In September 2025, a critical, still-unpatched vulnerability (CVE-2025-10184) was publicly disclosed in OnePlus smartphones running OxygenOS 12 through 15. Discovered by Rapid7, the flaw enables any installed app—without explicit permissions or user input—to access and exfiltrate SMS content and metadata on affected devices. This exposure was caused by insecurely exported content providers in the custom Android Telephony package, allowing SQL injection-style inference attacks. Despite multiple disclosure attempts, OnePlus did not respond for over four months; the details, including a proof of concept, were disclosed publicly to accelerate a fix. The case underscores rising risks from insecure mobile customizations and vendor slow response, especially as attackers increasingly exploit flaws in widely deployed consumer devices. With the proliferation of mobile-centric attacks and regulatory scrutiny on data privacy, this breach highlights the urgent need for robust patch management and proactive mobile security.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(low)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

High impact9 months ago

Telecommunications

Cisco's 2025 SNMP Zero-Day: Credential Compromise Drives Network Device Exploit Surge

In September 2025, Cisco disclosed a high-severity zero-day vulnerability (CVE-2025-20352) affecting IOS and IOS XE network infrastructure devices. The flaw, a stack-based buffer overflow in the SNMP subsystem, allowed remote, authenticated attackers with low privileges to cause denial-of-service and, in some cases, permitted high-privileged attackers to fully compromise devices. Exploitation was detected after local administrator credentials were stolen, enabling threat actors to send malicious SNMP packets over IPv4/IPv6, impacting unpatched devices globally. Immediate patching was recommended as no workarounds existed except tightly restricting SNMP access. This incident underscores the criticality of timely patching and robust identity and network access controls, as attackers increasingly target network infrastructure via both credential compromise and protocol-level vulnerabilities. Industry-wide, it marks an escalating trend of high-impact, infrastructure-level exploits requiring urgent coordinated response.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(high)

Read report

Medium impact9 months ago

Information Technology/IT

Supermicro’s 2025 BMC Firmware Flaws Expose Critical Backdoor Risks

In September 2025, Supermicro disclosed critical firmware vulnerabilities (CVE-2025-7937 and CVE-2025-6198) affecting its server Baseboard Management Controller (BMC). Security researchers at Binarly demonstrated that attackers could leverage these flaws to bypass firmware signature verification and the BMC root of trust, allowing deployment of persistent, malicious firmware on widely used Supermicro servers. Exploits could grant adversaries complete, long-term control over both the BMC and host OS, enabling stealthy persistence and reliable evasion of security controls, while systems appeared to be running valid, signed code. Supermicro confirmed the vulnerabilities, releasing firmware patches, but proof-of-concept exploits are already public. This incident underscores the evolving challenge of hardware-level attacks, as advanced threat actors increasingly target supply chain and firmware layers to establish persistent, hard-to-detect footholds. Recent regulatory pressure and rising incidents of firmware-based threats highlight the urgency for security teams to elevate visibility and controls across hardware trust boundaries.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(medium)

Read report

Low impact9 months ago

Information Technology/IT

Attackers Leverage Pandoc SSRF Vulnerability CVE-2025-51591 to Breach AWS IMDS

In September 2025, threat actors exploited a newly disclosed Server-Side Request Forgery (SSRF) vulnerability in the open-source Linux utility Pandoc (CVE-2025-51591), targeting Amazon Web Services (AWS) cloud environments. The attackers leveraged the flaw to send unauthorized requests to the AWS Instance Metadata Service (IMDS), allowing them to obtain EC2 role credentials and elevate cloud permissions. Security researchers, including Wiz, observed active exploitation in the wild, leading to unauthorized access and potential data exfiltration from affected AWS infrastructure. Organizations relying on Pandoc as part of their cloud automation workflows face heightened risk of credential compromise and lateral movement across accounts. This incident underscores a fast-evolving cloud threat landscape, where attackers exploit supply-chain and open-source vulnerabilities to traverse trusted infrastructure and target sensitive identity and metadata services. The rapid weaponization of CVE-2025-51591 mirrors the broader trend of SSRF attacks on cloud metadata, driving urgent calls for proactive detection, segmentation, and credential management in multi-cloud environments.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Low impact9 months ago

