Raven Stealer Uses Telegram to Pilfer Chromium Data in 2024Raven Stealer Uses Telegram to Pilfer Chromium Data in 2024
In early 2024, security researchers identified a new infostealer variant, Raven Stealer, being distributed via underground forums and cracked software packages. The malware targets Windows systems and focuses on stealthy extraction of browser data, particularly from Chromium-based browsers such as Google Chrome. Once installed, Raven Stealer harvests credentials, cookies, browser histories, and cryptocurrency wallets before exfiltrating the data through encrypted Telegram channels. The attack exploits unmonitored endpoints and capitalizes on users’ download of pirated or repackaged software, resulting in widespread compromise of sensitive authentication data across multiple organizations.
This incident underscores the ongoing evolution of commodity malware and demonstrates the sophistication with which even low-cost infostealers are leveraging encrypted communications and social engineering. As attackers continue to innovate with new TTPs and delivery vectors, organizations must strengthen endpoint monitoring and policy enforcement to reduce exposure to similar threats.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Microsoft September 2025 Patch Tuesday: Critical Privilege Escalation Flaws Demand Immediate Action
In September 2025, Microsoft disclosed 81 security vulnerabilities across its portfolio, with a significant focus on escalation of privilege (EoP) flaws. Of the CVEs released, 38 enabled attackers to gain elevated access after initial compromise, affecting modules like SMB and NTLM. Notably, CVE-2025-55234 (SMB) and CVE-2025-54918 (NTLM)—both rated CVSS 8.8—were publicly known and considered high impact, allowing attackers to leverage relay and crafted packet attacks for system takeover. Additional critical vulnerabilities were identified in Windows UI XAML and HPC components. While no active exploitation was confirmed at release, the breadth of affected products and criticality prompted urgent patching recommendations.
This wave of privilege escalation vulnerabilities underscores the ongoing risk posed by identity-based attacks and lateral movement, compelling organizations to accelerate patch deployment and strengthen segmentation controls. With the end-of-life of Windows 10 and expanded MFA mandates on the horizon, the incident reinforces the necessity for layered defenses and up-to-date asset management.
Medium impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
K2 Think AI Model Jailbroken Within Hours of 2024 Release
On September 9, 2024, the UAE-backed 'K2 Think' large language model (LLM) was released with the goal of industry-leading transparent reasoning. Within hours, however, cybersecurity researchers discovered a critical vulnerability known as Partial Prompt Leakage. This flaw allowed adversaries to observe the model's internal logic in plain text, making it easier to methodically bypass safeguards and jailbreak the AI system. The exploit was demonstrated by researcher Alex Polyakov, who publicly documented how attackers could uncover and iterate against the model’s defenses, enabling harmful behaviors such as malware generation. The breach did not result in immediate large-scale misuse, but it revealed a key tradeoff between transparency and security in modern LLM development.
This incident is emblematic of new AI security risks emerging as open, auditable models grow in popularity. It underscores the urgency for vendors to balance transparency with robust protection, as attackers quickly adapt to and exploit unique model features. With increased regulatory scrutiny and rising enthusiasm for open-source AI, safeguarding model reasoning is now a critical surface organizations cannot ignore.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Lies-in-the-Loop: When AI Coding Agents Become Supply Chain Threats
In June 2024, researchers at Checkmarx Zero demonstrated a novel supply chain attack called 'Lies-in-the-Loop' (LITL) targeting AI-assisted coding agents, specifically Anthropic's Claude Code. By leveraging prompt injection, attackers manipulated the AI into concealing malicious code execution behind benign prompts, effectively tricking human operators into approving dangerous actions. The attack exploited trust in the 'human-in-the-loop' workflow, showing that malicious context within public resources like GitHub issues could hide remote code execution triggers. Successful exploitation enabled attackers to deploy arbitrary commands and potentially introduce malicious packages into software repositories, increasing the risk of downstream supply chain compromise.
