Find what you’re looking for
Browse everything
6,838 results in Threat Reports
Fortra GoAnywhere MFT 2024: License Servlet Zero-Day Exposes File Transfer Infrastructure
In June 2024, Fortra disclosed a critical vulnerability (CVE-2024-XXXX) in its GoAnywhere Managed File Transfer (MFT) product’s License Servlet, enabling unauthenticated attackers to execute system commands remotely via command injection. Researchers discovered that by submitting crafted requests to the vulnerable servlet, attackers could gain full control of affected servers. No authentication was required, significantly increasing the risk of exploitation. Fortra released immediate security updates and guidance after reports of active exploitation attempts surfaced. Impacted organizations primarily included enterprises leveraging GoAnywhere MFT for secure file transfers, resulting in heightened risk of data exfiltration and business disruption. This incident underscores the ongoing importance of timely patch management, especially for widely used secure transfer solutions. The vulnerability’s ease of exploitation and criticality reflects trends of attackers targeting third-party file transfer products—often for extortion or ransomware campaigns—prompting renewed regulatory and industry scrutiny.
Inside the Ivanti EPMM 2025 Breach: How China-Linked APTs Exploited Zero-Day Flaws
In May 2025, advanced threat actors exploited two zero-day vulnerabilities (CVE-2025-4427 and CVE-2025-4428) in Ivanti Endpoint Manager Mobile (EPMM), targeting on-premise deployments. Attackers used an authentication bypass and code injection to deliver modular malware kits via crafted API requests, enabling them to gain initial access, perform reconnaissance, harvest credentials, and establish persistence within target environments. While Ivanti released patches shortly after discovery, the exploits were reportedly active before disclosure, affecting a limited set of organizations—primarily through an advanced persistent threat (APT) operation attributed by third-party researchers to a China-nexus espionage group. This incident underscores the growing trend of sophisticated supply chain and zero-day attacks on enterprise mobile device management (MDM) platforms, which are increasingly treated as high-value assets due to their access to sensitive business operations. Organizations must remain vigilant by prioritizing comprehensive patch management and strengthening internal traffic monitoring to mitigate similar risks.
Canada Seizes $40 Million in Historic Crackdown on TradeOgre Crypto Exchange
In September 2025, the Royal Canadian Mounted Police (RCMP) dismantled the TradeOgre cryptocurrency exchange, seizing over $40 million in digital assets linked to alleged financial crimes. The operation was initiated following intelligence from Europol, leading to an investigation by the Money Laundering Investigative Team (MLIT) that uncovered the exchange's lack of regulatory compliance, such as evading Know Your Customer (KYC) protocols and failing to register with Canada's FINTRAC. The lack of oversight facilitated the laundering of cybercrime proceeds, particularly via privacy-focused cryptocurrencies like Monero, culminating in the country's largest-ever asset seizure. This incident underscores the growing scrutiny and regulatory pressure on privacy-centric platforms facilitating anonymous digital transactions. The enforcement action highlights heightened law enforcement capabilities targeting underground exchanges and reflects broader trends in global efforts to curb illicit finance within the crypto sector.
ShadowLeak: Zero-Click OpenAI ChatGPT Bug Exposes Gmail Data in 2025
In June 2025, a critical zero-click vulnerability, codenamed ShadowLeak, was discovered in OpenAI ChatGPT’s Deep Research agent. This flaw enabled attackers to exfiltrate sensitive Gmail inbox content merely by sending a specially crafted email to victims using the agent, requiring no user action. Security researchers from Radware, after identifying the issue, disclosed it responsibly to OpenAI, which released a fix in early August 2025. The flaw had the potential to compromise confidential data across enterprise and personal Gmail accounts, raising major concerns around AI-driven integrations and email ecosystem security. This breach highlights the accelerating convergence of artificial intelligence with traditional email attack surfaces, raising unique risks around invisible, automated threat vectors. With GenAI agents increasingly embedded into communication flows, attackers are rapidly adapting zero-click tactics to exploit new behaviors and trust assumptions.
