Major Incidents or Breaches#

  • Bitcoin Depot Hack

    • Bitcoin Depot, a major Bitcoin ATM operator, reported a breach in which attackers stole approximately $3.665 million from its crypto wallets. Attackers gained access to credentials and transferred over 50 bitcoins out of company wallets.

  • Massachusetts Hospital Cyberattack

    • Signature Healthcare in Massachusetts experienced a cyberattack that forced ambulance diversions, cancellation of some services, and disruption of pharmacy operations.

  • Zendesk Ticket Theft by UNC6783

    • Threat actor UNC6783 compromised business process outsourcing (BPO) providers to steal corporate Zendesk support tickets from high-value companies across multiple sectors.

  • Magento E-commerce Card Skimming Campaign

    • Nearly 100 online stores running the Magento platform were impacted by a campaign embedding credit card-stealing code within a pixel-sized SVG image.

  • TeamPCP Supply Chain Attack Update

    • TeamPCP supply chain campaign update reveals Cisco source code was stolen via a breach linked to the Trivy security scanner. Google GTIG tracks the group as UNC6780.

Newly Discovered Vulnerabilities#

  • Apache ActiveMQ Classic RCE Vulnerability

    • A remote code execution vulnerability, present for 13 years in Apache ActiveMQ Classic, was disclosed. The flaw requires authentication for exploitation, but another related issue exposes the Jolokia API without authentication.

  • Ninja Forms WordPress Plugin

    • A critical vulnerability in the Ninja Forms plugin allows attackers to upload arbitrary files to WordPress servers, leading to potential remote code execution and site takeover.

  • OpenSSL Vulnerabilities

    • Seven vulnerabilities, including a data leakage flaw, were patched in OpenSSL. Most of these could be exploited for denial-of-service attacks.

  • Ivanti Endpoint Manager Mobile (EPMM)

    • CISA ordered U.S. federal agencies to patch a critical Ivanti EPMM vulnerability being actively exploited since January.

Notable Threat Actor Activity#

  • APT28 (Forest Blizzard)

    • APT28 deployed the previously undocumented PRISMEX malware in spear-phishing campaigns targeting Ukraine and NATO allies.
    • The group exploited vulnerable TP-Link and MikroTik SOHO routers to hijack DNS settings, enabling adversary-in-the-middle (AitM) espionage operations. U.S. authorities disrupted this operation.

  • Iranian State-Linked Actors

    • Iranian threat actors compromised Internet-facing OT devices, including exposed PLCs, to disrupt U.S. critical infrastructure. Attacks resulted in file/display manipulation, operational disruption, and financial losses.

  • Masjesu DDoS Botnet

    • The Masjesu botnet emerged as a DDoS-for-hire service targeting global IoT devices. The botnet is advertised via Telegram, focuses on persistence, and avoids widespread infection as well as blacklisted IPs and critical infrastructure.

  • UNC6783

    • Actively targeting BPO providers to access sensitive corporate support data, notably Zendesk tickets.

  • Russian State-Backed Router Hijacking

    • Ongoing campaigns by Russian actors (APT28) targeting home and small office routers for espionage through DNS hijacking, as warned by the FBI, NCSC, and Microsoft.

  • Voice Phishing (Vishing)

    • Vishing has overtaken email-based phishing as the leading initial intrusion vector in 2025, with attackers leveraging live, interactive social engineering.

  • Financial Cyberthreats

    • Kaspersky’s report highlights continued growth in phishing, PC malware, and infostealers targeting financial institutions. Regional differences in attack vectors and malware prevalence are noted for 2025 and projected into 2026.

  • Emojis in Threat Actor Communications

    • Threat actors are increasingly using emojis in covert communications to evade detection by automated filters.

  • Steganography in Web Skimming

    • Attackers are hiding card-skimming code in pixel-sized SVG images to evade detection on Magento e-commerce sites.

  • macOS ClickFix Attack Variant

    • New campaign delivers Atomic Stealer malware to macOS users by abusing the Script Editor in a variation of the ClickFix attack, tricking users into executing malicious Terminal commands.

  • Cloud-Targeting Malware

    • A new Chaos malware variant targets misconfigured cloud deployments and includes SOCKS proxy capabilities, expanding its botnet infrastructure.

  • Automated Vulnerability Discovery

    • Anthropic’s Project Glasswing, using the Claude Mythos AI model, identified thousands of zero-day vulnerabilities across major systems, signaling a shift toward AI-led vulnerability discovery.

  • Password Cracking Hardware

    • Analysis shows high-end AI GPUs do not outperform consumer GPUs for password cracking, indicating that attackers continue to rely on accessible hardware to break weak passwords.

  • Honeypot Fingerprinting

    • Attackers are increasingly able to detect honeypots, reducing their effectiveness in threat intelligence gathering.

Regulatory or Policy Developments#

  • CISA Emergency Directive

    • CISA mandated U.S. federal agencies to patch the exploited Ivanti EPMM vulnerability within four days.

  • FBI Cybercrime Report

    • The FBI reported nearly $21 billion in cybercrime losses for 2025, with over 1 million complaints. Investment fraud, business email compromise, and tech support scams were the top causes of financial loss.

  • HackerOne Bug Bounty Pause

    • HackerOne paused bug bounty programs due to an “AI-led remediation crisis,” as the bottleneck has shifted from discovery to remediation in open source projects following the rise of automated vulnerability discovery.

Other Noteworthy Items#

  • Credential Leakage via Browser Extensions

    • Research highlights that browser extensions can leak user information, which can be exploited by advertisers and scammers.

  • Mobile Fraud Surge in Latin America

    • Cyber-fraud in mobile-first Latin America is increasing, with rapid movement from device compromise to account takeover and funds transfer, often before financial institutions can intervene.

  • Supply Chain Security

    • The TeamPCP campaign demonstrates ongoing risks in the software supply chain, with security scanners weaponized for source code theft.

  • Timeshare Scams

    • Authorities warn of cartel-linked advance-fee fraud schemes targeting timeshare owners.