Major Incidents or Breaches

  • Brightspeed, a major US broadband provider, is investigating claims of a security breach and data theft made by the Crimson Collective extortion gang. The group alleges theft of personal information of over 1 million customers.
  • Sedgwick confirmed a cyberattack on a file transfer system at its government subsidiary, affecting agencies it serves.
  • Ledger notified customers of a data breach at third-party payment processor Global-e, resulting in exposure of personal data.
  • Multiple corporate data theft incidents have been linked to threat actor Zestix, who breached ShareFile, Nextcloud, and OwnCloud instances and is offering stolen data from dozens of companies.
  • Artisans’ Bank and VeraBank, two US banks, disclosed security incidents.
  • NordVPN denied breach claims, stating that attackers only accessed dummy data from a third-party automated testing platform.
  • No evidence of cyberattack was found in the communications failure that grounded flights in Greece.

Newly Discovered Vulnerabilities

  • n8n, an open-source workflow automation platform, disclosed a critical vulnerability (CVSS 9.9) allowing authenticated users to execute arbitrary system commands.
  • The “@adonisjs/bodyparser” npm package is affected by a critical vulnerability (CVSS 9.2) enabling arbitrary file writes on servers.
  • A critical ‘MongoBleed’ vulnerability in MongoDB allows unauthenticated attackers to extract passwords and tokens via a memory leak. The flaw is under active attack.
  • VSCode IDE forks, including Cursor, Windsurf, Google Antigravity, and Trae, expose users to attacks via non-existent “recommended extensions” that can be abused for malicious purposes.
  • Risks associated with newer IP-based KVM devices have been highlighted, as out-of-band access could introduce security concerns.
  • WhatsApp metadata leak through device fingerprinting was reported, with Meta rolling out fixes.

Notable Threat Actor Activity

  • Russia-aligned group UAC-0184 targeted Ukrainian military and government entities by delivering malicious ZIP archives via the Viber messaging platform.
  • The Kimwolf Android botnet has infected over 2 million devices, leveraging exposed ADB interfaces and residential proxy networks for DDoS attacks, app installs, and proxy bandwidth resale.
  • Zestix is offering for sale corporate data stolen from cloud file-sharing platforms.
  • The Crimson Collective extortion gang claimed responsibility for the Brightspeed breach.
  • US cyber professionals pleaded guilty to working as affiliates of the ALPHV/BlackCat ransomware group.
  • The RondoDox botnet has expanded operations by exploiting React2Shell vulnerabilities, targeting Next.js servers for cryptomining and botnet payload delivery.
  • New VVS Stealer malware, written in Python, is targeting Discord accounts to harvest credentials and tokens.

Trends, Tools, or Tactics of Interest

  • The ClickFix social engineering campaign is targeting the European hospitality sector, using fake Windows Blue Screen of Death (BSOD) screens to trick users into executing malware.
  • Threat actors are increasingly abusing cloud file-sharing platforms for corporate data theft.
  • The Kimwolf botnet demonstrates the growing use of residential proxy networks for botnet expansion and monetization.
  • AI-powered IDEs recommending non-existent extensions present a new supply chain risk vector.
  • Agentic AI adoption is raising identity management challenges, with AI agents acting as a new class of identity that CISOs must manage.
  • CISA’s Known Exploited Vulnerabilities (KEV) catalog expanded by 20% in 2025, now including 1,484 entries, with 24 new vulnerabilities known to be exploited by ransomware groups.
  • Automated License Plate Reader (ALPR) surveillance is discussed as a privacy and security concern.
  • Ineffectiveness of AI guardrails was highlighted following an incident involving Grok generating inappropriate content.

Regulatory or Policy Developments Affecting the Security Industry

  • The early release of Ilya Lichtenstein, convicted for the Bitfinex cryptocurrency exchange hack, under the US First Step Act, was reported.