This incident highlights a concerning trend: as AI coding agents are rapidly adopted, their interfaces become a ripe target for adversaries using social engineering and prompt manipulation. The attack underscores the evolving sophistication of supply chain threats, especially those that blur the lines between human fallibility and machine autonomy in development environments.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Vidar Infostealer Returns in 2024 with Stealthier Malware Campaigns
In June 2024, cybersecurity researchers observed a significant resurgence of the Vidar infostealer malware, marked by notable advancements in evasion and data exfiltration techniques. Vidar, which originated as a variant of Arkei and has remained active since 2018, now leverages encrypted command-and-control (C2) channels, sophisticated PowerShell-based delivery, and covert exfiltration methods to siphon credentials, cookies, authentication tokens, and sensitive financial information. The latest campaigns employ phishing, malvertising, and compromised websites as entry vectors. Tactics such as obfuscated PowerShell scripts, living-off-the-land binaries (LOLBins), Windows Defender exclusion manipulation, persistence via scheduled tasks, and exfiltration over TLS have enabled Vidar to bypass traditional detection controls and ensure lasting presence within infected enterprise and individual user environments.
The rapid iteration and adaptability of Vidar reflect broader trends in malware-as-a-service (MaaS) operations—demonstrating how popular infostealers continually implement new stealth and evasion tactics. This highlights the urgent need for organizations to adopt layered security defenses and proactive threat detection, as infostealers like Vidar push the boundaries of stealth and data theft in an era of increasing hybrid work, regulatory scrutiny, and sophisticated social engineering.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Critical Chaos Mesh Vulnerabilities Enable Kubernetes Cluster Takeover (2024)
In early June 2024, multiple critical vulnerabilities known collectively as "Chaotic Deputy" were disclosed in Chaos Mesh, a widely used open-source chaos engineering platform for Kubernetes. These bugs, including authentication bypass and privilege escalation flaws, allowed unauthorized attackers to obtain elevated access within Kubernetes clusters. Exploitation could lead to total cluster takeover, lateral movement, and the compromise of sensitive resources and data across affected environments. The disclosure prompted rapid patches from maintainers and advisories from security organizations and cloud providers due to the severe risk and broad adoption of Chaos Mesh in enterprise deployments.
This incident highlights the increasing focus of attackers and researchers on the Kubernetes and supply chain ecosystem. With Kubernetes now foundational to cloud-native infrastructure, vulnerabilities in operational tools like Chaos Mesh underline the need for robust segmentation, continuous security monitoring, and timely patch management to protect against emerging threats to hybrid and multi-cloud environments.
Low impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
SXVM Ransomware PoC Reveals Next-Gen DLL Unhooking to Bypass EDR
In September 2024, a novel ransomware proof-of-concept dubbed 'SXVM' showcased advanced defensive evasion capabilities through DLL unhooking, enabling it to bypass traditional endpoint detection and response (EDR) tools. The threat leverages in-memory manipulation to restore .text sections of key system DLLs—effectively undoing any hooks or software breakpoints set by debuggers and security products. This approach allows ransomware operators to conceal malicious actions and access powerful Windows APIs unchecked. While initial analysis points to a low detection rate and proof-of-concept status, the technique underscores an escalating trend in ransomware sophistication and anti-forensic tactics.
This incident is especially relevant as ransomware variants increasingly adopt anti-debugging and anti-EDR methods. The widespread use of DLL unhooking signals a maturing threat landscape, where attackers are continuously innovating to defeat security controls and leverage memory-based evasion techniques.
High impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Code Assistant LLM Vulnerabilities Expose New AI Supply Chain Risks (2024)
In early 2024, multiple leading code assistant platforms powered by Large Language Models (LLMs) were found to be vulnerable to security threats such as indirect prompt injection, model misuse, and code suggestion manipulation. Attackers exploited weaknesses in prompt handling and insufficient contextual isolation, allowing harmful code or misleading content to be surfaced to end users and potentially exposing enterprise environments to supply chain risks. These risks highlight the growing attack surface in organizations leveraging AI-driven development tools, where impaired oversight can lead to deceptive or insecure code entering production systems.
This incident underscores the urgency for enterprises to evaluate the deployment and integration practices for generative AI tools, particularly given the rapid rise in adoption and regulatory focus on AI safety. Attacker tactics are evolving quickly, and threat actors are increasingly targeting AI models and their usage contexts as a new cyber frontier.
