Major Incidents or Breaches

  • Optimizely, a New York-based ad tech company, confirmed a data breach following a voice phishing (vishing) attack that led to unauthorised access to customer data.
  • Vanta Diagnostics (formerly Vikor Scientific), a US healthcare diagnostics firm, reported a data breach affecting 140,000 individuals, attributed to the Everest ransomware group.
  • The University of Mississippi Medical Center was forced to close all clinics and cancel elective procedures following a ransomware attack.
  • PayPal disclosed that an application error led to a data breach, exposing customer personal information for nearly six months and resulting in fraudulent transactions.
  • France’s Ministry of Economy disclosed a data breach, as noted in Check Point Research’s latest threat intelligence bulletin.

Newly Discovered Vulnerabilities

  • Two recently patched vulnerabilities in RoundCube Webmail are being actively exploited in the wild, including an XSS flaw via animate tags in SVG documents.
  • Researchers identified multiple security vulnerabilities in Android mental health apps with a combined 14.7 million installs, potentially exposing sensitive medical information.
  • Microsoft is investigating a bug in the classic Outlook desktop client that causes the mouse pointer to disappear for some users.
  • Supply chain attacks continue to be observed in the npm ecosystem, with at least 19 malicious npm packages actively harvesting cryptocurrency keys, CI secrets, and API tokens.
  • Researchers reported ongoing malware campaigns using malicious JPEG files with embedded payloads to deliver MSI installers.

Notable Threat Actor Activity

  • APT28 (Russia-linked) has been attributed to a new campaign targeting Western and Central European entities using webhook-based macro malware.
  • The Iranian state-sponsored group MuddyWater deployed new malware strains in attacks against organizations in the Middle East and Africa.
  • The Everest ransomware group claimed responsibility for the Vanta Diagnostics breach.
  • A Russian-speaking hacker used generative AI to compromise over 600 FortiGate firewalls, targeting credentials and backups for potential ransomware operations.
  • Autonomous AI agents have been leveraged in a new class of supply chain attack targeting crypto wallets.
  • The Shai-Hulud-like npm supply chain campaign is actively spreading through malicious packages.
  • Spanish authorities arrested four alleged members of the Anonymous Fenix hacktivist group for DDoS attacks against government and political websites.
  • A Romanian hacker pleaded guilty to selling access to a US state government network.
  • Oleksandr Didenko, a Ukrainian national, was sentenced in the US for selling stolen identities to North Korean IT workers for use on freelance platforms.

Trends, Tools, or Tactics of Interest

  • There is a surge in ATM jackpotting attacks, with losses exceeding $20 million in 2025; attackers continue to use longstanding tools and tactics.
  • Cryptojacking campaigns are deploying bespoke XMRig miners using pirated software bundles, leveraging BYOVD (Bring Your Own Vulnerable Driver) exploits and time-based logic bombs for lateral movement.
  • Threat actors are increasingly using AI, including generative AI, to automate and scale attacks against exposed infrastructure, such as FortiGate firewalls.
  • Supply chain attacks remain prevalent, with npm and Docker ecosystems being active targets for malware distribution and credential harvesting.
  • Exposed endpoints and internal APIs in LLM (Large Language Model) infrastructure present new attack surfaces for organizations adopting AI technologies.
  • Ongoing campaigns use vishing (voice phishing) and deepfake audio to compromise organisations, as highlighted by the Optimizely breach and industry analysis of AI-generated voice threats.
  • Attackers are exploiting the persistent reuse of trust via stolen tokens and compromised devices, bypassing traditional identity-based security controls.
  • Malicious actors are using typosquatting (e.g., fake Huorong security site) to distribute remote access trojans such as ValleyRAT.

Regulatory or Policy Developments Affecting the Security Industry

  • CISA has ordered US federal agencies to patch actively exploited RoundCube Webmail vulnerabilities within three weeks.
  • The arrest of hacktivists and cybercriminals in Spain, the US, and Romania demonstrates ongoing law enforcement efforts targeting cybercrime and hacktivism.