Cybersecurity Brief – 2025-09-25

Thu, 25 Sep 2025 00:00:00 +0000

Major Incidents or Breaches

Boyd Gaming reported a data breach affecting employees and other individuals, as disclosed to the SEC.
A US Federal Civilian Executive Branch (FCEB) agency was breached via exploitation of a critical GeoServer vulnerability (CVE-2024-36401); attackers deployed China Chopper and remote access scripts and remained undetected for three weeks.
European airports experienced widespread disruptions due to a ransomware attack linked to the RTX group; the UK National Crime Agency arrested a suspect in connection with the incident. The attack on Collins Aerospace is believed to have involved HardBit ransomware.
Interpol-led law enforcement seized over $439 million in cash and cryptocurrency from cybercrime rings worldwide during a five-month joint operation.
A record-breaking DDoS attack peaked at 22 Tbps and 10 billion packets per second (Bpps), targeting a European network infrastructure company and linked to the Aisuru botnet.
The Python Package Index (PyPI) urged users to reset credentials following a new wave of phishing attacks using a fake PyPI website.
GitHub users were targeted in a large-scale phishing campaign impersonating Y Combinator via GitHub notifications, delivering cryptocurrency drainers.
KNP Logistics Group, a 158-year-old business, collapsed following a cyber incident attributed to poor password security.

Cisco disclosed a high-severity, actively exploited SNMP vulnerability in IOS and IOS XE Software allowing remote code execution or denial-of-service; patches have been released.
Two critical vulnerabilities were identified in Wondershare RepairIt, exposing private user data and enabling potential tampering with AI models.
Supermicro hardware was found to have two firmware vulnerabilities in its Baseboard Management Controller (BMC), which could allow attackers to create persistent backdoors by updating systems with malicious images.
A flaw in multiple OnePlus OxygenOS versions allows installed apps to access SMS data and metadata without permissions or user interaction; the issue remains unpatched.
Ongoing exploit attempts have been observed against an older Hikvision camera vulnerability.
SonicWall SMA devices were targeted with the ‘OVERSTEP’ backdoor; SonicWall released updates for SMA 100 appliances to remove the malware and improve file checks.

Suspected Chinese threat actors (RedNovember) have been targeting global government and private sector organizations using Pantegana and Cobalt Strike.
UNC5221, believed to be China-nexus, used the BRICKSTORM backdoor to infiltrate US legal, SaaS, BPO, and technology sectors; Google reports the malware has been used for over a year for data theft and persistent espionage.
UNC6148 deployed the OVERSTEP backdoor in ongoing attacks against SonicWall SMA devices, enabling system control, credential theft, and evasion.
A new malware family, YiBackdoor, was discovered with significant code overlap with IcedID and Latrodectus, suggesting shared development or tool reuse.
A new ransomware variant, Obscura, was observed spreading from a victim’s domain controller.
Scattered Spider: A core member surrendered to authorities amid claims of the group’s shutdown; US prosecutors charged a UK national, linking the group to $115 million in ransomware payments.
Russian threat actors conducted a disinformation campaign targeting the upcoming Moldovan elections, linked to previous 2022 operations.
An npm package was found to use steganography (QR codes) to hide a credential-stealing malware, posing a supply chain risk.

Attackers are exploiting payment iframe security weaknesses to deploy malicious overlays on checkout pages, facilitating credit card data theft.
Burp Suite introduced Burp AI, providing on-demand AI assistance for penetration testing workflows.
AI pentesting is emerging, with new agentic capabilities being integrated into security tools.
Kali Linux 2025.3 was released, featuring ten new tools, Nexmon support, and NetHunter improvements.
OpenAI is internally testing a new GPT-5-based AI agent, “GPT-Alpha”.
Police forces are increasingly using drones equipped with license plate recognition technology.
GitHub is implementing enhanced security measures for npm supply chain protection, including mandatory 2FA, short-lived granular tokens, and trusted publishing workflows.

GitHub announced new security requirements for npm package publishing, including mandatory two-factor authentication, expiring granular tokens, and trusted publishing, in response to recent supply chain attacks.