Major Incidents or Breaches

  • LexisNexis has confirmed a data breach after hackers leaked files containing approximately 400,000 personal information records. Attackers claim to have stolen 2GB of data.
  • The University of Mississippi Medical Center (UMMC) resumed operations after a ransomware attack that disrupted access to electronic medical records and IT systems for nine days.
  • LeakBase, one of the largest online cybercrime forums for trading stolen data and cybercrime tools, was seized by the FBI and Europol. Data of 142,000 members was reportedly obtained.
  • Customers of restaurants using the HungerRush POS platform received mass extortion emails from a threat actor threatening to leak restaurant and customer data.
  • A significant increase in hacktivist DDoS attacks was recorded, with 149 attacks affecting 110 organisations in 16 countries, following coordinated military action in the Middle East.

Newly Discovered Vulnerabilities

  • Google patched 129 Android vulnerabilities, including a high-severity, actively exploited flaw in a Qualcomm component affecting Android devices.
  • The FreeScout helpdesk platform is affected by a maximum severity vulnerability (“Mail2Shell”) enabling unauthenticated, zero-click remote code execution on mail servers.
  • Cisco released patches for two maximum-severity vulnerabilities in Secure Firewall Management Center (FMC) software, which could allow remote attackers to gain root access.
  • VMware Aria Operations is being actively exploited via a command injection vulnerability, allowing attackers broad access to cloud environments.
  • Fake Laravel PHP packages on Packagist were found to deploy a cross-platform remote access trojan (RAT) affecting Windows, macOS, and Linux systems.

Notable Threat Actor Activity

  • The Coruna (CryptoWaters) iOS exploit kit, originally linked to Russian state actors, is now being used by multiple threat actors for targeted espionage and financially motivated attacks, including crypto theft. The kit leverages 23 exploits across five exploit chains, targeting iOS 13.0 to 17.2.1.
  • APT41-linked “Silver Dragon” group has been targeting government entities in Europe and Southeast Asia, using phishing for initial access and legitimate network services for command and control, including Cobalt Strike and Google Drive.
  • Attackers are abusing OAuth’s built-in redirect mechanisms to send users from legitimate Microsoft or Google login pages to phishing or malware sites.
  • XWorm malware continues to circulate with evolving delivery techniques, indicating ongoing adaptation by threat actors.
  • A brute force attack on RDP led to the discovery of a geo-distributed VPN-linked infrastructure supporting ransomware-as-a-service operations.

Trends, Tools, or Tactics of Interest

  • Mobile malware continues to evolve, with notable threats in 2025 including preinstalled Android backdoors (Keenadu, Triada), spyware trojans, the Kimwolf IoT botnet, and Mamont banking trojans.
  • Phishing attacks have surged 400% year over year, with corporate users increasingly targeted. Recent campaigns include SMS-based tax scams (e.g., TurboTax) and sophisticated phishing targeting LastPass users with fake support emails.
  • Managed Detection and Response (MDR) is highlighted as a critical tool for protecting educational institutions, which remain under-resourced but heavily targeted.
  • Attackers are increasingly leveraging pirated software as a vector for malware delivery, turning employees seeking free software into unwitting malware distributors.
  • Abuse of OAuth redirection and phishing-as-a-service platforms such as Tycoon 2FA (now dismantled) demonstrate continued innovation in phishing tactics.

Regulatory or Policy Developments Affecting the Security Industry

  • Europol coordinated the takedown of the Tycoon 2FA phishing-as-a-service platform, which had enabled adversary-in-the-middle credential harvesting attacks at scale, reportedly targeting over 500,000 organisations monthly.
  • Zurich Insurance announced the acquisition of Beazley in an $11 billion deal, positioning Zurich as a leader in the cyberinsurance market, pending regulatory approval.
  • Google will move Chrome to a two-week release cycle starting September 2026.
  • A new RFP template for AI usage control and AI governance has been released, reflecting increased focus and budget allocation for AI security in enterprises.
  • Reports regarding a potential UK ban on VPNs have been described as exaggerated, with technical and legal feasibility questioned.