Cybersecurity Brief – 2025-09-17

Wed, 17 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Jaguar Land Rover has extended its production shutdown for another week following a significant cyberattack that impacted systems at the end of August.
The US Department of Homeland Security exposed sensitive national security intelligence, including surveillance data on Americans, to thousands of unauthorized users due to a misconfigured data hub.
The RaccoonO365 phishing network, responsible for large-scale phishing campaigns, was dismantled following a joint operation by Microsoft and Cloudflare, resulting in the takedown of 338 malicious domains.
Google has removed 224 Android applications involved in the “SlopAds” ad fraud operation, which generated 2.3 billion ad requests daily and affected 38 million downloads globally.
At least 187 npm packages were compromised in a self-propagating supply chain attack, dubbed ‘Shai-Hulud’, which stole developer credentials and spread malware through infected packages.
The BreachForums hacking forum administrator, Conor Brian Fitzpatrick, was resentenced to three years in prison for cybercrime charges, including the operation of the forum and possession of CSAM.

Apple released security updates for iOS, macOS, and older iPhone/iPad models, addressing over 50 vulnerabilities, including CVE-2025-43300, an out-of-bounds flaw actively exploited in sophisticated spyware attacks.
Multiple critical vulnerabilities were disclosed in Chaos Mesh, a chaos engineering platform for Kubernetes, allowing for remote code execution and potential full cluster takeover.
A new Rowhammer attack, named Phoenix, was demonstrated against DDR5 memory, achieving root access on systems in under two minutes.
ChatGPT’s new calendar integration was shown to be exploitable for email exfiltration via crafted calendar invites.

RevengeHotels, an established cybercrime group, has launched a new campaign in Latin America leveraging large language models (LLMs) to generate malicious scripts and using VenomRAT in targeted phishing attacks.
The North Korean group Kimsuky used ChatGPT to create deepfake military ID documents in attempts to compromise South Korean targets.
A new FileFix variant is delivering the StealC infostealer malware through multilingual phishing sites, using code obfuscation and steganography, and impersonating Meta account suspension warnings.
The Yurei ransomware group, believed to operate from Morocco, has claimed its first victims using a modified Prince-Ransomware binary.
The SlopAds fraud ring exploited commercial adtech infrastructure, including links to PropellerAds, to orchestrate its global ad fraud operation.
Security industry experts remain skeptical of claims by Scattered Spider and ShinyHunters that they are retiring, suggesting continued threat activity is likely.

Shadow AI threats are increasing, with reports highlighting the use of generative AI and autonomous agents in both attacks and enterprise workflows.
Phishing-as-a-service operations, such as RaccoonO365, continue to leverage large-scale domain infrastructure for credential theft.
Supply chain attacks targeting open-source repositories (npm) are increasingly employing self-replicating, worm-like malware to propagate and exfiltrate credentials.
AI chatbots, including ChatGPT and Grok, are being used to generate phishing emails and malicious code, with a noted focus on targeting vulnerable populations such as senior citizens.
Children and teenagers are increasingly involved in hacking school systems, often underestimating the consequences.
The FileFix campaign demonstrates advanced social engineering, using multilingual phishing, steganography, and code obfuscation.
The removal of WMIC (Windows Management Instrumentation Command-line) tool is planned for Windows 11 25H2 and later, impacting system administration and automation practices.
The emergence of new security solutions focused on AI agent management (Astrix), browser security (Neon Cyber), and real-time, AI-driven data protection (Ray Security) reflects a shift toward addressing AI-native and browser-based threats.

CrowdStrike announced the acquisition of Pangea to launch AI Detection and Response (AIDR), expanding protection for enterprise AI models and applications.
Check Point is acquiring AI security firm Lakera, underlining growing industry demand for AI-native security solutions amid increased generative AI adoption.
Apple’s backporting of zero-day patches to older devices addresses ongoing exploitation concerns and highlights regulatory and customer pressure for extended device support.