Find what you’re looking for
Browse everything
6,868 results in Threat Reports
Latvian Crew Arrested After Malware Attack on Italian Ferry: 2024 Maritime Cybersecurity Wake-Up Call
In June 2024, French law enforcement arrested two Latvian crew members aboard an Italian passenger ferry, the 'Cruise Bonaria,' after discovering they had installed malware on the ship’s critical systems. The suspects, employed as technicians, reportedly leveraged their privileged access to compromise the vessel’s automation and navigation controls. Investigators believe the malware was capable of allowing remote control over ship operations, raising concerns about the safety of passengers and the secure operation of maritime infrastructure. The incident temporarily disrupted the ferry's operations as authorities worked to contain the threat, analyze the infected systems, and restore normalcy while ensuring no lingering backdoors remained. This incident is a stark reminder of growing cyber risks targeting OT (operational technology) environments in critical transport sectors. The arrest coincides with heightened industry and regulatory attention on supply chain integrity, insider threats, and the urgent need for advanced monitoring and segmentation to protect safety-critical infrastructure.
HPE OneView 2025: Critical Remote Code Execution Flaw Places Global Enterprises at Risk
In December 2025, Hewlett Packard Enterprise (HPE) disclosed a maximum-severity security vulnerability (CVE-2025-37164) in its HPE OneView infrastructure management software. The flaw enabled unauthenticated remote attackers to execute arbitrary code on affected systems through low-complexity code injection, threatening widespread compromise of connected server, storage, and networking infrastructure. Reported by security researcher Nguyen Quoc Khanh, the vulnerability affected all OneView versions prior to v11.00, with no workarounds or mitigations available aside from applying vendor patches or hotfixes. As of publication, there were no confirmed reports of exploitation in the wild, but the risk to global HPE customers—including many Fortune 500 companies—was considered severe. The incident highlights the ongoing risks posed by critical remote code execution vulnerabilities in widely-used infrastructure management tools. With attackers regularly scanning for vulnerable systems and exploiting them in supply chain and ransomware campaigns, organizations must prioritize rapid patching and holistic vulnerability management to stay resilient.
Cisco Email Security Breach 2025: 0-Day Exploited by China-Linked APT
In December 2025, Cisco issued an urgent warning about active exploitation of a critical zero-day vulnerability in its AsyncOS software, which powers Cisco Secure Email Gateway and Secure Email and Web Manager appliances. A sophisticated, China-linked Advanced Persistent Threat (APT) group tracked as UAT-9686 successfully bypassed security controls to gain unauthorized access to unpatched devices. The exploitation enabled attackers to intercept, manipulate, or exfiltrate sensitive business communications, putting enterprise and government clients at significant risk. The vulnerability was disclosed following observed intrusions, prompting emergency advisories and a scramble among organizations to patch affected systems and review their email security postures. This incident highlights an ongoing trend of state-sponsored groups targeting core enterprise email systems via unknown or unpatched flaws. As attackers increasingly adapt to evolving defenses and zero-day vulnerabilities, organizations must prioritize rapid patch management and enhance segmentation and monitoring strategies against persistent, sophisticated threats.
E-Note Crypto Exchange Seized: $70M Ransomware Laundering Operation Disrupted
In December 2025, U.S. law enforcement agencies, in collaboration with Finnish and German authorities, seized the E-Note cryptocurrency exchange after investigating its role in facilitating ransomware-related money laundering. The FBI identified that over $70 million in proceeds from ransomware attacks and account takeover operations were funneled through E-Note since 2017, relying on a broad, international money mule network. The operation involved confiscating E-Note’s domains, mobile applications, servers, and transaction databases, severely disrupting a key enabling service for cybercriminals and potentially exposing a wide array of threat actors utilizing the platform. The alleged operator, Mykhalio Petrovich Chudnovets, has been indicted for money laundering and faces significant penalties. The takedown of E-Note highlights growing law enforcement action against illicit cryptocurrency infrastructure used by ransomware operators and cybercriminal ecosystems. The incident exemplifies an intensifying focus on disrupting financial channels that allow attackers to monetize stolen data and ransom payments, signaling increasing risk for enablers and users of such services.
ASUS Live Update Supply Chain Compromise (2025): CVE-2025-59374 Explained
In December 2025, ASUS experienced a critical supply chain compromise targeting its Live Update software. Attackers inserted malicious code into legitimate update packages, allowing widespread distribution of malware through a trusted channel. The vulnerability, tracked as CVE-2025-59374 (CVSS 9.3), was added to the CISA Known Exploited Vulnerabilities catalog following confirmation of active exploitation. Adversaries leveraged this breach to potentially gain remote access to victim machines, orchestrate data exfiltration, and enable lateral movement across enterprise environments while evading detection. The impact includes heightened risk to customers, supply chain partners, and organizations with installed ASUS software. This incident underscores the escalating sophistication of supply chain attacks and the urgency for robust verification of software integrity. Recent years have seen a surge in similar compromises, highlighting an industry-wide need for continuous monitoring and enhanced trust mechanisms for third-party software components.
Automated Credential Attacks Storm Cisco & Palo Alto Networks VPNs
In December 2025, automated credential attacks targeted enterprise VPN gateways from Cisco and Palo Alto Networks. Threat monitoring platforms such as GreyNoise observed a surge of password spraying attempts, with 1.7 million login probes against Palo Alto GlobalProtect portals within 16 hours, and coordinated activity later targeting Cisco SSL VPNs. The attacks originated from over 10,000 unique IPs, predominantly routed through the 3xK GmbH cloud provider in Germany. Attackers employed scripted credential stuffing—leveraging common username and password combinations—to probe for weak authentication endpoints, with no evidence of software vulnerabilities being exploited. This campaign highlights the ongoing evolution and scale of credential-based attacks targeting critical remote access infrastructure. As password spraying and automated reconnaissance increase, robust authentication and monitoring remain pivotal to defending against perimeter breaches, especially as threat actors exploit enterprise weaknesses during periods of heightened cyber activity.
