Find what you’re looking for
Browse everything
6,868 results in Threat Reports
VolkLocker 2025: Flaw in CyberVolk Ransomware Lets Victims Self-Decrpyt
In December 2025, the pro-Russia hacktivist group CyberVolk launched a new version of its VolkLocker ransomware-as-a-service (RaaS), targeting public sector and government organizations. The attackers leveraged Telegram automation for command-and-control, and conducted attacks on both Windows and Linux systems. However, investigators discovered a critical flaw: the ransomware stored its master encryption key in plaintext in the %TEMP% directory, allowing victims to recover encrypted files independently without paying ransom. This lapse likely resulted from debug functionality inadvertently left in production, significantly weakening the group's operations and credibility. This incident is highly relevant as ransomware groups are modernizing with advanced automation—but basic operational mistakes can undermine even sophisticated threat actors. For blue teams, it offers a real-world example of why continuous code auditing and rapid incident response are crucial, while for attackers, it’s a cautionary tale regarding quality control in criminal tooling.
Critical React & Next.js Deserialization Bug Leads to RCE: What You Need to Know
In April 2025, security researchers disclosed critical vulnerabilities (CVE-2025-55182 and CVE-2025-66478) affecting the React and Next.js frameworks, specifically tied to unsafe data serialization and deserialization mechanisms in the Server Actions and Flight protocol. Attackers exploited the flaw to achieve remote code execution (RCE), enabling credential harvesting, lateral movement, and persistent access across affected environments. Within days of the CVEs’ disclosures, weaponized public exploit scripts proliferated on GitHub, compressing defenders’ reaction times and raising the risk of widespread attacks on applications running modern web stacks. This incident highlights the persistent danger of insecure serialization across software ecosystems, a threat pattern seen across at least a decade and multiple development languages. As AI-augmented coding accelerates release cycles, the lessons of past serialization flaws remain vital to protect emerging cloud-native applications from rapidly evolving threats.
10 Critical November 2025 CVEs: Quality Over Quantity in Exploitation Trends
In November 2025, a sharp 69% drop in reported critical vulnerabilities masked a surge in the intensity of exploitation campaigns. Threat intelligence from Recorded Future revealed 10 high-risk CVEs—including two critical Fortinet FortiWeb flaws—actively targeted by threat actors. Notably, the LANDFALL spyware campaign weaponized Samsung's image processing vulnerability for zero-click remote attacks, while seven of ten vulnerabilities had public proof-of-concept code released. Vulnerabilities included OS command injection, out-of-bounds writes, access control failures, and issues affecting major vendors such as Microsoft, Oracle, and Google. This incident highlights how attackers are shifting to fewer but far more impactful vulnerabilities, emphasizing quality over quantity in their exploitation. Security teams must adapt, maintaining vigilance even during perceived lulls and prioritizing fast patching, advanced monitoring, and comprehensive exposure management to counter rapidly evolving threats.
ClickFix Attackers Get Creative: Finger Protocol Exploitation in Ongoing Social Engineering Campaigns (2025)
In December 2025, ongoing ClickFix social engineering campaigns, notably KongTuke and SmartApeSG, exploited the legacy finger protocol to deliver malicious payloads to Windows hosts. Attackers enticed users to interact with fake CAPTCHA pages, triggering finger.exe commands that retrieved further instructions—such as encoded PowerShell commands or direct downloads of malware—from attacker-controlled servers over TCP port 79. These techniques allowed adversaries to bypass conventional detection and deliver remote access tools or additional scripts, posing operational threats to unprotected enterprise environments. This campaign highlights the resurgence of creative use of legacy or overlooked network protocols in modern attack chains. The persistence of ClickFix-driven social engineering and the reuse of finger.exe underline the importance for organizations to reassess traffic filtering strategies, as attackers are diversifying their initial access and payload delivery vectors.
Ransomware Gets Hacked: CyberVolk’s VolkLocker Crumbles Under Weak Crypto
In June 2024, the pro-Russia hacktivist group CyberVolk introduced its VolkLocker ransomware-as-a-service (RaaS) platform, targeting organizations with file-encrypting malware. However, security researchers quickly discovered significant cryptographic vulnerabilities in its implementation, allowing many victims to recover encrypted files without paying the ransom. The flawed encryption methods meant attackers’ efforts to monetize were largely ineffective, reducing financial impact for most affected organizations but still causing temporary operational disruption and alarm. This incident highlights the persistent evolution of ransomware delivery via RaaS models, even by newly emerging threat actors with insufficient technical sophistication. As ransomware groups proliferate and adapt, businesses face the dual challenges of staying current on new threats and maintaining fundamental security practices, including robust encryption and incident response readiness.
PayPal Subscriptions Abused for Advanced Phishing Campaigns in 2024
In mid-2024, cybercriminals exploited PayPal’s legitimate ‘Subscriptions’ billing feature to send authentic-looking emails with fraudulent purchase notifications. By inserting malicious information into the Customer Service URL field, attackers leveraged PayPal’s trusted platform to bypass spam filters, tricking recipients into believing they had initiated a costly subscription. Victims, startled by these official-looking emails, contacted the provided phone numbers, which connected them to threat actors conducting social engineering attacks, potentially resulting in credential theft or financial loss. This incident highlights a growing trend of attackers abusing trusted platforms and supply chain features to execute highly persuasive phishing campaigns. Increased reliance on platform-generated transactional emails, coupled with social engineering, presents new security and compliance challenges for organizations and consumers alike.
