Security. In focus.

VIPRE’s Email ThreatTrends Report: Q2 2025 - VIPRE

VIPRE’s Q2 2025 Email Threat Landscape Report highlights a rise in personalized and regionally nuanced email threats, particularly targeting manufacturing, retail, and healthcare sectors. Phishing, BEC, and malware campaigns are increasingly customized, with callback phishing and Lumma Stealer emerging as prevalent threats. Organizations must adapt their security strategies to combat these evolving, AI-fueled threats.

Nation-state group CL-STA-0969 targeted Southeast Asian telecoms in 2024

Nation-state actor CL-STA-0969 targeted Southeast Asian telecoms from February to November 2024, exploiting vulnerabilities and using custom tools for covert access and command-and-control. The group, linked to Liminal Panda, demonstrated a deep understanding of telecom environments, using techniques like DNS tunneling and process disguising to maintain stealth. Despite no evidence of data exfiltration, the group’s actions highlight the need for vigilant security measures in the telecom sector.

Inside Storm-2603: The Ransomware Operator Behind ToolShell’s Shadow

Check Point Research investigated the ransomware operator Storm-2603, linked to the ToolShell exploitation campaign. Storm-2603, active in Latin America and APAC, uses a hybrid approach combining APT and ransomware tactics. The group employs a custom C2 framework, AK47C2, and deploys multiple ransomware strains, including LockBit Black and Warlock, often in tandem.

CrowdStrike 2025 Threat Hunting Report: AI Becomes a Weapon and a Target

The CrowdStrike 2025 Threat Hunting Report highlights adversaries’ evolving use of AI, a rise in cloud-focused intrusions, and a “long game” approach to cyberattacks. Threat actors are weaponizing AI to scale operations, automate tasks, and target AI agents, while cross-domain attacks are becoming the norm, bypassing traditional security defenses. The report also notes an increase in malware-free intrusions, eCrime activity, and voice phishing, impacting various sectors, including government.

AI Still Writing Vulnerable Code www.databreachtoday.com/ai-still-…

Artificial intelligence may be writing more of today’s code, but it’s also writing in vulnerabilities. Large language models introduce vulnerabilities in nearly half of test cases when asked to complete secure code tasks, say researchers. There’s been little improvement in how well AI models handle core security decisions, says a report from application security company Veracode.

AI models are getting better at writing syntactically correct code, but not at writing secure code, the report finds. “LLMs are fantastic tools for developing software, but blind faith is not the way to go,” Veracode CTO Jens Wessling told Information Security Media Group.

Veracode analyzed 80 curated coding tasks drawn from well-established common weakness enumeration classifications, including SQL injection, cryptographic weaknesses, cross-site scripting and log injection, each representing risks ranked on the OWASP Top 10. Veracode tested over 100 LLMs across these tasks, using static analysis to assess outcomes. The results confirm what many security teams suspected: GenAI is transforming the pace of development, but it is not yet reliable when it comes to risk.

IR Trends Q2 2025: Phishing attacks persist as actors leverage compromised valid accounts to enhance legitimacy blog.talosintelligence.com/ir-trends…

Phishing remained the top method of initial access this quarter, appearing in a third of all engagements – a decrease from 50 percent last quarter. Threat actors largely leveraged compromised internal or trusted business partner email accounts to deploy malicious emails, bypassing security controls and gaining targets’ trust. Interestingly, the objective of the majority of observed phishing attacks appeared to be credential harvesting, suggesting cybercriminals may consider brokering compromised credentials as simpler and more reliably profitable than other post-exploitation activities, such as engineering a financial payout or stealing proprietary data.

Ransomware and pre-ransomware incidents made up half of all engagements this quarter, similar to last quarter. Cisco Talos Incident Response (Talos IR) responded to Qilin ransomware for the first time, identifying previously unreported tools and tactics, techniques, and procedures (TTPs), including a new data exfiltration method. Our observations of Qilin activity indicate a potential expansion of the group and/or an increase in operational tempo in the foreseeable future, warranting this as a threat to monitor. Additionally, ransomware actors leveraged a dated version of PowerShell, PowerShell 1.0, in a third of ransomware and pre-ransomware engagements this quarter, likely to evade detection and gain more flexibility for their offensive capabilities.

