Major Incidents or Breaches

  • The Illinois Department of Human Services (IDHS) exposed personal and health data of nearly 700,000 residents due to incorrect privacy settings.
  • Gulshan Management Services, a Texas gas station operator, reported a data breach affecting 377,000 individuals following a ransomware attack.
  • An Illinois man has been charged with hacking nearly 600 Snapchat accounts via phishing to steal and sell private photos online.

Newly Discovered Vulnerabilities

  • Trend Micro patched a critical remote code execution vulnerability (CVSS 9.8) in on-premise versions of Apex Central for Windows, which could allow attackers to execute arbitrary code with SYSTEM privileges. Three vulnerabilities were addressed, and proof-of-concept code has been released.
  • VMware ESXi zero-day vulnerabilities have been exploited by threat actors, with evidence that exploits were developed up to a year prior to public disclosure. The flaws allow virtual machine escapes and were initially accessed via a compromised SonicWall VPN appliance.

Notable Threat Actor Activity

  • Russian APT28 (state-sponsored) is conducting credential-stealing campaigns targeting individuals linked to Turkish energy and nuclear research agencies, as well as other policy organizations.
  • Chinese-speaking threat actors exploited VMware ESXi zero-days and used a compromised SonicWall VPN for initial access. Chinese cyberattacks against Taiwan have intensified.
  • North Korean Kimsuky group has been using spear-phishing campaigns featuring malicious QR codes to target government organizations, think tanks, and academic institutions.
  • Threat actors are systematically seeking out misconfigured proxy servers to gain unauthorized access to paid large language model (LLM) services.

Trends, Tools, or Tactics of Interest

  • “ClickFix”/ConsentFix attacks, a form of social engineering using fake prompts (e.g., Cloudflare), are being observed, relying on tricking users into clicking under false pretenses.
  • Researchers demonstrated the “ZombieAgent” attack, which can bypass ChatGPT protections to exfiltrate user data and implant persistent logic in the agent’s memory.
  • Deepfake-enabled fraud tools are increasing in realism and popularity, but defensive measures are currently keeping pace.
  • Email security analysis highlights that post-compromise impact and containment are more critical than traditional “click rate” metrics.
  • Process Environment Block (PEB) manipulation is being used by malware to evade detection and analysis.
  • There is a surge in illicit cryptocurrency transactions, particularly involving nation-state actors from sanctioned countries such as Russia and Iran.

Regulatory or Policy Developments Affecting the Security Industry

  • The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has retired 10 emergency cybersecurity directives issued between 2019 and 2024, as their objectives have been met or are now covered by the Known Exploited Vulnerabilities (KEV) catalog.
  • Microsoft is testing a policy to allow IT administrators to uninstall Copilot on managed devices.
  • The founder of stalkerware provider pcTattletale pleaded guilty in a rare U.S. federal case as authorities increase enforcement actions against stalkerware vendors.
  • Tim Kosiba has been appointed as the new Deputy Director of the U.S. National Security Agency (NSA).