Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Ransomware Breach at London’s Kido Nursery: Child Data Leaked by Radiant Group
In September 2025, the Kido International nursery chain, operating in several countries and serving over 15,000 families, suffered a ransomware attack orchestrated by the Radiant Group. Attackers accessed sensitive data and photographs of more than 1,000 children, their families, and nursery employees. Some stolen data, including children's pictures and residential addresses, were leaked on a dark web site to pressure Kido into paying a ransom. When extortion attempts failed, the attackers removed the leaked files, but only after making threatening calls to parents, intensifying the distress of the incident. This event underscores the alarming targeting of childcare and educational institutions by cybercriminals, reflecting a broader trend of ransomware attacks exploiting organizations that handle sensitive personal data. The swift arrests by London police of suspects involved demonstrate growing law enforcement action, yet also highlight increased risks for sectors entrusted with children's safety and privacy.
Hackers Exploit Auth Bypass in Service Finder WordPress Theme (CVE-2025-5947)
In the autumn of 2025, a critical authentication bypass vulnerability (CVE-2025-5947) was discovered and actively exploited in the Service Finder WordPress theme, affecting versions 6.0 and older. Attackers leveraged improper validation in the 'service_finder_switch_back()' function, allowing them to impersonate any user—including administrators—simply by sending HTTP requests with a crafted cookie or query parameter. The flaw enabled threat actors to gain full administrative control over thousands of websites, with over 13,800 exploitation attempts recorded by Wordfence since August 1. Attackers could then create or modify site content, add malicious code, or export sensitive data undetected, putting site owners and users at risk. This breach is particularly relevant as it illustrates the continued targeting of WordPress ecosystems with privilege escalation exploits, highlighting growing risks from vulnerable third-party themes and plugins. It underscores the urgency of rapid patching, improved logging, and continuous monitoring to defend against evolving web application threats.
Crimson Collective’s 2025 AWS Cloud Data Breach: Tactics, Impacts, and Security Lessons
In October 2025, the Crimson Collective threat group executed a sophisticated attack targeting Amazon Web Services (AWS) cloud instances belonging to multiple organizations, most notably Red Hat. Utilizing exposed AWS credentials discovered via open-source reconnaissance tools, the attackers escalated their privileges by creating new IAM users with administrative rights. They then enumerated and accessed sensitive resources, including databases and storage volumes, exfiltrating approximately 570 GB of data from private GitLab repositories. The Crimson Collective followed up with extortion demands, leveraging AWS's internal and external email services to apply pressure on victims and collaborating with the Scattered Lapsus$ Hunters to intensify threats. This incident underscores an escalating trend of cloud-focused threat actors exploiting credential exposures to breach critical infrastructure, bypass perimeter controls, and apply multifaceted extortion tactics. Organizations face increasing regulatory and business risk as attackers target cloud identity and API misconfigurations, requiring immediate attention to zero trust controls, egress restrictions, and anomaly detection in multi-cloud environments.
FileFix's 2024 Cache Smuggling Attack: What CISOs Need to Know
In June 2024, a new variant of the FileFix social engineering attack was identified leveraging cache smuggling to bypass endpoint security and deliver a malicious ZIP archive onto victims' systems. Attackers enticed users with phishing emails or deceptive social engineering content, prompting them to click download links. These links abused proxy and cache server behaviors to insert a malware payload into responses that security tools would otherwise block, enabling stealthy malware infection and potential data exfiltration. The attack method proved effective at evading security controls such as endpoint protection, web proxies, and firewalls, increasing the risk to business operations and sensitive data. This incident underscores the sophisticated evolution of social engineering attacks, now boosted by technical exploits like cache smuggling. Attackers are increasingly combining human and infrastructure weaknesses to evade even advanced security defenses, making traditional filtering and sandboxing less reliable. Security operations should urgently revisit email, web proxy, and endpoint controls for these new attack chains.
How Qilin Ransomware Disrupted Asahi’s Breweries in 2025
In late September 2025, Japanese beer giant Asahi fell victim to a major ransomware attack attributed to the Qilin cybercrime group. The attack began on September 29, disabling operations at six of Asahi's Japan-based breweries and resulting in the suspension of production for their flagship and other beer labels. Investigation confirmed that the attackers exfiltrated approximately 27GB of sensitive data, including internal financial documents, employee ID records, and confidential contracts. Qilin publicly claimed responsibility after failed ransom negotiations, leaking data and amplifying operational impacts. The incident forced Asahi to adopt manual processes, delaying product launches and potentially causing an estimated $335 million in financial losses. This breach underscores a persistent and rising trend of ransomware actors targeting large manufacturers by exploiting vulnerable edge devices and employing data theft for leverage. The Qilin group’s evolving tactics—linked to both organized cybercrime and nation-state affiliates—reflect the growing complexity of ransomware risks facing critical supply chain and manufacturing sectors in 2025.
2025 Fortra GoAnywhere Breach: Medusa Ransomware Leverages Zero-Day and Key Compromise
In early 2025, Medusa ransomware operators—tracked as Storm-1175—successfully exploited a critical vulnerability (CVE-2025-10035) in the Fortra GoAnywhere Managed File Transfer (MFT) platform. The attack required access to a private key, indicating either an advanced intrusion or insider compromise. Once inside, the threat actors moved laterally to deploy ransomware payloads, seizing sensitive business data and disrupting managed file transfers for impacted organizations. Multiple enterprises suffered data theft, business downtime, and reputational damage as a result. This incident underscores an ongoing trend of targeting supply chain platforms and MFT products with ransomware via sophisticated access methods. As ransomware groups become more resourceful in exploiting zero-days and leveraging stolen keys, organizations must prioritize proactive threat detection, timely patching, and tighter access controls to counter these evolving tactics.
