Find what you’re looking for
Browse everything
6,843 results in Threat Reports
Over 75,000 WatchGuard Firebox VPN Devices Vulnerable to Critical RCE Flaw
In October 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-9242, was disclosed in WatchGuard Firebox network security appliances. Nearly 76,000 public-facing Firebox devices worldwide are exposed, primarily in the United States and Europe. The flaw resides in the Fireware OS 'iked' process, which handles IKEv2 VPN negotiations. Attackers can exploit the vulnerability without authentication by sending specially crafted IKEv2 packets, leading to out-of-bounds memory writes and potentially full device compromise. WatchGuard has issued patches, but thousands remain unprotected, as many affected devices run versions that are end-of-life or unpatched. This incident underscores a continuing trend of attackers targeting network infrastructure with VPN-centric vulnerabilities, particularly impacting organizations reliant on legacy or unpatched systems. The rise of critical edge device exploits heightens urgency for patching and proactive segmentation, especially as regulatory scrutiny around infrastructure security tightens.
Muji Halts Online Sales After Supply Chain Ransomware Hits Logistics Partner
In June 2024, Japanese retail giant Muji was forced to suspend its online sales after a logistics outage caused by a ransomware attack on Askul, its major delivery partner. The incident was triggered when attackers compromised Askul's systems, encrypting critical operational data and disrupting supply chain operations. As a result, Muji's ability to fulfill customer orders was severely impacted, highlighting the downstream risk associated with third-party vendors in an interconnected retail ecosystem. This breach not only halted Muji's core e-commerce activities but also underscored the vulnerability of global supply chains to cyber extortion. This event is particularly relevant as ransomware groups increasingly leverage supply chain attacks to maximize disruption and extort multiple victims. It reflects a rapid evolution in attacker tactics, where targeting essential providers amplifies business risk, and regulatory scrutiny on supply chain resilience continues to intensify.
Qantas 2024 Data Breach: Legal Orders Fail, Security Controls Critical
In early 2024, Qantas Airways experienced a significant data breach when cybercriminals exfiltrated sensitive passenger and employee information. Despite an Australian court issuing an injunction to prevent the distribution of stolen data, the responsible threat actors ignored the legal order and leaked the compromised datasets on the dark web. The breach was confirmed by multiple data breach notification services. Attackers leveraged unencrypted traffic vulnerabilities and lateral movement inside Qantas systems, bypassing internal controls and highlighting deficiencies in east-west traffic security and zero trust segmentation. Business operations faced regulatory pressure, reputational damage, and potential compliance issues. This incident underscores the difficulties organizations face in containing modern breaches, especially as legal measures alone cannot halt the distribution or misuse of exposed data. The continued release and trade of stolen datasets emphasize the importance of proactive technical controls and the need for robust, automated detection and data governance in line with evolving compliance standards.
Linux Fileless Malware in 2024: Syscall(memfd_create) Unlocks New Attack Vectors
In October 2024, security researchers discovered a new Linux-targeting fileless malware that exploits Python and the direct use of syscalls—specifically 'memfd_create'—to execute payloads entirely in memory, bypassing traditional disk-based detection. The attack begins with a Python dropper embedding a base64-encoded ELF binary, which is loaded directly into memory using syscall(319), then executes file encryption using a simple 1-byte XOR key. While the second stage payload is rudimentary and appears to be a proof-of-concept, the methodology demonstrates how easily threat actors can evade filesystem-based controls and endpoint security tools on Linux systems. The incident underscores an increasing trend in fileless malware and direct syscall manipulation, especially on Linux servers and cloud workloads. These advanced tactics make traditional detection and prevention approaches less effective, urging organizations to adopt stronger memory and process monitoring, inline threat detection, and zero-trust segmentation to mitigate similar threats.
Agentic AI's OODA Loop Vulnerability: Prompt Injection & Architecture Risks in 2025
In October 2025, a major vulnerability was revealed in agentic AI systems’ OODA (Observe, Orient, Decide, Act) decision loops, where adversaries exploited prompt injection, training data poisoning, and tool protocol confusion to compromise autonomous AI agents. Attackers planted triggers and malicious instructions in web-accessible content and tool descriptions, which were ingested by AI models, bypassing privilege separation and contaminating operational state and chat history. The incident resulted in persistent data leaks, unintentional tool actions, and the propagation of backdoors and compromised context across organizations deploying AI-driven automation and analytics. This exposure underscores a critical and growing risk: as organizations adopt increasingly autonomous AI, vulnerabilities related to data integrity, input trust, and OODA loop manipulation have escalated. Recent trends show surges in prompt injection exploits, AI-powered toolchain attacks, and regulatory focus on AI integrity controls, highlighting an urgent need for architectural reforms and robust zero trust measures.
TikTok-Delivered Infostealer: ClickFix Campaign Compromises Credentials
In October 2025, a widespread campaign leveraged TikTok videos masquerading as free activation guides for popular software titles—including Windows, Adobe products, and Spotify—to distribute information-stealing malware. Attackers used "ClickFix" social engineering to instruct viewers to run obfuscated PowerShell commands, delivering the Aura Stealer infostealer and an additional payload via Cloudflare-hosted executables. The attack enabled threat actors to harvest browser credentials, authentication cookies, and wallet data from victims, leading to high risk of account compromise and data theft. Infection occurred after users were tricked into executing single-line commands under the guise of software activation or fixes. This incident highlights the increasing weaponization of social media platforms as initial access vectors for malware and demonstrates the growing sophistication of infostealer campaigns. The trend underscores the urgent need for organizations to address social engineering risks and update awareness programs as attackers rapidly innovate their distribution methods.