MITRE 2025: The Top 25 Most Dangerous Software Weaknesses Revealed
In June 2025, MITRE released its annually curated list of the Top 25 Most Dangerous Software Weaknesses, compiling exploit data from 39,000 security vulnerabilities reported between June 2024 and June 2025. This report is used globally by software vendors, security teams, and regulators to target systemic issues—such as improper input validation, use-after-free errors, and insufficient authentication—that are consistently abused by cybercriminals and advanced threat actors. The publication aims to increase awareness and prioritize remediation actions, reducing exposure to the most common and severe attack vectors across both enterprise and critical infrastructure sectors. MITRE's 2025 CWE Top 25 is particularly relevant as organizations respond to a continuing rise in supply chain attacks and software-targeted ransomware campaigns. Regulatory frameworks increasingly demand proactive vulnerability management and prioritization based on real-world exploitability—making this list a critical resource for compliance, risk reduction, and secure software development initiatives.
Apple 2025 WebKit Zero-Day Breach: What Security Teams Must Know
In June 2025, Apple issued urgent security updates across iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari in response to two actively exploited zero-day vulnerabilities in the WebKit browser engine. One notable vulnerability, CVE-2025-43529, was a use-after-free flaw that could allow maliciously crafted web content to execute arbitrary code on affected devices. The flaws were discovered being exploited in the wild, with attackers leveraging compromised web traffic to bypass built-in device protections, raising concerns for the billions of global Apple device users. This event underscores the growing prevalence and severity of zero-day exploits against popular consumer platforms, highlighting attacker agility and cross-app targeting. With the rapid pace of vulnerability discovery and exploitation, it accentuates the pressing need for real-time patching, proactive threat detection, and segmentation strategy for organizations leveraging Apple devices.
CISA Orders Feds to Patch Active GeoServer XXE Vulnerability Exploitation
In June 2024, U.S. federal agencies were ordered by CISA to immediately patch a critical vulnerability in GeoServer, an open-source geospatial server widely deployed across government networks. Threat actors were observed actively exploiting an XML External Entity (XXE) injection flaw that allows attackers to access sensitive files, exfiltrate data, and potentially pivot within federal environments. The exploitation, which was discovered in the wild, underscores how quickly attackers can weaponize unpatched vulnerabilities to compromise mission-critical public sector infrastructure, putting sensitive government information at risk. This incident highlights a recent spike in the exploitation of internet-facing open-source software by both cybercriminal and nation-state groups. With regulatory pressure mounting around software supply chain risks and zero-day response times, such vulnerabilities remain a primary vehicle for initial access in sophisticated cyberattacks.
React2Shell Exploit Wave Exposes Web App Security Gaps in 2025
In December 2025, the critical React2Shell (CVE-2025-55182) vulnerability was actively exploited following its public disclosure. Attackers leveraged unsafe deserialization in React Server Components, impacting frameworks including React and Next.js. Proof-of-concept exploits rapidly spread online, with some functional variants enabling remote code execution. Exploit activity was observed from China-nexus threat groups and opportunistic cybercriminals, resulting in widespread targeting of vulnerable systems with cryptominers, infostealers, and webshells. Security vendors and threat researchers noted that while many PoC attacks were ineffective, validated exploits—some featuring advanced WAF bypasses and in-memory payloads—posed serious risks to organizations relying on web application frameworks. The incident highlights the increasing sophistication of attackers in quickly adapting and bypassing newly deployed defenses such as WAF rules. As automated scanning and exploit release cycles accelerate, enterprises face mounting challenges in promptly identifying, patching, and defending against RCE vulnerabilities across their web application infrastructure.
Mesa County's 2021 Election System Data Breach: The Insider Threat Exposed
In 2021, Mesa County, Colorado experienced a significant breach of its election system data, orchestrated by then-county election clerk Tina Peters. Unauthorized copies of sensitive voting-system hard drives were made following the 2020 U.S. Presidential election and leaked to the public, purportedly to expose alleged voter fraud. The breach, which did not reveal any evidence of fraud, exposed highly confidential election infrastructure information, leading to criminal charges against Peters. The incident is widely recognized as one of the most impactful attacks on U.S. election security in recent years and undermined trust within the local community and beyond. This case highlights the ongoing risks to election system integrity posed by insider threats and emphasizes the importance of robust access controls, encryption, and segmentation. It is particularly relevant today as the U.S. prepares for upcoming elections amid heightened scrutiny of both technical and human vulnerabilities in election infrastructure.
Fake Movie Torrent Delivers Agent Tesla Infostealer via Subtitles in 2024
In early June 2024, cybersecurity researchers discovered that a malicious torrent purporting to offer the Leonardo DiCaprio film 'One Battle After Another' was distributing infostealer malware through booby-trapped subtitle files. Unsuspecting users who downloaded the fake torrent were exposed to malicious PowerShell loaders, which delivered the Agent Tesla remote access trojan (RAT). This malware enabled attackers to steal sensitive credentials, exfiltrate data, and remotely monitor infected devices, highlighting how threat actors weaponize popular entertainment content to bypass user defenses and propagate infostealers. The incident underscores the evolving threat landscape in which cybercriminals exploit widely-used file formats and trusted brands to lure victims. Multimedia supply chains are increasingly being targeted through creative means—such as doctored subtitles—with infostealers and RATs surging in popularity. Organizations and individuals must heighten their vigilance, especially as compliance scrutiny and attack techniques grow more sophisticated.