Financial Services

State-Sponsored Actors Breach Libraesva ESG via Command Injection Vulnerability

In September 2025, Libraesva disclosed a command injection vulnerability (CVE-2025-59689, CVSS 6.1) affecting its Email Security Gateway (ESG) platform, which was actively exploited by state-sponsored threat actors. Attackers leveraged maliciously-crafted email payloads to trigger remote command execution, bypassing ESG protections and potentially gaining persistent access to targeted networks. The intrusion method allowed attackers to move laterally and exfiltrate sensitive data, underscoring the risks posed by the exploitation of security appliances themselves. Libraesva released emergency patches and urged customers to upgrade immediately, as evidence emerged of ongoing targeted campaigns against critical sectors. This incident highlights the increasing use of email gateway exploits by sophisticated adversaries, aligning with a wider trend of targeting security infrastructure for initial access. With command injection flaws on the rise and ransomware operators adopting similar approaches, organizations face escalating pressure to rapidly patch vulnerabilities and reinforce segmentation and anomaly detection across their environments.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Low impact9 months ago

Financial Services

YiBackdoor: A Sophisticated Backdoor Malware Campaign Bridging IcedID and Latrodectus

In June 2025, researchers discovered YiBackdoor, a novel malware family exhibiting significant source code overlaps with the notorious IcedID and Latrodectus strains. Campaigns leveraging YiBackdoor execute advanced backdoor techniques that establish remote access, command execution, and data exfiltration within compromised environments. YiBackdoor is typically deployed as part of a multi-stage attack campaign, using phishing or malicious attachments as its primary entry vector. Its detection signaled the emergence of new collaborative threats between criminal malware groups, raising concerns over increased code sharing and tool evolution. This incident highlights growing technical sophistication and cross-pollination between established malware actors. The use of YiBackdoor in conjunction with IcedID and Latrodectus demonstrates adversary agility and the accelerated pace of malware innovation, elevating the threat to enterprises reliant on traditional detection models.

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(low)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(low)

Read report

Low impact9 months ago

Government Administration

RedNovember: 2025 Chinese State Cyber Espionage Campaign Hits Global Governments

In mid-2025, a Chinese state-sponsored threat group known as RedNovember (previously tracked as TAG-100) orchestrated a widespread cyber espionage campaign targeting government and private sector organizations across Africa, Asia, North America, South America, and Oceania. The attackers leveraged sophisticated tools including the Pantegana backdoor and Cobalt Strike to establish persistence, perform lateral movement, and exfiltrate sensitive data. Entry vectors included spear-phishing emails and exploitation of known network vulnerabilities, allowing RedNovember to stealthily compromise high-value systems and harvest intelligence for extended periods before discovery. The impact included unauthorized access to confidential government documents and disruption of critical data workloads. This incident underscores the persistent evolution of state-sponsored attack tactics, with RedNovember employing advanced, evasive techniques and custom malware. The growing use of encrypted command-and-control traffic and living-off-the-land strategies sets a concerning precedent, especially for government agencies and regulated enterprises facing a surge in sophisticated espionage operations.

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(low)

Read report

Medium impact9 months ago

Financial Services

UNC6148 Installs OVERSTEP Backdoor in SonicWall SMA Devices: 2024 APT Breach Analysis

In early 2024, a sophisticated threat actor group identified as UNC6148 targeted SonicWall Secure Mobile Access (SMA) appliances with a newly discovered backdoor malware named 'OVERSTEP'. By exploiting unpatched vulnerabilities, attackers gained unauthorized access, deployed persistent hidden software, exfiltrated credentials, and established remote control over affected devices. The compromise allowed lateral movement within victim networks, providing attackers with ongoing access to sensitive data and resources while evading detection for extended periods. Organizations using SonicWall SMA were particularly at risk of operational disruptions, data breaches, and unauthorized exposure of business-critical systems. This incident exemplifies the growing trend of supply-chain and edge-device attacks by advanced persistent threats (APTs). The deployment of stealthy backdoors like OVERSTEP signals increased sophistication and automation among threat actors, further pressuring organizations to improve detection, patch management, and east-west segmentation strategies.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

High impact9 months ago

Government Administration

Russian Disinformation Group Rybar Orchestrates REST Media Election Campaign in Moldova

In June 2024, researchers revealed that REST Media, an online outlet targeting Moldova’s elections, is actually a front for the Russian disinformation group Rybar. Rybar, already sanctioned by the EU and wanted by the U.S., used REST Media to amplify anti-EU narratives and undermine the Party of Action and Solidarity, leveraging platforms like TikTok, Telegram, and X to achieve millions of views. Technical forensics linked REST Media’s online infrastructure and production workflows directly to Rybar, demonstrating operational overlap and deliberate efforts at obfuscation. The campaign exploited Moldova's fragmented media regulations, using cloaked registration accounts, privacy services, and anonymized hosting, making attribution complex while rapidly expanding its influence ahead of key elections. This incident exemplifies the growing sophistication of state-sponsored information operations, exploiting both technology and weak local controls. As hybrid threats, including coordinated disinformation and cyberattacks, continue to undermine democratic processes across Eastern Europe, organizations and governments face mounting regulatory, reputational, and operational risks from similar campaigns.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(high)