Fake Homebrew and LogMeIn Sites Spread Infostealer Malware via Google Ads in 2025
In October 2025, a sophisticated malvertising campaign exploited Google Ads to distribute infostealing malware via fake Homebrew, LogMeIn, and TradingView websites targeting macOS users and developers. The threat actors registered over 85 convincing domains and lured victims to enter terminal commands that downloaded malware such as AMOS (Atomic macOS Stealer) and Odyssey Stealer. Once executed, these payloads bypassed security controls, harvested browser credentials, cryptocurrency wallets, and sensitive files, and forwarded the stolen data to threat actor-controlled servers. This campaign underscores the effectiveness of ClickFix social engineering techniques and highlights the risks of trust in search advertising. The incident is particularly relevant as infostealer malware continues to evolve with new tactics, including sophisticated social engineering, supply chain targeting, and persistent access capabilities. Organizations face increasing pressure to defend against rapidly shifting malware delivery channels and enforce user education to reduce the likelihood of compromise.
Europol Takedown of SIMCARTEL: SIM Box Fraud Network Disrupted
In October 2024, Europol led a coordinated international operation to dismantle a sophisticated cybercrime syndicate known as "SIMCARTEL". This network, spanning Austria, Estonia, and Latvia, leveraged over 1,200 SIM box devices and 40,000 active SIM cards to conduct large-scale phishing, credential theft, and financial fraud across more than 3,200 recorded cases. Authorities linked the group to $5.8 million in financial losses, the creation of 49 million fraudulent accounts, and infrastructure facilitating criminal services in over 80 countries. The takedown resulted in seven arrests, seizure of servers, SIMs, websites, luxury vehicles, and the freezing of suspect assets. This incident highlights the growing global threat posed by SIM farms and SIM box networks, which enable scammers to evade detection, commit diverse types of fraud, and undermine trust in online communications. The rapid adoption of similar tactics worldwide puts financial institutions, telecoms, and consumers increasingly at risk.
Iranian Nation-State Hackers Target John Bolton’s Email in 2021 Security Breach
In July 2021, former U.S. National Security Adviser John Bolton's personal email account was compromised by cyber actors believed to be linked to the Islamic Republic of Iran. The attackers gained unlawful access, extracted emails containing potentially sensitive information, and leveraged these materials to threaten and attempt to coerce Bolton, including by referencing classified content and threatening public disclosure. The FBI became aware when Bolton’s representative reported the intrusion and subsequent extortion attempts, with the threat actor referencing previous high-profile leaks to amplify pressure. It remains unclear if any sensitive materials were publicly disseminated, but the incident elevated concerns around the exposure of classified or sensitive government information through personal communication channels. This incident highlights a persistent risk from nation-state actors targeting senior government officials, leveraging cyber-intrusions for espionage and psychological operations. With the proliferation of similar tactics against political, governmental, and critical infrastructure targets globally, this attack reflects an urgent need for heightened security controls on personal communications of high-profile public figures.
Sotheby’s 2025 Data Breach: Employee Financial Data Compromised
In July 2025, Sotheby's, the renowned international auction house, identified a significant cybersecurity breach in which an unknown threat actor exfiltrated sensitive employee information, including full names, Social Security numbers, and financial account details. The breach was discovered on July 24, 2025, and an internal investigation with data protection experts and law enforcement extended over two months to confirm the nature and scope of compromised data. Sotheby’s responded by notifying impacted employees and offering a year of free identity protection and credit monitoring services. No ransomware group claimed responsibility, and the number of affected individuals remains undisclosed. This incident underscores ongoing risks facing financial and high-value service sectors, especially from sophisticated attacks targeting personnel data for monetization and fraud. Organizations with sensitive employee or client financial data must act promptly as regulatory scrutiny tightens and attacks on high-net-worth entities continue to escalate.
F5 Supply Chain Breach 2025: China-Linked Attack Exposes Global BIG-IP Risk
In October 2025, F5 Networks disclosed a major cybersecurity incident involving a China-linked nation-state group (UNC5291) that gained unauthorized access to its infrastructure. Attackers reportedly maintained covert access for at least a year, stealing F5 BIG-IP source code and information on as-yet-undisclosed vulnerabilities. While F5 stated there’s no evidence of active exploitation of these flaws, the breach affects more than 266,000 exposed BIG-IP instances worldwide. The attackers leveraged advanced persistence techniques and deployed specialized malware, raising serious concerns about global supply chain integrity. This breach highlights the persistent targeting of critical infrastructure vendors by highly resourced nation-state actors. Government agencies and enterprises face heightened urgency as regulatory bodies issue emergency directives to patch devices, with compliance and operational risks elevated by the scale and sophistication of the attack.
Microsoft Patches Highest-Severity ASP.NET Core Vulnerability in 2025
In October 2025, Microsoft patched CVE-2025-55315—the highest-severity vulnerability ever identified in ASP.NET Core. The flaw, found in the Kestrel web server, allowed authenticated attackers to perform HTTP request smuggling, enabling them to hijack user credentials, bypass security controls, and potentially carry out privilege escalation or injection attacks. The vulnerability exposed sensitive data, permitted internal malicious requests, and in certain scenarios, enabled attackers to compromise integrity and availability by altering server files or forcing crashes. Microsoft responded with urgent patches for multiple ASP.NET Core and Visual Studio versions. The urgency around this incident reflects a rising trend in the exploitation of critical web application vulnerabilities. Such flaws highlight the importance of prompt patch management and robust internal segmentation controls, as sophisticated attacks continue to target application-layer weaknesses for lateral movement and data exfiltration.