Major Incidents or Breaches

  • The Crimson Collective extortion group claims to have stolen data on over one million Brightspeed broadband customers. Brightspeed is investigating the alleged breach.
  • Chrome extensions impersonating AITOPIA, with a combined 900,000 downloads, were found exfiltrating users’ AI chat data and browser activity.
  • Logitech Options+ and G Hub apps for macOS became non-functional after their code-signing certificate expired, preventing users from launching the applications.
  • Multiple enterprises’ file-sharing instances were breached by the “Zestix” threat actor using infostealers to obtain credentials; lack of multi-factor authentication (MFA) was identified as a common vulnerability.
  • ownCloud issued a warning to users to enable MFA following reports of credential theft and unauthorised data access.

Newly Discovered Vulnerabilities

  • A critical unauthenticated remote code execution (RCE) vulnerability (CVSS 10.0, dubbed “Ni8mare”) was disclosed in n8n, a popular workflow automation platform, affecting both self-hosted and cloud deployments.
  • Veeam released patches for several vulnerabilities in its Backup & Replication software, including a critical RCE flaw (CVSS 9.0) that could allow attackers to compromise backup servers.
  • jsPDF, a widely used JavaScript PDF generation library, is affected by a critical vulnerability allowing attackers to steal sensitive local files via maliciously crafted PDFs.
  • A vulnerability in Totolink range extenders enables unauthenticated attackers to start a root-level Telnet service and take over affected devices.
  • A zero-day vulnerability in discontinued D-Link DSL routers is being actively exploited to execute arbitrary commands remotely on unpatched devices.
  • CISA added actively exploited vulnerabilities in Microsoft Office and HPE OneView to its Known Exploited Vulnerabilities Catalog, urging immediate remediation.

Notable Threat Actor Activity

  • North Korean threat actor Kimsuky is distributing mobile malware via phishing sites that use QR codes, targeting users to install malicious apps.
  • The Black Cat cybercrime group is running an SEO poisoning campaign, creating fraudulent sites advertising popular software to deliver malware to users searching for legitimate downloads.
  • The pro-Russian hacktivist group NoName057(16) continues to leverage its DDoSia tool to coordinate volunteer-driven DDoS attacks against government, media, and institutional targets associated with Ukraine and Western countries.
  • The “Zestix” actor used infostealers to compromise cloud credentials and breach approximately 50 enterprise file-sharing environments.
  • GoBruteforcer botnet activity is increasing, targeting crypto and blockchain projects by brute-forcing exposed databases on servers often configured with weak, AI-generated default credentials.
  • Threat actors are exploiting complex email routing scenarios and misconfigured spoof protections to impersonate internal domains in phishing campaigns, particularly targeting Microsoft Office 365 tenants with weak configurations.

Trends, Tools, or Tactics of Interest

  • QR code-based phishing is being actively observed, with attackers embedding QR codes in emails and web pages to lure victims into installing malware or visiting phishing sites.
  • There is a rise in phishing attacks exploiting email routing misconfigurations and insufficient anti-spoofing controls, enabling domain impersonation and internal phishing.
  • Cybercriminals are increasingly adopting AI to automate and scale attacks, including “vibe hacking” and the use of tools like “HackGPT” in underground forums, reducing the technical barrier to entry for threat actors.
  • AI-generated server configuration examples are contributing to insecure deployments, as seen in GoBruteforcer campaigns targeting databases with weak or default passwords.
  • Affiliate-driven hacktivist campaigns, such as those orchestrated by NoName057(16) with DDoSia, are enabling coordinated volunteer attacks at scale.
  • Non-human (AI/automation) entities are becoming integral to cybersecurity operations, increasing the attack surface and requiring new approaches to identity and access management.

Regulatory or Policy Developments

  • The UK government announced a new cybersecurity strategy backed by over £210 million to strengthen cyber defences across public sector organisations and government departments.
  • OpenAI confirmed that health information shared with ChatGPT Health will not be used to train its models, addressing privacy concerns related to health data.