Interest

  • The threat landscape for industrial automation systems in Q3 2025 shows continued targeting of ICS computers with miners, ransomware, spyware, and other malware, indicating ongoing risk to industrial environments.
  • Attackers are exploiting flaws in AI chatbots and containerisation platforms such as Docker, reflecting a trend towards abusing emerging technologies and infrastructure components in attack chains.