Major Incidents or Breaches

  • The European Space Agency (ESA) confirmed a breach of external servers containing unclassified information related to collaborative engineering and project management activities. The compromised systems were outside ESA’s corporate network.
  • Korean Air reported that data belonging to approximately 30,000 employees was stolen following a breach at its former subsidiary KC&D, which was linked to an Oracle E-Business Suite (EBS) hack.
  • Two former employees of cybersecurity incident response firms Sygnia and DigitalMint pleaded guilty to conducting BlackCat (ALPHV) ransomware attacks against U.S. companies in 2023.

Newly Discovered Vulnerabilities

  • The Cyber Security Agency of Singapore (CSA) issued an alert regarding a critical remote code execution vulnerability in SmarterTools SmarterMail email software. The flaw is rated maximum severity and can be exploited for full compromise.
  • CISA ordered U.S. federal agencies to patch the actively exploited MongoBleed vulnerability in MongoDB, which can be used to steal credentials, API keys, and other sensitive data.

Notable Threat Actor Activity

  • The Chinese APT Mustang Panda was observed deploying a previously undocumented, signed kernel-mode rootkit driver to load a new variant of the TONESHELL backdoor. The driver contains user-mode shellcodes for execution.
  • The threat actor Silver Fox has shifted focus to India, conducting phishing campaigns using income tax-themed lures to deliver the ValleyRAT (Winos 4.0) modular remote access trojan.

Trends, Tools, or Tactics of Interest

  • Researchers at Push Security identified a new “ConsentFix” technique that blends OAuth consent phishing with ClickFix-style prompts, enabling attackers to trick users into handing over OAuth tokens and compromise accounts.
  • A new cybercrime service, ErrTraffic, is automating ClickFix attacks by generating fake browser glitches on compromised websites, luring users into downloading malicious payloads or following malicious prompts.
  • A campaign dubbed Zoom Stealer has been detected, in which 18 malicious browser extensions targeting Chrome, Firefox, and Edge have affected 2.2 million users. The extensions harvest online meeting data, including corporate meeting intelligence.
  • Analysis of cyber-insurance claims data identified six cybersecurity technologies that are most effective in reducing losses and are recommended for deployment by 2026.
  • The rapid deployment of artificial intelligence (AI) in security operations is exposing new risks, with practitioners struggling to consistently operationalise AI while maintaining security.

Regulatory or Policy Developments

  • The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) lifted sanctions on three individuals previously linked to the Intellexa Consortium, the commercial spyware vendor behind Predator spyware.
  • The total disclosed value of cybersecurity M&A deals in 2025 exceeded $84 billion, with eight acquisitions surpassing the $1 billion mark.