New Linux backdoor Plague bypasses auth via malicious PAM module

A new Linux backdoor, Plague, disguised as a malicious PAM module, bypasses authentication and grants persistent SSH access. It uses advanced obfuscation, anti-debugging features, and sanitizes session traces to evade detection. The attribution of the Plague backdoor is still unknown.

Anthropic Filesystem MCP Server: Directory Access Bypass via Improper Path Validation · Embrace The Red

A vulnerability in Anthropic’s Filesystem MCP Server allowed AI access to files and directories beyond the intended scope due to improper path validation. The issue, reported in June 2025, was fixed in a subsequent release.

Lionishackers Threat Actors Exfiltrating and Selling Corporate Databases on Dark Web

Lionishackers, a financially motivated threat actor, breaches database servers using automated SQL injection tools, exfiltrates sensitive data, and sells it on the dark web. Their tactics, which include exploiting SQL injection vulnerabilities and deploying lightweight backdoors, highlight the growing potency of database-focused cybercrime. The group’s impact spans various industries, including government, telecommunications, and gambling, with stolen data posing risks of identity theft and corporate espionage.

CL-STA-0969 Installs Covert Malware in Telecom Networks During 10-Month Espionage Campaign

A state-sponsored threat actor, CL-STA-0969, targeted telecommunications organizations in Southeast Asia, deploying malware to enable remote control and collect location data. The attacks, which occurred between February and November 2024, utilized various tools and techniques to maintain stealth and evade detection. While no data exfiltration was observed, the threat actor’s actions demonstrate a deep understanding of telecommunications protocols and infrastructure.

Critical OAuth2-Proxy Vulnerability (CVE-2025-54576) Lets Attackers Bypass Authentication - SOCRadar® Cyber Intelligence Inc.

A critical vulnerability (CVE-2025-54576) in OAuth2-Proxy allows attackers to bypass authentication by manipulating query parameters in protected URLs. The issue is resolved in version v7.11.0, and users are advised to upgrade or audit their configurations to mitigate the risk.

What Singapore’s First Public Cyber Attribution Tells Us | Royal United Services Institute

Singapore’s Coordinating Minister for National Security publicly attributed cyberattacks on the country’s critical infrastructure to Chinese-linked APT group UNC3886, marking the first time Singapore has publicly named a cyber threat actor targeting the nation. Minister K Shanmugam’s carefully worded attribution during the Cyber Security Agency’s 10th anniversary dinner represents a strategic “naming without fully naming” approach, referencing the Mandiant-designated threat actor rather than explicitly naming China while making the implications clear to cybersecurity professionals. This calibrated move reflects Singapore’s broader foreign policy of hedging between maintaining strong economic ties with China and asserting sovereignty over cyber incidents that target vital infrastructure capable of espionage and major disruption. The attribution follows previous testing of public communication strategies through references to other incidents like the Viasat satellite hack, demonstrating how small digitally-advanced states navigate cyber attribution by balancing deterrence messaging with diplomatic preservation in geopolitically complex regions.​​​​​​​​​​​​​​​​

New ‘Shade BIOS’ Technique Beats Every Kind of Security www.darkreading.com/endpoint-…

Researchers have developed a method for running malware in a computer’s BIOS — a place where no security software can reach.

At Black Hat 2025, Kazuki Matsuo, a security researcher at FFRI Security, will detail the technique he and his colleagues call “Shade BIOS.” Unlike with traditional UEFI rootkits and bootkits, Shade BIOS distinguishes itself by requiring essentially zero interaction with an operating system (OS). Thus, it allows an attacker to perform malicious functions from beyond where any antivirus, endpoint or extended detection and response (EDR/XDR), or operating system security tools can see or touch.

