Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Mirion Medical 2025: Critical Vulnerabilities in NMIS BioDose Software Threaten Healthcare Security
In December 2025, Mirion Medical disclosed multiple high-severity vulnerabilities affecting its EC2 Software NMIS BioDose product, versions prior to 23.0. These flaws—incorrect permission assignments, use of hard-coded credentials, and client-side authentication weaknesses—could be exploited by attackers to gain unauthorized access, elevate privileges, manipulate executables, steal sensitive medical data, or execute arbitrary code. Impacting the healthcare and public health sectors globally, these vulnerabilities pose critical operational and patient-data risks, especially in environments with networked installations and exposed Microsoft SQL Server databases. No active exploitation has yet been reported, but CISA urges urgent mitigation measures due to the vulnerabilities’ remote exploitability and low attack complexity. This incident highlights intensifying regulatory scrutiny on medical device security as threat actors increasingly target healthcare systems for sensitive patient data and intellectual property. The vulnerabilities in Mirion’s product underscore persistent gaps in authentication and privilege controls—a growing concern amid adoption of connected medical technologies and regulatory frameworks such as HIPAA and NIST.
Law Enforcement Dismantles Cryptomixer, Deals Major Blow to Ransomware Laundering Networks
In June 2024, a coalition of European law enforcement agencies successfully disrupted Cryptomixer, a cryptocurrency mixing service allegedly used to launder proceeds from ransomware and cybercrime. Authorities seized infrastructure and millions in digital assets linked to illicit transactions, following months of cross-border investigation and digital forensics. Cryptomixer was reportedly favored by ransomware groups to obfuscate the trail of stolen funds, complicating recovery efforts and hampering international financial tracking of illicit operations. This incident underscores the escalation of law enforcement action against cryptographic financial laundering tools, which remain instrumental to cybercriminal operations. Increasing scrutiny and regulatory collaboration highlight a growing intolerance for shadow financial ecosystems enabling ransomware and cyber extortion.
Ransomware Halts CodeRED Emergency Alert System in 2024
In June 2024, the CodeRED emergency alert platform experienced a major operational disruption after being targeted by the Inc ransomware gang. Attackers infiltrated the organization's systems, encrypted critical servers, and exfiltrated sensitive subscriber data, causing CodeRED to take its emergency alert services offline. Initial entry occurred through a phishing campaign, allowing lateral movement and the deployment of ransomware across east-west traffic. The attack compromised both the confidentiality and availability of data, significantly impacting public safety communication in affected regions. This incident highlights the escalating threat ransomware groups pose to critical infrastructure and public safety technology providers. As attackers target essential services with increasingly sophisticated methods, robust east-west security controls, zero trust segmentation, and real-time threat detection have become urgent priorities for organizations in all sectors.
SharePoint 2025: ToolShell In-Memory Exploit Bypasses Defenses
In August 2025, Microsoft SharePoint servers were targeted by an advanced exploit chain known as ToolShell, leveraging newly disclosed vulnerabilities CVE-2025-53770 and CVE-2025-53771. Threat actors bypassed authentication and exploited deserialization flaws on on-premises SharePoint Server 2016, 2019, and Subscription editions. Initial attacks involved file-based web shells easily detected by EDRs, but adversaries quickly shifted to highly evasive in-memory payloads, rendering detection challenging and enabling the extraction of machine keys or the execution of PowerShell commands for data exfiltration and deeper system compromise. The incident underscores the growing risks of sophisticated post-exploit activity and lack of robust network detection. This breach highlights a wider threat: attackers are increasingly adapting their techniques to evade endpoint protections by using fileless, memory-resident malware and targeting enterprise collaboration platforms. As such attack patterns spread, organizations must urgently reinforce defenses and monitor network-level traffic for signs of exploitation, especially with remote work and critical business data gravitating to such platforms.
Tomiris Unleashes 'Havoc': 2024 CIS Government Cyber-Espionage Explained
In early 2024, the Russian-speaking APT group Tomiris launched a sophisticated cyber-espionage campaign targeting government and diplomatic organizations in several CIS nations and Central Asia. Attackers leveraged new malware tools and refined tactics, initially gaining access via spear-phishing and malicious email attachments designed to exploit trust within diplomatic correspondence chains. Once inside, the group deployed covert tools for lateral movement, maintained persistence, and exfiltrated sensitive diplomatic communications and internal documents. The breach had significant operational security implications, exposing strategic discussions and potentially undermining ongoing government initiatives. This incident exemplifies the ongoing risk posed by advanced persistent threats in geopolitical hotspots, with Tomiris demonstrating evolving tradecraft and adaptability. Organizations are urged to review east-west security, segmentation, and monitoring practices as similar espionage campaigns are increasingly targeting public sector networks.
North Korea’s ‘Contagious Interview’ npm Supply Chain Attack Disrupts Developer Ecosystem
In October 2023, North Korean state-sponsored threat actors launched an extensive supply chain attack by distributing over 197 malicious npm packages, collectively accumulating more than 31,000 downloads. These attackers, using tactics known as the 'Contagious Interview,' targeted software developers, especially those active in open-source environments, by delivering trojanized code through compromised npm modules. The campaign aimed to infiltrate developer systems, steal sensitive information, and establish persistent access to downstream enterprise networks, significantly raising the risk to downstream software supply chains and CI/CD pipelines. This incident is especially notable for its scale, rapid spread, and focus on highly trusted open-source ecosystems, underscoring an alarming trend in software supply chain attacks. Organizations are urged to strengthen controls around package management, implement zero trust principles, and increase monitoring of development infrastructure to defend against similar threats.