Clop Ransomware Strikes Oracle: 2024 Zero-Day Breakdown
In early 2024, the Clop ransomware group leveraged a previously unknown zero-day vulnerability in Oracle E-Business Suite to infiltrate the networks of multiple Oracle customers. Exploiting this zero-day, Clop operators gained unauthorized access to critical enterprise systems by bypassing conventional security controls, moving laterally within organization environments, and ultimately deploying ransomware to encrypt sensitive business data. The attack’s vector allowed rapid compromise across industries reliant on Oracle systems, resulting in operational disruptions, potential data exposure, and ransom demands for decryption keys. Security teams across affected organizations were forced into emergency response and containment procedures. This incident highlights a disturbing trend of ransomware gangs exploiting supply-chain vulnerabilities and zero-day flaws in widely used enterprise applications. With attackers aggressively targeting business-critical platforms, the urgency for patch management, network segmentation, and advanced threat monitoring has never been higher, especially as regulatory scrutiny and financial impacts intensify.
Breaking: 'RediShell' RCE Vulnerability Hits 300,000+ Redis Cloud Servers
In early June 2024, security experts identified a critical remote code execution (RCE) vulnerability, dubbed 'RediShell,' impacting Redis servers worldwide. This 13-year-old flaw (CVSS 10.0) enables unauthenticated attackers to execute arbitrary commands and fully compromise exposed hosts. More than 300,000 unpatched Redis instances were found publicly accessible, largely in cloud and hybrid environments, risking complete data loss, ransomware deployment, or lateral movement within enterprise networks. Attackers rapidly weaponized the exploit to automate mass scans and attacks, prompting emergency advisories and patch releases from Redis maintainers and cloud providers. This incident underscores the ongoing risks posed by old vulnerabilities in widely deployed open-source software. The scale and speed of RediShell exploitation demonstrate attackers’ preference for high-impact, low-effort weaknesses in cloud infrastructure, forcing organizations to prioritize patching, network segmentation, and modern Zero Trust models.
Brazilian Military Breach: Zimbra Zero-Day Exploited via Libyan Navy Impersonation
In early 2024, cyber attackers posing as representatives of the Libyan Navy’s Office of Protocol targeted the Brazilian military using a sophisticated spear-phishing campaign. By leveraging a previously unknown zero-day vulnerability in Zimbra Collaboration Suite and delivering malicious emails through compromised inter-country secure communications channels (ICS), the threat actors successfully bypassed traditional perimeter defenses. The attackers' advanced persistent techniques enabled them to gain unauthorized access, exploit sensitive data, and risk critical communications infrastructure for the Brazilian defense sector, with potential exposure of mission-critical information. This incident highlights the escalating risks posed by zero-day vulnerabilities and state-linked or impersonation-driven threat actors, particularly against government and defense organizations. The unusual attack vector via ICS demonstrates evolving tactics beyond routine phishing, reinforcing the necessity for layered security, real-time threat detection, and robust segmentation controls.
FreePBX VoIP Vulnerability Exploited: CVE-2025-57819 Enables Code Execution
In August 2025, a critical SQL injection vulnerability (CVE-2025-57819) was disclosed in FreePBX, a popular open-source VoIP telephony platform. The flaw, found in the system's web-based admin interface, allowed unauthenticated attackers to inject malicious SQL queries via a vulnerable 'brand' parameter, enabling arbitrary modification of the backend database. Attackers have already been observed using this vulnerability to gain remote code execution by inserting persistent cron jobs that continuously recreate a web shell on the target server, providing full access for data exfiltration or fraudulent activities. Organizations using unpatched versions may be exposed to call fraud, impersonation, lateral movement, or further compromise of VoIP infrastructure. This breach highlights a persistent trend of attackers exploiting critical web application vulnerabilities shortly after public disclosure, underscoring the importance of proactive patching and real-time threat detection. It also illustrates attackers’ growing focus on embedded and telecom systems as entry points for broader enterprise compromise.
EU Chat Control Law Threatens Privacy and Encryption in 2024
In 2024, the European Union considered sweeping legislation called Chat Control, aimed at mandating providers of end-to-end encrypted messaging apps to implement client-side scanning of user content for illegal material, notably child sexual abuse material (CSAM). Major privacy advocates and technology leaders, including Signal's CEO, highlighted that such a regulation would undermine privacy by requiring access to sensitive content before encryption. Technical experts warned that creating lawful access inherently weakens the entire encrypted ecosystem, exposing all users—including journalists, activists, and vulnerable groups—to potential surveillance or exploitation, and might force some encrypted messaging services to exit the EU market entirely. This proposed law has sparked an urgent debate on digital privacy, as its adoption could set a global precedent for government-mandated encryption backdoors. The current climate of rising concerns over lawful and extrajudicial surveillance, combined with persistent cyber threats, amplifies the pertinence and risks associated with such regulatory initiatives.
Oracle Zero-Day Breach: Clop Ransomware Group Orchestrates Global Data Theft in 2024
In mid-2024, the Clop ransomware gang exploited a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite, executing a sophisticated chain of exploits for unauthorized, pre-authenticated remote code execution. Attackers infiltrated multiple enterprise and public-sector environments, stealing significant volumes of data before issuing high-dollar extortion demands—some as high as $50 million. The breaches went undetected for weeks, with Oracle disclosing the flaw only after victims began receiving ransom emails and the U.S. CISA catalogued the vulnerability as actively exploited. This incident underscores the rapid weaponization of newly discovered vulnerabilities by well-resourced threat actors. As enterprises increase reliance on complex ERP systems, threats leveraging zero-day exploits and multi-bug chains have become a pressing concern, signaling the need for enhanced threat detection, segmentation, and zero-trust controls.