The Unified Extensible Firmware Interface (UEFI), successor to the Basic Input/Output System (BIOS), is an industry-wide specification for connecting a computer’s firmware with its operating system. Advanced cyberattackers sometimes target UEFI because it runs before a computer’s actual operating system on startup. Preempting the OS allows malware to establish a gnarly degree of persistence — irrespective of reboots, reinstalling the OS, etc. — and helps it get a head start on disabling security programs before they load.

Microsoft OAuth App Impersonation Campaign Leads to MFA Phishing www.proofpoint.com/us/blog/t…

Proofpoint has identified a cluster of activity using Microsoft OAuth application creation and redirects that lead to malicious URLs enabling credential phishing. The fake Microsoft 365 applications impersonate various companies including RingCentral, SharePoint, Adobe, and DocuSign. Proofpoint first observed this activity in early 2025 and remains ongoing.

The goal of the campaigns is to use OAuth applications as a gateway lure to conduct other activities, mostly to obtain access to Microsoft 365 accounts via MFA phishing. The phishing campaigns leverage multifactor authentication (MFA) attacker-in-the-middle (AiTM) phishing kits, predominately Tycoon. Such activity could be used for information gathering, lateral movement, follow-on malware installation, or to conduct additional phishing campaigns from compromised accounts.

Proofpoint has observed this technique in email campaigns with over 50 impersonated applications, and multiple different phishing kits using this attack chain including Tycoon and ODx. Proofpoint threat researchers have seen a smaller number of observed applications and follow-on activity in cloud threat data. Proofpoint reported the observed apps to Microsoft.

Notably, in June 2025, Microsoft announced it is updating default settings in Microsoft 365 by “blocking legacy authentication protocols and requiring admin consent for third-party app access. Changes start mid-July 2025 and complete by August 2025.” This update will have a positive impact on the landscape overall and will hamstring threat actors that use this technique.

Pi-hole discloses data breach triggered by WordPress plugin flaw www.bleepingcomputer.com/news/secu…

Pi-hole, a popular network-level ad-blocker, has disclosed that donor names and email addresses were exposed through a security vulnerability in the GiveWP WordPress donation plugin. Pi-hole acts as a DNS sinkhole, filtering out unwanted content before it reaches the users' devices. While initially designed to run on Raspberry Pi single-board computers, it now supports various Linux systems on dedicated hardware or virtual machines.

The organization stated that they first learned of the incident on Monday, July 28, after donors began reporting that they were receiving suspicious emails at addresses used exclusively for donations. As explained in a Friday post-mortem, the breach affected users who donated through the Pi-hole website’s donation form to support development, exposing personal information that was visible to anyone who viewed the webpage’s source code due to a GiveWP security flaw.

China says US spies exploited Microsoft Exchange zero-day to steal military info www.theregister.com/2025/08/0…

China has accused US intelligence agencies of exploiting a Microsoft Exchange zero-day exploit to steal defense-related data and take over more than 50 devices belonging to a “major Chinese military enterprise” for nearly a year. In a Thursday alert, the National Computer Network Emergency Response Technical Team / Coordination Center of China (CNCERT/CC), a group which claims that it is non-governmental, said American cyberattacks against Chinese high-tech, defense-related universities, research institutes, and enterprises “have become more targeted and their methods, more covert.”

These data-stealing campaigns pose “a serious threat to the scientific research and production security of China’s defense and defense industries, and even to national security,” the alert continues. The US National Security Agency did not immediately respond to The Register’s inquiries.

Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations research.checkpoint.com/2025/befo…

Check Point Research (CPR) conducted a focused analysis of Storm-2603, a threat actor associated with recent ToolShell exploitations, together with other Chinese APT groups. Storm-2603 utilizes a custom malware Command and Control (C2) framework dubbed internally by the attacker as “ak47c2”. This framework includes at least two different types of clients: HTTP-based (dubbed by us “ak47http”) and DNS-based (dubbed by us “ak47dns”).

