Major Incidents or Breaches

  • Ingram Micro disclosed that a ransomware attack in July 2025 resulted in a data breach affecting over 42,000 individuals, with compromised data including names, dates of birth, Social Security numbers, and employment-related information.
  • A Fortune 100 company in the finance sector was targeted by ransomware attackers, who deployed a new malware strain named PDFSider to deliver malicious payloads on Windows systems.
  • Spanish energy company Endesa reported a data breach, as noted in Check Point’s latest threat intelligence report.
  • A Tennessee man pleaded guilty to hacking the U.S. Supreme Court’s electronic filing system and breaching accounts at AmeriCorps and the Department of Veterans Affairs, subsequently leaking stolen Supreme Court data on Instagram.

Newly Discovered Vulnerabilities

  • A hardware vulnerability, codenamed StackWarp, was disclosed affecting AMD Zen 1–5 CPUs. The flaw breaks Secure Encrypted Virtualization – Secure Nested Paging (SEV-SNP) protections, potentially undermining the security guarantees of AMD’s confidential computing technology.
  • TP-Link patched a vulnerability in its VIGI security cameras that exposed over 2,500 internet-facing devices to remote hacking risks.
  • Cybersecurity researchers disclosed an indirect prompt injection flaw in Google Gemini, which allowed attackers to bypass authorization guardrails and access private Google Calendar data via malicious calendar invites.

Notable Threat Actor Activity

  • The UK government issued warnings regarding ongoing attacks by Russian-aligned hacktivist groups targeting UK critical infrastructure and local government organisations with disruptive activities.
  • A Jordanian national pleaded guilty in US court to operating as an access broker, selling unauthorized access to at least 50 corporate networks.
  • Researchers identified a new information stealer dubbed SolyxImmortal, which abuses legitimate APIs and libraries to exfiltrate data via Discord webhooks.
  • A campaign named KongTuke was observed using a malicious Chrome extension, CrashFix, which masquerades as an ad blocker and intentionally crashes browsers to facilitate further malware installation via ClickFix-style lures.
  • Additional malvertising campaigns were reported using fake ad blocker extensions (e.g., NexShield) on Chrome and Edge to crash browsers and launch ClickFix attacks.
  • New sleeper browser extensions were found spying on users and installing backdoors, now targeting Firefox in addition to Chrome and Edge.

Trends, Tools, or Tactics of Interest

  • The emergence of PDFSider malware highlights the continued use of custom payloads by ransomware groups targeting large enterprises.
  • The use of browser extensions (CrashFix, NexShield) as vectors for malvertising and malware delivery is increasing, with attackers employing browser crashes as part of social engineering tactics.
  • Threat actors are leveraging Discord webhooks for data exfiltration, as seen with the SolyxImmortal information stealer.
  • Indirect prompt injection attacks targeting AI assistants (e.g., Google Gemini) are being actively researched and exploited as a means to bypass security controls and access sensitive data.
  • Sleeper extensions that remain dormant before activating malicious behaviour are being deployed across multiple browsers, broadening the attack surface for user surveillance and backdoor installation.

Regulatory or Policy Developments Affecting the Security Industry

  • The UK government’s public warning about Russian hacktivist group activity signals heightened concern over threats to national critical infrastructure and may prompt increased defensive measures and reporting requirements across the sector.