MalTerminal: GPT-4-Powered Malware Signals New Era of AI Cyberattacks
In September 2025, SentinelOne’s SentinelLABS revealed the existence of 'MalTerminal,' the first documented malware leveraging GPT-4-powered Large Language Model (LLM) capabilities. Demonstrated at LABScon 2025, MalTerminal introduces LLM-driven automation within the malware lifecycle—enabling it to generate ransomware payloads, establish reverse shells, and craft social engineering content in real time. The attack method shows that malware authors are blending AI models directly into code to rapidly escalate privilege, automate lateral movement, and obfuscate command-and-control traffic. Business impact includes advanced, adaptive attacks that defeat legacy detection, heightening risks of data exfiltration, extended dwell time, and operational disruption. MalTerminal’s emergence is a bellwether for the rapid weaponization of generative AI technology by threat actors. This incident highlights the urgent need for organizations to re-evaluate traditional controls and accelerate adoption of cognitive security, visibility, and real-time policy enforcement frameworks to keep pace with evolving adversary techniques.
LastPass Exposes macOS Atomic Infostealer Attack via Fake GitHub Repositories
In mid-2025, LastPass identified and warned users about a sophisticated information-stealing campaign targeting Apple macOS users. Attackers set up fraudulent GitHub repositories impersonating reputable projects, including LastPass, to distribute versions of the 'Atomic' infostealer malware. Unsuspecting users downloading these fake tools had their credentials, browser data, and sensitive files compromised. The campaign leveraged social engineering, search poisoning, and open-source developer trust to infiltrate victims’ systems, posing significant risk to both individual and enterprise security. The incident highlights continued abuse of trusted development platforms to target the software supply chain. This breach is noteworthy as it reflects the growing trend of attacker focus on macOS endpoints and the exploitation of open-source ecosystems. With supply chain attacks and infostealer campaigns rising sharply in 2025, organizations face increasing pressure to enhance their controls for code provenance, user awareness, and endpoint defense.
How 'ShadowLeak' Turned ChatGPT into a Data Exfiltration Channel
In mid-2024, security researchers uncovered a novel cyberattack—dubbed 'ShadowLeak'—that exploits OpenAI’s ChatGPT platform to surreptitiously exfiltrate emails and sensitive enterprise data. Threat actors leveraged covert techniques to route data through OpenAI’s infrastructure, effectively bypassing traditional network security controls and leaving virtually no forensic traces within the victim organization. The attack exploits the trusted status of sanctioned AI platforms inside corporate environments, making malicious exfiltration activity blend in with legitimate AI-assisted workflow traffic. As a result, internal monitoring and traditional DLP tools fail to identify or intercept the breach, putting confidential business communications and data at risk. This incident spotlights the growing risk posed by increasingly sophisticated methods of data exfiltration over legitimate AI services. With organizations accelerating the adoption of generative AI in critical business processes, attackers are exploiting technical and policy blind spots, making traditional perimeter defenses inadequate against such stealthy insider threats.
Critical Fortra GoAnywhere 2025 Vulnerability Enables Command Injection Attacks
In early June 2025, Fortra disclosed a critical command injection vulnerability (CVE-2025-10035) in its GoAnywhere managed file transfer (MFT) solution. The flaw could be exploited by unauthenticated attackers if the management interface was exposed to the Internet, allowing remote code execution and potential takeover of affected servers. Fortra warned that active exploitation had been observed, and threat actors were leveraging the vulnerability to move laterally within compromised networks and facilitate data exfiltration. The incident affected a broad range of organizations reliant on GoAnywhere for secure file transfers, raising concerns about operational continuity and potential data exposure. The attack underscores the ongoing risk posed by internet-exposed enterprise services and highlights the urgent need for timely patching of high-severity vulnerabilities. Increasingly, ransomware and data theft campaigns are targeting known security flaws in widely-used third-party solutions, putting supply chains and regulatory compliance at risk.
