Find what you’re looking for
Browse everything
6,844 results in Threat Reports
New 2025 Guidance: Securing Microsoft Exchange Servers from Infrastructure Vulnerabilities
In October 2025, cybersecurity authorities including CISA and the NSA released urgent best practices following persistent threats targeting on-premises Microsoft Exchange servers. Despite patch releases and increased awareness, many organizations continued running outdated or misconfigured Exchange environments, leaving them vulnerable to exploitation. Attackers leveraged these weaknesses to gain unauthorized access, often leading to lateral movement, data exfiltration, and in some cases, ransomware incidents. The culmination of such ongoing attacks prompted renewed guidance emphasizing strong authentication, rigorous encryption, and decommissioning of unsupported hybrid Exchange servers to minimize operational risk. This incident underscores the ongoing trend of adversaries exploiting infrastructure vulnerabilities, especially in legacy and hybrid setups. With continued attacker innovation and regulatory scrutiny, organizations must adopt zero trust principles, prioritize patch cycles, and upgrade legacy systems to mitigate evolving threats.
CISA Highlights Active Exploitation of XWiki & VMware Vulnerabilities in 2025 KEV Catalog Update
In October 2025, CISA added two actively exploited vulnerabilities—CVE-2025-24893 in XWiki Platform (Eval Injection) and CVE-2025-41244 in Broadcom VMware Aria Operations and VMware Tools (Privilege Defined with Unsafe Actions)—to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws enable remote attackers to inject malicious code or escalate privileges, presenting substantial risks for the federal enterprise and beyond. The inclusion in the KEV Catalog signals confirmed in-the-wild exploitation and compels agencies to expedite remediation measures under Binding Operational Directive 22-01 to protect critical federal infrastructure networks. This incident underscores the persistent trend of attackers rapidly leveraging new or previously overlooked vulnerabilities with real-world consequences. As the speed of exploitation shortens and attack surfaces broaden, timely vulnerability management, zero trust practices, and proactive monitoring remain vital to reducing enterprise cyber risk.
ISO 15118-2 EV Charging Protocol Vulnerability: Man-in-the-Middle Risk in 2025
In October 2025, a critical vulnerability (CVE-2025-12357) impacting the ISO 15118-2 standard for electric vehicle (EV) chargers was disclosed. The flaw centers on improper restriction of communication channels, specifically enabling attackers to exploit the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements. This manipulation facilitates man-in-the-middle attacks between EVs and compliant chargers, with attacks feasible wirelessly and in close proximity via electromagnetic induction. The vulnerability jeopardizes authentication and data exchange during the EV charging process but has not yet been publicly exploited. The incident highlights escalating risks across connected infrastructure, especially as EV adoption surges globally. As regulators, manufacturers, and utility providers converge on charging protocols, the need for mandatory end-to-end encryption is increasingly urgent to safeguard against evolving threat actors targeting critical transportation sectors.
Dentsu Subsidiary Employee Data Stolen in 2024 Breach: What Enterprises Must Know
In June 2024, a subsidiary of global marketing and PR giant Dentsu experienced a significant data breach in which unidentified threat actors accessed and stole sensitive employee information. The breach reportedly targeted internal personnel data, potentially exposing names, contact information, and other personally identifiable details, though Dentsu has not publicly shared whether client data was affected. The precise entry vector has not been disclosed, but the attack highlights vulnerabilities in east-west traffic inspection and data-in-transit encryption within subsidiary environments. Dentsu's management responded by initiating a comprehensive forensic investigation and notifying affected employees while enhancing internal security protocols. This breach accentuates the growing targeting of large holding companies and their subsidiaries, as attackers increasingly seek weak links in global enterprise ecosystems. With regulatory pressure mounting and privacy violations facing stiffer penalties worldwide, all large organizations must urgently reassess how they secure internal traffic and control access across decentralised operational units.
Iranian Hacker Training School Hit by Major Data Leak in 2024
In June 2024, a significant data breach struck Ravin Academy, an institution linked to training operatives for Iran’s Ministry of Intelligence and Security (MOIS). Unknown attackers infiltrated Ravin Academy’s infrastructure and exfiltrated sensitive personal information on students, instructors, and internal operations. The breach exposed emails, full names, contact info, assignment details, and evidence of the academy’s ties to cyberespionage. Responsibility was claimed by hacktivists aiming to publicly reveal Iranian cyber capabilities. The school is believed to have failed in securing internal East-West traffic, and evidence suggests lack of robust threat detection or network segmentation allowed attackers to maintain persistence long enough to extract substantial records. The breach is under investigation, but sensitive intelligence operations may have been compromised. This incident draws renewed focus on “learning supply chain” vulnerabilities: attacker interest in targeting not just state actors, but their feeder institutions and ecosystems. Such breaches underscore mounting regulatory concern over insider risk, inadequate segmentation, and the risks of unencrypted internal communications in institutions developing offensive cyber capabilities.
PhantomRaven’s Malicious npm Packages: 2024 Supply-Chain Risk with Invisible Dependencies
In early 2024, the "PhantomRaven" campaign targeted the open-source software ecosystem by distributing 126 malicious npm packages containing concealed, 'invisible' dependencies. These packages, published over several months, bypassed detection mechanisms and were downloaded over 86,000 times by unsuspecting developers. Threat actors leveraged these supply chain attacks to potentially exfiltrate sensitive data, propagate malware, or serve as initial entry points for deeper compromises in downstream applications and organizations dependent on these packages. The campaign highlighted significant vulnerabilities in supply-chain security and the risks associated with open-source package management. This incident is part of a rising trend of sophisticated supply-chain attacks leveraging trusted developer tools and repositories. With increasing regulatory scrutiny and mounting pressure to harden software dependencies, organizations must assess their exposure and implement robust controls to thwart similar attacks in the future.