Google Issues Urgent Patch for 107 Android Vulnerabilities, Two Actively Exploited Zero-Days
In December 2025, Google released a significant Android security update that addressed 107 vulnerabilities, including two zero-day flaws (CVE-2025-48633 and CVE-2025-48572) already being actively exploited in the wild. These high-severity issues in the Android framework allowed threat actors to access sensitive information and escalate privileges, posing a substantial threat to user data and device functionality. The update also remedied several critical vulnerabilities impacting the kernel, system, and multiple vendor components such as MediaTek, Unisoc, and Qualcomm. This incident highlights the intricate security landscape of mobile operating systems and the evolving tactics of cyber adversaries in exploiting vendor fragmentation and delayed patch cycles. The breadth and urgency of this patch reflects growing concerns around mobile platform vulnerabilities, especially as targeted exploitation of zero-days intensifies. With attackers rapidly leveraging gaps before they’re widely recognized or patched, organizations face increased pressure to maintain real-time vulnerability management and swift patch deployment to minimize exposure.
Authorities Dismantle Cryptomixer: $28 Million in Bitcoin Seized Amid Europol-Led Takedown
In June 2024, European authorities executed a coordinated operation to dismantle Cryptomixer, a cryptocurrency mixing service reportedly used to launder over $1.5 billion for global cybercriminals. Operation Olympia involved Europol, Eurojust, and law enforcement agencies from Germany and Switzerland, resulting in the seizure of nearly $28 million in Bitcoin, three physical servers, the cryptomixer.io domain, and over 12 terabytes of data. Cryptomixer functioned as an anonymizing layer for a multitude of cybercrimes, including ransomware, payment card fraud, and trafficking in illicit goods, allowing threat actors to evade detection and launder stolen assets. This takedown demonstrates mounting regulatory and law enforcement pressure on cryptocurrency-based money laundering infrastructure. The case highlights a shift among advanced threat groups—such as the North Korean Lazarus Group—from prioritizing anonymity to speed and automation in financial cybercrime operations, reflecting evolving cybercriminal tactics and the urgent need for robust digital asset tracking controls.
Law Enforcement Dismantles Cryptomixer: Major Blow to Crypto Laundering Networks
In June 2024, a coordinated operation between Swiss and German law enforcement agencies led to the shutdown of the Cryptomixer cryptocurrency-mixing service. Since its inception in 2016, Cryptomixer is believed to have laundered over €1.3 billion in Bitcoin, providing cybercriminals with tools to obfuscate illicit financial flows from ransomware, scams, and darknet market activities. The takedown included seizure of digital infrastructure and assets, disrupting one of the major cryptocurrency laundering platforms that aided threat actors operating globally. This collaborative international action highlights increased efforts by authorities to clamp down on crypto-enabled cybercrime. The incident reflects the growing focus on digital financial transparency and signals greater scrutiny of services aiding threat actors in anonymizing transactions.
ShadyPanda: 4.3 Million Impacted in Massive Malicious Browser Extension Attack (2024)
In early 2024, the ShadyPanda campaign targeted users of Chrome and Edge browsers by distributing over 4.3 million malicious extensions disguised as legitimate utilities. Attackers leveraged browser extension supply chains—often through fraudulent developer accounts and aggressive social engineering—to gain access to users’ browsing data, credentials, and sensitive online activity. The malware evolved over time, adapting to evade security controls and harnessing sophisticated capabilities to extract data, redirect web sessions, and facilitate persistent surveillance, affecting millions globally and highlighting gaps in browser marketplace vetting. This incident exemplifies a rapid escalation in supply-chain attacks focusing on widely used platforms like web browsers. The surge in malicious browser extension campaigns underscores the increasing sophistication of threat actors and the urgent need for organizations and individuals to be vigilant about third-party software, browser hygiene, and visibility into user-installed code.
Coupang Data Breach 2024: 33 Million Customers Exposed in Massive Retail Incident
In early 2024, Coupang, South Korea's largest online retailer, reported a significant data breach affecting approximately 33.7 million customers. The incident involved unauthorized access to personal information, potentially including customer names, phone numbers, addresses, and partial payment details. Coupang disclosed the breach after detecting unusual access patterns and subsequently notified both customers and regulatory authorities. Initial investigations suggest attackers exploited vulnerabilities in Coupang's data management or access controls, raising concerns over the safeguarding of sensitive information in large-scale e-commerce environments. This breach is especially notable due to the unprecedented scale within the South Korean retail industry and highlights a broader trend of cybercriminals targeting high-profile, data-rich organizations. With customer trust and regulatory scrutiny at stake, organizations globally are urged to reassess their data security and compliance strategies.
Glassworm Malware Returns: Third Wave Targets VS Code with Supply-Chain Attack (2024)
In early 2024, a new wave of the Glassworm malware campaign was discovered infiltrating the Microsoft Visual Studio Code and OpenVSX marketplaces with 24 malicious packages. These supply-chain attacks targeted software developers by masquerading as legitimate extensions, but upon installation delivered trojans capable of stealing sensitive files, authentication tokens, and establishing persistence for command-and-control activities. The campaign began in October 2023, with this third and most extensive wave compromising both trusted VS Code ecosystems and potentially impacting thousands who unknowingly downloaded tainted packages. The threat actors have not been formally attributed but demonstrated sophisticated understanding of both developer environments and software supply chains. This incident is a striking example of the increasing shift toward attacking upstream dependencies, leveraging trusted developer tools to gain footholds deeper in organizations. With open-source and third-party marketplaces under continuous attack, businesses face growing pressure to implement better package vetting and monitoring along with zero-trust segmentation and detection capabilities.