Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Salesforce AI Prompt Injection Bug Exposes CRM Data in 2025 Breach
In September 2025, security researchers at Noma Security identified a critical vulnerability, termed ForcedLeak (CVSS 9.4), in Salesforce Agentforce, an AI-powered platform for constructing automation agents. The flaw allowed threat actors to launch indirect prompt injection attacks against Agentforce’s integration with Salesforce’s CRM, opening avenues for exfiltration of sensitive customer relationship data. The attack leveraged manipulated AI prompts that bypassed input validation, ultimately resulting in confidential business and customer information being at risk of exposure until Salesforce deployed a rapid patch. This incident highlights the growing risks stemming from AI prompt injection vulnerabilities as more enterprises embrace AI-integrated SaaS for customer-facing processes. The Salesforce episode underscores regulatory and security urgency to address trust boundaries around rapidly-evolving AI within business-critical platforms.
Vane Viper Powers 1 Trillion DNS Queries in 2025 Malvertising Mega-Breach
In September 2025, the threat actor group known as Vane Viper was revealed to be operating a vast and covert ad fraud and malvertising network, leveraging a staggering one trillion DNS queries to enable malware distribution globally. According to a detailed Infoblox technical report, Vane Viper manipulated core internet infrastructure using shell companies and complex ownership structures to obfuscate responsibility and perpetuate malicious adtech practices. Their operations enabled widespread malvertising campaigns, significantly impacting advertising platforms and exposing users worldwide to illicit downloads and credential theft. This breach underscores a recent surge in the use of advanced DNS tunneling and obfuscation tactics in cybercrime, particularly within ad fraud and malvertising schemes. The incident exemplifies how attackers increasingly exploit foundational internet protocols, challenging traditional detection and defense measures while prompting urgent regulatory attention and industry-wide response.
Cisco ASA Zero-Day (CVE-2025-20333) Breach: Inside the CISA Emergency Response
In September 2025, Cisco disclosed a critical zero-day vulnerability (CVE-2025-20333, CVSS 9.9) affecting its Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) Software. Attackers actively exploited improper input validation in the VPN web server, enabling them to bypass authentication and potentially gain unauthorized access to sensitive environments. Cisco urged immediate patching as exploitation was observed targeting both perimeter and internal firewalls, demonstrating advanced lateral movement strategies. This exploitation prompted an emergency mitigation directive from CISA to reduce risk across U.S. federal agencies and private enterprises. This incident underscores the ongoing evolution of threat actors leveraging zero-days to target critical infrastructure firewalls, coinciding with a nationwide spike in sophisticated, identity-driven attacks. Organizations are under increasing regulatory scrutiny to patch rapidly and advance segmentation, threat monitoring, and east-west traffic controls.
RedNovember: Chinese APT Weaponizes Public PoCs for Rapid Government Espionage in 2024
In 2024, a state-aligned Chinese advanced persistent threat (APT) group known as RedNovember, or Storm-2077, conducted an extensive cyber espionage campaign targeting high-profile organizations, especially government agencies and technology firms across Asia and Europe. Rather than developing custom exploits or zero-days, RedNovember systematically monitored security researcher disclosures and quickly weaponized publicly released proof-of-concept (PoC) vulnerability exploits to compromise edge devices such as VPN gateways, firewalls, and remote access platforms. Notable targets included Taiwan’s technology sector and Fijian government entities, coinciding with periods of heightened geopolitical activity. The group's attacks enabled deep network intrusion and intelligence exfiltration in line with Chinese state interests. This campaign exemplifies a fast-growing threat: sophisticated threat actors operationalize public vulnerability disclosures before organizations can patch, increasing the risk of high-impact breaches. The reliance on open-source PoCs reduces barriers to entry, accelerates attacks, and puts pressure on organizations to shorten vulnerability patch cycles.
Russia-Backed Disinformation Targets Moldova's 2024 Election
In early 2024, cybersecurity researchers uncovered a coordinated Russian disinformation campaign aimed at Moldova’s upcoming national elections. Threat actors, believed to be linked to state-sponsored Russian groups, leveraged social media platforms, fake news websites, and malicious amplification techniques to spread false narratives and undermine trust in Moldova’s electoral process. The campaign, tracked back to tactics active since 2022, included distribution of forged documents and coordinated inauthentic behavior to influence public perception and destabilize the region ahead of the vote. This incident reflects a broader surge in state-backed information operations targeting elections across Europe and globally. Such campaigns erode democratic institutions, manipulate public opinion, and heighten information security risks for governments and citizens. Organizations and governments must strengthen their capabilities to detect and mitigate influence operations and protect democratic processes.
Scattered Spider Ransomware: Teen Member Arrested, Group Claims Shutdown in 2024
In June 2024, law enforcement arrested a teenage member of the notorious Scattered Spider ransomware group, a cybercriminal collective linked to disruptive attacks against major organizations including MGM Resorts and Caesars Entertainment. The arrest followed claims by the group that it was shutting down operations amid heightened law enforcement scrutiny and infighting among its members. Scattered Spider became infamous for leveraging social engineering and identity-based attacks to gain initial entry, then rapidly moving laterally to deliver ransomware and conduct data theft. This latest development underscores the increasingly aggressive response from law enforcement to high-impact ransomware threats. The recent action highlights the continued evolution and volatility of ransomware groups, many of which are now using sophisticated identity compromise and cloud-based attack chains. Organizations should remain vigilant as law enforcement disruptions may cause threat actors to splinter, rebrand, or accelerate new attack campaigns using similar techniques.