Based on VirusTotal data, Storm-2603 likely targeted some organizations in Latin America throughout the first half of 2025, in parallel to attacking organizations in APAC. Some of the actor’s TTPs align with many other ransomware groups, and involve open-source tools such as PsExec and masscan. In addition, the threat actors use a custom tool that leverages the BYOVD (Bring Your Own Vulnerable Driver) technique to tamper with endpoint protections. Storm-2603 attacks involved multiple ransomware families, sometimes bundled together. Those are commonly deployed by abusing DLL hijacking.

SonicWall firewall devices hit in surge of Akira ransomware attacks www.bleepingcomputer.com/news/secu…

SonicWall firewall devices have been increasingly targeted since late July in a surge of Akira ransomware attacks, potentially exploiting a previously unknown security vulnerability, according to cybersecurity company Arctic Wolf. Akira emerged in March 2023 and quickly claimed many victims worldwide across various industries. Over the last two years, Akira has added over 300 organizations to its dark web leak portal and claimed responsibility for multiple high-profile victims, including Nissan (Oceania and Australia), Hitachi, and Stanford University.

The FBI says the Akira ransomware gang has collected over $42 million in ransom payments as of April 2024 from more than 250 victims. As Arctic Wolf Labs observed, multiple ransomware intrusions involved unauthorized access through SonicWall SSL VPN connections, starting on July 15. However, while a zero-day vulnerability being exploited in these attacks is very likely, Arctic Wolf has not ruled out credential-based attacks.

“The initial access methods have not yet been confirmed in this campaign,” the Arctic Wolf Labs researchers cautioned. “While the existence of a zero-day vulnerability is highly plausible, credential access through brute force, dictionary attacks, and credential stuffing have not yet been definitively ruled out in all cases.”

Mozilla has warned add-on developers about an active phishing campaign where attackers impersonate Mozilla and falsely claim that “Your Mozilla Add-ons account requires an update to continue accessing developer features.” The company emphasizes it has not sent any such emails and warns that phishing messages may evolve to circumvent detection. Mozilla recommends developers avoid clicking email links, verify emails come from official Mozilla domains (firefox.com, mozilla.org, mozilla.com and subdomains), ensure emails pass SPF/DKIM/DMARC authentication checks, manually navigate to Mozilla URLs instead of following links, and only enter credentials on official mozilla.org or firefox.com sites. The warning highlights the ongoing threat of credential theft targeting software developers and the importance of verifying sender authenticity before taking any action.​​​​​​​​​​​​​​​​

The global ransomware ecosystem shifted dramatically in Q2 2025, with the disappearance of several prominent ransomware-as-a-service (RaaS) groups including LockBit, RansomHub, and 8Base. Law enforcement crackdowns, shrinking payment rates, and tougher national policies on ransom payments contributed to a 6% decline in publicly listed victims compared to the previous year’s monthly average. This fragmentation has weakened centralized control, but activity continues, driven by emerging groups and smaller, independent actors.

Qilin emerged as the most dominant ransomware group this quarter, adopting aggressive new extortion methods such as regulatory pressure campaigns and AI-driven victim harassment. Meanwhile, DragonForce expanded its “Ransomware Cartel” model, giving affiliates brand autonomy, while Hunters International shifted entirely to data-theft-based extortion via its new “World Leaks” platform. Despite a downturn in volume, ransomware remains a persistent threat, with healthcare and high-value sectors continuing to face significant risk.

Source

#Ransomware #CyberSecurity #RaaS #Qilin #DragonForce #HuntersInternational #LockBit #CyberThreats #DataExtortion #CyberCrime #RansomwareCartel #WorldLeaks #InfoSec #CyberDefense #ThreatLandscape #Malware #DataTheft #CyberResilience #GlobalSecurity #LawEnforcement #CyberExtortion #HealthcareSecurity #INC #DigitalThreats #AIInCybercrime #CyberPolicy #DataSecurity #CyberAttack #CyberIntelligence #CyberAwareness

China’s Cyberspace Administration has accused Nvidia of embedding a backdoor in its H20 chip, a model designed specifically for the Chinese market under US export restrictions. According to Beijing, US experts alleged that the chip allows location tracking and remote shutdown capabilities. The regulator has summoned Nvidia to provide technical documentation addressing the concerns, just weeks after Washington lifted a ban on H20 sales. This development threatens Nvidia’s efforts to revive its China business, which included CEO Jensen Huang’s recent trip to Beijing to reassure customers and introduce a Blackwell-based GPU compliant with US controls.

