Major Incidents or Breaches

  • Ransomware threat actors tracked as Velvet Tempest have been linked to breaches involving the Termite ransomware. They are utilising the ClickFix technique and legitimate Windows utilities to deploy DonutLoader malware and the CastleRAT backdoor.
  • Over 100 GitHub repositories have been identified distributing the BoryptGrab stealer, which targets browser data, cryptocurrency wallets, system information, and user files.
  • Leakbase, a cybercrime forum, was dismantled in an international law enforcement operation.

Notable Threat Actor Activity

  • Velvet Tempest is deploying Termite ransomware through a chain involving ClickFix, DonutLoader, and CastleRAT, leveraging legitimate Windows tools to evade detection.

Trends, Tools, or Tactics of Interest

  • Microsoft reports that threat actors are now abusing artificial intelligence at every stage of cyberattacks, using AI to accelerate attacks, scale operations, and lower technical barriers.
  • The latest YARA-X 1.14.0 release includes four improvements and two bugfixes, enhancing malware detection and analysis capabilities.
  • The BoryptGrab stealer is being widely distributed via public GitHub repositories, highlighting ongoing abuse of developer platforms for malware delivery.

Regulatory or Policy Developments

  • The US has updated its cyber strategy, emphasising stronger deterrence against cyber adversaries, modernisation of federal networks, protection of critical infrastructure, and investment in emerging technologies such as AI and quantum computing.
  • The Pentagon is developing procedures for different levels of autonomy in warfare, reflecting internal debates over the use of AI in autonomous weapons systems.
  • US Customs and Border Protection (CBP) has used online advertising data to track phone locations, raising privacy and surveillance concerns.