Federal Agency Breach: GeoServer Zero-Day Exposes Gaps in 2024 Cyber Defense
In July 2024, attackers exploited CVE-2024-36401—a critical remote code execution vulnerability in the open source GeoServer mapping server—less than two weeks after public disclosure, to breach a US federal civilian executive branch (FCEB) agency. The adversaries gained initial access to public-facing GeoServer instances, subsequently moving laterally through the network using living-off-the-land techniques, dropping web shells (including China Chopper), leveraging brute force and privilege escalation attacks, and establishing command-and-control with open-source tools. Due to delayed patching and inadequate incident response, attackers remained undetected for three weeks, compromising additional servers and extracting sensitive information related to geospatial data and internal credentials. This incident exemplifies the growing risk posed by rapid, post-disclosure exploitation of critical vulnerabilities, particularly those affecting widely deployed open source software. The breach also highlights persistent gaps in vulnerability management, security operations, and incident response readiness at major organizations, driving new urgency around patch timeliness and comprehensive monitoring.
Persistent Exploitation of Hikvision Camera Vulnerabilities (2017–2025): Lessons for IoT Security
Between 2017 and 2025, waves of exploit attempts have targeted Hikvision IP cameras using vulnerabilities such as CVE-2017-7921. Attackers abused easily guessable or default credentials passed via HTTP GET parameters, leveraging weak authentication mechanisms to access sensitive camera endpoints, user configurations, and device data. The entry vector relied on IoT device misconfigurations and insecure design, while brute-force attempts and credential stuffing remain prevalent. This activity has potential to expose live feeds, user data, and create a foothold into internal networks, with implications for privacy, compliance, and physical security. This breach is notable today as attempts to exploit Hikvision and similar IoT cameras continue at scale, highlighting persistent IoT security challenges due to poor credential hygiene, slow patch adoption, and device interface limitations. The incident demonstrates ongoing risk as attackers increasingly automate targeting of legacy and unpatched embedded devices across global networks.
Webshells Hidden in .well-known Directories: The 2024 Web Application Attack Trend
In September 2024, cybersecurity researchers observed a surge in malicious actors targeting the .well-known directory on web servers to deploy PHP-based webshells. Attackers exploited this typically-overlooked directory, intended for status and authentication files, as it remains web-accessible but hidden within the Unix filesystem. Logs and honeypot data detailed repeated attempts to probe and establish footholds via .well-known and its subdirectories, such as acme-challenge and pki-validation, with the clear goal of persistent, covert remote control. This technique illustrates an evolving trend in web application attacks, where multistage threats exploit common web standards and overlooked controls. Organizations face heightened risk from such stealthy compromises, underscoring the need for continuous monitoring and adaptive defense in the current threat landscape.
Stately Taurus: 2022 Bookworm APT Campaign Unveiled in Southeast Asia
In 2022, cybersecurity researchers traced sophisticated spear-phishing attacks against government and commercial entities in Southeast Asia to Stately Taurus, a Chinese advanced persistent threat (APT) group active since at least 2012. Using the Bookworm malware, a modular remote access trojan (RAT) with advanced C2 and lateral movement capabilities, the threat actor gained initial access via tailored phishing emails, followed by persistence and data exfiltration. Detailed code analysis, shared infrastructure, unique PDB paths, and parallel tooling (e.g., ToneShell) confirmed high-confidence attribution. The campaign exposed OPSEC artifacts and overlapping infrastructure, confirming Stately Taurus’s long-term commitment to targeted espionage. This incident underscores a broader surge in targeted APT campaigns using modular malware and sophisticated infrastructure reuse. The precision of the Unit 42 Attribution Framework exemplifies the growing emphasis on multi-layered, evidence-based attribution, which is now critical as state-linked groups automate and diversify their attack techniques.
Cisco SNMP Zero-Day: Active Exploits Target IOS XE Network Devices in 2025
In September 2025, Cisco disclosed a critical vulnerability (CVE-2025-20352) affecting its IOS and IOS XE operating systems, actively exploited via the SNMP subsystem. The flaw stems from a stack-based buffer overflow that allows authenticated remote attackers to trigger denial-of-service or potentially achieve root-level remote code execution. Attackers utilized crafted SNMP packets over both IPv4 and IPv6 to compromise devices with SNMP enabled, including popular models like the Meraki MS390 and Catalyst 9300. Cisco confirmed attacks in the wild following credential compromise, urging immediate patching, as no reliable workarounds exist. This incident highlights the ongoing risks associated with ubiquitous network protocols like SNMP and the necessity of rapid response to zero-day exploits within core infrastructure. The rise of attacks targeting network management systems signals both increased attacker sophistication and heightened regulatory scrutiny.
GitHub Notification Phishing Abuses Y Combinator Brand for Crypto Theft (2025)
In September 2025, a widespread phishing campaign exploited GitHub's notification system to target software developers for cryptocurrency theft. Attackers impersonated the reputable startup accelerator Y Combinator and generated hundreds of fake issue notifications across GitHub repositories, tagging users to trigger authentic-looking emails. Victims were lured to a spoofed Y Combinator website with a subtle domain misspelling, where they were prompted to connect cryptocurrency wallets for 'verification.' Behind the scenes, obfuscated scripts authorized malicious transactions, draining wallets once users signed in. The fraudulent repositories were quickly reported and taken down, but it's unclear how many users suffered financial losses. This attack highlights the growing trend of threat actors leveraging trusted platforms for sophisticated social engineering, particularly as notification-based phishing campaigns increase and cryptocurrency remains a lucrative target. The evolving tactics underscore the urgent necessity for enhanced vigilance, technical controls, and authentication checks across digital collaboration tools.