Medium impact
Kill Chain
ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Q2 2025 Mobile Malware Surge: Mamont and Triada Lead Sophisticated Attacks
In Q2 2025, Kaspersky detected a substantial wave of mobile malware impacting Android and iOS, blocking 10.71 million attacks involving Trojans, adware, and unwanted applications. The campaign was notable for a surge in banking Trojans—primarily the Mamont family—pre-installed backdoors like Triada, and novel threats such as SparkKitty, which targets crypto wallet recovery codes via image theft. Attackers leveraged fake app stores, porn-viewing apps that secretly built DDoS botnets, and deceptive VPNs that intercepted OTP codes through notification hijacking. Regionalized attacks exploited localized malware families to increase efficacy and evade global threat visibility, raising risks for financial and privacy exposure worldwide.
This incident highlights a persistent trend of increasingly sophisticated mobile threats focused on financial theft and data exfiltration. The continued evolution of malware TTPs, including use of pre-installed Trojans, modular SDK-based payloads, and cross-platform attack vectors, emphasizes the urgent need for advanced endpoint protection and vigilant detection routines in the mobile security domain.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
RevengeHotels 2025: AI-Fueled VenomRAT Breach Hits Hospitality Sector
In the summer of 2025, the RevengeHotels cybercrime group (also tracked as TA558) significantly escalated its campaigns targeting the hospitality sector across Latin America, especially Brazil. Leveraging large language models (LLMs) to dynamically generate phishing lures and scripted malware loaders, the attackers delivered new VenomRAT payloads via sophisticated, invoice-themed phishing emails. These emails led hotel staff to malicious websites that dropped JavaScript and PowerShell-based loaders, ultimately granting persistent remote access for data theft and lateral movement. The attack exploited evolving tactics such as anti-kill mechanisms, registry persistence, custom encryption, and use of AI-generated code to evade detection.
This incident demonstrates a marked evolution in attacker methodology, combining commodity malware, AI-driven code generation, and targeted social engineering. Such developments highlight how AI is accelerating the sophistication and reach of cyber threats, particularly in sectors with high-value payment data and limited security resources.
High impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
2025 Salesforce Data Breach: Supply Chain Extortion Hits Retail Sector
In mid-2025, a coordinated cybercriminal campaign led by UNC6395 and affiliates of Muddled Libra targeted Salesforce tenants via a multi-stage supply chain attack stemming from infiltrated third-party integrations such as Salesloft and Drift. Attackers used advanced social engineering and process exploitation rather than technological vulnerabilities to gain access to Salesforce customer data—including sensitive records like accounts, contacts, and opportunities. The operation highlighted the growing focus on data theft extortion tactics and the use of encrypted communications, with threat actors actively marketing stolen data through Telegram channels under monikers like "Scattered LAPSUS$ Hunters." The impact has been significant for retailers and digital platform users, driving urgent defensive and policy changes at Salesforce and affected enterprises.
This incident underscores an accelerating threat shift in 2025: attackers are increasingly leveraging social engineering and the SaaS supply chain to circumvent traditional defenses, monetizing access through extortion rather than ransomware. The event has intensified industry efforts to tighten access controls and enforce encryption, amid persistent regulatory and law enforcement actions.
Medium impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Apple’s 2025 Zero-Day Puts iOS & macOS Security in Spotlight: What You Need to Know
In September 2025, Apple issued urgent patches for iOS, iPadOS, and macOS in response to several critical vulnerabilities, with CVE-2025-43300 standing out due to active exploitation in sophisticated targeted attacks. The vulnerability, affecting the ImageIO component, enabled attackers to compromise devices by processing malicious image files, potentially resulting in memory corruption and enabling unauthorized access or control. Previous patches were limited to the latest OS versions, leaving older systems exposed until this coordinated rollout addressed those gaps. Apple further backported fixes to supported older releases to mitigate the heightened risk of exploitation.
This incident underscores an accelerating wave of zero-day vulnerabilities leveraged in real-world attacks, highlighting the persistent threats facing major software ecosystems like Apple’s. The discovery and rapid backporting response reflects mounting regulatory and industry pressure to quickly secure even legacy platforms and close compliance gaps.
Low impact
Kill Chain
ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