Experts remain divided on the validity of the claims. Paul Triolo of DGA-Albright Stonebridge Group expressed skepticism, noting a lack of evidence presented by China. Meanwhile, US lawmakers are pushing for mandatory location tracking in export-controlled chips, citing national security concerns. In response, Beijing has encouraged domestic tech giants such as Huawei, Biren, and Cambricon to accelerate their adoption of homegrown AI chips. With both Washington and Beijing under pressure, the future of Nvidia’s H20 shipments remains uncertain, adding tension to an already fragile US-China technology relationship.

Source

#Nvidia #H20Chip #ChinaTech #USChinaRelations #Semiconductors #AIChips #BackdoorClaims #TechSecurity #CyberRegulation #JensenHuang #BlackwellGPU #ExportControls #ChipSmuggling #AIHardware #Beijing #CAC #Huawei #Biren #Cambricon #ChipWars #NationalSecurity #USChinaTech #CyberSecurity #TechGeopolitics #ArtificialIntelligence #ChipEcosystem #SupplyChainSecurity #SemiconductorIndustry #TechPolicy #GlobalTech

Google Project Zero has announced its 2025 Reporting Transparency policy, aiming to reduce the “upstream patch gap” — the critical delay between when a vendor develops a security fix and when downstream dependents integrate it into products used by end users. While the core 90+30 disclosure model remains in place, Project Zero will now publicly confirm the existence of a vulnerability within one week of reporting it to a vendor. These disclosures will include the vendor, affected product, and reporting timelines, while withholding technical details to avoid aiding attackers.

The new transparency step is designed to improve communication across the supply chain, enabling downstream partners to take early action and strengthening patch adoption. Google Big Sleep, a joint initiative with DeepMind, will also pilot this policy. By signalling vulnerabilities sooner, Project Zero hopes to accelerate remediation, enhance ecosystem security, and build industry consensus that vulnerabilities are a reality requiring coordinated response, not secrecy.

Source

#GoogleProjectZero #CyberSecurity #PatchGap #UpstreamPatchGap #VulnerabilityDisclosure #ReportingTransparency #CyberResilience #SecurityPolicy #BugHunting #DeepMind #BigSleep #CyberDefense #SecurityResearch #VulnerabilityManagement #InfoSec #DataSecurity #SoftwareSecurity #TechPolicy #BugDisclosure #CyberAwareness #DigitalSecurity #ThreatMitigation #SecureEcosystem #TransparencyInSecurity #VulnerabilityAlerts #CyberTransparency #InfoSecurity #CyberEcosystem #PatchManagement #EndUserProtection

Researchers have found that in roughly 80% of cases, spikes in malicious activity like network reconnaissance, targeted scanning, and brute-forcing attempts targeting edge networking devices are a precursor to the disclosure of new security vulnerabilities (CVEs) within six weeks. This has been discovered by threat monitoring firm GreyNoise, which reports these occurrences are not random, but are rather characterized by repeatable and statistically significant patterns.

“Across all 216 spike events we studied, 50 percent were followed by a new CVE within three weeks, and 80 percent within six weeks,” explain the researchers. The correlation was notably stronger for Ivanti, SonicWall, Palo Alto Networks, and Fortinet products, and weaker for MikroTik, Citrix, and Cisco. State-sponsored actors have repeatedly targeted such systems for initial access and persistence.

GreyNoise notes that in the majority of the cases underlying these spikes, the attackers perform exploit attempts against older, known flaws. The researchers believe that this either facilitates the discovery of new weaknesses or the discovery of internet-exposed endpoints that can be targeted in the next phase of the attack, which leverages novel exploits.