L3Harris Insider Breach: Zero-Day Exploits Sold to Russian Broker in 2024
In 2024, a former executive at defense contractor L3Harris, Peter Williams, pleaded guilty to stealing and selling eight zero-day cyber exploits to a Russian broker linked to Operation Zero. Williams exploited privileged access at Trenchant, an L3Harris subsidiary, to covertly extract software developed for the U.S. government. He sold these sensitive trade secrets between 2022 and 2024 for several million dollars in cryptocurrency, hiding the transactions through encrypted communications. The sale of these advanced cyber capabilities to an entity catering to Russian state clients exposed L3Harris to estimated damages of $35 million and raised concerns about offensive tools in adversarial hands. This case highlights the increasing risks posed by insider threats exploiting specialized knowledge in the cyber-arms marketplace. Recent trends show threat actors—often with national ties—actively pursuing zero-day exploits via brokers, making supply chain trust and internal controls critical concerns for organizations managing sensitive cyber assets.
PhantomRaven Floods npm with Malicious Credential-Stealing Packages
In April 2024, the 'PhantomRaven' threat campaign targeted the JavaScript software ecosystem by flooding the npm package repository with dozens of malicious packages. These packages, aimed at developers and CI/CD environments, were crafted to harvest authentication tokens, CI/CD secrets, and GitHub credentials when installed. Attackers employed typosquatting and deceptive package naming techniques to trick developers into integrating the compromised code into their applications, thereby enabling broad access to source code and sensitive internal systems. The attack underscores the growing risk posed by software supply chain compromises, impacting thousands of potential downstream applications and organizations. This incident highlights an ongoing surge in supply chain attacks leveraging public code repositories, targeting both individual developers and enterprise development pipelines. Attackers are increasingly employing credential harvesting via trusted open-source channels, intensifying regulatory scrutiny and driving immediate needs for enhanced software integrity controls and threat detection across development workflows.
Microsoft 2024 DNS Outage Paralyzes Azure & Microsoft 365 Globally
On June 20, 2024, Microsoft experienced a global DNS outage that disrupted access to Azure and Microsoft 365 services for customers worldwide. The outage was triggered by an internal DNS configuration issue that affected service resolution and authentication to corporate networks. Users reported being unable to access several core Microsoft services, including email, cloud storage, and collaboration tools. Microsoft’s engineering teams identified the root cause and began remediation, but the incident resulted in widespread operational downtime lasting several hours and affected businesses dependent on Microsoft’s cloud infrastructure. This incident highlights the increasing business impact of cloud infrastructure dependencies and emphasizes the importance of resilient and redundant DNS architectures. Service disruptions of this magnitude reinforce regulatory and customer scrutiny regarding cloud service reliability and prompt renewed attention to business continuity, availability controls, and third-party risk management.
Canada’s Water & Energy Sectors Breached by Hacktivist Attackers in 2024
In early 2024, multiple Canadian critical infrastructure sectors, including water and energy facilities, were breached by hacktivist groups. According to the Canadian Centre for Cyber Security, attackers exploited exposed internet-facing industrial control systems, gaining access and, in some instances, making unauthorized modifications that could have resulted in dangerous physical effects. The threat actors, likely with a political or ideological motive, targeted operational technology (OT) environments, highlighting the vulnerabilities present in essential public services and raising alarm over the potential for severe disruption or damage. This breach reflects a broader trend of hacktivist-driven attacks targeting critical infrastructure worldwide, often leveraging OT/IT convergence and insufficient network segmentation. The incident underscores the urgent need for modern security controls, enhanced monitoring, and robust response strategies to keep pace with rapidly evolving threat actor tactics in the industrial sector.
Malicious npm Package Attack Exposes Software Supply Chain Risks in 2024
In June 2024, security researchers identified a supply chain attack involving at least ten malicious npm packages uploaded to the public registry. Masquerading as legitimate software components, these packages were designed to infect developer environments across Windows, Linux, and macOS. Once installed, they downloaded and executed an information-stealing payload capable of harvesting sensitive data such as credentials and environment variables, potentially enabling lateral movement or further breaches within affected organizations. The attack leveraged trusted software distribution channels to bypass traditional defenses and amplify impact among open-source users. This incident underlines escalating risks in the software supply chain, highlighting how open-source package ecosystems have become prime targets for attackers. The trend represents a growing challenge for organizations relying on third-party code, driving new urgency around vetting procedures, continuous monitoring, and enforcing granular security controls in developer pipelines.
WordPress Plugin Flaw Exposes Sensitive Data to Subscribers in 2024
In June 2024, a critical vulnerability was disclosed in the widely used WordPress 'Anti-Malware Security and Brute-Force Firewall' plugin, which is active on over 100,000 websites. The flaw enables authenticated subscriber-level users to exploit improperly validated file access mechanisms, granting them read access to arbitrary files stored on the web server. This could allow the exposure of sensitive configuration files, credentials, or proprietary business data, significantly undermining site security and user privacy. Plugin maintainers were alerted, and a patched version was released to mitigate the issue. This incident emphasizes the risks posed by third-party plugin vulnerabilities within content management platforms, which remain a persistent attack vector as organizations contend with rapid plugin adoption and reliance on open-source tools.