Find what you’re looking for
Browse everything
6,854 results in Threat Reports
CISA Flags China-Linked APT Exploitation of VMware Zero-Day (CVE-2025-41244)
In October 2025, a critical zero-day vulnerability, CVE-2025-41244, affecting VMware Aria Operations and VMware Tools was actively exploited by a China-linked Advanced Persistent Threat (APT) group. The attackers leveraged this flaw to achieve remote code execution within enterprise environments, bypassing authentication on exposed VMware instances. Initial access was typically gained via internet-facing management interfaces, followed by lateral movement to access sensitive data and systems. The incident prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the rapid operational impact and the potential for widespread compromise in cloud and hybrid infrastructures. This breach exemplifies the ongoing risk posed by state-sponsored actors exploiting enterprise software supply chain gaps and underscores the need for rigorous patch management and segmentation. Organizations face renewed urgency as attackers increasingly focus on high-value cloud platforms, driving heightened regulatory scrutiny and reinforcing the importance of visibility and agility in security operations.
Eclipse Foundation Supply Chain Risk: Open VSX Token Exposure Sparks Security Response
In June 2025, the Eclipse Foundation, custodians of the Open VSX open-source project, took immediate remedial action after Wiz security researchers reported that authentication tokens had been unintentionally leaked in several Visual Studio Code (VS Code) extensions across official marketplaces. These exposed tokens could have allowed malicious actors to tamper with extensions, inject malicious code, or compromise downstream developer environments. Upon validation, the Eclipse Foundation promptly revoked a limited set of impacted tokens and notified affected extension maintainers, mitigating potential risks before evidence of active exploitation surfaced. This event underscores the inherent risks in software supply chains, particularly in widely-used open-source development tools. Software supply chain vulnerabilities remain a top concern for enterprises as development workflows increasingly depend on publicly distributed packages and extensions. The growing adoption of open-source ecosystems means that even small credential leaks can impact thousands of users, driving new urgency for continuous monitoring and proactive threat detection.
CISA and NSA Warn: Immediate Action Required to Harden Exchange & WSUS – 2025 Global Security Advisory
In October 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), together with Australian and Canadian cyber authorities, issued urgent joint guidance to mitigate widespread exploitation risks targeting on-premises Microsoft Exchange Server and Windows Server Update Services (WSUS) deployments. These critical advisories arise after recent campaigns revealed how sophisticated threat actors leveraged open administrative interfaces and inadequate authentication to gain persistence, move laterally, and exfiltrate sensitive data from unpatched systems. Organizations globally are at risk of business disruption and potential regulatory violation from ensuing breaches. This new wave of advisories underscores the persistent targeting of core enterprise infrastructure by nation-state and criminal groups. The trend toward exploiting unencrypted data in transit, identity and access misconfigurations, and patching gaps makes immediate action essential for IT and security leaders, especially with regulatory scrutiny and ransomware risk at all-time highs.
China-Linked APT Exploits Windows Shortcut Flaw in 2025 to Breach EU Diplomats
In late 2025, the China-linked threat group UNC6384 orchestrated a targeted cyber espionage campaign against European diplomatic and government institutions. Utilizing a previously unpatched Windows shortcut (LNK) vulnerability, attackers delivered malicious payloads to compromise systems in Hungary, Belgium, Italy, the Netherlands, and Serbia. The group specialized in stealthy lateral movement, data collection, and command-and-control operations while evading standard defenses. As a result, sensitive government data and communications were potentially exposed, undermining national security and international collaboration efforts. This incident underscores the growing sophistication of state-sponsored cyberattacks, intensified by the exploitation of zero-day vulnerabilities and advanced lateral movement techniques. The frequent targeting of government and diplomatic organizations shows a continued evolution in APT tactics and a rising threat to global critical infrastructure.
2025 Lanscope Zero-Day: Tick APT’s Attack on Corporate Systems
In October 2025, the cyber espionage group Tick (also known as Bronze Butler), believed to be linked to China, exploited CVE-2025-61932—a critical zero-day vulnerability (CVSS 9.3) affecting Motex Lanscope Endpoint Manager. The attackers gained remote SYSTEM-level access to targeted on-premise environments, allowing them to hijack corporate systems and exfiltrate sensitive data. The attack chain involved leveraging the flaw for command execution, facilitating lateral movement and persistence within victim organizations, primarily impacting Japanese and East Asian enterprises. Authorities issued advisory alerts urging immediate remediation to prevent data loss and further intrusions. This incident underscores the growing operational risk posed by nation-state actors exploiting enterprise endpoint vulnerabilities. It highlights an escalation in zero-day weaponization and reinforces the need for robust segmentation, endpoint monitoring, and proactive patch management amid intensifying APT activity and regulatory scrutiny.
Airstalk Malware: 2025 Nation-State Supply Chain Attack Hits Mobile Device Ecosystems
In October 2025, a suspected nation-state threat actor, tracked as CL-STA-1009, orchestrated a sophisticated supply chain attack involving the novel 'Airstalk' malware. Investigations by Palo Alto Networks Unit 42 revealed that Airstalk exploited the AirWatch mobile device management (MDM) API to gain unauthorized access to victim organizations' internal networks. This enabled adversaries to compromise large numbers of mobile devices, bypass network controls, and pivot laterally within affected systems, causing operational disruption and data loss. The primary targets were organizations with complex supply chains, where the attackers injected malicious code via trusted software providers, highlighting the vulnerabilities inherent in interconnected IT ecosystems. This incident is especially relevant as supply chain attacks become increasingly prevalent, with attackers leveraging trusted third-party relationships to bypass traditional network defenses. Nation-state actors' use of advanced evasion techniques and MDM abuse underscores the need for enhanced visibility, segmentation, and threat detection across distributed and hybrid IT environments.