Read report

Medium impact9 months ago

Legal Services

Brickstorm: The Next-Level Chinese APT Breach Impacting SaaS & Legal Sectors in 2025

In 2025, a highly sophisticated cyberespionage campaign attributed to a suspected Chinese advanced persistent threat (APT), utilizing malware later dubbed 'Brickstorm,' successfully infiltrated multiple US legal services and tech supply chain organizations. The attackers leveraged undisclosed zero-day vulnerabilities to gain initial access, maintain exceptional stealth with average dwell times of over 400 days, and move laterally into downstream customers. Their campaign targeted proprietary source code and sensitive trade/national security intelligence, making detection challenging through advanced cleanup techniques and non-overlapping infrastructure. This incident is particularly significant as it represents a new echelon of APT supply chain intrusions, echoing a rise in strategic, multi-year campaigns focusing on SaaS and cloud intermediaries. It highlights the growing need for robust east-west visibility, zero trust segmentation, and supply chain security amid evolving TTPs that routinely outpace traditional detection and response capabilities.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

High impact9 months ago

Computer/Network Security

UNC6148 Rootkit Attack on SonicWall SMA100 Devices in 2025

In September 2025, SonicWall released a critical firmware update for its SMA 100 series products in response to a sophisticated attack campaign orchestrated by threat actor UNC6148. This incident involved the deployment of the OVERSTEP user-mode rootkit on end-of-life SMA 100 devices, providing persistent unauthorized access, stealing sensitive configuration and certificate data, and enabling lateral movement. Attackers exploited vulnerabilities in legacy firmware to maintain remote access—even post firmware upgrades—compromising credentials, OTP seeds, and digital certificates, with notable overlaps to prior Abyss ransomware operations. The incident underscores the growing threat posed by ransomware groups leveraging supply chain devices and persistent malware in network appliances. With a surge in rootkit-enabled persistence and a rise in zero-day exploitations targeting network edge devices, organizations must prioritize timely patching and end-of-life device management to curb risk exposure.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(high)

Read report

High impact9 months ago

Financial Services

Cloudflare Thwarts Record-Breaking 22.2 Tbps DDoS Assault in 2025

In September 2025, Cloudflare successfully mitigated a record-breaking Distributed Denial-of-Service (DDoS) attack that peaked at 22.2 Tbps and 10.6 billion packets per second. Orchestrated over just 40 seconds, the massive volumetric attack overwhelmed network infrastructure, pushing the limits of firewalls, routers, and load balancers. Prior research links recent large-scale DDoS campaigns—including those hitting Cloudflare—to the AISURU botnet, which leveraged a sudden increase in infected devices globally, stemming in part from exploited router firmware vulnerabilities. Business impact was minimized due to Cloudflare’s rapid mitigation, but the attack underscores the ever-increasing scale and sophistication of DDoS threats. Record-breaking DDoS attacks are climbing in frequency and intensity, with attackers exploiting IoT vulnerabilities and leveraging formidable botnets. This surge highlights the urgent need for resilient, scalable mitigation strategies, and amplifies ongoing regulatory and industry pressure to strengthen defenses against large-scale infrastructure threats.

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(high)

Read report

1...247 248 249 250 251...258

[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports

Government Administration

Unpatched SMS Flaw in OnePlus Phones Leaves User Messages Exposed

Cisco's 2025 SNMP Zero-Day: Credential Compromise Drives Network Device Exploit Surge

Supermicro’s 2025 BMC Firmware Flaws Expose Critical Backdoor Risks

Attackers Leverage Pandoc SSRF Vulnerability CVE-2025-51591 to Breach AWS IMDS

State-Sponsored Actors Breach Libraesva ESG via Command Injection Vulnerability

YiBackdoor: A Sophisticated Backdoor Malware Campaign Bridging IcedID and Latrodectus

RedNovember: 2025 Chinese State Cyber Espionage Campaign Hits Global Governments

UNC6148 Installs OVERSTEP Backdoor in SonicWall SMA Devices: 2024 APT Breach Analysis

Russian Disinformation Group Rybar Orchestrates REST Media Election Campaign in Moldova

Brickstorm: The Next-Level Chinese APT Breach Impacting SaaS & Legal Sectors in 2025

UNC6148 Rootkit Attack on SonicWall SMA100 Devices in 2025

Cloudflare Thwarts Record-Breaking 22.2 Tbps DDoS Assault in 2025

Stop Active Cloud Data Exfiltration

Products

By Role

Customer Stories

Security & Legal

Solutions

Resources

Industry

Company

Tools

Government Administration