[Source](Researchers have found that in roughly 80% of cases, spikes in malicious activity like network reconnaissance, targeted scanning, and brute-forcing attempts targeting edge networking devices are a precursor to the disclosure of new security vulnerabilities (CVEs) within six weeks. This has been discovered by threat monitoring firm GreyNoise, which reports these occurrences are not random, but are rather characterized by repeatable and statistically significant patterns.

“Across all 216 spike events we studied, 50 percent were followed by a new CVE within three weeks, and 80 percent within six weeks,” explain the researchers. The correlation was notably stronger for Ivanti, SonicWall, Palo Alto Networks, and Fortinet products, and weaker for MikroTik, Citrix, and Cisco. State-sponsored actors have repeatedly targeted such systems for initial access and persistence.

GreyNoise notes that in the majority of the cases underlying these spikes, the attackers perform exploit attempts against older, known flaws. The researchers believe that this either facilitates the discovery of new weaknesses or the discovery of internet-exposed endpoints that can be targeted in the next phase of the attack, which leverages novel exploits.

[Source](Researchers have found that in roughly 80% of cases, spikes in malicious activity like network reconnaissance, targeted scanning, and brute-forcing attempts targeting edge networking devices are a precursor to the disclosure of new security vulnerabilities (CVEs) within six weeks. This has been discovered by threat monitoring firm GreyNoise, which reports these occurrences are not random, but are rather characterized by repeatable and statistically significant patterns.

“Across all 216 spike events we studied, 50 percent were followed by a new CVE within three weeks, and 80 percent within six weeks,” explain the researchers. The correlation was notably stronger for Ivanti, SonicWall, Palo Alto Networks, and Fortinet products, and weaker for MikroTik, Citrix, and Cisco. State-sponsored actors have repeatedly targeted such systems for initial access and persistence.

GreyNoise notes that in the majority of the cases underlying these spikes, the attackers perform exploit attempts against older, known flaws. The researchers believe that this either facilitates the discovery of new weaknesses or the discovery of internet-exposed endpoints that can be targeted in the next phase of the attack, which leverages novel exploits.

Source

Internet Exchange Points (IXPs) are the invisible hubs that allow global networks to exchange traffic efficiently, reducing costs, lowering latency, and improving reliability for billions of users. Despite their indispensable role in keeping the digital world running, IXPs are often absent from critical infrastructure protection plans, leaving a major vulnerability in global connectivity. Recent internet outages in Portugal and Spain highlight how nations with stronger IXP footprints fare better during crises, underscoring the urgent need for policymakers to act.

Flavio Luciani, CTO of Namex, warns that IXPs face systemic risks such as traffic centralization, dependence of smaller ISPs, and uneven governance standards. He calls for IXPs to be embedded in cybersecurity strategies, resilience frameworks, and disaster preparedness initiatives. By recognizing IXPs as critical infrastructure and supporting them with transparent governance and shared incident response mechanisms, governments can strengthen digital sovereignty and future‑proof the internet against growing threats.

Source

#IXP #InternetExchange #CriticalInfrastructure #NetworkResilience #DigitalSovereignty #CyberSecurity #Connectivity #Peering #InternetInfrastructure #ISOC #DataTraffic #TechPolicy #Telecom #GlobalConnectivity #CyberResilience #DisasterPreparedness #NetworkSecurity #InternetGovernance #DigitalInfrastructure #BGP #InternetBackbone #ResilientNetworks #TechPolicy #CyberAwareness #FutureProofInternet #TelecomPolicy #NetworkOperators #InfrastructureResilience #InternetReliability #GlobalInternet

Phishing with Proofpoint: Cyber attack disguises itself as a security link

Cybercriminals are using Proofpoint’s link wrapping system to carry out targeted phishing attacks. The attackers exploit Proofpoint’s protection to make fraudulent URLs appear credible, using compromised email accounts and multi-level detours to disguise the actual target.