LotL Malware Concealed in Windows Native AI Stack Exposes New Risks
In early 2024, security researchers uncovered a Living-off-the-Land (LotL) attack that leveraged Windows' native AI stack to conceal and deploy malware within trusted AI data files. Attackers exploited the inherent trust that many Windows systems grant to files used by the native AI stack, allowing the threat to bypass traditional detection methods. The malicious payloads used fileless techniques, hiding in AI models and exploiting automated processing pipelines to achieve stealthy initial access and lateral movement. The campaign resulted in significant risks of unauthorized access, data theft, and potential disruption to business operations reliant on AI-driven processes. This incident is a timely reminder of evolving threat tactics using fileless malware and trusted native components. As the adoption of AI and automation accelerates, attackers are adapting by targeting supply chains and leveraging trusted AI data flows to bypass security controls and compliance frameworks.
Claroty Authentication Bypass Threatens OT Security in 2025
In early 2025, a critical vulnerability tracked as CVE-2025-54603 was discovered in Claroty’s industrial cybersecurity products, exposing operational technology (OT) networks and critical infrastructure to potential attacks and data theft. The flaw allowed threat actors to bypass authentication mechanisms, granting unauthorized access to sensitive network segments. Attackers leveraging this security gap could disrupt essential services, compromise confidential process data, and pose significant operational and safety risks. Claroty responded by issuing urgent patches to contain the exposure and mitigate ongoing threats. This incident highlights the increasing risk of authentication bypass exploits in OT environments, as threat actors target weak points in security architectures to gain privileged access. The event underscores an urgent need for robust, zero trust security frameworks and rapid vulnerability management in critical infrastructure sectors.
2024 Smart Building Zero-Day: Global Infrastructure Exposed
In early 2024, cybersecurity researcher Gjoko Krstic uncovered hundreds of zero-day vulnerabilities within legacy building automation systems still widely deployed in hospitals, schools, and commercial facilities globally. The investigation, codenamed "Project Brainfog," revealed that outdated codebases, some as old as 18 years, exposed critical physical infrastructure to remote compromise by unauthenticated attackers. Exploitable weaknesses in authentication, encryption, and access controls allowed for the manipulation of HVAC, security, and energy systems, putting sensitive environments such as medical and educational facilities at operational risk, and making them potential targets for ransomware and espionage. This incident highlights the growing threat of unpatched operational technology in critical sectors, as attackers increasingly target IoT and building control systems for both sabotage and lateral movement. As digital-physical convergence accelerates, organizations must rapidly modernize and secure these legacy environments to mitigate cascading risks.
When AI Agents Go Rogue: The Risk of Session Smuggling in Agent2Agent Systems
In early 2024, cybersecurity researchers uncovered a novel vulnerability in agent-to-agent (A2A) AI systems, termed 'Agent Session Smuggling.' The attack allowed malicious actors to hijack sessions between AI agents, abusing trust relationships and manipulating agent behavior. Attackers leveraged weaknesses in session authentication and input validation, circumventing security controls to inject unauthorized commands and siphon sensitive data. Demonstrated through proof of concept, the exploit posed risks to organizations deploying sophisticated autonomous AI workflows and threatened the integrity of operational and business data. This incident highlights a rapidly emerging class of AI/ML security threats, where attacks exploit autonomous system intercommunication. As organizations accelerate AI adoption, understanding and mitigating these exploit techniques—especially in east-west, agent-driven environments—has become a pressing priority for security and compliance teams globally.
LinkedIn Phishing Scam Exploits Finance Executives with Fake Board Invites
In May 2024, attackers launched a highly targeted phishing campaign abusing LinkedIn’s direct messaging system to impersonate executive board invitations and target finance executives. The phishing messages enticed victims to a spoofed Microsoft authentication page designed to steal their credentials. These attacks demonstrated careful social engineering, relying on the professional trust inherent to LinkedIn. Stolen credentials could be leveraged for unauthorized access to sensitive corporate financial data or for follow-on business email compromise attacks, creating substantial business risk and potential regulatory exposure. This incident underscores an ongoing surge in sophisticated, identity-driven phishing attacks against senior business leadership. As attackers increasingly exploit trusted professional platforms and personalize their lures, organizations face mounting pressure to adopt advanced detection, multi-factor authentication, and user awareness to counter modern credential theft threats.
Insider at L3Harris Sells Cyber Exploits to Russian Broker in 2024 Breach
In early 2024, Peter Williams, a former executive at L3Harris Trenchant, a U.S. defense contractor, pleaded guilty to stealing and illicitly selling confidential cyber exploit information to a Russian broker. The insider utilized privileged access to exfiltrate sensitive data on cybersecurity vulnerabilities and offensive research, subsequently marketing this intelligence to foreign entities, including actors associated with the Russian cyber underground. The breach exposed L3Harris Trenchant's internal detection gaps, ultimately triggering a federal investigation and leading to Williams' prosecution in U.S. District Court. This incident underscores the growing threat posed by insider actors within critical infrastructure and defense sectors. It highlights the need for advanced detection, segmentation, and strict policy enforcement to counter the insider risk—especially as nation-state and organized crime demand for zero-day vulnerabilities and advanced cyber tools continues to escalate.