AI Supercharges Ransomware: SMBs Face New Extortion Tactics in 2024
In early 2024, small and medium-sized businesses (SMBs) experienced a significant surge in ransomware attacks, with threat actors leveraging AI-driven tools to automate reconnaissance, exploit vulnerabilities, and escalate extortion tactics. Attackers typically gained initial access through phishing emails, credential compromise from infostealer malware, or unpatched systems, then deployed dual-pronged ransomware campaigns involving both data encryption and data theft for double extortion. These incidents were characterized by rapidly evolving tactics, including deployment of 'EDR killer' malware to neutralize security controls and the emergence of AI-powered ransomware strains like PromptLock, further complicating incident recovery. Businesses reported severe operational disruptions, permanent data loss, and in some cases, closure due to the financial and reputational fallout. The proliferation of ransomware-as-a-service (RaaS), combined with AI-enabled attack chains, has dramatically widened the threat landscape for SMBs—who account for nearly 9 in 10 ransomware breaches. The current wave highlights the urgent need for organizations of all sizes to revisit their defensive posture, ensure visibility, and adopt zero trust and modern detection solutions to mitigate evolving risks.
Gamaredon & Turla: Joint APT Campaign Strikes Ukraine in 2025
In early 2025, a previously unseen collaboration between advanced persistent threat groups Gamaredon and Turla was discovered in Ukraine. Utilizing ESET telemetry, researchers identified co-compromises in which Gamaredon provided initial access using spearphishing and malicious PowerShell-based tools (such as PteroGraphin and PteroOdd), allowing Turla to deploy its exclusive Kazuar backdoor on select high-value targets. The attacks, attributed to Russian FSB-linked groups, targeted governmental entities and leveraged encrypted channels, PowerShell scripting, and multi-stage malware delivery via compromised web services and cloud platforms. Impact was mainly concentrated on the potential exfiltration of sensitive national intelligence. This incident underscores a growing trend of threat actor collaboration within nation-state cyber operations, blurring lines between operational roles and increasing attack efficiency. The overlapping TTPs and use of novel access and persistence mechanisms signal heightened complexity in the Eastern European threat landscape, demanding urgent operational and strategic defensive improvements.
GoAnywhere 2025: Maximum-Severity Vulnerability Spurs Ransomware Fears Globally
In September 2025, a critical vulnerability (CVE-2025-10035) was disclosed in Fortra's GoAnywhere Managed File Transfer (MFT) service, exposing over 3,000 organizations, including major Fortune 500 companies, to significant risk. The flaw, a maximum-severity deserialization bug requiring no authentication, allows remote attackers to gain unauthorized code execution by leveraging a crafted license response signature. While no exploitation was detected at the time of disclosure, researchers warn that ransomware groups—such as Clop, known for previously targeting file-transfer software—are likely to attempt mass exploitation based on past patterns and the high impact of this vulnerability. If exploited, this flaw could result in widespread data theft, business disruption, and regulatory penalties. This incident is especially important as it mirrors techniques used in highly publicized attacks on file-transfer applications, highlighting increased sophistication and urgency among ransomware operators. The ongoing evolution of such vulnerabilities amplifies the threat to critical data flows and underscores rising compliance and zero trust enforcement needs across enterprises.
ICS Malware Attacks Spike in Q2 2025: Key Lessons for Industrial Automation Security
In Q2 2025, industrial automation systems worldwide experienced significant and persistent threats, with 20.5% of ICS (Industrial Control Systems) computers encountering malicious objects, despite a slight quarterly decrease. Attackers leveraged a multi-stage campaign, beginning with phishing emails and malicious documents to gain access, and subsequently deploying next-stage malware such as spyware, ransomware, and cryptominers. Regions like Africa and sectors such as biometrics were among the most targeted, while common initial infection sources included malicious internet resources, infected emails, and removable media devices. Multiple sophisticated malware families (over 10,000 variants) exploited ICS security gaps to enable lateral movement, persistent access, and data exfiltration, impacting operational resilience and increasing risk of service disruption for critical industries. This incident underscores the continued evolution of ICS-targeting malware and the increasing sophistication of attack vectors in the operational technology sector. The upward trend in email-based infiltration and malicious cloud links, coupled with persistent use of multi-stage payloads, highlights the urgent need for robust, layered security, Zero Trust policies, and compliance alignment to protect critical infrastructure environments against both commodity and targeted threats.