Kimsuky Leverages QR Phishing to Spread Android Malware in Fake Delivery App Campaign (2025)
In June 2025, the North Korean threat group Kimsuky launched a sophisticated phishing campaign using QR codes that directed victims to malicious websites impersonating South Korean logistics giant CJ Logistics. Unsuspecting users who scanned the QR codes and interacted with fake prompts were tricked into downloading and executing the DocSwap Android malware. The malware enabled unauthorized access to sensitive device data and communications, potentially allowing attackers to conduct surveillance and lateral movement within enterprise environments. The incident highlights the versatility of Kimsuky’s tactics and the growing risk to mobile users targeted via supply-chain or delivery-themed phishing. Kimsuky's campaign reflects a broader industry-wide uptick in mobile phishing and social engineering attacks that leverage QR codes and trusted brands. This case demonstrates how advanced persistent threat actors are pivoting to circumvent traditional detection, pushing organizations to adopt holistic mobile and endpoint security strategies.
Clop Ransomware Hits Gladinet CentreStack: 2025 Data Theft Alert
In December 2025, the Clop ransomware gang initiated a widespread extortion campaign by exploiting internet-facing Gladinet CentreStack file servers. Gladinet CentreStack, used by thousands of businesses worldwide, enables remote file sharing without VPNs. The attackers scanned for accessible servers, exploited a yet-undetermined (potentially zero-day or unpatched) vulnerability, and exfiltrated sensitive business data, leaving ransom notes for victims. The breaches escalated concerns after Clop’s history with major file transfer solutions, such as MOVEit and Oracle EBS, resulting in significant data leaks and operational disruption for affected organizations. This attack underscores the persistent risk posed by sophisticated ransomware groups exploiting file transfer and sharing platforms. With attackers rapidly leveraging unknown or unpatched security flaws, enterprises must prioritize robust vulnerability management for all internet-exposed assets and monitor threat actor trends targeting remote-access file servers.
HPE OneView 2025: CVE-2025-37164 Remote Code Execution Threat
In June 2025, Hewlett Packard Enterprise (HPE) patched a critical vulnerability (CVE-2025-37164) in its OneView infrastructure management software, allowing unauthenticated remote code execution via network exposure. Rated CVSS 10.0, the flaw enabled threat actors to gain full control over affected systems by exploiting improper input validation in OneView’s remote management interfaces. This vulnerability posed immediate risk to critical infrastructure across industries relying on OneView for centralized management, potentially resulting in disruption, unauthorized access, or lateral movement within enterprise environments. The discovery highlights ongoing concerns around enterprise software supply chain security and the elevated threats facing privileged IT management tools. Increasingly, sophisticated threat actors target such infrastructure software to bypass traditional security controls, emphasizing the urgency for timely patching and advanced east-west traffic controls.
North Korea’s $2 Billion Crypto Heist: 2025’s Largest Nation-State Cyber Attack
In 2025, threat actors closely tied to North Korea orchestrated a record-breaking $2.02 billion in cryptocurrency thefts, representing over half of the global digital asset losses for the year. These attackers leveraged sophisticated intrusion techniques, advanced persistent threat (APT) operations, and exploited vulnerabilities in decentralized finance (DeFi) platforms and exchanges from January through early December. High-value thefts were often facilitated by exploiting weak internal controls, compromised credentials, and security gaps in cross-chain bridges, resulting in severe financial losses for both exchanges and their clients. This incident marks a significant escalation in nation-state cybercrime and highlights evolving attacker sophistication in targeting cryptocurrency infrastructure. It underscores escalating regulatory scrutiny and the necessity for organizations to bolster east-west traffic controls, threat detection, and zero trust architectures in response to persistent, financially-motivated adversaries.
2025 Multi-Vector Breach: WhatsApp Hijacks, MCP Leaks & AI Threats Signal New Era of Cyber Attacks
In December 2025, adversaries leveraged multiple cyberattack vectors—including WhatsApp account hijacking, major control plane (MCP) data leaks, generative AI reconnaissance, and the React2Shell exploit—to target organizations worldwide. Attackers combined social engineering, exploitation of unpatched vulnerabilities, and east-west traffic movement for lateral compromise. The orchestration of these tactics led to large-scale credential theft, successful ransomware deployment, and significant data exfiltration across cloud and on-premise environments. Notably, sophisticated evasion and automation tools hindered early detection and response, increasing operational disruption and risk exposure for affected enterprises. This incident exemplifies how weaponized AI, hybrid cloud vulnerabilities, and multi-vector attacks are converging. Organizations face growing urgency for zero trust segmentation, improved encrypted traffic controls, and comprehensive threat detection as attackers exploit interconnected infrastructure weaknesses and automation gaps.
University of Sydney 2024 Data Breach Exposes Student and Staff Details
In June 2024, the University of Sydney disclosed a data breach following unauthorized access to an online coding repository. Attackers exfiltrated files containing personal information of students and staff by exploiting weak access controls on the system. The breach was identified after suspicious activity was detected, prompting immediate investigation and containment steps by the university. Impacted data reportedly includes names, contact details, and university credentials, potentially exposing the affected individuals to heightened phishing and identity theft risks. This breach underscores increasing attacks on educational institutions using supply chain and cloud repository vectors. With universities under pressure to rapidly digitize, protecting developer and collaboration tools has become critical amid surging credential-based attacks and regulatory scrutiny of personally identifiable information (PII) handling.